SEVERSON, Justice.

[¶ 1.] Randall and Lori Masad (Plaintiffs) appeal the circuit court's summary judgment in favor of the South Dakota Department of Corrections (State). The circuit court ruled that Randall Masad's (Masad) negligence claim was barred by SDCL 3-21-8 and 3-21-9(5), that application of these statutes to bar his claim did not violate the South Dakota Constitution, and that, as a matter of law, Masad was not a third-party beneficiary of the contract between Catering by Marlins, Inc. (CBM) and the State. We reverse in part and affirm in part.

FACTS

[¶ 2.] For purposes of the motion for summary judgment, the evidence relied upon by the circuit court was not seriously contested. In 2002, CBM entered into a contract with the State to provide food services for inmates in the South Dakota State Penitentiary (Penitentiary) in Sioux Falls, South Dakota. The contract covered all time periods relevant to this case. Masad was employed by CBM in 2003 as a food service director. He primarily worked in the kitchen area of the Penitentiary's Jameson Annex.

[¶ 3.] Gregory Stephens (Inmate Stephens) was an inmate in the Penitentiary. Before being sentenced to the Penitentiary, he was an inmate in the Clay County jail awaiting trial on felony charges. While there, he assaulted a fellow inmate causing injury, including a fractured facial bone. After being convicted of various felony charges in Turner County, Inmate Stephens was sentenced to the Penitentiary and originally received into the Jameson Annex as an inmate on December 29, 2003. On February 6, 2004, he was sent to the Durfee State Prison in Springfield, South Dakota. Shortly after arrival, he assaulted another inmate with a pool cue and was moved to a disciplinary cell on February 8, 2004. He was given forty-five days of disciplinary segregation as a result of that assault.

[¶ 4.] Inmate Stephens was transferred from Durfee State Prison back to the Penitentiary and placed in the Special Housing Unit (SHU). Contrary to Department of Corrections (DOC) policy, his institutional file was not simultaneously transferred. While in the SHU, he was written up for a disciplinary infraction on February 25, 2004, because he threatened harm to a staff member. As a result, he was given an additional thirty days of disciplinary segregation, to be served consecutively with his previous disciplinary segregation.

[¶ 5.] On March 5, 2004, Inmate Stephens was moved to the disciplinary segregation unit, Unit A in the Jameson Annex. On March 9, 2004, he had a transfer hearing even though the hearing board did not have his institutional file. On March 10, 2004, Inmate Stephens was moved to general population in Unit B of Jameson Annex. At this time, Inmate Stephens had not served the full length of his disciplinary segregation.

[¶ 6.] On March 19, 2004, Inmate Stephens was permitted to exit Unit B, which consisted of exiting his cell, his section, and ultimately, his unit. Each subdivision was secured by a sliding door which was operated by a control officer, whose duty was to control inmate movement. Inmates were allowed off the unit only if they had a pass or were going to work or school. There was no evidence that, on this day, Inmate Stephens was issued a pass to leave Unit B, and he was not assigned to work or school.

[¶ 7.] After leaving Unit B, Inmate Stephens obtained an orange uniform from a laundry cart and put it on over his khaki uniform. He then approached the kitchen door. Inmates wearing either orange or white uniforms were allowed to work in the kitchen. Therefore, when the employee in the Central Control Room saw the inmate in the orange uniform at the kitchen door, she allowed him to enter the kitchen with no further attempt to identify him. No officer was assigned to the kitchen to provide security. Masad was working in the kitchen area at this time and had his back to the kitchen door when Inmate Stephens entered. Inmate Stephens obtained a four-foot metal stirring whisk in the size and shape of a boat oar and struck Masad's head and body ten to fifteen times. Masad sustained serious and permanent injuries and was hospitalized for approximately a month. He is unable to return to his previous level of employment.

[¶ 8.] Plaintiffs initiated this lawsuit alleging negligence and loss of consortium against the State and multiple employees of the DOC (collectively, Defendants) in their individual and official capacities. Plaintiffs alleged Defendants were liable for the assault because they negligently failed to perform various duties, including classifying Inmate Stephens's risk status, preventing him from gaining access to the kitchen, and otherwise supervising him, which, as a result, allowed Inmate Stephens to perpetrate the assault upon Masad. Plaintiffs later amended their complaint to allege that Masad was a third-party beneficiary of the security provisions contained in the contract between CBM and the State, and that these security provisions were breached.

[¶ 9.] Defendants moved for summary judgment as to both the negligence and loss of consortium claims based on SDCL 3-21-8 and 3-21-9(5). Defendants also moved for summary judgment on the breach of contract claim, alleging the security obligations in the contract were owed to CBM, rather than Masad or any other CBM employee. The circuit court granted Defendants' motion, concluding that Masad's negligence claim was barred by SDCL 3-21-8 and 3-21-9(5), that those statutes were not violative of the South Dakota Constitution, and that Masad was not a third-party beneficiary under the contract between the State and CBM. The circuit court also granted summary judgment on the loss of consortium claim. Plaintiffs appeal.

STANDARD OF REVIEW

[¶ 10.] "In reviewing the circuit court's summary judgment, we must determine whether the moving party demonstrated the absence of any genuine issue of material fact and established entitlement to judgment on the merits as a matter of law." Bertelsen v. Allstate Ins. Co., 2009 SD 21, ¶ 11, 764 N.W.2d 495, 498 (citing Clark County v. Sioux Equip. Corp., 2008 SD 60, ¶ 8, 753 N.W.2d 406, 409). This case involves both statutory and contractual interpretation. The interpretation of statutes is a question of law. Nelson v. Promising Future, Inc., 2008 SD 130, ¶ 5, 759 N.W.2d 551, 553 (quoting Rotenberger v. Burghduff, 2007 SD 7, ¶ 8, 727 N.W.2d 291, 294). Similarly, "[t]he interpretation of a contract is a question of law[.]" Kernelburner, L.L.C. v. MitchHart. Mfg., Inc., 2009 SD 33, ¶ 7, 765 NW2d 740, 742. We review questions of law under the de novo standard of review. Id.

ISSUE ONE

Whether the circuit court erred in determining that the Plaintiffs' negligence claim was barred by SDCL 3-21-8 and 3-21-9(5).

[¶ 11.] Sovereign immunity is derived from either the common law or statute. Statutory sovereign immunity, as its name implies, arises from statutes passed by the Legislature based on its constitutional authority in Article III, Section 27 of the South Dakota Constitution. Unruh v. Davison County, 2008 SD 9, If 8, 744 N.W.2d 839, 842. These statutes establish "in what manner and in what courts suits may be brought against the state." Id. In this case, Defendants raised the defense of statutory sovereign immunity pursuant to SDCL 3-21-8 and 3-21-9(5) in response to Plaintiff[s'] claims.

[¶ 12.] To decide the statutory sovereign immunity issue presented in this case, it is necessary to clearly understand the Plaintiffs' claims. Before the circuit court, Plaintiffs alleged that Defendants acted negligently in performing several duties: (1) failing to send Inmate Stephens's institutional file when he was transferred from Durfee State Prison to the Penitentiary; (2) failing to ensure Inmate Stephens remained in the more-secure Jameson Unit A until he finished serving the required disciplinary segregation time, or, alternatively, receive the requisite written time cut; (3) failing to ensure Inmate Stephens remained in Unit B, or if permitted to leave the unit, failing to verify that Inmate Stephens had a pass or some other legitimate purpose for leaving the unit; and (4) failing to identify Inmate Stephens before permitting him access to the kitchen, where there were unsecured kitchen tools. Plaintiffs argued that such negligence was a legal cause of their injuries and damages. Defendants responded that Plaintiffs' claims were barred by statutory immunity pursuant to SDCL 3-21-8 and 3-21-9(5). The circuit court agreed. In deciding that these statutory provisions barred Plaintiffs' claims, the circuit court specifically stated:

SDCL 3-21-8 provides "[n]o person . . . is liable for . . . failure to provide sufficient equipment, personnel, programs, facilities or services in a prison or other correctional facility." (Emphasis added). Plaintiff argues that this statute is inapplicable to a non-inmate third-party plaintiff such as in this case. Plaintiffs do not cite authority for this argument. While cases which have addressed this statute have generally involved claims by inmates, the plain language of the statute does not limit its application to claims asserted by inmates. Statutes are interpreted as written. Unruh, 2008 SD 9, ¶ 28, 744 N.W.2d at 848-49. "When a statute's language is clear, certain and unambiguous, our function confines us to declare its meaning as plainly expressed." Id. (citation omitted). The statute does not distinguish between potential plaintiffs. Its plain language provides immunity for injuries resulting to anyone due to the "failure to provide sufficient equipment, personnel, programs, facilities or services in a prison or other correctional facility." Plaintiffs' allegations fall within the language of this statute. Therefore, Defendants are entitled to immunity under the provisions of SDCL 3-21-8.

* * *

Defendants also argue that they are entitled to immunity under SDCL 3-21-9(5) which provides that "[n]o person . . . is liable for any injury caused by or resulting from . . . services or programs administered by or on behalf of the prison, jail or correctional facility." Plaintiffs argue that their claims do not fall within this immunity because the assault of Masad was not the product of a service or program, but rather arose from Defendant[s'] alleged negligence in maintaining custody and control of a prisoner. Further Plaintiffs argue that SDCL 3-21-9, as a whole, relates only to liability for escaping and fleeing prisoners. The South Dakota Supreme Court held in Hancock v. Western South Dakota Juvenile Services Center, 2002 SD 69, ¶ 15, 647 N.W.2d 722, 725, that SDCL 3-21-8 and 9 provide an administrator of a juvenile detention center immunity from a prisoner's claim that the administrator's negligent supervision caused his injuries. Hancock did not involve a fleeing or escaping prisoner. When considering SDCL 3-21-9 in its entirety, immunity for injuries resulting from an escaping prisoner is merely one of the categories of injuries granted immunity. SDCL 3-21-9(5) is a broad grant of immunity for "any injury caused by or resulting from . . . services or programs administered by or on behalf of the prison, jail or correctional facility." Plaintiff[s'] claims fall within this broad immunity. Therefore, the immunity of SDCL 3-21-9(5) also applies to bar Plaintifff[s'] claims.

The circuit court never explained how the Plaintiffs' claims fall within the statutory language of SDCL 3-21-8 and 3-21-9(5), and thereby were barred by immunity. Careful consideration of Plaintiffs' claims reveal, however, that they are not alleging Defendants failed to "provide sufficient equipment, personnel, programs, facilities or services[,]" SDCL 3-21-8, or that their injuries were "caused by or resulting from . . . services or programs administered by or on behalf of the prison," SDCL 3-21-9(5). Rather, Plaintiffs claim that Defendants simply acted negligently in performing their defined duties.

[¶ 13.] Defendants contend that Plaintiffs' claims, in reality, amount to a failure to provide security, or at least sufficient security. Defendants' argument follows that because security is a basic service provided by a correctional facility, Plaintiffs' claims are barred by statutory immunity pursuant to SDCL 3-21-8 and 3-21-9(5). Defendants' interpretation, however, conflicts with the legislative intent underlying the statutes. "When determining legislative intent, `we assume no part of its statutory scheme be rendered mere surplusage.'" Ruber v. Dep't of Pub. Safety, 2006 SD 96, ¶ 14, 724 N.W.2d 175, 179 (citing Double Diamond Constr. v. Farmers Coop. Elevator Ass'n of Beresford, 2003 SD 9, ¶ 7, 656 N.W.2d 744, 746). Had the Legislature intended to immunize all torts occurring in correctional facilities, it would not have specifically immunized the state from liability for "failure to provide sufficient equipment, personnel, programs, facilities, or services in a prison or other correctional facility," SDCL 3-21-8, or from injury caused by or resulting from "[s]ervices or programs administered by or on behalf of the prison, jail, or correctional facility," SDCL 3-21-9(5). Instead, it could have provided a broad grant of immunity for all injuries relating to, or arising out of, such facilities. Therefore, we cannot render the specific language in these two statutes mere surplusage.

[¶ 14.] Defendants contend that under both SDCL 3-21-8 and 3-21-9(5), Plaintiffs' claims fall within the "services" language.

Words and phrases in a statute must be given their plain meaning and effect. When the language in a statute is clear, certain and unambiguous . . . the Court's only function is to declare the meaning of the statute as clearly expressed.

Discover Bank v. Stanley, 2008 SD 111, ¶ 15, 757 N.W.2d 756, 761 (quoting Martinmaas v. Engelmann, 2000 SD 85, 1149, 612 N.W.2d 600, 611). "Service" does not equate to the operation and maintenance of a correctional facility, as urged by Defendants. Plaintiffs claim that Defendants negligently performed their duties, not that Defendants failed to provide a service. In analyzing the language of SDCL 3-21-9 in Hall v. City of Watertown, 2001 SD 137, 115, 636 N.W.2d 686, we paid particular attention to the plain meaning of the statutory language. We must do the same here. Failure to transfer an institutional file, failure to ensure an inmate is housed in a higher-security location when his previous conduct so requires, failure to ensure an inmate does not leave a unit when he is not so authorized, and failure to identify an inmate before permitting him access to an unauthorized location do not equate with failure to provide a service or failure to provide security. These claims amount to failure to perform, or negligent performance of, designated duties. Plaintiffs' claims do not fall within the plain language of the statutes.

[¶ 15.] As the party raising the affirmative defense of immunity, Defendants had the burden of establishing they were entitled to that protection. See Burkenn v. Dennis Supply Co., 2004 SD 91, ¶ 32, 685 N.W.2d 778, 786 ("Since [defendant] asserted the affirmative defenses . . ., it bore the burden of proving those claims.") As a matter of law, Defendants failed to meet that burden. Therefore, the circuit court erred in granting summary judgment. Due to our resolution of this issue, we do not reach the issue of whether SDCL 3-21-8 and 3-21-9(5) violate the South Dakota Constitution.

ISSUE TWO

[13] Whether the circuit court erred in determining, as a matter of law, that Masad was not a third-party beneficiary of the contract between CBM and the State.

[¶ 16.] Plaintiffs contend that the circuit court erred in concluding that Masad was not a third-party beneficiary of the contract between the State and CBM, resulting in the State owing Masad no duty to provide for his security. They assert that Masad was a member of the class that was to be benefited by the State's agreement to provide "safety and security." Defendants respond that it is apparent from the face of the contract that the contracting parties intended for CBM, father than each of its employees, to possess whatever contractual rights existed concerning security. Defendants argue in the alternative that even if Masad was a third-party beneficiary under the terms of the contract, Plaintiffs failed to provide any evidence of a breach of those terms.

[¶ 17.] Immunity is waived to the extent that the State enters a contract and a party or third-party beneficiary sues to enforce that contract. Sisney v. Reisch 2008 SD 72, ¶ 13, 754 N.W.2d 813, 819. The State may waive its immunity "`by entering into a contract which implicitly gives the other party to the contract a right of action upon it.'" Id. (quoting Wilson v. Hogan, 473 N.W.2d 492, 494 (S.D. 1991)). Therefore, if Masad is a third-party beneficiary to the contract between CBM and the State, the State's immunity would be waived to the extent that Masad's claims seek to enforce that contract. See id.

[¶ 18.] SDCL 53-2-6 governs the right to enforce a contract as a third-party beneficiary. It provides: "[a] contract made expressly for the benefit of a third person may be enforced by him at any time before the parties thereto rescind it." SDCL 53-2-6. "This does not, however, entitle every person who received some benefit from the contract to enforce it." Sismy v. State, 2008 SD 71, ¶ 10, 754 N.W.2d 639, 643.

The [third-party beneficiary] statute is not applicable to every contract made by one person with another for the performance of which a third person will derive a benefit; the intent to make the contract inure to the benefit of a third party must be clearly manifested. In the language of the statute, the contract must be on[e] "made expressly for the benefit of a third person."

Id. (quoting Thompson Yards v. Van Nice, 59 S.D. 306, 308, 239 N.W. 753, 755 (1931)) (emphasis added). See also Trouten v. Heritage Mut. Ins. Co., 2001 SD 106, ¶ 13, 632 N.W.2d 856, 858; Kary v. Kary, 318 N.W.2d a34, 336 (S.D. 1982); Fry v. Amman, 29 S.D. 30, 135 N.W. 708, 710 (1912). "Thus, the rule requires that at the time the contract was executed, it was the contracting parties' intent to expressly benefit the third party. And, even then, not all beneficiaries qualify: incidental beneficiaries are not entitled to third-party beneficiary status." Sisney v. State, 2008 SD 71, ¶ 10, 754 N.W.2d at 643. For the party claiming third-party beneficiary status to prevail, he must show "that the contract was entered into by the parties directly and primarily for his benefit." Id. (quoting Mercado v. Mitchell, 83 Wis.2d 17, 28, 264 N.W.2d 532, 538 (1978)). A mere showing of an incidental benefit is not sufficient. Id.

[¶ 19.] The relevant sections of the contract provide:

6.19.5 Area Security The contractor's staff shall open, close and check State food service facilities as instructed and required by the State. State shall furnish instructions and initially train contractor's full-time managers in approved procedures.

* * *

6.21.4 Facility Security

The contractor is responsible for control of keys obtained from the State and the security of those areas that are used by its representatives. Designated employees of the contractor shall be responsible for ensuring that all equipment has been turned off, windows closed, light and fans turned off, and doors locked. The contractor shall be responsible for immediately reporting all the facts relating to losses incurred as a result of breakins to areas to the State. The State shall designate the authority who shall receive these reports and be responsible for key control.

The State and contractor shall mutually determine the additional security measures required to control unauthorized access to all food service areas included in the contract. The State and contractor shall mutually determine their responsibilities for the cost to provide initial and future additional security.

* * *

6.21.6 State Security

The State shall provide the contractor with safety and security services currently available to food service, such as night patrol, door checks, security consulting, call response, etc. This service shall not include armored car service. If the contractor requires additional security, it shall be provided by, or coordinated through, the State for which the contractor agrees to pay prevailing charges. In addition to Security staff, the contractor may supplement with additional supervisory staff. The contractor shall follow the State's policies in dealing with improper conduct and shall report all incidences to the State. Emergency calls shall be reported to the State as promptly as possible.

Defendants argue that nothing in the contract indicates that the State made a promise directly and primarily to CBM's employees to provide them with security while working in food service areas. Plaintiffs assert that the contract was ambiguous and introduced extrinsic evidence supporting their contention that the contract was intended to benefit third parties such as Masad.

[¶ 20.] We recently addressed the third-party beneficiary concept in Sisney v. State, 2008 SD 71, 754 N.W.2d 639. Sisney, a state inmate who allegedly practiced the Jewish religion, filed a complaint maintaining the state food service provider breached a contract to provide food services to state prisons by failing to adequately provide kosher food, and that this breach violated his civil rights. On appeal, this Court concluded that Sisney was not a third-party beneficiary under the contract between the food service provider and the State, and therefore, had no standing to sue on the contract. We acknowledged this was a public contract and the contract did not "expressly indicate that it was intended for Sisney's direct benefit or enforcement." Id. ¶ 13. Instead, the contract was made for the express benefit of the State, and "the collective benefit that inmates may have received was only incidental to that of the State." Id. Further-more, the provision in the contract relating to a complaint resolution process did not confer "contractual third-party beneficiary status on Sisney to enforce the contract." Id. ¶ 14 (emphasis in original).

[¶ 21.] We came to a similar conclusion in Trouten v. Heritage Mutual Ins. Co., 2001 SD 106, 632 N.W.2d 856. In Trouten, Kenison purchased a business liability insurance contract from Heritage to provide coverage for her business. The contract, in pertinent part, provided coverage for "medical expenses . . . for bodily injury caused by an accident . . . [o]n ways next to premises you own or rent . . . regardless of fault." Id. ¶ 13. Subsequently, Trouten, a third-party, slipped and fell on a sidewalk abutting the building insured by' Heritage. He reported the accident and made a claim for medical and hospital WEBER expenses. When Heritage denied the claim, Trouten sued Heritage for breach of contract, including a claim of bad faith. Ultimately, the case came before this Court on intermediate appeal with one of the issues being whether Trouten could maintain a direct action suit against Heritage when he did not contract with Heritage. This Court recognized:

[W]henever two parties enter into an agreement that appears to have been made expressly for the benefit of a third party, and such agreement has a good and sufficient consideration, the agreement itself creates all the privity there need be between the person for whose benefit the agreement was entered into and the party assuming the obligation, and an action at law should lie regardless of whether there was any obligation existing between the other party to the agreement and the third party. But, before the third party can adopt the agreement entered into and recover thereon, he must show clearly that it was entered into with the intent on the part of the parties thereto that such third party should be benefited thereby. This intent might, in a given case, sufficiently appear from the contract itself, but it must frequently be shown by other proof.

Id. (quoting Fry, 29 S.D. at 36-37, 135 N.W. at 710) (emphasis added). Accord Verni v. Cleveland Chiropractic College, 212 S.W.3d 150, 153 (Mo. 2007) (stating that "[t]o be bound as a third-party beneficiary, the terms of the contract must clearly express intent to benefit that party or an identifiable class of which the party is a member" and "not every person who is benefited by a contract may bring suit to enforce that contract[;]" "only those third-parties who are clearly intended beneficiaries may do so."). This Court held that because the contract did not expressly or clearly imply that a third party, such as Trouten, had a right to sue Heritage directly for medical benefits, the action would not stand. Trouten, 2001 SD 106, ¶ 23, 632 N.W.2d at 862.

[¶ 22.] Several jurisdictions have concluded that, under analogous circumstances, the injured third party was not a third-party beneficiary of the contract at issue. The Massachusetts Court of Appeal's decision in Lakew v. Massachusetts Bay Tramp. Auth., 65 Mass.App.Ct. 794, 844 N.E.2d 263 (2006), considered a case with an analogous factual scenario as that before us now. Plaintiff Lakew suffered injuries from an armed robbery, which occurred while he was on duty as a parking lot attendant in a parking garage owned by the Defendant, Massachusetts Bay Transportation' Authority (MBTA). Lakewr obtained a jury verdict on his claims for negligence and breach of contract. MBTA appealed, asserting, among other things, that the breach of contract claim should fail as a matter of law because Lakew was not an intended beneficiary of the lease between MBTA and Lakew's employer, which provided that MBTA would supply security at fourteen transit facilities, including Lakew's works site. The court agreed. In applying Restatement (Second) principles, it reasoned:

[A]s a matter of law we consider it clear from the language of the lease and the circumstances of its execution that the MBTA reserved to itself the responsibility for security services in order to control the parties' risk due to potential claims by third parties for loss resulting from property damage or personal injury at the leased facilities. While such a purpose necessarily anticipates the interests of such third parties in avoiding loss, the purpose of the arrangement is, not to confer on such parties a right to enforce the contract but instead to allocate between the direct contracting parties the risk of loss, and control over facts affecting such risk. Viewed in that manner, third parties who suffer a loss as a result of deficient security are not "intended beneficiaries" within the terms of the Restatement (Second), which looks in the first instance to whether "recognition of a right to performance in the beneficiary is appropriate to effectuate the intention of the parties."

Id. at 267-68 (citing Restatement (Second) of Contracts § 302 (1981)) (Emphasis added). Therefore, the court determined that Lakew was not an intended beneficiary of the provisions of the lease between his employer and MBTA concerning security. Id. at 268. Although we make our decision based on SDCL 53-2-6 rather than the Restatement (Second), we find this reasoning persuasive. Analogous to the lease in Lakew, the instant contract was not executed "to confer on such parties a right to enforce the contract," but instead to establish CBM's and the State's mutual rights and responsibilities concerning security in light of the services CBM provided. See id. at 267.

[¶ 23.] Under the instant case, we agree with the circuit court that "[t]he contract is unambiguous as to whether, at the time it was executed, the contracting parties intended to directly benefit CBM employees such as Masad." The language of the contract indicates that the State intended for the contractual rights concerning security be possessed by CBM, as opposed to CBM and all of its employees. Because the contract is unambiguous in this regard, we need not consider extrinsic evidence.

[¶ 24.] The primary purpose of the contract was to provide food services for the prisoners in the custody of the State. Plaintiffs have failed to show that the contract was entered into by the parties "directly and primarily" for Masad's, or any other CBM employee's, benefit. Sisney v. State, 2008 SD 71, ¶ 10, 754 N.W.2d at 643. Any benefit to CBM's employees, such as Masad, was indirect. Therefore, we affirm the circuit court's holding that Plaintiffs have failed to meet their burden of proving Masad was a third-party beneficiary of the contract.

[¶ 25.] Reversed in part, affirmed in part.

[¶ 26.] GILBERTSON, Chief Justice, and KONENKAMP, ZINTER, and MEIERHENRY, Justices, concur.