ORACLE.
PUBLIC SECTOR AGREEMENT FOR ORACLE CLOUD SERVICES
This Public Sector Agreement for Oracle Cloud Services (this "Agreement") is between Oracle America, Inc. ("Oracle," •we," "us," or "our") and the entity that has executed this Agreement as identified in the signature block below ("You" or "Your"). This Agreement sets forth the terms and conditions that govern orders placed under this Agreement.
1. USE OF THE SERVICES
1.1. We will make the Oracle services listed in Your order (the "Services") available to You pursuant to this Agreement and Your order. Except as otherwise stated in this Agreement or Your order, You have the non exclusive, worldwide, limited right to use the Services during the period defined in Your order, unless earlier terminated in accordance with this Agreement or Your order (the · services Period"), solely for Your internal business operations. You may allow Your Users (as defined below) to use the Services for this purpose, and You are responsible for their compliance with this Agreement and Your order.
1.2. The Service Specifications describe and govern the Services. During the Services Period, we may update the Services and Service Specifications to reflect changes in, among other things, laws, regulations, rules, technology, industry practices, patterns of system use, and availability of Third Party Content (as defined below).
Oracle updates to the Services or Service Specifications will not materially reduce the level of performance, functionality, security or availability of the Services during the Services Period of Your order.
1.3. You may not, and may not cause or permit others to: (a) use the Services to harass any person; cause damage or injury to any person or property; publish any material that is false, defamatory, harassing or obscene; violate privacy rights; promote bigotry, racism, hatred or harm; send unsolicited bulk e-mail, junk mail, spam or chain letters; infringe intellectual or other property rights; sell, manufacture, market and/or distribute any product or service in violation of applicable laws; or otherwise violate applicable laws, ordinances or regulations; (b) perform or disclose any benchmarking or availability testing of the Services, except as permitted in the Service Specifications; (c) perform or disclose any performance or vulnerability testing of the Services without Oracle's prior written approval. except as permitted in the Service Specifications, or perform or disclose network discovery, port and service identification, vulnerability scanning, password cracking or remote access testing of the Services; or (d) use the Services to perform cyber currency or crypto currency mining ((a) through {d) collectively, the •Acceptable Use Policy"). In addition to other rights that we have in this Agreement and Your order, we have the right to take remedial action if the Acceptable Use Policy is violated, and such remedial action may include removing or disabling access to material that violates the policy.
2. FEES AND PAYMENT
2.1. All fees payable are due within 30 days from the invoice date. Once placed, Your order is non-cancelable and the sums paid nonrefundable, except as provided in this Agreement or Your order. You will pay any sales, value added or other similar taxes imposed by applicable law that we must pay based on the Services You ordered, except for taxes based on our income. Fees for Services listed in an order are exclusive of taxes and expenses, unless expressly stated otherwise in Your order.
2.2. If You exceed the quantity of Services ordered, then You promptly must purchase and pay fees for the excess quantity.
2.3. You understand that You may receive multiple invoices for the Services. Invoices will be submitted to You pursuant to Oracle's Invoicing Standards Policy, available at https://www.oracle.com/contracts/cloud-services.
3. OWNERSHIP RIGHTS AND RESTRICTIONS
3.1. You or Your licensors retain all ownership and intellectual property rights in and to Your Content (as defined below). We or our licensors retain all ownership and intellectual property rights in and to the Services, derivative works thereof, and anything developed or delivered by or on behalf of us under this Agreement.
Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG City of Anaheim_ 14352553_Prithvi Ramesh_ 16 August 2024 Page 1 of 10
3.2. You may have access to Third Party Content through use of the Services. Unless otherwise stated in Your order, all ownership and intellectual property rights in and to Third Party Content and the use of such content is governed by separate third party terms between You and the third party.
3.3. You have the authority to and do grant us the right to host, use, process, display and transmit Your Content to provide the Services pursuant to and in accordance with this Agreement and Your order. You have sole responsibility for the accuracy, quality, integrity, legality, reliability, and appropriateness of Your Content, and for obtaining all rights related to Your Content required by Oracle to perform the Services.
3.4. Except as permitted by this Agreement or Your order, You may not, and may not cause or permit others to:
(a) modify, make derivative works of, disassemble, decompile, reverse engineer, reproduce, republish, download, or copy any part of the Services (including data structures or similar materials produced by programs); (b) access or use the Services to build or support, directly or indirectly, products or services competitive to Oracle; or (c) license, sell, transfer, assign, distribute, outsource, permit timesharing or service bureau use of, commercially exploit, or make available the Services to any third party.
4. NONDISCLOSURE
4.1. By virtue of this Agreement, the parties may disclose to each other information that is confidential ("Confidential Information"). Confidential Information shall be limited to the terms and pricing under this Agreement and Your order, Your Content residing in the Services, and all information clearly identified as confidential at the time of disclosure.
4.2. A party's Confidential Information shall not include information that: (a) is or becomes a part of the public domain through no act or omission of the other party; (b) was in the other party's lawful possession prior to the disclosure and had not been obtained by the other party either directly or indirectly from the disclosing party; (c) is lawfully disclosed to the other party by a third party without restriction on the disclosure; or (d) is independently developed by the other party.
4.3 Subject to applicable law, each party agrees not to disclose the other party's Confidential Information to any third party other than as set forth in the following sentence for a period of five years from the date of the disclosing party's disclosure of the Confidential Information to the receiving party; however, we will protect the confidentiality of Your Content residing in the Services for as long as such information resides in the Services. Each party may disclose Confidential Information only to those employees, agents or subcontractors who are required to protect it against unauthorized disclosure in a manner no less protective than required under this Agreement, and each party may disclose the other party's Confidential Information in any legal proceeding or to a governmental entity as required by law.
4.4 The parties acknowledge and agree that You and this Agreement are subject to applicable freedom of information or open records laws. Should You receive a request under such law for Oracle's Confidential Information, You agree to give Oracle adequate prior notice of the request and before releasing Oracle's Confidential Information to a third party, in order to allow Oracle sufficient time to seek injunctive relief or other relief against such disclosure.
5. PROTECTION OF YOUR CONTENT
5.1. In order to protect Your Content provided to Oracle as part of the provision of the Services, Oracle will comply with the applicable administrative, physical. technical and other safeguards, and other applicable aspects of system and content management, available at httos·//www oracle.com/contracts/cloud-servjces.
5.2. To the extent Your Content includes Personal Information (as that term is defined in the applicable data privacy policies and the Data Processing Agreement (as defined below)), Oracle will furthermore comply with the following:
a. the relevant Oracle privacy policies applicable to the Services, available at http://www.oracle.com/us/leqal/privacy/oyervjew/index.html; and b. the applicable version of the Data Processing Agreement for Oracle Services (the "Data Processing Agreement"), unless stated otherwise in Your order. The version of the Data Processing Agreement applicable to Your order (i) is available at https:llwww,oracfe com/contractskloud-services and is incorporated herein by reference, and (ii) will remain in force during the Services Period of Your order. In Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG City of Anaheim _14352553_Prithvi Ramesh_16 August 2024 Page 2 of 10 the event of any conflict between the terms of the Data Processing Agreement and the terms of the Service Specifications (including any applicable Oracle privacy policies), the terms of the Data Processing Agreement shall take precedence.
5.3. Without prejudice to Sections 5.1 and 5.2 above, You are responsible for (a) any required notices, consents and/or authorizations related to Your provision of. and our processing of, Your Content (including any Personal Information) as part of the Services, (b) any security vulnerabilities, and the consequences of such vulnerabilities, arising from Your Content, including any viruses, Trojan horses, worms or other harmful programming routines contained in Your Content. and (c) any use by You or Your Users of the Services in a manner that is inconsistent with the terms of this Agreement and/or Your order. To the extent You disclose or transmit Your Content to a third party, we are no longer responsible for the security or confidentiality of such content outside of Oracle's control.
5.4. Unless otherwise specified in Your order (including in the Service Specifications), Your Content may not include any data that imposes specific data security, data protection, or regulatory obligations on Oracle in addition to or different from those specified in the Data Processing Agreement, Service Specifications or this Agreement.
If Your Content includes any of the foregoing data (e.g., certain regulated health or payment card information), Oracle will process such data only pursuant to the terms of Your order, the Data Processing Agreement, Service Specifications and this Agreement. You are responsible for complying with Your specific regulatory, legal or data security obligations which may apply to such data. If available for the Services, You may purchase additional services from us (e.g., Oracle Payment Card Industry Compliance Services) designed to address specific data security, data protection or regulatory requirements applicable to such data.
6. WARRANTIES, DISCLAIMERS AND EXCLUSIVE REMEDIES
6.1. Each party represents that it has validly entered into this Agreement and that it has the power and authority to do so. We warrant that during the Services Period we will perform the Services using commercially reasonable care and skill and in all material respects as described in the Service Specifications (the "Services Warranty"). If the Services provided to You were not performed as warranted, You must promptly provide us with a written notice that describes the deficiency in the Services (including, as applicable, the service request number notifying us of the deficiency in the Services).
6.2. WE DO NOT WARRANT THAT THE SERVICES WILL BE PERFORMED ERROR-FREE OR
UNINTERRUPTED, THAT WE WILL CORRECT ALL SERVICES ERRORS, OR THAT THE SERVICES WILL MEET YOUR REQUIREMENTS OR EXPECTATIONS. WE ARE NOT RESPONSIBLE FOR ANY ISSUES
RELATED TO THE PERFORMANCE, OPERATION OR SECURITY OF THE SERVICES THAT ARISE FROM YOUR CONTENT OR THIRD PARTY CONTENT OR SERVICES PROVIDED BY THIRD PARTIES.
FOR ANY BREACH OF THE SERVICES WARRANTY, YOUR EXCLUSIVE REMEDY AND OUR ENTIRE
LIABILITY SHALL BE THE CORRECTION OF THE DEFICIENT SERVICES THAT CAUSED THE BREACH OF
WARRANTY, OR, IF WE CANNOT SUBSTANTIALLY CORRECT THE DEFICIENCY IN A COMMERCIALLY
REASONABLE MANNER, YOU MAY END THE DEFICIENT SERVICES AND WE WILL REFUND TO YOU THE
FEES PAID FOR THE DEFICIENT SERVICES FOR THE PERIOD OF TIME DURING WHICH THE SERVICES WERE DEFICIENT.
6.3. TO THE EXTENT NOT PROHIBITED BY LAW, THESE WARRANTIES ARE EXCLUSIVE AND THERE ARE
NO OTHER EXPRESS OR IMPLIED WARRANTIES OR CONDITIONS, INCLUDING FOR SOFTWARE,
HARDWARE, SYSTEMS, NETWORKS OR ENVIRONMENTS OR FOR MERCHANTABILITY, SATISFACTORY QUALITY AND FITNESS FOR A PARTICULAR PURPOSE.
7. LIMITATION OF LIABILITY
7.1. IN NO EVENT WILL EITHER PARTY OR ITS AFFILIATES BE LIABLE FOR ANY INDIRECT,
CONSEQUENTIAL, INCIDENTAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES, OR ANY LOSS OF
REVENUE, PROFITS (EXCLUDING FEES UNDER THIS AGREEMENT), SALES, DATA, DATA USE, GOODWILL, OR REPUTATION.
7.2. IN NO EVENT SHALL THE AGGREGATE LIABILITY OF ORACLE AND OUR AFFILIATES ARISING OUT
OF OR RELATED TO THIS AGREEMENT OR YOUR ORDER, WHETHER IN CONTRACT, TORT, OR
OTHERWISE, EXCEED THE TOTAL AMOUNTS ACTUALLY PAID UNDER YOUR ORDER FOR THE ORACLE Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG City of Anaheim_ 14352553_Prithvi Ramesh_ 16 August 2024 Page 3 of 10 PRODUCTS OR SERVICES GIVING RISE TO THE LIABILITY DURING THE TWELVE (12) MONTHS IM MEDIATELY PRECEDING THE DATE OF THE EVENT GIVING RISE TO SUCH LIABILITY.
8. INDEMNIFICATION
If a third party makes a claim against either You or Oracle ("Recipient." which may refer to You or us, depending upon which party received the Material), that any information, design, specification, instruction, software, service, data, hardware, or material (collectively, "Material') furnished by either You or us ("Provider," which may refer to You or us depending on which party provided the Material) infringes the third party's intellectual property rights. the Provider, at the Provider's sole cost and expense. will. to the extent not prohibited by law, defend the Recipient against the claim and indemnify the Recipient from the damages. liabilities. costs and expenses awarded by the court to the third party claiming infringement or the settlement agreed to by the Provider, if the Recipient does the following:
a. notifies the Provider promptly in writing, not later than 30 days after the Recipient receives notice of the claim (or sooner if required by applicable law);
b. gives the Provider sole control of the defense and any settlement negotiations to the extent permitted by law; and
c. gives the Provider the information, authority and assistance the Provider needs to defend against or settle the claim.
8.1. If the Provider believes or it is determined that any of the Material may have violated a third party's intellectual property rights, the Provider may choose to either modify the Material to be non-infringing (while substantially preserving its utility or functionality) or obtain a license to allow for continued use, or if these alternatives are not commercially reasonable, the Provider may end the license for, and require return of, the applicable Material and refund any unused, prepaid fees the Recipient may have paid to the other party for such Material. If such return materially affects our ability to meet obligations under the relevant order, then we may, upon 30 days' prior written notice, terminate the order and refund any unused. prepaid fees for the Services under the terminated order. If such Material is third party technology and the terms of the third party license do not allow us to terminate the license, then we may, upon 30 days' prior written notice, end the Services associated with such Material and refund any unused, prepaid fees for such Services.
8.2. The Provider will not indemnify the Recipient if the Recipient (a) alters the Material or uses it outside the scope of use identified in the Provider's user or program documentation or Service Specifications, or (b) uses a version of the Material which has been superseded (and the Recipient has been notified in writing of the new version), if the infringement claim could have been avoided by using an unaltered current version of the Material which was made available to the Recipient. The Provider will not indemnify the Recipient to the extent that an infringement claim is based upon any material not furnishe d by the Provider. We will not indemnify You to the extent that an infringement claim is based on Third Party Content or any material from a third party portal or other external source that is accessible or made available to You within or by the Services (e.g., a social media post from a third party blog or forum, a third party web page accessed via a hyperlink, marketing data from third party data providers, etc.).
8.3. This Section 8 provides the parties' exclusive remedy for any claims or damages under Section 8.1.
9. TERM AND TERMINATION
9.1. Unless this Agreement is terminated earlier, You may place orders governed by this Agreement for a period of ten years from the date You accept this Agreement. Even if terminated, this Agreement will continue to govern any order for the duration of the Services Period of such order.
9.2. Services shall be provided for the Services Period defined in Your order. Notwithstanding anything to the contrary in the Service Specifications, the Services You order will not be automatically renewed.
9.3. We may suspend Your and/or Your Users' access to, or use of, the Services if we believe that (a) there is a significant threat to the functionality, security, integrity, or availability of the Services or any content, data, or applications in the Services; (b) You or Your Users are accessing or using the Services to commit an illegal act; (c) there is a violation of the Acceptable Use Policy: or (d) You provided false account or payment information or Your digital payment method is refused. When reasonably practicable and lawfully permitted, we will provide You with advance notice of any such suspension. For Services with the applicable operational capability, Oracle will Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG City of Anaheim_ 14352553_Prithvi Ramesh_16 August 2024 Page 4 of 10 use reasonable efforts to limit any suspension only to the portion of the Services related to the issue causing suspension. We will use reasonable efforts to re-establish the Services promptly after we determine that the issue causing the suspension has been resolved. During any suspension period, we will make Your Content {as it existed on the suspension date) available to You. Any suspension under this Section shall not excuse You from Your payment obligations .
9.4. If either of us breaches a material term of this Agreement or any order and fails to correct the breach within 30 days of written specification of the breach (provided in accordance with Section 16.1 below), then the breaching party is in default and the non-breaching party may terminate (a) in the case of breach of any order, the order under which the breach occurred; or (b) in the case of breach of this Agreement. this Agreement and any orders that have been placed under this Agreement. lf we terminate any orders as specified in the preceding sentence, You must pay within 30 days all amounts that have accrued prior to such termination, as well as all sums remaining unpaid for the terminated order(s) plus related taxes and expenses. Except for nonpayment of fees, the non breaching party may agree in its sole discretion to extend the 30 day period for so long as the breaching party continues reasonable efforts to cure the breach. You agree that if You are in default under this Agreement and/or Your order, You may not use those Services ordered.
9.5 You may terminate this Agreement at any time without cause by giving Oracle 30 days prior written notice of such termination. Termination of the Agreement will not affect orders that are outstanding at the time of termination.
Those orders will be performed according to their terms as if this Agreement were still in full force and effect.
However, those orders may not be renewed or extended subsequent to termination of this Agreement.
9.6 At the end of the Services Period. we will make Your Content (as it existed at the end of the Services Period) available for retrieval by You during a retrieval period specified in the Service Specifications. Following the retrieval period, and except as may be required by law, we will delete any of Your Content that remains in the Services.
Our data deletion practices are described in more detail in the Service Specifications.
9. 7 Provisions that survive termination or expiration of this Agreement are those relating to limitation of liability, indemnification, payment and others which by their nature are intended to survive.
10. THIRD PARTY CONTENT , SERVICES AND WEBSITES
10.1. The Services may enable You to link to, transfer Your Content or Third Party Content to, or otherwise access, third parties' websites, platforms. content, products, services, and information ("Third Party Services"). Oracle does not control and is not responsible for Third Party Content or Third Party Services. You are solely responsible for complying with the terms of access and use of Third Party Services, and if Oracle accesses or uses any Third Party Services on Your behalf to facilitate perfonnance of the Services, You are solely responsible for ensuring that such access and use, including through passwords, credentials or tokens issued or otherwise made available to You, is authorized by the terms of access and use for such services. If You transfer or cause the transfer of Your Content or Third Party Content from the Services to a Third Party Service or other location, that transfer constitutes a distribution by You and not by Oracle.
10.2. Any Third Party Content we make accessible is provided on an "as-is" and ·as available" basis without any warranty of any kind. We disclaim all liabilities arising from or related to Third Party Content.
10.3. You acknowledge that: (a) the nature, type, quality and availability of Third Party Content may change at any time during the Services Period, and (b) features of the Services that interoperate with Third Party Services, such as Facebookn.c, YouTubern and Twitterr"'. etc., depend on the continuing availability of such third parties' respective application programming interfaces (APls). We may need to update, change or modify the Services under this Agreement as a result of a change in, or unavailability of, such Third Party Content, Third Party Services or APls. Any change to Third Party Content, Third Party Services or APls, including their unavailability, during the Services Period does not affect Your obligations under this Agreement or the applicable order, and You will not be entitled to any refund, credit or other compensation due to any such changes.
11. SERVICE MONITORING, ANALYSES AND ORACLE-PROVIDED SOFTWARE
11.1. We continuously monitor the Services to facilitate Oracle's operation of the Services; to help resolve Your service requests; to detect and address threats to the functionality, security, integrity, and availability of the Services as well as any content, data, or applications in the Services; and to de1ect and address illegal acts or violations of the Acceptable Use Policy. Oracle monitoring tools do not collect or store any of Your Content residing Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG City of Anaheim_ 14352553_Prithvi Ramesh_ 16 August 2024 Page 5 of 10 in the Services, except as needed for such purposes. Oracle does not monitor, and does not address issues with, non-Oracle software provided by You or any of Your Users that is stored in, or run on or through, the Services.
Information collected by Oracle monitoring tools (excluding Your Content) may also be used to assist in managing Oracle's product and service portfolio, to help Oracle address deficiencies in its product and service offerings, and for license management purposes.
11 .2. We may (a) compile statistical and other information related to the performance, operation and use of the Services, and {b) use data from the Services in aggregated form for security and operations management, to create statistical analyses. and for research and development purposes (above clauses (a) and {b) are collectively referred to as "Service Analyses"}. We retain all intellectual property rights in Service Analyses. 11 .3. We may provide You with the ability to obtain certain Oracle-provided Software (as defined below) for use with the Services. Unless we specify that separate terms will apply to Oracle-provided Software, any Oracle provided Software is provided as part of the Services and You have the non-exclusive, worldwide, limited right to use, and allow Your Users to use. such Oracle-provided Software, subject to the terms of this Agreement and Your order, solely to facilitate Your authorized use of the Services. Your right to use any Oracle-provided Software will terminate upon the earlier of our notice (by web posting or otherwise) or the end of the Services associated with the Oracle-provided Software . Your right to use any part of the Oracle-provided Software that is licensed under the separate terms is not restricted in any way by this Agreement.
12.HARDWARE DEVICES
The terms in this Section 12 (Hardware Devices) only apply to an order which includes a Hardware Device.
12.1. Your order may include a Hardware Device (as defined below), which You may use with the applicable Services as described in the Service Specifications. The terms of this Agreement and Your order (including those terms that refer to Services) govern Hardware Devices, the Operating System and Integrated Software (both as defined below), unless expressly stated otherwise in this Section 12, or if the terms by their nature would be inapplicable to Hardware Devices.
12.2. We provide a limited warranty for Hardware Devices as described in the Oracle Hardware Warranty available at http·//www oracle,com/contracts/hardware . Any changes to the Oracle Hardware Warranty will not apply to Hardware Devices ordered prior to such change.
12.3. We provide technical support services for Hardware Devices as described in the Service Specifications and/or Oracle's Hardware and Systems Support Policies in effect at the time the technical support services are provided (available at http://www,oracle.com/contracts/hardware }, as applicable.
12.4. With respect to our indemnification for Hardware Devices under Section 8, notwithstanding the provisions of Section 8.2, if we believe or it is determined that the Hardware Device (or portion thereof) may have violated a third party's intellectual property rights, we may choose to either replace or modify the Hardware Device ( or portion thereof) to be non-infringing {while substantially preserving its utility or functionality) or obtain a right to allow for continued use, or if these alternatives are not commercially reasonable, we may remove the applicable Hardware Device (or portion thereof) and refund the net book value for the Hardware Device.
12.5. "Hardware Device" is defined as hardware that meets both of the following requirements: (a} the hardware is managed by or used as part of the Services, and {b) the hardware is designated as a Hardware Device by Oracle. Title to Hardware Devices will transfer to You upon delivery to You unless otherwise specified in Your order.
12.6. "Operating System" refers to the software that manages the Hardware Device. You have the right to use the Operating System delivered with the Hardware Device (and any updates acquired through our technical support services) only as incorporated in, and as part of, the Hardware Device and subject to the terms of the license agreement(s) delivered with or on the Hardware Device. Current versions of the license agreements are located in the documentation for the Hardware Device.
12.7. "Integrated Software" refers to any software or programmable code that is embedded or integrated in a Hardware Device and enables the functionality of the Hardware Device. Integrated Software does not include and You do not have rights to (a) code or functionality for diagnostic, maintenance, repair or technical support services; or {b) separately licensed applications, development tools. or system management software or other code that is separately licensed by us or a third party. You have the limited, non-exclusive right to use Integrated Software Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG City of Anaheim _ 14352553 _Prithvi Ramesh_ 16 August 2024 Page 6 of 10 delivered with a Hardware Device (and any updates acquired through our technical support services) only as incorporated in, and as part of, the Hardware Device and subject to any terms delivered with or on the Hardware Device and/or in the applicable documentation.
12.8. We or our licensors retain all ownership and intellectual property rights in and to the Operating System and Integrated Software. The Hardware Device may contain or require the use of third party technology that is provided with or pre-installed on the Hardware Device. Third party technology is licensed under terms which we may provide to You (i) with or on the Hardware Device, (ii) in the applicable product documentation, (iii) in the readme files, or (iv) in the notice files. Your right to use this third party technology under separate license terms are not restricted in any way by this Agreement. We do not warrant or provide any technical support services for this third party technology.
12.9. The Operating System or Integrated Software may include separate works, identified in a readme file, notice file or the applicable documentation, which are licensed under open source or similar license terms; Your rights to use the Operating System and Integrated Software under such terms are not restricted in any way by this Agreement. The appropriate terms associated with these separate works can be found in the readme files, notice files or in the documentation accompany ing the Operating System and Integrated Software. For software (i) that is part of the Operating System or Integrated Software and (ii) that You receive from us in binary form and (iii) that is licensed under an open source license that gives You the right to receive the source code for that binary, You may obtain a copy of the applicable source code from https://oss.oracle com/sources/ or http:1/www oracie com/goto/opensourcecode . If the source code for the software was not provided to You with the binary, You may also receive a copy of the source code on physical media by submitting a written request pursuant to the instructions in the "Written Offer for Source Code" section of the latter website.
13. EXPORT
13.1. Export control and economic sanctions laws and regulations ("export laws") of the United States and any other relevant local export laws apply to the Oracle Products and Services ordered under this Agreement. Such export laws govern use of the Oracle Products and Services (including technical data) and any Oracle products or services deliverables provided under this Agreement, and You and we each agree to comply with all such export laws {including "deemed export'' and "deemed re-export" regulations). You agree that no data, information, software programs and/or materials resulting from the Oracle products or services (or direct product thereof) will be exported, directly or indirectly, in violation of these laws, or will be used for any purpose prohibited by these laws including, without limitation, nuclear, chemical, or biological weapons proliferation, or development of missile technology.
13.2. You acknowledge that the Services are designed with capabilities for You and Your Users to access the Services without regard to geographic location and to transfer or otherwise move Your Content between the Services and other locations such as User workstations. You are solely responsible for the authorization and management of User accounts across geographic locations, as well as export control and geographic transfer of Your Content.
14. FORCE MAJEURE
Neither You nor we shall be responsible for failure or delay of performance if caused by: an act of war, hostility, or sabotage; act of God; pandemic; electrical, internet. or telecommunication outage that is not caused by the obligated party; government restrictions (including, without limitation, an embargo, economic sanction or the denial or cancelation of any export, import or other license); or other event outside the reasonable control of the obligated party. Both You and we will use reasonable efforts to mitigate the effect of a force majeure event. If such event continues for more than 30 days, either of You or we may cancel unperformed Services and affected orders upon written agreement. This Section does not excuse either party's obligation to take reasonable steps to follow its normal disaster recovery procedures or Your obligation to pay for the Services.
15. UCITA
The Uniform Computer Information Transactions Act does not apply to this Agreement or to orders placed under it.
Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG City of Anaheim_ 14352553_Prithvi Ramesh_16 August 2024 Page 7 of 10
16. NOTICE
16.1. Any notice required under this Agreement shall be provided to the other party in writing. If You have a legal dispute with us or if You wish to provide a notice under the Indemnification Section of this Agreement, or if You become subject to insolvency or other similar legal proceedings, You will promptly send written notice to: Oracle America, Inc., 500 Oracle Parkway Redwood Shores, CA 94065, Attention: General Counsel, Legal Department.
16.2. We may give notices applicable to our Services customers by means of a general notice on the Oracle portal for the Services, and notices specific to You (a) by electronic mail to Your e-mail address on record in our account information or (b) by written communication sent by first class mail or pre-paid post to Your address on record in our account information.
16.3. You may register to receive notice of updates to the Oracle Cloud Hosting and Delivery Policies and the Data Processing Agreement (and certain other Service Specifications made available by Oracle) at http://www.oracle.com/contractslcloud-services.
17. ASSIGNMENT
You may not assign this Agreement or give or transfer the Services or any interest in the Services to another individual or entity.
18. OTHER
18.1. We are an independent contractor, and each party agrees that no partnership, joint venture, or agency relationship exists between the parties.
18.2. Our business partners and other third parties, including any third parties with which the Services have integrations or that are retained by You to provide consulting services, implementation services or applications that interact with the Services, are independent of Oracle and are not Oracle's agents. Even if recommended by us, we are not liable for, bound by, or responsible for any problems with the Services or Your Content arising due to any acts or omissions of any business partner or third party, unless the business partner or third party is providing Services as our subcontractor or is otherwise engaged by Oracle in connection with performance of its obligations under this Agreeme nt, and, if so, then only to the same extent as we would be responsible for our resources under this Agreement.
18.3. If any term of this Agreement is found to be invalid or unenforceable, the remaining provisions will remain effective and such term shall be replaced with another term consistent with the purpose and intent of this Agreement.
18.4. Except for actions for nonpayment or breach of Oracle's proprietary rights, no action, regardless of form, arising out of or relating to this Agreement may be brought by either party more than two years after the cause of action has accrued.
18.5. Prior to entering into an order governed by this Agreement, You are solely responsible for determining whether the Services meet Your technical , business or regulatory requirements. Oracle will cooperate with Your efforts to determine whether use of the standard Services are consistent with those requirements. Additional fees may apply to any additional work performed by Oracle or changes to the Services. You remain solely responsible for Your regulatory compliance in connection with Your use of the Services.
19. ENTIRE AGREEMENT
19.1. You agree that this Agreement and the information which is incorporated into this Agreement by written reference (including reference to information contained in a URL or referenced policy), together with the applicable order, is the complete agreement for the Oracle Products and Services ordered by You and supersedes all prior or contemporaneo us agreements, proposals. negotiations, demonstrations or representations, written or oral, regarding such Oracle Products and Services.
19.2. It is expressly agreed that the terms of this Agreement and any Oracle order shall supersede the terms in any purchase order, procurement internet portal, or other similar non-Oracle document,=and no terms included in Cloud_Cloud Services Agreemen t (CSA)_US Public Sector_v062223_US _ENG City of Anaheim _ 14352553_Prithvi Ramesh_ 16 August 2024 Page 8 of 10 any such purchase order, portal, or other non-Oracle document shall apply to Your order. In the event of any inconsistencies between the terms of an order and the Agreement, the order shall take precedence; however, unless expressly stated otherwise in an order, the terms of the Data Processing Agreement shall take precedence over any inconsistent terms in an order. This Agreement and orders hereunder may not be modified and the rights and restrictions may not be altered or waived except in a writing signed or accepted online by authorized representatives of You and of Oracle; however. Oracle may update the Service Specifications, including by posting updated documents on Oracle's websites. No third party beneficiary relationships are created by this Agreement.
20. AGREEMENT DEFINITIONS
20.1. "Oracle-provided Software· means any software agent, application or tool that Oracle makes available to You specifically for purposes of facilitating Your access to, operation of, and/or use with, the Services.
20.2. "Program Documentation " refers to the user manuals, help windows. readme files for the Services and any Oracle-provided Software. You may access the documentation online at htto:/Joracle com/contracts or such other address specified by Oracle.
20.3. "Service Specifications ' means the following documents, as applicable to the Services under Your order:
(a) the Oracle Cloud Hosting and Delivery Policies, the Program Documentation, the Oracle service descriptions, and the Oracle Corporate Security Practices; (b} Oracle's privacy policies; and (c) any other Oracle documents that are referenced in or incorporated into Your order. The following do not apply to any non-Cloud Oracle service offerings acquired under Your order, such as professional services: the Oracle Cloud Hosting and Delivery Policies and Program Documentation. The following do not apply to any Oracle-provided Software: the Oracle Cloud Hosting and Delivery Policies.
20.4. "Third Party Content" means all software. data, text, images, audio, video, photographs and other content and material, in any format, that are obtained or derived from third party sources outside of Oracle that You may access through, within, or in conjunction with Your use of, the Services . Examples of Third Party Content include data feeds from social network services, rss feeds from blog posts, Oracle data marketplaces and libraries, dictionaries, and marketing data. Third Party Content includes third-party sourced materials accessed or obtained by Your use of the Services or any Oracle-provided tools.
20.5. "Users• means, for Services, those employees, contractors, and end users, as applicable, authorized by You or on Your behalf to use the Services in accordance with this Agreement and Your order. For Services that are specifically designed to allow Your clients, agents, customers, suppliers or other third parties to access the Services to interact with You, such third parties will be considered "Users" subject to the terms of this Agreement and Your order.
20.6. "Your Content " means all software, data (including Personal Information), text, images, audio, video, photographs, non-Oracle or third party applications. and other content and material, in any format, provided by You or any of Your Users that is stored in, or run on or through, the Services. SeNices under this Agreement, Oracle-provided Software, other Oracle Products and Services, and Oracle intellectual property, and all derivative works thereof, do not fall within the meaning of the term "Your Content." Your Content includes any Third Party Content that is brought by You into the Services by Your use of the SeNices or any Oracle-provided tools.
21. CLOUD SERVICES AGREEMENT EFFECT IVE DATE
The Effective Date of this Cloud Services Agreement is 22-AUG-2024.
THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK. THE SIGNATURE BLOCK FOR THIS AGREEMENT FOLLOWS IMMEDIATELY ON THE NEXT PAGE.
Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG City of Anaheim _14352553_Pri thvi Ramesh_16 August 2024 Page 9 of 10 City of Anaheim Oracle America, Inc.
Authorized Signature: ______ __ _
[;br~~
Authorized Signature: _ _______ _
Heather Pe 11 ey
Name: ______ _______ _ Name: _____________ _
Title: _____ _________ _ Director, Deal Management Title: ____ ______ _ ___ _ 16-Jul - 2024 I 2:31 PM PDT
Signature Date: _____ _____ _ Signature Date: _ _________ _ Agreement No.: US-CSA-CPQ-2840587
APPROVED AS TO FORM:
::A~Y'S OFFICE
r.CJ#?r,.J,
Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG City of Anaheim _ 14352553_Prithvi Ramesh_ 16 August 2024 Page 10 of 10 ORACLE .
-
ORDERING DOCUMENT
Name
Address
City of Anaheim
201 S Anaheim Blvd
ANAHEIM CA
92805
New Subscription
Services Period: 60 months
!Cloud Services Data Center
Region
B91109 - Oracle Integration Cloud NORTH Service for Oracle Saas - Standard - AMERICA 1 Million Messages B90333 - Oracle Field Service NORTH Professional Cloud Service - Hosted AMERICA Named User B79903 - Oracle Additional Test NORTH Environment for Oracle Field Service AMERICA Cloud Service - Test Environment B91134 - Oracle Utilities Work and NORTH V,.Sset Cloud Service, Additional Test AMERICA Environment - Instance B91134 - Oracle Utilities Work and NORTH ~set Cloud Service, Additional Test AMERICA Environment - Instance 891131 - Oracle Utilities Work and NORTH lA.sset Cloud Service - Hosted Named AMERICA Users 879903 - Oracle Additional Test NORTH Environment for Oracle Field Service AMERICA Cloud Service• Test Environment CPQ-2840587 • 1
Quantity
2 425
1 1
1 425
1 Contact
Phone Number
Email Address
Term
60mo
60mo
60mo
36 mo
60mo
60mo
36 mo
Subtotal
Fee Description
Oracle America, Inc.
500 Oracle Parkway
Redwood Shores, CA
94065
Hans Nielsen
+1 (714) 765-4180
hnielsen@anaheim .net
Cloud Services F~
Net Fees
Total Fees
Issued by Oracle America, Inc.
(")Net Fee
2,285,325.00
Net Fee
2,285,325.00
2,285,325.00
2,285,325.00
16-JUL-2024
A. Terms of Your Order
1. Applicable Agreement:
a. Oracle Cloud Services Agreement US-CSA-CPQ-2840587
2. Cloud Payment Terms:
a. Net 30 days from invoice date
3. Cloud Payment Frequency:
a. Quarterly in Arrears
4. Currency:
a. US Dollars
5. Offer Valid through:
a. 28-AUG-2024
6. Service Specifications
a. The Service Specifications applicable to the Cloud Services and the Consulting/Professional Services ordered may be accessed at http://www.orac le.com/contracts.
7. Services Period
a. The Services Period for the Services commences on the date stated in this order. If no date is specified, then the "Cloud Services Start Date• for each Service will be the date that you are issued access that enables you to activate your Services, and the "Consulting/Professional Services Start Date" is the date that Oracle begins performing such services.
B. Additional Order Terms
1. Shelving of On Premise Program Licenses
a. Shelved On Premise Licenses. Under one or more separate contracts with Oracle (the "Separate Contract(s)"), You previously acquired the Oracle on premise program licenses listed in the attached License Shelving Exhibit (the "Shelv ed On Premise Licenses "} and related technical support services . In connection with the Services acquired under this order, You may cease using, and cease purchasing annual technical support services for (such cessation of use and cessation of purchasing of annual technical support services being referred to as "shelved" or "shelving"), the Shelved On Premise Licenses in accordance with the terms of this "Shelving of On Premise Program Licenses• section. Notwithstanding anything to the contrary, the Shelved On Premise Licenses may only include Oracle on premise program licenses for which You maintain technical support (i.e., continue purchasing annua l technical support services for) in accordance with their applicable Separate Contract(s) until the commencement of the Transition Period (as defined below}. In addition, as a requirement for shelving the Shelved On Premise Licenses, the Cloud Services acquired under this order must be mainta ined (i.e., not terminated) for the full Services Period specified in the table above (the "Full Services Period"}.
Except as modified by this "Shelving of On Premise Program Licenses• section, Your use of the Shelved On Premise Licenses and related Oracle technical support services (including, Limited On Premise Support (as defined below)) must remain in accordance with the terms of their Separate Contract(s) (induding, limiting use to the Quantity and license type for which a program is licensed}, and the Oracle technical support policies located at http://www.oracle.com/support/policies.html ("Orac le Technical Support Policies "}. Annual technical support services fees for the Shelved On Premise Licenses as of the issuance date of this order are set forth on the License Shelving Exhibit, and remain subject to adjustment by Oracle per the terms of the applicable Separate Contract(s) and the Oracle Technical Support Policies. b. Transition Period .
i. On Premise Technical Support. With respect to the Shelved On Premise Licenses and subject to the terms of this "Shelving of On Premise Program licenses • section, You may
(1) cease purchasing annual technical support services for those licenses commencing as of the beginning of the Transition Period; and (2) continue using those licenses during the Transition Period.
During the Initial Transition Period (as defined below) only, Oracle will provide You at no charge with Limited On Premise Support for such licenses.
Notwithstanding anything to the contrary and as used In this "Shelving of On Premise Program licenses" section, "Limited On Premise Support• means only technical support services for the Shelved On Premise licenses that do not include (A) any major version release updates for the applicable Oracle on premise programs, or (8) any professional services that are separate from technical support (such as from Oracle Advance Customer Services or Oracle Consulting Services}. Except as set forth in the preceding sentence, Limited On Premise Support consists of all the components of the phase of Oracle technical support (I.e., Premier Support, Extended Support or Sustaining Support} that is applicable to Your installed version of the Oracle on premise programs included in the Shelved On Premise Licenses, as described in the Oracle Technical Support Policies and Oracle's Lifetime Support Policies referenced therein.
ii. Initial Transition Period(s) . The "Initia l Transit ion Period" for the Shelved On Premise Licenses is the 12 month period commencing on the Cloud Services Start Date.
CPQ-2840587 • 1 Issued by Oracle America, Inc. 16-JUL-2024
iii. Continuin g Trans ition Period(s). If You would like to continue using the Shelved On Premise Licenses beyond 12 months from the Cloud Services Start Date, then You must:
( 1) send Oracle written notice of such election at least 30 days before the 12 months end specifying the elected additional period, and (2) purchase from Oracle annual on premise technical support (i.e., not Limited On Premise Support) in 12 month increments for such licenses which covers such elected continuing usage period {each such 12 month increment, a "Continuing Transition Period" and, collectively, the "Continuing Transition Periods").
For each Continuing Transition Period, You will be billed in arrears a net fee equal to the annual support rate in Your last paid support renewal order {annualized as appropriate) for the Shelved On Premise Licenses. iv. End of Transition Period. If You do not elect to continue Your ongoing Transition Period pursuant to the terms of this "Transition Period" subsection, then Your Transition Period will end, and You will immediately commence shelving of the Shelved On Premise Licenses in accordance with the "Shelving Period" subsection below, effective as of the end of the current Initial Transition Period or Continuing Transition Period, as applicable. In addition, by providing Oracle with written notice, You may at any time end any ongoing Transition Period and immediately commence shelving of the Shelved On Premise Licenses in accordance with the "Shelving Period" subsection below. With respect to any ongoing Transition Period that is terminated, fees related to any partial quarter of technical support received for the Shelved On Premise Licenses will be pro-rated. v. Definition of Transition Period. As used in this "Shelving of On Premise Program Licenses• section, the "Transition Period" means the total cumulative period of the Initial Transition Period and any Continuing Transition Periods. c. Shelving Credit . Oracle will issue You a credit for any Oracle technical support services fees that You prepaid, if applicable, for the Shelved On Premise Licenses which remain unused as of the commencement of the Transition Period, provided that the invoices for such technical support services have been paid in full. If applicable, this credit will be applied against Your next invoice for the Cloud Services acquired under this order following the commencement of the Transition Period and may not be used by You for purchase of any other Oracle products or services. d. Shelving Period . The term "Shelving Period" means the time during which the Shelved On Premise Licenses are considered to be shelved and starts at the end of the Transition Period and continues through the earlier of the following to occur:
(i) the expiration or termination of the Services Period for the Cloud Services acquired under this order; (ii) Your resumption of use of the Shelved On Premise Licenses in accordance with the "Election to Unshelve· subsection below; (iii) any assignment or transfer to a third party of the Cloud Services acquired under this order or of the Shelved On Premise Licenses; or (iv) Your non-compliance (as described in the •unshelving Due to Non Compliance· subsection below).
If the Shelving Period ends under clause (i) of the preceding sentence due to the expiration of the Full Services Period, then You may continue to shelve the Shelved On Premise Licenses by entering into an order with Oracle pursuant to mutually agreed to terms and conditions which renews the Cloud Services and expressly extends such licenses' Shelving Period. If the Shelving Period ends under clause (iii) of the first sentence of this paragraph, then You must unshelve (i.e., resume use and Oracle technical support for) the Shelved On Premise Licenses in accordance with the "Election to Unshelve" subsection below.
During the Shelving Period, You must:
(1) not use the Shelved On Premise Licenses for any purposes other than read-only access to historical archived data, (2) not receive for, or use for the benefit of, the Shelved On Premise Licenses, any direct or indirect Oracle technical support in any manner, including but not limited to updates, patches, fixes, accessing historical archived data, phone support, or on-line support accessible through a web browser or other connectivity tool, and
(3) with respect to Your remaining Oracle on premise program licenses {i.e., program licenses which have not been shelved), continue to comply with all applicable license and technical support terms under the separate contract(s) pursuant to which they are licensed and the Oracle Technical Support Policies.
e Unshelving Due to Non-Compliance. If You fall to meet any of the requirements or otherwise violate any of the terms in this "Shelving of On Premise Program Licenses" section then, as of the date of the first failure or violation, as applicable (the "Non-Compliance Date"), {i) the Shelving Period will immediately end and the Shelved On Premise Licenses will no longer be deemed shelved under these provisions, (ii) all rules and policies in the Oracle Technical Support Policies will again apply, (iii) You will be charged a reinstatement fee and applicable back support fees for the Shelved On Premise Licenses, and (iv) You will be charged annual technical support services for the Shelved On Premise Licenses, which will be deemed reinstated as of the Non-Compliance Date.
If You fail to pay Oracle all the fees specified in the preceding sentence within 15 days of the Non-Compliance Date, then the rules on repricing and matching service levels in the Oracle Technical Support Policies will be applied to the Shelved On Premise Licenses and any applicable remaining supported licenses. Reinstatement and back support fees under the first sentence of this subsection will be calculated pursuant to the Oracle Technical Support Policies for the period commencing from the start of the Transition Period for the Shelved On Premise Licenses. f. Election to Unshelve. Except as provided In the "Unshelvlng Due to Non Compliance" subsection above, You may elect to end the Shelving Period and resume use of the Shelved On Premise Licenses in accordance with their applicable Separate Contract{s):
(i) at any time during the Services Period specified for the Cloud Services acquired under this order by providing Oracle with prior written notice of Your election to unshelve such licenses and resuming payment of all annual technical support services fees for such licenses {at the annual technical support services rate equal to Your last paid support fee for such licenses {annualized as appropriate)) no later than 30 days from Your resumption of use, or
(ii) at the end of the Full Services Period for the Cloud Services acquired under this order, by resuming payment of all annual technical support services fees for such licenses (at the annual technical support services rate equal to Your last paid support fee for such licenses (annualized as CPQ-2840587 • 1 Issued by Oracle America, Inc. 16·JUL·2024
appropria te)) no later than 30 days from the end of the Full Services Period (under this clause (ii), annual technical support services fees for the Shelved On Premise Licenses will be calculated based on annual technical support services commencing as of the end of the Full Services Period).
You will not be charged back support or reinstatement fees for unshelving the Shelved On Premise Licenses in accordance with the preceding sentence.
However, If You fail to pay Oracle all the technical support fees in accordance with lhe first sentence of this subsection, then:
(1) Your failure to pay in full will be considered a failure to maintain annual technical support services for the Shelved On Premise Licenses under their applicable Separate Contract(s) and the Oracle Technical Support Policies; (2) all rules and policies in the Oracle Technical Support Policies, including the repricing and matching service rules, will again apply to the Shelved On Premise licenses and any applicable remaining supporte d licenses; and (3) thereafter, if You use technical support with any remaining Shelved On Premise licenses, then You must first reinstate such support pursuant to the Oracle Technical Support Policies and pay Oracle back support and reinstatement fees calculated for the period commencing on the earlier of (A) Your resumption of use of such licenses or (B) the end of the Shelving Period.
For clarity, this order for Cloud Services and all rights and obligations hereunder (including payment obligations), will remain in full force and effect for the duration of the Services Period for the Cloud Services acquired under this order, notwithstanding any resumption of use by You of the Shelved On Premise Licenses prior to the end of such Services Period. g. Purchases of Addit ional On Premise Licens es. In the event that You require additional Oracle on premise program licenses for an Oracle program that has been shelved under this "Shelving of On Premise Program Licenses· section, You must first unshelve the required number of licenses of such program (up to the total number shelved) in accordance with the "Election to Unshelve" subsec tion above. You may not purchase additional licenses for that program until all Shelved On Premise Licenses of such program have been unshelved. h. Certification . You must certify in writing to Oracle at the commencement of the Shelving Period, and annually thereafter during the Shelving Period, that the Shelved On Premise Licenses are and rema in shelved in accordance with the terms of this "Shelving of On Premise Program Licenses' section. i. Unpaid Invoices
You agree that:
1. the invoices for technical support for the Oracle on premise program licenses associated with the technical support services contract(s) identified in the column labeled Invoice Number (INV#) in the table below ("Subject Licenses") do not appear In Oracle's systems as having been paid as the issuance date of this order;
2. such invoices reflect fees for a technical support term that expires (or has already expired) as set forth in the column labeled Invoice Due Date in the table below; and
3. those invoices are noncancelable and non-refundable and, if not in fact already paid, will be paid in full In accordance with the payment terms applicable thereto.
You acknowledge that unless the invoices related to the Subject licenses are paid in full, then (1) in accordance with the technical support requirements of the "Shelved On Premise Licenses· subsection above, these licenses will not be Included in the Shelved On Premise Licenses under this "Shelving of On Premise Program Licenses" section, and (2) no credit for unused support related to the Subject Licenses will be valid nor granted under this order.
OKS INV# Invoice Due Date Amount Due Remalnlna Amount Due Oriainallv Currencv 1784297 100684702 30-JUN -23 52,546.21 52 546.21 USO
1784297 100684703 30-SEP-23 52 546.21 52 546.21 USO
1784297 100684704 30-DEC-23 52,546.21 52 546 21 USD
1784297 100684869 30-MAR-24 52,546.25 52,546.25 USO
2. Limited use
The following Services are limited use. City of Anaheim can use OFS service if only with the WACS on the order. City usage case is for WACS and OFS, which share a Hosted Named User metric, to be used by the same body of users.
3. Oracle Cloud Hosting and Delivery Policies
Oracle's Cloud Hosting and Delivery Policies, current as of the date this order is issued by Oracle, are attached hereto. Oracle's Cloud Hosting and Delivery Policies are subject to change, but such changes will not materially reduce the level of performance , security, or availability of the Cloud Services under this order for the duration of the Services Period.
4. Oracle Corporate Security Practices
Oracle 's Corporate Security Practices current as of the date this order is issued by Oracle, are attached hereto, and are included in the Service Specifications for the Cloud Services acquired under this order . Oracle's Corporate Security Practices are subjec t to change, but such changes will not mate rially reduce the level of security of the Cloud Services under this order for the duration of the Services Period.
5. No Auto-Renewal
Notwithstanding any statement to the contrary in the Service Specifications, the parties expressly agree that the Services acquired under this order will not Auto-Renew.
CPQ-2840587 • 1 Issued by Oracle America, In c. 16-JUL-2024
6. Non-Appropriation
In the event funds are not appropriated for a new fiscal year period, You may terminate this order immediately without penalty or expense ; provided, however, that: (a) for each of the 12-month terms of the order, You must provide a purchase order, and {b) Your issuance of each 12-month purchase order shall signify to Oracle that all funds for the given 12-month term have been fully appropriated and encumbered. Notwithstanding the foregoing, You agree to pay for all Services performed by Oracle prior to Oracle's receipt of Your notice of non-appropriation.
CPQ-2840587 - 1 Issued by Oracle America, Inc. 16-JUL-2024
City of Anaheim
Signature
Name
Title
Signature Date
Oracle America, Inc.
Signature
Name
Title
Heather Pelley
Director, Deal Management
Signature Date 16-Jul-2024 2: 31 PM PDT
BILL TO/ SHIP TO INFORMATION
Bill To
Customer Name City of Anaheim
Customer Address 201 S Anaheim Blvd
ANAHEIM CA
92805
Contact Name Hans Nielsen
Contact Phone +1 (714) 765-4180
Contact Email hnielsen@anaheim .net
CPQ-2840S87 • 1
Ship To
Customer Name City of Anaheim
Customer Address 201 s Anaheim Blvd
ANAHEIM CA
92805
Contact Name Hans Nielsen
Contact Phone +1 (714) 765-4180
Contact Email hnielsen@anaheim .net
Issued by Oracle America, Inc. 16·JUL·2024
ATTACHMENT 1-A
ORACLE
Oracle Cloud Hosting and
Delivery Policies
-
Effective Date: February 2024; Version 3.6
Oracle Cloud Hostin@ and Defivery Policies Page1 of 18
TABLE OF CONTENTS
Overview
1. Oracle Cloud Security Policy
1.1 Oracle Inform ation Security Practices - General
1.2 Physical Security Safeguards
1.3 System Access Controls
1.4 Data Access Controls
1.5 User Encryption for External Connections
1.6 Input Control
1.7 Data and Network Segregation
1.8 Confidentiality and Training
1. 9 Asset Management
1.10 Oracle Internal Information Security Policies
1.11 Internal Security Reviews and Enforcement
1.12 External Reviews
1.13 Oracle Software Security Assurance
1.14 Security Logs
1.15 Other Customer Security Related Obligations
2. Oracle Cloud Service Continuity Policy
2.1 Oracle Cloud Services High Availability Strategy
2.2 Oracle Cloud Services Backup Strategy
2.3 Oracle Business Continu ity
3. Oracle Cloud Service Level Agreement
3.1 Hours of Operation
3.2 Service Availability
3.2.1 Measurement of Availability
3.2.2 Reporting of Availability
3.2.3 Service Credits
3.3 Definition of Unplanned Downtime
3.4 Monitoring
3.4.1 Monitored Components
3.4.2 Customer Monitoring & Testing Tools
4. Oracle Cloud Change Management Policy
4.1 Oracle Cloud Change Management and Maintenance
4.1.1 Critical Security Maintenance
4.1.2 Data Center Migrati ons
4.2 Software Versioning
4.2.1 Software Updates
4.2.2 End of Life
5. Oracle Cloud Support Policy
5.1 Oracle Cloud Support Term s
Oracle Cloud Hosting and Delivery Policies
4 5
5 6
6 7
7 7
7 7
8 8
8 8
8 9
9 9
9 10
10 10
10 10
11 11
11 11
12 12
12 12
12 13
13 14
14 14
14 14
Page2 of18
5.1.1 Support Fees
5.1.2 Support Period
5.1.3 Technical Contacts
5.1.4 Oracle Cloud Support
5.2 Oracle Cloud Customer Support Systems
5.2.1 Oracle Cloud Customer Support Portal
5.2.2 Live Telephone Support
5.3 Severity Definitions
5.3.1 Severity 1 (Critical Outage)
5.3.2 Severity 2 (Significant Impairment)
5.3.3 Severity 3 (Technical Issue)
5.3.4 Severity 4 (General Guidance)
5.4 Change to Service Request Severity Level
5.4.1 Initial Severity Level
5.4.2 Downgrade of Service Request Levels
5.4.3 Upgrade of Service Request Levels
5.4.4 Adherence to Severity Level Definitio ns
5.5 Service Request Escalation
6. Oracle Cloud Suspension and Termination Po1icy
6.1 Termination of Oracle Cloud Services
7 Use of Services
Orade Cloud Hosting and Delivery Policies
14 14
14 15
15 15
16 16
16 16
16 17
17 17
17 17
17 17
18 18
18 Page3 of 18
OVERVIEW
These Oracle Cloud Hosting and Delivery Policies (these "Delivery Policies") describe the Oracle Cloud Services ordered by You. These Delivery Policies may reference other Oracle Cloud policy documents; any reference to "Customer" in these Delivery Policies or in such other policy documents shall be deemed to refer to "You" as defined in Your order. All commitments in these Delivery Policies apply to production Cloud Services unless otherwise specified.
References in these Delivery Policies to a Cloud Services' "Data Center Region" refers to the geographic region listed in Your order for such Services or, if applicable, the geographic region that You have selected when activating the instance of such Services. For purposes of the Data Center Region applicable to Your ordered Cloud Services, the following applies:
• "Europe" refers to the member countries of the European Union, the United Kingdom, and Switzerland, collectively; and
• "APAC" refers to the Asia-Pacific geography, except China as Oracle has no data centers in China
• "North America" refers to geographical regions made up of the continental United States of America and Canada; except where the entity purchasing Cloud Services elects to be initially provisioned in the country of Mexico, in which case, North America refers to the geographical regions made up of the continental United States of America, Canada and Mexico.
With respect to Your ordered Oracle Cloud Services, Your Content will be stored in the Data Center Region applicable to such Services. Oracle may replicate Your Content to other locations within the identified Data Center Region in support of data redundancy. Capitalized terms that are not otherwise defined in these Delivery Policies shall have the meaning ascribed to them in the Oracle agreement, Your order or the policy, as applicable. These Delivery Policies are updated on a biannual basis.
Your order or Oracle's Service Specifications (as defined in Your agreement for Oracle Cloud Services which includes Oracle Cloud Services Pillar documentation, Service Descriptions and additional definitions provided in the Oracle Cloud Services Agreement) may include additional details or exceptions related to specific Oracle Cloud Services. The Oracle Cloud Service Pillar documentation, the Service Descriptions and the Program Documentation for Oracle Cloud Services are available at www.oracle.com/contracts.
Oracle Cloud Services are provided under the terms of the Oracle agreement, Your order, and Service Specifications applicable to such Services. Oracle's delivery of the Oracle Cloud Services is conditioned on Your and Your Users' compliance with Your obligations and responsibilities defined in such documents and incorporated policies. These Delivery Policies, and the documents referenced herein, are subject to change at Oracle's discretion; however, Oracle policy changes will not result in a material reduction in the level of performance, functionality, security, or availability of the Oracle Cloud Services provided during the Services Period of Your order.
Oracle Cloud Hosting and Detive,y Policies Page4of18
Oracle Cloud Services are deployed at data centers or third -party infrastructure service providers retained by Oracle, with the exception of Oracle Cloud at Customer Services. Oracle Cloud at Customer Services are Public Cloud Services that are deployed at Your data center or at a third-party data center retained by You. You may purchase these Services standalone or they may be deployed as the underlying platform for othe r Oracle Cloud Services. For Oracle Cloud at Customer Services, Oracle will deliver to Your data center certain hardware components, including gateway equipment, needed by Oracle to operate these Services. You are responsible for providing adequate space, power, and cooling to deploy the Oracle hardware (including gateway equipment) and for ensuring adequate network connectivity for Oracle Cloud Operations to access the services. Oracle is solely responsible for maintenance of the Oracle hardware components (including gateway equipment).
These Delivery Policies do not apply to Oracle BigMachines Express or such other Oracle Cloud offerings as specified by Oracle in Your order or the applicable Service Descriptions.
1. ORACLE CLOUD SECURITY POLICY
1.1 Oracle Information Security Practices - General
Oracle has adopted security controls and practices for the Oracle Cloud Services that are designed to protect the confidentiality, integrity, and availability of Your Content that is hosted by Oracle in Your Oracle Cloud Services and to protect Your Content from any unauthorized processing activities such as loss or unlawful destruction of data. Oracle continually works to strengthen and improve those security controls and practices.
Oracle Cloud Services operate under practices which are aligned with the IS0/lEC 27002 Code of Practice for information security controls, from which a comprehensive set of controls are selected.
Oracle Cloud Services are aligned with National Institute of Standards and Technology ("NIST") 800- 53 and 800-171.
Oracle Cloud information security practices establish and govern areas of security applicable to Oracle Cloud Services and to Your use of those Oracle Cloud Services.
Oracle personnel (including employees, contractors, and temporary employees) are subject to the Oracle information security practices and any additional policies that govern their employment or the services they provide to Oracle.
Oracle takes a holistic approach to information security, implementing a multi-layered defense security strategy where network, operating system, database, and software security practices and procedures complement one another with strong internal controls, governance and oversight.
For those Oracle Cloud Services which enable You to configure Your security posture, unless otherwise specified, You are responsible for configuring, operating, maintaining , and securing the operating systems and other associated software of these select Oracle Cloud Services (including Your Content) that is not provided by Oracle. You are responsible for maintaining appropriate security, protection, and backup of Your Content, which may include the use of encryption Oracle Cloud Hosting and Delivery Policies Pages of 18
technology to protect Your Content from unauthorized access and the routine archiving of Your Content.
1.2 Physica1 Security Safeguards
Oracle employs measures designed to prevent unauthorized persons from gaining access to computing facilities in which Your Content is hosted such as the use of security personnel, secured buildings, and designated data center premises. Oracle provides secured computing facilities for both office locations and production cloud infrastructure. Common controls between office locations and Oracle controlled co-locations/data centers currently include, for example:
• Physical access requires authorization and is monitored • All employees and visitors must visibly wear official identification while onsite • Visitors must sign a visitor's register and be escorted and/or observed while onsite • Possession of keys/access cards and the ability to access the locations is monitored. Staff leaving Oracle employment must return keys/cards
Additional physical security safeguards are in place for Oracle-controlled Cloud data centers, which currently include safeguards such as:
• Premises are monitored by CCTV
• Entrances are protected by physical barriers designed to prevent unauthorized entry by vehicles
• Entrances are manned 24 hours a day, 365 days a year by security guards who perform visual identity recognition and visitor escort management • Safeguards related to environmental hazards
• Any physical movement of equipment is controlled by hand -delivered receipts and other authorized change control procedures
• Network cables are protected by conduits and, where possible, avoid routes through public areas
This section does not apply to Oracle Cloud at Customer Services. You must provide Your own secure computing facilities tor the hosting and operation of the Oracle Cloud at Customer Services-related hardware (including the gateway equipment) and network connections required for Oracle to provide the Oracle Cloud at Customer Services.
1.3 System Access Controls
Oracle policies require the following controls to be applied: authentication via passwords and/or multi-factor authentication, documented authorization controls, and logging of access. All remote access to the Oracle Cloud Network by Oracle personnel that have access to Your Content is restricted through the use of a Virtual Private Network which utilizes multi-factor authentication . In addition to the required use of a Virtual Private Network, before Oracle personnel are granted access to the Oracle Cloud Network, Oracle performs device posture checks and has in place controls, such as Oracle Cloud Host ing and Delivery Policies Page6of18
bastion hosts. Oracle prohibits (through both policy and technical controls) the use of personal devices to access the Oracle Cloud Network and the Oracle Cloud Services.
For Cloud Services hosted by Oracle: (i) log-ins to Cloud Services are logged and (ii) logical access to the data centers is restricted and protected.
1.4 Data Access Controls
For service components managed by Oracle, Oracle's access to Your Content is restricted to authorized staff.
With respect to Oracle personnel accessing the Oracle Cloud Services (including Your Content residing in the Oracle Cloud Services), Oracle enforces Role Based Access Controls (RBAC} and employs the access management principles of "need to know", "least privilege" and "segregation of duties." In addit ion, Oracle provides a mechanism by which You control Your Users' access to the Oracle Cloud Services and to Your Content.
1.5 User Encryption for External Connections
Your access to Oracle Cloud Services is through a secure communication protocol provided by Oracle.
If access is through a Transport Layer Security (TLS} enabled connection, that connection is negotiated for at least 128 bit encryption. The private key used to generate the cipher key is at least 2048 bits. TLS is implemented or configurable for all web-based TLS-certified applications deployed at Oracle. It is recommended that the latest available browsers certified for Oracle programs, which are compatible with higher cipher strengths and have improved security, be utilized for connecting to web enabled programs. The list of certified browsers for each release of Oracle Cloud Services will be made available via a portal accessible to You or in the corresponding Service Description for the Oracle Cloud Services. In some cases, a third party site that You wish to integrate with the Oracle Cloud Services, such as a social media service, may not accept an encrypted connection. For Oracle Cloud Services where HTTP connections with the third party site are permitted by Oracle, Oracle will enable such HTTP connections in addition to the HTTPS connection.
1.6 Input Control
The source of Your Content is under Your control and Your responsibility. and integrating Your Content into the Oracle Cloud Services, is managed by You.
1.7 Data and Network Segregation
Your Content is logically or physically segregated from the content of other customers hosted in the Oracle Cloud Services. All Oracle Cloud networks are segregated from Oracle's corporate networks.
1.8 Confidentiality and Training
Oracle personnel are subject to confidentiality agreements and are required to complete information protection awareness training upon hiring. Thereafter, all Oracle personnel must complete training periodically in accordance with applicable Oracle security and privacy awareness training policies.
Oracle Cloud Hosting and 0eUvery Policies Page7of18
1. 9 Asset Management
Oracle is responsible for the protection and inventory of Oracle's Cloud Services assets. The responsibilities may include reviewing and authorizing access requests to those who have a business need and maintaining an inventory of assets.
You are responsible for the assets You control that utilize or integrate with the Oracle Cloud Services, including determining the appropriate information classification for Your Content, and whether the documented controls provided by Oracle Cloud Services are appropriate for Your Content. You must have or obtain any required consents or other legal basis related to the collection and use of information provided by data subjects, including any such consents or other legal basis necessary to provide the Oracle Cloud Services.
1.10 Oracle Internal Information Security Policies
Oracle Cloud information security policies establish and govern areas of security applicable to Oracle Cloud Services and to Your use of Oracle Cloud Services. Oracle personnel are subject to the Oracle Corporate Information Security Policies and any additional policies that govern their employment or the services they provide to Oracle. Oracle's Informat ion Security Program ("ISP") is comprised of documented policies that consider risk factors including cyber and security factors, with accompanying derivative procedures, standards and guidelines required for the effective operationalizat ion of policy . Oracle's ISP is designed to ensure the confidentiality, integr ity, privacy, continuity and availability of Your Conten t that is hosted by Oracle in Your Oracle Cloud Services through effective security management practices and controls. Oracle's ISP is reviewed annually by the Oracle Security Oversight Committee and updated as required.
1.11 Internal Security Reviews and Enforcement
Oracle employs internal processes for regularly testing, assessing, evaluating and maintaining the effectiveness of the technical and organizational security measures described in this section.
1.12 External Reviews
Oracle may conduct independent reviews of Oracle Cloud Services utilizing third parties in the following areas (the scope of any such reviews may vary by Service and country):
• SOC 1 (based on Statement on Standards for Attestation Engagements (SSAE) No 18) and/or SOC 2 reports (based upon Trust Services Criteria) • Other independent third-party security testing to review the effectiveness of administrative and technical controls
Relevant information from these reviews may be made available to customers.
1.13 Oracle Software Security Assurance
Oracle Software Security Assurance (OSSA) is Oracle's methodology for building security into the design, build, testing, and maintenance of its products, whether they are used on-premises by Oracle Cloud Hosting and D..iive,y Policies Page8 of 18 customers, or delivered through Oracle Cloud. The OSSA program is described at httos://www.orac)e.com/coroorate/security -oractkes/assurance/.
1.14 Security Logs
Logs are generated for security-relevant activities on operating systems. Systems are configured to log default security activities, access to information or programs , system events such as alerts, console messages, and system errors. Oracle reviews logs for forensic purposes and incidents; identified anomalous activities feed into the incident management process. Security logs are stored within the Security Information and Event Management system (or equivalent system) in a native, unaltered format and retained in accordance with Oracle's internal policies. Such logs are retained online for a minimum of 1 year. These logs are retained and used by Oracle for our internal security operations of the Oracle Cloud Services.
1.15 Other Customer Security Related Obligations
You are responsible for:
• Implemen ting Your own comprehensive system of security and operational policies, standards and procedures, according to Your risk-based assessments and business requirements
• Ensuring that end-user devices meet web browser requirements and minimum network bandwidth requirements for access to the Oracle Cloud Services • Managing client device security controls, so that antivirus and malware checks are performed on data or files before importing or uploading data into the Oracle Cloud Services
• Maintaining Customer-managed accounts according to Your policies and security best practices
• Additionally, for Oracle Cloud at Customer Services, You are responsible for the following:
o Adequate physical and network security
o Security monitoring to reduce the risk of real time threats and prevent unauthorized access to Your Oracle Cloud Services from Your networks; this includes intrusion detection systems, access controls, firewalls and any other netwo rk monitoring, and any management tools managed by You.
2. ORACLE CLOUD SERVICE CONT!NUITY POLICY
2.1 Oracle Cloud Services High Availability Strategy
Oracle deploys the Oracle Cloud Services on resilient computing infrastructure designed to maintain service availability and continuity in the case of an incident affecting the Services. Data centers retained by Oracle to host Oracle Cloud Services have component and power redundancy with backup generators in place, and Oracle may incorporate redundancy in one or more layers, including network infrastructure, program servers, database servers, and/or storage.
Oracle Cloud Hosting and Delivery Policies Page9 of 18
2.2 Oracle Cloud Services Backup Strategy
Oracle periodically makes backups of Your Content in your instance of the Oracle Cloud Services for Oracle's sole use to minimize data loss in the event of an incident. Backups are stored at the primary site used to provide the Oracle Cloud Services and may also be stored at an alternate location for retention purposes. A backup is typically retained online or offline for a period of at least 60 days after the date that the backup is made. Oracle typically does not update, insert, delete or restore Your data on Your behalf. However, on an exception basis and subject to written approval, Oracle may assist You to restore data which You may have lost as a result of Your own actions.
For Oracle Cloud Services which enable You to configure backups in accordance with Your own policies, You are responsible for performing backups and restores of Your Content. Additionally, You are encouraged to develop a business continuity plan to ensure continuity of Your own operations in the event of a disaster.
2.3 Oracle Business Continuity
Oracle will at all times during the term maintain a plan as it pertains to Oracle's internal operations with the goal of minimizing any disruption to the provision of services if any disaster, disruption or force majeure event occurs {"BC Plan").
The BC Plan establishes, documents and implements processes, procedures and controls to ensure the security provisions applicable to the Oracle Cloud Services are not diminished in the event the BC Plan is invoked. The purpose of the BC Plan is to provide, among other things, resilience for Oracle's internal operations for the continuity and maintenance of the Oracle Cloud Services regardless of cause.
3. ORACLE CLOUD SERVICE LEVEL AGREEMENT
3.1 Hours of Operation
The Oracle Cloud Services are designed to be available 24 hours a day, 7 days a week, 365 days a year, except during maintenance periods, technology upgrades and as otherwise set forth in the Oracle agreement, Your order and this Oracle Cloud Service Level Agreement.
3.2 Service Availability
Commencing at Oracle's activation of Your Oracle Cloud Service, Oracle works to meet the Target Service Availability Level, or Target Service Uptime of 99. 9%. This is in accordance with the terms set forth in the Oracle Cloud Service Pillar documentation for the applicable Oracle Cloud Service (or such other Target Service Availability Level or Target Service Uptime specified by Oracle for the applicable Oracle Cloud Service in such documentation).
The foregoing is contingent on Your adherence to Oracle's recommended minimum technical configuration requirements for accessing and using the Oracle Cloud Services from Your network infrastructure and Your user workstations as set forth in the Program Documentation for the applicable Oracle Cloud Services.
Oracle Cloud Hosting and Delivery Policies Page10of18
3.2.1 Measurement of Availability
Following the end of each calendar month of the applicable Services Period, Oracle measures the Service Availability Level or Service Uptime over the immediately preceding month by dividing the difference between the total number of minutes in the month ly measurement period and any Unplanned Downtime (as defined below) by the total number of minutes in the measurement period and multiplying the result by 100 to reach a percent figure. (
Number of minutes in the month - Number of minutes of unplanned downtime) * 100 Number of minutes in the month
Number of minutes in a 30 day month = 30 days* 24 hours in the day *60 minutes in an hour Number of unplanned minutes in the month = minutes of unplanned downtime defined in the section "Definition of Unplanned Downtime".
Example: June has 30 days = 30*24*60 = 43,200 minutes in the month If 90 minutes of unplanned downtime occurred in the month of June the equation would be:
{(43,200 - 90)/43 ,200) * 100 = 99.8% Service Level Availability
3.2.2 Reporting of Availability
Oracle will provide you metrics on the Service Availability Level for Oracle Cloud Services that You purchased under Your order, either in a self-service manner or via a Service Request submitted by You to Oracle requesting the metrics.
3.2.3 Service Credits
You may receive Service Credits in the event that the Target Service Availability Level or Target Service Uptime for Oracle Cloud Services that You purchased under Your order is below the defined Target Service Availability Level or Target Service Uptime applicable to such Services. Service Credits are defined in the Oracle Cloud Service Pillar documentation or Service Descriptions applicable to Your purchased Oracle Cloud Services. Notwithstanding the provisions of this section, if Your order with Oracle or Service Specifications applicable to your order for a particular Oracle Cloud Service provides a right to receive a higher amount of Service Credits, then You may receive the Service Credits under the provision which provides for the highest amount of Service Credits to You, but You may not recover Service Credits under multiple provisions for the same event.
3.3 Definition of Unplanned Downtime
Oracle Cloud Services are deployed in resilient comput ing facilities with resilient infrastructure, redundant network connections , and power at each hosting facility. "Unplanne d Downtime" means any time during which a problem with the Oracle Cloud Services prevents Your connectivity. Unplanned Downtime does not include any time during which the Oracle Cloud Services or any Oracle Cloud Services component are not available due to: (i) scheduled maintenance , (ii) circumstances outside of Oracle's control and other force majeure events (e.g., Or•cle Cl01,1d Hosting and Delivery Policies Pagello 116 outages initiated at Your request, outages caused by non-Oracle infrastructure such as electrical, network, telecommunication, or other connectivity equipment, security attacks, natural disasters, or political events), (iii) any actions or inactions of You, Your Users or any third party (other than any Oracle agents and contractors who Oracle has engaged to perform the applicable Oracle Cloud Services) or (iv) any suspension by Oracle permitted under Your Oracle agreement or Your order. In addition, with respect to Oracle Cloud at Customer Services, Unplanned Downtime also does not include downtime or other unavailability (i) of Your data center (e.g., due to maintenance) or (ii) occurring outside the on-site hours defined under Your order for Oracle Cloud Operations personnel at Your data center.
3.4 Monitoring
Oracle uses a variety of software tools to monitor the availability and performance of the Oracle Cloud Services and the operation of infrastructure and network components. Oracle does not monitor, or address deviations experienced by any non-Oracle managed components used by You in the Oracle Cloud Services, such as non-Oracle applications.
3.4.1 Monitored Components
Oracle monitors the hardware that supports the Oracle Cloud Services, and generates alerts for monitored network components, such as CPU, memory, storage, database and other components.
Oracle Cloud Operations staff monitors alerts associated with deviations to Oracle defined thresholds and follows standard operating procedures to investigate and resolve underlying issues.
3.4.2 Customer Monitoring & Testing Tools
Oracle permits You to conduct limited functional testing for Oracle Cloud Services in Your test instance. Specific rules for testing may be found in the Program Documentation.
Oracle regularly performs penetration and vulnerability testing and security assessments against Oracle Cloud infrastructure, platforms, and applications in order to validate and improve the overall security of Oracle Cloud Services. The Oracle Cloud Services Program Documentation outlines when and how You may assess or test any components that You manage or create in Oracle Cloud Services, including non-Oracle applications, non-Oracle databases, other applicable non-Oracle software, code, or the use of data scraping tools.
Oracle reserves the right to remove or disable access to any tools or technologies that violate the guidelines in this section or the applicable Oracle Cloud Services Program Documentation, without any liability to You.
4. ORACLE CLOUD CHANGE MANAGEMENT POLICY
4.1 Oracle Cloud Change Management and Maintenance
Oracle Cloud Operations performs changes to cloud hardware infrastructure, operating software, product software, and supporting application software that is provided by Oracle as part of the Oracle Cloud Services, to maintain operational stability, availability, security, performance, and currency of Orade Cloud Hosting and Delivery Policies Page12011e
the Oracle Cloud Services. Oracle follows formal change management procedures to review, test, and approve changes prior to application in the service.
Changes made through change management procedures include system and service maintenance activities, upgrades and updates, and customer specific changes. Oracle Cloud Services change management procedures are designed to minimize service interruption during the implementation of changes.
Oracle reserves specific maintenance periods for changes that may require the Oracle Cloud Services to be unavailable during the maintenance period. Oracle works to ensure that change management procedures are conducted during scheduled maintenance windows (of which Oracle shall give advanced notice), while taking into consideration low traffic periods and geographical requirements.
Oracle will provide prior notice of modifications to the maintenance windows schedule. For Customer-specific changes and upgrades, where feasible, Oracle will coordinate the maintenance periods with You.
For changes that are expected to cause service interruption, the durations of the maintenance periods for scheduled maintenance are not included in the calculation of Unplanned Downtime minutes in the monthly measurement period for Service Availability Level (see the Oracle Cloud Service Level Agreement above). Oracle uses commercially reasonable efforts to minimize the use of these reserved maintenance periods and to minimize the duration of maintenance events that cause service interruptions.
For Oracle Cloud Services which enable You to perform maintenance activities, You are responsible for configuring and maintaining the operating systems and other associated software.
4.1.1 Critical Security Maintenance
Oracle may be required to execute critical security maintenance in order to protect the security of the Oracle Cloud Services. Critical security maintenance is required to address an exigent situation (e.g., security vulnerability) with the Oracle Cloud Service or Oracle infrastructure that cannot be addressed except on an emergency basis. Oracle works to minimize the use of critical security maintenance, and to the extent reasonable, will work to provide 24 hours prior notice for any critical security maintenance requiring a service interruption outside of scheduled maintenance periods.
4.1.2 Data Center Migrations
Oracle may migrate Your Oracle Cloud Services deployed in data centers retained by Oracle between production data centers in the same Data Center Region as deemed necessary by Oracle or in the case of disaster recovery. For data center migrations for purposes other than disaster recovery, Oracle will provide a minimum of 30 days notice to You.
Oracle Cloud Hosting and Delivery Polldes Page13of 18
4.2 Software Versioning
4.2.1 Software Updates
Oracle requires all Oracle Cloud Services customers to keep the software versions of the Oracle Cloud Services current with the software versions that Oracle designates as supported releases for such Oracle Cloud Services. Software updates are required for the Oracle Cloud Services in order to maintain version currency. Oracle's obligations under these Delivery Policies {including the Oracle Cloud Service Continuity Policy, the Oracle Cloud Service Level Agreement, and the Oracle Cloud Support Policy) are dependent on You maintaining the currently supported versions of Your Oracle Cloud Services. Oracle is not responsible for performance, functionality, availability or security issues experienced with Oracle Cloud Services that may result from running earlier versions.
4.2.2 End of Life
Oracle will host and support only the supported releases of an Oracle Cloud Service. All other versions of the Oracle Cloud Service are considered as "End of Life" {EOL}. You are required to complete the Oracle Cloud Services update to the latest version before the EOL of a given version. You acknowledge that failure to complete the update prior to the EOL of an Oracle Cloud Service version may result in an update automatically performed by Oracle or a suspension of the Oracle Cloud Services. In certain circumstances where an Oracle Cloud Service version reaches EOL and Oracle does not make available an updated version, Oracle may designate, and require You to transition to, a successor Oracle Cloud Service.
5. ORACLE CLOUD SUPPORT POLICY
The support described in this Oracle Cloud Support Policy applies only for Oracle Cloud Services and is provided by Oracle as part of such Oracle Cloud Services under Your order. Oracle may make available, and You may order for additional fees, additional support service offerings made available by Oracle for the Oracle Cloud Services.
5.1 Oracle Cloud Support Terms
5.1.1 Support Fees
The fees paid by You for the Oracle Cloud Services under Your order include the support described in this Oracle Cloud Support Policy. Additional fees are applicable for additional Oracle support services offerings purchased by You.
5.1.2 Support Period
Oracle Cloud support becomes available upon the Oracle Cloud Services start date and ends upon the expiration or termination of the Services (the "support period"). Oracle is not obligated to provide the support described in this Oracle Cloud Support Policy beyond the end of the support period.
5.1.3 Technical Contacts
Your technical contacts are the sole liaisons between You and Oracle for Oracle support for Oracle Cloud Services. Those technical contacts must have, at a minimum, initial basic service training and, Oracle Cloud Hosting and De~very Policies Page14of 18
as needed, supplemental training appropriate for specific role or implementation phase, specialized service/product usage, and migration. Your technical contacts must be knowledgeable about the Oracle Cloud Services in order to help resolve system issues and to assist Oracle in analyzing and resolving service requests. When submitt ing a service request, Your technical contact should have a baseline understanding of the problem being encountered and an ability to reproduce the problem in order to assist Oracle in diagnosing and triaging the problem . To avoid interruptions in Oracle support for Oracle Cloud Services, You must notify Oracle whenever technical contact responsibilities are transferred to another individual.
5.1.4 Oracle Cloud Support
Oracle support for Oracle Cloud Services consists of:
• Diagnoses of problems or issues with the Oracle Cloud Services • Reasonable commercial efforts to resolve reported and verifiable errors in the Oracle Cloud Services so that those Oracle Cloud Services perform in all material respects as described in the associated Service Specifications
• Support during Change Management activities described in the Oracle Cloud Change Management Policy (see above)
• Assistance with technical service requests 24x7x365
• 24x7x365 access to a Cloud Customer Support Portal designated by Oracle and Live Telephone Support to log service requests
• Access to community forums
• Non-technical customer service assistance during normal Oracle business hours (8:00 to 17:00) local country time
5.2 Oracle Cloud Customer Support Systems
5.2.1 Oracle Cloud Customer Support Portal
Oracle provides support for the Oracle Cloud Service acquired by You, under an Order, through the Cloud Customer Support Portal (support portal) designated for that Oracle Cloud Service. While Oracle Cloud Support and the portals (including any portion of the Services they may provide) may be part of Your order, they are not an Oracle Cloud Service offering, and they may be delivered globally, with access to them governed by the Terms of Use posted on the applicable portal web sites, which terms of use are subject to change. Where such portals allow You to upload information, You are responsible for ensuring that You and Your Users do not submit any government-issued identification numbers or any health, financial, payment card, controlled unclassified information, or other sensitive personal information into such portals, unless otherwise expressly permitted by the terms of the support portal or Your applicable Cloud Services order . Access to the support portal is limited to Your designated technical contacts and other authorized users of the Oracle Cloud Services.
Where applicable, the support portal provides support details to Your designated technical contacts to enable use of Oracle support for Oracle Cloud Services. Support notifications and alerts relevant to your service requests are posted in the support portal.
Oracle Cloud Hosting and Delivery Policies Page'ISof 18
5.2.2 Live Telephone Support
Your technical contacts may access live telephone support via the phone numbers and contact lnformation found on Oracle's support web site at https://www.oracle.com/support/contact.html.
5.3 Severity Definitions
Service requests for Cloud Services may be submitted by Your designated technical contacts via the support portal. The severity level of a service request is assigned based on inputs from You, and will be based on the following severity definitions:
5.3.1 Severity 1 (Critical Outage}
Your production use of the Oracle Cloud Services is stopped or so severely impacted that You cannot reasonably continue work. You experience a complete loss of service. The impacted operation is mission critical to the business and the situation is an emergency. A Severity 1 service request has one or more of the following characteristics:
• Data corrupted
• A critical documented function is not available
• Service hangs indefinitely, causing unacceptable or indefinite delays for resources or response
• Service crashes, and crashes repeatedly after restart attempts • Security Incident with the potential to impact the confidentiality, integrity or availability of the service
Oracle will use reasonable efforts to respond to Severity 1 service requests within fifteen (15) minutes .
Throughout the period during which Oracle is working to address a Severity 1 service request, You agree to make available Your technical contact 24x7. Oracle will work 24x7 until the Severity 1 service request is resolved, a reasonable work-around is put in place, an approved action plan is in place or the Customer's 24x7 contact is no longer available. You must provide Oracle with a technical contact during this 24x7 period to assist with data gathering, testing, and applying fixes. You are required to propose this severity classification with great care, so that valid Severity 1 situations obtain the necessary resource allocation from Oracle.
5.3.2 Severity 2 (Significant Impairment)
You experience a severe loss of service. Important features ot the Oracle Cloud Services are unavailable with no acceptable workaround; however, operations can continue in a restricted fashion .
5.3.3 Severity 3 (Technical Issue)
You experience a minor loss of service. The impact is an inconvenience, which may require a workaround to restore functionality .
Oracle Ooud Hosting and Delivery Policies Page16of 18
5.3.4 Severity 4 (General Guidance)
You request information , enhancement, or documentation clarification regarding the Oracle Cloud Services, but there is no impact on the operation of such service. You experience no loss of service.
5.4 Change to Service Request Severity Level
5.4.1 Initial Severity Level
At the time when the service request is created, Oracle will record an initial severity level of the service request based on the above severity definitions and/or Your inputs. Oracle's initial focus, upon creation of a service request, will be to resolve the issues underlying the service request. The severity level of a service request may be adjusted as described below.
5.4.2 Downgrade of Service Request Levels
As work on the underlying issue progresses, if the issue no longer warrants the severity level currently assigned based on its current impact on the operation of the applicable Oracle Cloud Service, then the severity level will be downgraded to the severity level that most appropriately reflects its current impact.
5.4.3 Upgrade of Service Request Levels
If, during the service request process, the issue warrants the assignment of a higher severity level than that currently assigned based on the current impact on the production operation of the applicable Oracle Cloud Service, then the severity level will be upgraded to the severity level that most appropriately reflects its current impact.
5.4.4 Adherence to Severity Level Definitions
You shall ensure that the assignment and adjustment of any severity level designation is accurate based on the current impact on the production operation of the applicable Oracle Cloud Service.
5.5 Service Request Escalation
For service requests that are escalated by You, the Oracle support analyst will engage the Oracle service request escalation manager who will be responsible for managing the escalation. The Oracle service request escalation manager will work with You to develop an action plan and allocate the appropriate Oracle resources. If the issue underlying the service request continues to remain unresolved, You may contact the Oracle service request escalation manager to review the service request and request that it be escalated to the next level within Oracle as required. To facilitate the resolution of an escalated service request, You are required to provide contacts within Your organization that are at the same level as that within Oracle to which the service request has been escalated.
Oracle Cloud Hosting and Oefive,y Policies Page17of 18
6. ORACLE CLOUD SUSPENSION AND TERMINATION POLICY
6.1 Termination of Oracle Cloud Services
For a period of 60 days after the end of the Services Period for the Oracle Cloud Services or, if applicable, the 60 day period following Your termination of Cloud Services that You consume in a Pay as You Go model, following the end of their associated Services Period, Oracle will make available, via secure protocols and in a structured, machine-readable format, Your Content residing in the Oracle Cloud Services, or keep the service system accessible, for the purpose of data retrieval by You.
For free trials and pilots of Oracle Cloud Services, Oracle will make Your Content available for a period of 30 days following end of the trial or pilot. During this retrieval period, Oracle's Cloud Service Level Agreement does not apply and the service system may not be used for any production activities.
Oracle has no obligation to retain Your Content after this retrieval period.
If You need assistance from Oracle to obtain access to or copies of Your Content, You must create a service request in the support portal.
Data retrieval and any related assistance by Oracle is not applicable for Oracle Cloud Services that do not store Your Content. You are responsible for ensuring that if those Oracle Cloud Services are dependent on separate Oracle Cloud Services (such as Storage Cloud Service or Database Cloud Services) for the storage of data, those separate Oracle Cloud Services must have a valid duration through the end of the terminating Oracle Cloud Service to enable data retrieval, or for otherwise taking appropriate action to back up or otherwise store separately Your Content while the production Oracle Cloud Services is still active prior to the end of the Services Period.
Following expiry of the retrieval period, Oracle will delete Your Content from the Oracle Cloud Services (unless otherwise required by applicable law).
For Oracle Cloud at Customer Services, You must make available for retrieval by Oracle any Oracle Cloud at Customer Service-related hardware components (including the gateway equipment) provided by Oracle in good working order and the same condition as at the start of the Oracle Cloud at Customer Services subject to reasonable wear and tear for appropriate use. 7 USE OF SERVICES
You are responsible for ensuring that access and use of acquired Oracle Cloud Services, and the benefit received from such Cloud Services, is only by and for Users in countries in accordance with Oracle's Global Trade Compliance policy described at htt ps://www,orac)e,com/corporate / securjty Practices/ corporate /governance /global-tr a de-com o liance.html.
Oracle Ooud Hosting and Delivery Policies Page18of18
ORACLE ATTACHMENT 1-B
Oracle Corporate Security
Practices
-
April 2024 I Version 3.3
Copyright© 2024, Oracle and/or its affiliates
Oracle - Public
INTRODUCTION
Oracle's mission is to help people see data in new ways, discover insights and unlock endless possibilities.
Oracle's security practices reflect the various ways Oracle engages with its customers:
• Oracle Corporate Security programs, policies and recommendations guide the IT teams managing Oracle's corporate network and systems as well as guiding the operational, cloud and services Lines of Business. • In this document, •customer data" means any data stored in a customer's computer system (data accessed by or provided to Oracle while performing services for a customer) or data in a customer's cloud tenancy. • Third parties provided access to customer data by Oracle ("subprocessors") are required to contractually commit to materially equivalent security practices.
Oracle continually works to strengthen and improve the security controls and practices for internal operations and services offered to customers. These practices are subject to change at Oracle's discretion.
Companies that Oracle acquires are required to align with these security practices as part of the integration process. This duration and outcome of each aspect of the integration process relies on the size, complexity, contractual commitments and regulatory requirements applicable to the acquired company's products, services, personnel and operations.
Oracle's Cloud, Support, and Services lines of business have developed statements of security practices that apply to the respective service offerings. These are published and incorporated into applicable orders.
The purpose of this paper is to summarize key Oracle's security practices and programs. This paper does not exhaustively describe all security practices and programs which may be applicable and relevant to individual Lines of Business, products or services.
Orade Corporate Security Practices I Version 33
Copyright © 2024. Oracle and/or its affiliates I Oracle Ptblic
TABLE OF CONTENTS
Introduction
Oracle Corporate Security
Organizational Security
Oracle Security Oversight Committee
Corporate Security Organizations
Global Information Security
Global Product Security
Global Physical Security
Corporate Security Architecture
Global Trade Compliance
line of Business Security Organizations
Oracle Information Technology Organizations
Independent Review of Information Security
Privacy
Customer Data Protection
Asset Classification and Control
Responsibility, Inventory, and Ownership of Assets
Asset Classification and Control
Human Resources Security
Employee Screening
Confidentiality Agreements
Security Awareness Education and Training
Physical Security
Operations Management
Protection Against Malicious Code
Monitoring and Protection of Audit Log Information
Network Controls
Access Control
User Access Management
Privilege Management
Password Management
Periodic Review of Access Rights
Information Systems Development, and Maintenance
Technical Vulnerability Management
Information Security Incident Response
Security Incident Policy and Operations
Notifications
Oracle Software Security Assurance
Coding Standards & Security Training
1 3
3 3
3 3
3 3
4 4
4 4
4 4
5 5
5 5
5 5
5 6
6 6
6 6
7 7
7 7
8 8
8 8
8 8
9 9
9 Security Analysis & Testing 10
Security Fixing Policies 10
Applicability of Critical Patch Updates and Security Alerts to Oracle Cloud Environments 10 Source Code Protection
External Security Evaluations
Resilience Management
Revision History
2 Oracle Corporate Sea.irity Practices I Version 3.3
Copyri13ht © 2024, Oracle and/or its affilia tes I Oracle Public 10 11
11 12
ORACLE CORPORATE SECURITY
Oracle's Corporate Security Programs are designed to protect both Oracle and customer data, such as:
• Mission-critical systems that customers rely upon for cloud, technical support and other services • Oracle source code and other sensitive data against theft and malicious alteration • Personal and other sensitive information that Oracle collects in the course of its business, including customer, partner, supplier and employee data residing in Oracle's internal IT systems Oracle's security policies cover the management of security for both Oracle's internal operations and the services Oracle provides to its customers, and apply to all Oracle personnel, such as employees and contractors. These policies are generally aligned with the ISO/IEC 27002:2022 and ISO/IEC 27001:2022 standards and guide security within Oracle.
Reflecting the recommended practices in security standards issued by the International Organization for Standardization (ISO), the United States National Institute of Standards and Technology (NIST}, and other industry sources, Oracle has implemented a wide variety of preventive, detective and corrective security controls with the objective of protecting information assets.
ORGANIZATIONAL SECURITY
Oracle's overarching Organizational Security is described in the Oracle security organization policy and the Oracle information security policy.
The Chief Corporate Architect is one of the directors of the Oracle Security Oversight Committee. The Chief Corporate Architect manages the Corporate Security departments which guide security at Oracle. These departments manage the corporate security programs, define corporate security policies, and provide global oversight for Oracle's security policies and requirements.
Oracle Security Oversight Committee
The Oracle Security Oversight Committee (OSOC) oversees the implementation of Oracle-wide security programs, including security policies and data privacy standards. The OSOC is chaired by Oracle's CEO, General Counsel, and Chief Corporate Architect.
Corporate Security Organizations
Global Information Security
Global Information Security (GIS) defines policies for the management of information security across Oracle. GIS provides direction and advice to help Lines of Business (LoBs) protect Oracle information assets (data), as well as the data entrusted to Oracle by our customers, partners and employees. GIS also coordinates the reporting of information security risk to senior leadership such as the Oracle Security Oversight Committee and Board of Directors. GIS programs direct and advise on the protection of data developed, accessed, used, maintained, and hosted by Oracle.
Global Product Security
The Global Product Security organization acts as a central resource to he.Ip Oracle development teams improve the security of Oracle products. Encompassing every phase of the product development lifecycle, Oracle Software Security Assurance is Oracle's methodology for building security into the design, build, testing, and maintenance of its products.
Under the leadership of Oracle's Chief Security Officer, Global Product Security promotes the use of Oracle Software Security Assurance standards throughout Oracle, acts as a central resource to help development teams improve the security of their products, and handles specialized security functions.
Global Physical Security
Global Physical Security is responsible for defining, developing, implementing, and managing physical security for the protection of Oracle's employees, facilities, business enterprise, and assets. Oracle's physical security standards and policies have been developed to generally align with several physical security industry initiatives, including the International Organization for Standardization (ISO), United States Customs Trade Partnership Against Terrorism (CTPAT), American 3 Oracle Corporate Security Practices I Version 3.3
Copyrigh! ~ 2024, Oracle and/or its affiliates I Oracle Public Institute of Certified Public Accountants (AICPA) Statement on Standards for Attestation Engagements (SSAE) No. 18, and the Payment Card Industry Security Standards Council. Physical security controls are described later in this document.
Corporate Security Architecture
The Oracle corporate security architect helps set internal information-security technical direction and guides Oracle's IT departments and lines of business towards deploying information security and identity management solutions that advance Oracle's information security goals. The corporate security architect works with Global Information Security and Global Product Security, and the Development Security Leads to develop, communicate and implement secure architectures.
Corporate Security Architecture (CSA) manages a variety of programs and leverages multiple methods of engaging with leadership and operational security teams responsible for Oracle operations, services, cloud and all other lines of business.
Global Trade Compliance
Oracle Global Trade Compliance (GTC) is responsible for import and export oversight, guidance and enforcement to enable worldwide trade compliant business processes across Oracle in order to uphold and protect Oracle's global trade privileges.
GTC manages Oracle's global trade compliance portfolio and is responsible tor global trade regulatory interpretation and coordination of policy advocacy, Global Brand Protection, Hardware Compliance Strategy and Market Access programs.
Further, GTC reviews and resolves global trade compliance matters; serves as the clearinghouse for all global trade compliance information, including product classification, and is empowered to take actions necessary to ensure Oracle remains compliant with U.S. and applicable local Customs, import, and export laws, regulations and statutes.
Line of Business Security Organizations
Lines of Business (LoB) have security teams which oversee their products, systems and cloud services managed by that organization. LoBs are required to define technical standards in accordance with Oracle's information security policies, as well as drive compliance to Oracle policies and standards within their organization and cloud service teams. LoBs are also required to comply with Corporate Security program requirements and directions. This paper does not describe LoB's specific security organizations, standards, and programs.
Oracle Information Technology Organizations
Oracle information technology {IT) and cloud DevOps organizations are responsible for 1T security strategy, architectural design of security solutions, engineering, risk management, security infrastructure operations and support, standards and compliance, threat intelligence and remediation and security technical assessment for new infrastructure.
Independent Review of Information Security
Oracle's Business Assessment & Audit is an independent global audit organization which performs global process and regional reviews. These reviews examine key business risk management protocols and compliance with Oracle policies, standards and select laws and regulations across Oracle's Lines of Business.
PRIVACY
The Oracle General Privacy Policy addresses information we collect in connection with your use of Oracle websites, mobile applications, and social media pages that link to the General Privacy Policy, your interactions with Oracle during in-person meetings at Oracle facilities or at Oracle events, and in the context of other online or offline sales and marketing activities.
The Services Privacy Policy describes our privacy and security practices that apply when handling (i) services personal information in order to perform Consulting, Technical Support, Cloud and other services on behalf of Oracle customers; and (ii) personal information contained in systems operation data generated by the interaction of ( end-)users of these services with Oracle systems and networks. Oracle Advertising Privacy Policy (also referred to as the 'Privacy Policy' or the 'Oracle Data Cloud Privacy Policy') informs consumers on the collection, use, sharing, and selling (collectively referred to as 'processing') of your personal information in connection with Oracle's provision of Oracle Advertising services designed to help Oracle's customers' and partners' online and offline marketing activities ('Oracle Advertising'). This policy also explains your privacy rights in relation to these processing activities. 4 Oracle Corporate Security Practices I Version 3.3
Copyright© 2024, Oracle and/or its affiliates I Oracle Public
CUSTOMER DATA PROTECTION
Oracle's media sanitation and disposal policy defines requirements for removal of information from electronic storage media (sanitization) and disposal of information which is no longer required against unauthorize d retrieva l and data reconstruct ion. Electronic storage media include laptops, hard drives, storage devices and removable media.
ASSET CLASSIFICATION AND CONTROL
Responsibi1ity, Inventory, and Ownership of Assets
Oracle's forma l information protection policy provides guidelines for all Oracle information classificatio n and minimum handling requirements for each classificatio n.
Developing and maintaining accurate system inventory is a necessary element for effective general information systems management and operational security. Oracle's info rmation systems asset inventory policy requires that Lines of Business (LoBs) mantain accurate and comprehensive inventories of information systems, hardware and software. This policy applies to all information assets held on any Oracle system, including both enterprise systems and cloud services.
Asset Classification and Control
Oracle categorizes information into four classes- Public, Internal, Restricted, and Highly Restricted-with each classification requiring corresponding levels of security controls , such as encryption requirements for non -Public data:
• "Public" information is not sensitive, and there is no need with it remaining confident ial to Oracle. • "Oracle Interna l" information must remain confidential to Oracle. • "Oracle Restricted" and "Oracle Highly Restricted" informa tion must remain confidentia l to Oracle and access within Oracle must be restricted on a "need to know" basis, with additional handling requirements for "Oracle Highly Restricted" information .
Oracle has forma l requirements for managing data retention. These operationa l policies define requirements per data type and category, including examples of records in various Oracle departments. Retention of customer data in cloud services is controlled by the custome r and is subject to terms in their contract.
Customer data is classified under one of Oracle's top two categories of confidential information for the purpose of placing limits on access, distribution and handling of such data. Oracle keeps the information confidential in accordance with the terms of custome r's order.
HUMAN RESOURCES SECURITY
Oracle places a strong emphas is on personnel security. The company maintains ongoing initiatives intended to help minimize risks associated with human error, theft, fraud and misuse of facilities, including personne l screening, confidentiality agreements, security awareness education and training, and enforcement of discip linary actions.
Oracle mainta ins high standards for ethical business conduct at every level of the organization, and at every location where Oracle does business around the world. These apply to Oracle employees, contracto rs, and tempo rary employees, and cover legal and regulatory compliance and business conduct and relationships. Oracle requires its employees to receive training in ethics and business conduct every two years.
Employees who tail to comply with Oracle policies, procedures and guidelines may be subject to discip linary action up to and including termination of employment.
Employee Screening
In the United States, Oracle currently uses an external screening agency to perform pre-employment background investigations for newly hired U.S. personne l. Personnel screening in other countries varies according to local laws, employment regulations and local Oracle policy .
Confidentiality Agreements
Oracle employees are required to maintain the confidentiality of customer data. Employees must sign a confidentiality agreement and comply with company poli cies concerni ng protection of confidential information as part of their initial terms 5 Orade Corporate Security Practices I Version 3.3
Copyrleht © 2024. Oracle and/o r its affiliates I O..acle Public of employment. Oracle obtains a written confidentiality agreement from each subcontractor before that subcontractor provides services.
Security Awareness Education and Training
Oracle promotes security awareness and educates employees through regular newsletters and security awareness campaigns. Each employee is required to complete information-protection awareness training upon hiring and every two years thereaft er. The course instructs employees on their obligations under Oracle privacy and security policies. This course also covers privacy principles and data handling practices required by company policy .
PHYSICAL SECURITY
Oracle Global Physical Security is responsible for defining, developing, implementing, and managing all aspects of physical security for the protection of Oracle's employees, facilities , business enterprise, and assets.
Oracle currently has implemented the following protocols in Oracle facilities :
• Physical access to facilit ies is limited to Oracle employees, contractors, and author ized visitors . • Oracle employees, subcontractors, and authorized visitors are issued identification cards that must be worn while on Oracle premises.
• Visitors are required to sign a visitor's register, be escorted and/or observed when they are on Oracle premises, and/or be bound by the terms of a confidentiality agreement with Oracle. • Security monitors the possession of keys/access cards and the ability to access facilities. Staff leaving Oracle's employment must return keys/cards and key/cards are deactivated upon terminatio n. • Security authorizes all repairs and modifications to the physical security barriers or entry controls at service locations.
• Mixture of 24/7 onsite security officers or patrol officers, depending on the risk/protection level of the facility. In all cases officers are respons ible for patrols, alarm response, and recording of physical security events. • Centrally managed electronic access cont rol systems with integ rated intruder alarm capability and CCTV moni toring and record ing. The access control system logs and CCTV recordings are retained for a period of 30-90 days as per Oracle's Record Retention Policy which are based on the facility's function, risk level and local laws.
OPERATIONS MANAGEMENT
Protection Against Malicious Code
Oracle policy requires the use of antivirus protection and firewall software on endpoint devices such as laptops, desktops and mobile devices. Additionally, all computers running a Windows operating system that hold Oracle data must have automated Microsoft security updates enabled. Security updates for all other devices and operating systems must be installed upon notification of their availability. Desktops and laptops that process Oracle or customer information must be encrypted using approved software. Reports enable lines of business management to verify deployment of laptop encryption for their organization.
Antivirus software must be scheduled to perform daily threat-definition updates and virus scans.
The Oracle information technology organization keeps antivi rus products and Windows Server Update Services (WSUS) up to date with virus definitions and security updates. They are responsible for:
• notifying internal Oracle system users of both any credible virus threats and when security updates are available • providing automation to manage and verify antivirus configuration Employees are prohib ited from altering, disabling or removing antivirus software and the security update service from any computer. Any Oracle employee who is discovered violating this standard may be subject to disciplinary action up to and incl uding termination of employment.
Monitoring and Protection of Audit Log Information
Oracle logs certain security-related activities on operating systems, applications, databases and network devices. Systems are configured to log access to Oracle programs, as well as system alerts, console messages and system errors. Oracle 6 Oracle Corporate Security Practices I Version 3.3
Copyright© 2024, Oracle and/o r its affiliates I Oracle Public implements contro ls designed to protect against operational problems, including log file media becoming exhausted, failing to record events and/or logs being overwritten.
Oracle reviews logs for security event investigation and forensic purposes. Identified anomalous activities feed into security event management processes. Access to security logs is provided on the basis of need-to-know and least privilege. Where available for cloud services, log files are protected by strong cryptography and other security controls, and access is monitored. Logs generated by internet-access ible systems are relocated to systems that are not internet-accessible.
Network Controls
Oracle has implemented and maintains strong network contro ls for the protection and contro l of both Oracle and custom er data during its transmission. Oracle's network security policy establishes requirements for network management, network access and network device management, including authent ication and authorization requirements for both physical devices and software-based systems. Unused network ports must be deactivated.
For administration of network security and network -management devices, Oracle requires IT personnel to use secure protoco ls with authentication, authorization and strong encryption. Network devices must be located in an environment protected with physical access controls and other physical security measures defined by Global Physical Security (GPS).
Commun ications to and from the Oracle corporate network must pass through network security devices at the border of Oracle's interna l corporate network. Remote connect ions to the Oracle corporate network must exclusively use approved virtual private networks (VPNs). Corporate systems available outside the corporate network are protected by alternative security controls such as multifactor authentication.
Oracle's network security policy establishes formal requirements for the provision and use of wireless networks and connectivity to access the Oracle corporate network, including network segmentation requirements. Oracle IT manages wireless networks and monito rs for unauthorized wireless networks .
Access to the Oracle corporate network by suppliers and third parties is subject to limitations and prior approval per Oracle's third-party netwo rk access policy .
ACCESS CONTROL
Access control refers to the policies, procedures and tools that govern access to and use of resources. Examples of resources include a physical server, tile, application, data in a database and network device. • Least privilege is a system-oriented approach in which user permissions and system funct ionality are carefully evaluated and access is restricted to the resources required for users or systems to perform their duties. • Default-deny is a network-oriented configuration approach that implicit ly denies the transmission of all traffic, and then specifically allows only required traffic based on protocol, port, source network address, and destination network address.
Oracle's logical access control policy is applicable to access control decisions for all Oracle employees and any information processing facility for which Oracle has administrative author ity. Logical access contro ls for appl ications and systems must prov ide identification, authentication, authorizat ion, accountability and auditing functionality. This policy does not apply to customer end user accounts for Oracle cloud services.
User Access Management
Oracle user access is provisioned through an account provisioning system that is integrated with Oracle's Human Resources database. Access privileges are granted based on job roles and require management approval. Operations are organized into functional groups, where each function is performed by separate groups of employees. Examples of functional groups include developers, database administrators, system administrators, and network engineers.
Privilege Management
Authorization is dependent on successful authentication, since controlling access to specific resources dep_ends upon establishing an entity or individual's identity . All Oracle authorization decisions tor granting, approva l and review of access are based on the follow ing principles:
• Need to know: Does the user require this access for his job function? • Segregation of duties: Will the access result in a conflict of interest? 7 Oracle Corporate Security Practices I Version 33
Copyright© 2024, Orade and/or Its affiliates I Oracle Public • Least privilege: Is access restricted to only those resources and information required for a legitimate business purpose?
Password Management
The use of passwords is addressed in the Oracle password policy . Oracle has strong password policies (includ ing length and complexity requirements) tor the Oracle network, operating system, email, database and other accounts to reduce the chances of intruders gaining access to systems or environments through exploitation of user accounts and associated passwords. System-generated and assigned passwords are required to be changed immed iately on receipt.
Employees must keep their passwords confidential and secured at all times and are prohibited from sharing their individ ual account passwords with anyone, whether verbally, in writing, or by any other means. Employees are not permitted to use any Oracle system or applications passwords for non-Oracle applications or systems.
Periodic Review of Access Rights
Oracle regularly reviews network and operating system accounts with regard to the appropriate employee access levels. In the event of employee terminations, deaths, or resignations, Oracle takes appropriate actions to promptly terminate network, telephony and physical access.
INFORMATION SYSTEMS DEVELOPMENT, AND MAINTENANCE
Technical Vulnerability Management
Oracle has formal practices designed to identify, analyze, and remediate the technical security vulnerabilities that may affect our enterprise systems and your Oracle Cloud environment.
The Oracle IT, security and development teams monitor relevant vendor and industry bulletins, including Oracle's own security advisories, to identify and assess relevant security patches. Additionally, Oracle requires that vulnerability scann ing using automated scanning systems be frequently performed against the internal and externally facing systems it manages.
Oracle also requires that penetr ation testing activities be performed periodically in production environments.
Oracle's strategic priority for the handling of discovered vulnerabilities in Oracle Cloud is to remediate these issues according to their severity and the potential impact. The Common Vulnerability Scoring System (CVSS) is one of the criteria used in assessing the relative severity of vulnerabilities and their potential impact. Oracle requires that identified security vulnerabilities be identified and tracked in a defect tracking system.
Oracle aims to complete all cloud remediation activities, including testing, implementation, and reboot (if required) within planned maintenance windows. Emergency maintenance will be performed as described in the Oracle Cloud Hosting and Delivery Policies and applicable Pillar documentation.
Oracle Software Security Assurance is Oracle's methodology tor building security into the design, build, testing, and maintenance of its products, whether they are used on-premises by customers, or delivered through Oracle Cloud.
Customers and security researchers can report suspected security vulnerabilities: How to Report Security Vulnerabilities to Oracle or by subm itting a Seryjce Reauest io their designated support system.
INFORMATION SECURITY INCIDENT RESPONSE
A security incident is a security event that Oracle, per its incident response process, has determined results in the actual or potential loss of confi dential ity, integrity, or availability of Oracle managed assets (systems and data).
Oracle will respond to information security events when Oracle suspects unauthorized access to Oracle-managed assets.
Cloud customers are responsible for controlling user access and monitoring their cloud service tenancies via available tooling and logging.
Security Incident Policy and Operations
Oracle's Security Inciden t Management Policy defines requirements for reporting and responding to information security events and incidents. This policy authorizes the Oracle Global Information Security organization to provide overall direction 8 Oracle Corporate Security Practices I Version 3.3
Copyright © 2024, Oracle ar,d/o, its afhliates I Oracle Public tor security event and incident preparation, detection, investigation, resolution and forensic evidence handling across Oracle's Lines of Business (LoB). This policy does not apply to availability issues (outages) or to physical security events.
Global Information Security further defines roles and responsibilities for the incident response teams within the LoBs. All LoBs must comply with Global Information Security guidance for managing information security events and implementing timely corrective actions.
Upon discovery of a security event, Oracle incident response plans support rapid and effective event triage, including investigation, response, remediation , recovery, and post-incident analysis. LoB incident response teams, as required by the Security Incident Management Policy, conduct post-event analysis to identify opportunities for reasonable measures which improve security posture and defense in depth. Formal procedures and systems are utilized within the LoBs to collect information and maintain a chain of custody for evidence during event investigation. Oracle can support legally admissible forensic data collection when necessary.
Notificat ions
If Oracle determines a security incident involving assets managed by Oracle has occurred, Oracle will promptly notify impacted customers or other third parties in accordance with its contractual and regulatory responsibilities as defined in the Data Processjng Agreement for Oracle Services. Information about malicious attempts, suspected incidents and incident history are not shared externally .
ORACLE SOFTWARE SECURITY ASSURANCE
Encompassing every phase of the product development lifecycle, Oracle Software Security Assurance (OSSA) is Oracle's methodology for building security into the design, build, testing and maintenance of its products, whether they are used on premises by customers or delivered through Oracle cloud services.
Oracle's goal is to ensure that Oracle's products help customers meet their security requirements while providing for the most cost-effective ownership experience. Oracle Software Security Assurance is a set of industry -leading standards, technologies, and practices aimed at:
• Fostering security innovations. Oracle has a long tradition of security innovations. Today this legacy continues with solutions that help organizations implement and manage consistent security controls across the technical environments in which they operate, on-premises and in the cloud. • Reducing the incidence of security weaknesses in all Oracle products. Oracle Software Security Assurance key programs include Oracle's Secure Coding Standards, mandatory security training for development, the cultivation of security leaders within development groups and the use of automated analysis and testing tools. • Reducing the impact of security weaknesses in released products on customers. Oracle has adopted transparent security vulnerability disclosure and remediation policies. The company is committed to treating all customers equally and delivering the best possible security patching experience through the Critical Patch Update and Security Alert programs.
Coding Standards & Security Training
Developing secure software requires consistently applied methodologies across the organization; methodologies that conform to stated policies, objectives, and principles. Oracle's objective is to produce secure code. To that end, Oracle requires that all of development abide by secure coding principles that are documented and maintained to remain relevant.
Developers must be familiar with these standards and apply them when designing and building Oracle products.
Oracle Secure Coding Standards and related guidance have evolved and expanded over time to encompass emerging technologies such as Artificial Intelligence and Machine Learning (Al/ML) and address the most common issues affecting Oracle code, new threats as they are discovered, and new customer use cases for Oracle technology.
All Oracle staff are required to take security training. Technical development staff, up to and including vice presidents, who are involved in building, maintaining, customizing or testing product code are required to take an OSSA awareness course.
Additionally, Oracle adapted its secure coding principles and created training material for use by its consulting and services organizations when they are engaged in producing code on behalf of customers. 9 Oracle Corporate Security Praai ces I Version 3.3
CopyrisJlt !O 2024. Orade and/or its affiliat<>< I Oracle Public Security Analysis & Testing
Oracle requires that security testing be performed for its on-premises and cloud products. Security testing of Oracle code includes both functional and non-functional activities for verification of product features and quality. Although these types of tests often target overlapping product features, they have orthogonal goals and are carried out by different teams.
Functional and non-functio nal security tests complement each other to support comprehensive security testing coverage of Oracle products.
Functional security testing is typically executed by regular product Quality Assurance (QA) teams as part of normal product testing cycle. During this testing, QA engineers verify conformance of implemen ted security features to what had been previously agreed upon in the functional specifications during the architectural and checklist reviews process.
Security assurance analysis and testing verify security qualities of Oracle products against various types of attacks. There are two broad categories of tests employed for testing Oracle products: static and dynamic analysis:
• Static security analysis of source code is the initial line of defense used during the product development cycle.
Oracle uses a commercial static code analyzer as well as a variety of internally developed tools, to catch problems while code is being writ ten.
• Dynamic analysis activity takes place during latter phases of product development: at the very least, the product or component should be able to run. Dynamic analysis is aimed at externally visible product interfaces and APls, and frequently relies on specialized tools for testing. Both manual and automatic tools are used for testing at Oracle.
Automat ic tools employ fuzzing technique to test network-accessible product interfaces and protocols, while manual tools require making the modifications by hand.
Oracle will not provide customers sensitive security assurance artifacts (including but not limited to static code analysis reports). Oracle will not submit its product to third-party static code assessments. For more information, see MOS Article :
General Instructions for Submitting Security Questionnaires to Oracle (Doc ID 2337651.1).
Security Fixing Policies
The Critical Patch Update (CPU) is the primary mechanism for the backport of security bug fixes for all Oracle on -premises products . Critical Patch Updates are available to customers with valid support contracts. Critical Patch Updates are released quarterly on the third Tuesday of January, April, July, and October. Oracle retains the ability to issue out of schedule patches or workaround instructions in case of particularly critical vulnerabilit ies and/or when active exploits are reported in the wild.
This program is known as the Security Alert program.
Vulnerab ilities are remediated by Oracle in order of the risk they pose to users. This process is designed to patch the security defects with the greatest associated risk first in the Critical Patch Update, resulting in optimizing the security posture of all Oracle customers.
A standardized CPU schedule helps organizations plan their security maintenance windows. The CPU schedule is designed to avoid typical blackout dates during which customers cannot typically alter their production environments.
As much as possible, Oracle tries to make Critical Patch Updates cumulative; that is, each Critical Patch Update contains the security fixes from all previous Critical Patch Updates. This provides customers the ability to catch up quickly to the current security release level, since the application of the latest cumulative CPU resolves all previously addressed vulnerabilities.
Applicability of Critical Patch Updates and Security Alerts to Oracle Cloud Environments The Oracle Cloud operations and security teams regularly evaluate Oracle's Critical Patch Updates and Security Alerts as well as relevant third -party security updates as they become available and apply the relevant patches in accordance with applicable change management processes.
Source Code Protection
Oracle maintains strong security controls over its source code. Oracle's source-code protection policies provide limits on access to source code (enforcement of the need to know), requirements for independen t code review, and periodic auditing of the company's source-code repositories .
Oracle Software Security Assurance policies and practices are designed to prevent the introduction of security vulnerabilities in Oracle-developed code. Additionally , Oracle maintains strong controls over the technical description of security vulnerabilities in Oracle code. Oracle's Security Vulnerability Information Protection Policy defines the classification and 10 Oracle Corporate Secur~y Plactices J Version 33
Copyrishl «> 2024, Oracle and/ or Its affiliates J Oracle Public handling of information related to product security vulnerabilities and requires that information concerning security bugs be recorded in a tightly controlled database.
Oracle's policies prohibit the introduction of backdoors into its products. Backdoors are deliberately (and maliciously) introduced code intended to bypass the security controls of the application in which it is embedded. Backdoors do not include:
• Unintentional defects in software that could lead to a weakening of security controls (security bugs) • Undocumented functionality designed to be generally inaccessible by customers but serves a valid business or technical purpose (diagnostics and troubleshooting utilities) Oracle assesses third -party software and hardware to avoid the use of products :
• With known vulnerab ilities
• Developed with poor security assurance
• That may potentially include backdoors or other malicious components External Security Evaluations
Oracle submits certain products for external security evaluations. These evaluations involve rigorous testing by independently accredited organizat ions ("labs") with further oversight and certification completed by government bodies.
Independent verlfication helps provide additional assurance to Oracle customers with regards to the security posture of the validated produc ts. Organizaations in many indust ries have business and compliance requirements that imply the use of validated products . Such evaluations include Common Criteria and FIPS 140.
RESILIENCE MANAGEMENT
Oracle's risk management resiliency policy defines requirements and standards for all Oracle Lines of Business (LOBs) plans for and response to business disruption events. It also specifies the functional roles and responsibilities required to create, maintain, test and evaluate business continuity capability for Oracle across lines of business and geographies. It authorizes a centralized Risk Management Resiliency Program (RMRP) Program Management Office (PMO) and defines the compliance oversight responsibilities for the program. The policy mandates an annual operational cycle for planning, evaluation, train ing, validation and executive approvals for critical business operations.
The Risk Managemen t Resiliency Program (RMRP) objective is to establish a business-resiliency framework to help provide an efficient response to business interruption events affecting Oracle's operations.
The RMRP approach is comprised of several subprograms: emergency response to unplanned and emergent events, crisis management of serious incidents, technology disaster recovery and business-con tinuity management. The goal of the program is to minimize negative impacts to Oracle and maintain critical business processes until regular operating conditions are restored .
Each of these subprograms is a uniquely diverse discipline. By consolidating emergency response, crisis management, business continuity and disaster recovery, they can become a robust collaborative and communicative system. 11 Orade Corp0<ate Securijy Practices I Version 3.3
Copyright© 2024, Or;,c!o and/or its affoiates I Orade Public
REVISION HISTORY
Version 3.3
Version 3.2
Version 3.1
Verison3.0
Version2 .1
Version22
Version23
04Apr 2024
12 Sep2023
20Jan2023
30Sep2022
20 May2021
10 Sep 2021
22Apr2022
Updated introduction, information security incident response and Oracle Software Security Assurance sections
Clarified physical security and technical vulnerability management controls Expanded Oracle Software Security Assurance (OSSA) section and updated the order of sections.
Updates to all sections.
Clarified operational responsibilities for Incident Response.
Added wireless network management practices. Updated Operations Management , Incident Response, Technical Vulnerability Management and Access Control sections.
Clarified Global Informat ion Security and Incident Response sections U Oracle Corporate Security Practices I Version 3.3
Copyright© 2024, Oracle and/or its affma,.,s I Orade Public
CONNECT WITH US
Call +1.800.ORACLE1 or visit oracle.com.
Outside North America, find your local office at oracle.com/contact. ~ biogs.oracle.com 11 facebook.com/oracle a twitter.com/oracle Copyright © 2024, Oracle and/o r its affiliates. Unless this document is affirma tively incorporated into Your order 10< Cloud Services as part of Its Service Spedflca!lons, the following terms apply:
This document i~ provided for information purposes only, aod the contents hereof •re subject to change without notice.
This doc-ument is not warranted to be error•free, nor subject to any other warranties or conditions, vthether expres.sed orlllly o, implied in law, including implied warranties and condilions of merchantabmty or fitness tor a particular purpose. We specifically disclaim any liabiHty wi1h respect to this document. and no contractual obligatio ns are formed either directly or indirectly by !his document This document rnay not be reproduced or transmitted in any form or by any mean~ electronic or mechanical. for any purpose. y.Ji1hou1 our prk,, wrir1en permission, Oracle and Java are registe,ed trademarks of Oracla: and/0< its affiliates. Other names may be lradcmarks of their , e-spective owners.
Oracle Corporate Security Practices
April, 2024
ra
ATTACHMENT 1-C
ORACLE~
License Shelving Exhibit
Pursuant to the terms of this order, You have agreed to shelve the following on premise program licenses You previously acquired under Separate Contract(s): CPQ- 2840587
CSI Instance Product Description License Quantity Annual Number Number Metric Technical
Support Fees
15397407 40099339 SPL Synergen Series Bar CONCURRENT 75 47,118.60 CodinQ Extension USER
15397407 40099379 SPL Synergen Series CONCURRENT 75 47,118.60 Base Product: All USER
Subsystems
15397407 40099338 SPL Synergen Series Web CONCURRENT 75 47,118.60 Installation USER
GMA ID: 6054907