Agreement.pdf — Bakersfield City Council, February 26, 2025

INDEPENDENT CONTRACTOR'S AGREEMENT – Over $40,000 Page 1 of 11 S:\Agreements\Palo Alto Networks\Palo Alto-Draft Agrmt Final.Docx Updated – August 15, 2022

AGREEMENT NO. ___________________

INDEPENDENT CONTRACTOR'S AGREEMENT
[Over $100,000]

This INDEPENDENT CONTRACTOR’S AGREEMENT (“Agreement”) is made and entered into on _______________________, by and between the CITY OF BAKERSFIELD, a municipal corporation (referred to herein as “CITY”) and Tec- Refresh, Inc. a corporation authorized to do business in California (referred to herein as “CONTRACTOR”).

R E C I T A L S

WHEREAS, CITY desires to contract for a web -based, hosted service to provide CyberSecurity products, Solutions and Services; and

WHEREAS, CITY desires to continue using the “Tec-Refresh” hosted service to provide CyberSecurity products, Solutions, and Services for a new three (3) year term pursuant to the terms and conditions of this Agreement.

NOW, THEREFORE, incorporating the foregoing recitals herein, CITY and CONTRACTOR mutually agree as follows:

1. SCOPE OF WORK. In exchange for the C ompensation (defined below), CONTRACTOR shall perform the following: provide CITY a three- year recurring subscription to the “Tec-Refresh” service as set forth in more detail in Exhibit A & B attached hereto and incorporated herein (“Scope of Work”). The Scope of Work shall include all items and procedures necessary to properly complete the task CONTRACTOR has been hired to perform, whether specifically included in the Scope of Work or not.

2. COMPENSATION/PAYMENT PROCEDURE. Subject to the conditions of this section, CITY will pay CONTRACTOR as follows for performing the Scope of Work (“Compensation”):

A total payment of $ 704,248.41 which shall be paid in three annual installments pursuant to Exhibit B, attached hereto and incorporated by reference herein, as follows:

Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA

INDEPENDENT CONTRACTOR'S AGREEMENT – Over $40,000 Page 2 of 11 S:\Agreements\Palo Alto Networks\Palo Alto-Draft Agrmt Final.Docx Updated – August 15, 2022

1. $350,768.23 in 2025

2. $176,740.09 in 2026

3. $176,740.09 in 2027

CITY will pay CONTRACTOR within 30 days after CONTRACTOR submits an itemized invoice for the portions of the Scope of Work completed and that invoice is approved by CITY. The Compensation will be the total amount paid to CONTRACTOR for performing the Scope of Work and includes, but is not limited to, all out -of-pocket costs and taxes. CITY will pay no other compensation to CONTRACTOR more than Seven Hundred and Four Thousand, Two Hundred and Forty -Eight Dollars and Forty One Cents $704,248.41for performing the Scope of Work.

3. TERM. Unless terminated sooner, as set forth herein, this Agreement shall terminate on February 26, 2028.

4. TERMINATION. Either party may terminate this Agreement after giving the other party written notice, as provided herein, thirty (30) days before the termination is effective. Upon termination, City shall pay CONTRACTOR all amounts outstanding for work performed prior to the termination becoming effective.

5. COMPLIANCE WITH ALL LAWS. CONTRACTOR shall, at CONTRACTOR’s sole cost, comply with all of the requirements of Municipal, State, and Federal authorities now in force, or which may hereafter be in force, pertaining to this Agreement, and shall faithfully observe in all activities r elating to or growing out of this Agreement all Municipal ordinances and State and Federal statutes, rules or regulations, and permitting requirements now in force or which may hereafter be in force including, without limitation, obtaining a City of Bakersfield business tax certificate (Bakersfield Municipal Code Chapter 5.02) where required.

6. INDEPENDENT CONTRACTOR. This Agreement calls for CONTRACTOR’s performance of the Scope of Work as an independent contractor.

CONTRACTOR is not an agent or employee of the CITY for any purpose and is not entitled to any of the benefits provided by CITY to its employees. This Agreement shall not be construed as forming a partnership or any other association with CONTRACTOR other than that of an independent contractor.

7. DIRECTION. CONTRACTOR retains the right to control or direct the manner in which the services described herein are performed.

Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA

INDEPENDENT CONTRACTOR'S AGREEMENT – Over $40,000 Page 3 of 11 S:\Agreements\Palo Alto Networks\Palo Alto-Draft Agrmt Final.Docx Updated – August 15, 2022

8. EQUIPMENT. CONTRACTOR will supply all equipment, tools, materials and supplies necessary to perform the services under this Agreement.

9. STARTING WORK. CONTRACTOR shall not begin work until authorized to do so in writing by CITY. No work will be authorized before the date first written above.

10. KEY PERSONNEL. CONTRACTOR shall name all key personnel to be assigned to perform the Scope of Work. All key personnel shall be properly licensed and have the experience to perform the work called for under this Agreement. CONTRACTOR shall provide background for each of the key personnel including, without limitation, resumes and work experience performing work similar to the Scope of Work . CITY reserves the right to approve key personnel. Once the key personnel are approved , CONTRACTOR shall not change such personnel without CITY’s written approval, which shall not be unreasonably withheld . CONTRACTOR reserves all rights to make internal personnel decisions without consulting the City, however, the City retains approval rights for new personnel assigned to the Scope of Work.

11. INCLUDED DOCUMENTS. Any bid documents, including, without limitation, special provisions and standard specifications and any Request for Proposals, Request for Qualifications and responses thereto relating to this Agreement are incorporated by reference as though fully set forth herein.

12. LICENSES. CONTRACTOR shall, at its sole cost and expense, keep in effect or obtain at all times during the term of this Agreement any licenses, permits and approvals which are legally required for CONTRACTOR to practice its profession and perform the Scope of Work . If CONTRACTOR is a corporation, at least one officer or key employee shall hold the required licenses or professional degrees. If CONTRACTOR is a partnership, at least one partner shall hold the required licensees or professional degrees.

13. STANDARD OF PERFORMANCE. The Scope of Work shall be performed in conformity with all legal requirements and industry standards observed by a specialist of CONTRACTOR’s profession in California.

14. SB 854 COMPLIANCE. To the extent Labor Code Section 1771.1 applies to this Agreement, a contractor or subcontractor shall not be qualified to bid on, be listed in a bid proposal, be subject to the requirements of Section 4104 of the Public Contract Code, or engage in the performance of any Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA

INDEPENDENT CONTRACTOR'S AGREEMENT – Over $40,000 Page 4 of 11 S:\Agreements\Palo Alto Networks\Palo Alto-Draft Agrmt Final.Docx Updated – August 15, 2022

contract for public work, as defined in this chapter, unless currently registered and qualified to perform public work pursuant to Section 1725.5.

It is not a violation of Labor Code Section 1771.1 for an unregistered contractor to submit a bid that is au thorized by Section 7029.1 of the Business and Professions Code or by Section 10164 or 20103.5 of the Public Contract Code, provided the contractor is registered to perform public work pursuant to Section 1725.5 at the time the contract is awarded. The prime contractor is required to post job site notices in compliance with Title 8 California Code of Regulations Section 16451. This project is subject to compliance monitoring and enforcement by the Department of Industrial Relations.

15. NO WAIVER OF DEFAULT. The failure of any party to enforce against another party any provision of this Agreement shall not constitute a waiver of that party's right to enforce such a provision at a later time and shall not serve to vary the terms of this Agreement.

16. INSURANCE.

16.1 Types and Limits of Insurance. In addition to any other insurance or security required under this Agreement, CONTRACTOR must procure and maintain, for the duration of this Agreement, the types and limits of insurance below ("Basic Insurance Requirements").

16.1.1 Automobile liability insurance, providing coverage for owned, non -owned, and hired autos on an occurrence
basis for bodily injury, including death, of one or more persons, property damage , and personal injury, with limits of not less than $1,000,000 per occurrence.

16.1.2 Commercial general liability insurance, unless otherwise approved by CITY ’s Risk Manager, providing coverage on an occurrence basis for bodily injury, including death, of one or more persons, property damage, and personal
injury, with limits of not less than $1,000,000 per occurrence.

The policy must:

16.1.2.1 Provide contractual liability coverage for the terms of this Agreement;

16.1.2.2 Provide products and completed operations
coverage;
Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA

INDEPENDENT CONTRACTOR'S AGREEMENT – Over $40,000 Page 5 of 11 S:\Agreements\Palo Alto Networks\Palo Alto-Draft Agrmt Final.Docx Updated – August 15, 2022

16.1.2.3 Provide premises, operations, and mobile
equipment coverage; and

16.1.2.4 Contain an additional insured endorsement in
favor of CITY and its mayor, council, officers,
agents, employees, and designated volunteers.

16.1.3 Workers' compensation insurance with limits of not less than $1,000,000 per occurrence . I n accordance with the
provisions of Labor Code Section 3700, every contractor will be required to secure the payment of compensation to his employees. Pursuant to Labor Code Section 1861,
CONTRACTOR must submit to CITY the following
certification before beginning any work on the
Improvements:

I am aware of the provisions of Section 3700 of the
Labor Code which require every employer to be
insured against liability for worker’s compensation or
to undertake self -insurance in accordance with the
provisions of that code, and I will comply with such
provisions before commencing the performance of
the work of this contract.

By executing this Agreement, CONTRACTOR is submitting the certification required above.

The policy must contain a waiver of subrogation in favor of CITY and its mayor, council, officers, agents, employees, and designated volunteers.

16.2 General Provisions Applying to All Insurance Types.

16.2.1 All policies required of CONTRACTOR must be written on a first-dollar coverage basis, or contain a deductible
provision. Subject to CITY’s advance approval,
CONTRACTOR may utilize a self -insured retention in any or all of the policies provided, but the policy or policies may not contain language, whether added by endorsement or
contained in the policy conditions, that prohibits
satisfaction of any self -insured provision or requirement by anyone other than the named insured or by any means
Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA

INDEPENDENT CONTRACTOR'S AGREEMENT – Over $40,000 Page 6 of 11 S:\Agreements\Palo Alto Networks\Palo Alto-Draft Agrmt Final.Docx Updated – August 15, 2022

including other insurance or which is intended to defeat the intent or protection of an additional insured.

16.2.2 All policies required of CONTRACTOR must be primary insurance as to CITY and its mayor, council, officers, agents, employees, or designated volunteers and any insurance or self-insurance maintained by CITY and its mayor, council, officers, agents, employees, and designated volunteers
must be excess of CONTRACTOR’s insurance and must not
contribute with it.

16.2.3 The insurance required above, except for workers’ compensation insurance, must be placed with insurers with a Best’s rating as approved by CITY ’s Risk Manager, but in no event less than A- :VII. Any deductibles, self -insured retentions, or insurance in lesser amounts, or lack of certain types of insurance otherwise required by this Agreement, or insurance rated below Best’s A-:VII, must be declared prior to execution of this Agreement and appro ved by CITY in writing.

16.2.4 The insurance required in this section must be maintained until the Scope of Work is satisfactorily completed as
evidenced by CITY’s written acceptance. All policies must provide that there will be continuing liability thereon, notwithstanding any recovery on any policy.

16.2.5 Full compensation for all premiums which the CONTRACTOR is required to pay to satisfy the Basic Insurance
Requirements shall be considered as included in the prices paid for the performance of the Scope of Work, and no
additional allowance will be made therefor or for additional premiums which may be required by extensions of the
policies of insurance.

16.2.6 It is further understood and agreed by CONTRACTOR that its liability to CITY will not in any way be limited to or affected by the amount of insurance obtained and carried by
CONTRACTOR in connection with this Agreement.

16.2.7 Unless otherwise approved by CITY, if any part of the Scope of Work is subcontracted, the Basic Insurance Requirements must be provided by, or on behalf of, all subcontractors Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA

INDEPENDENT CONTRACTOR'S AGREEMENT – Over $40,000 Page 7 of 11 S:\Agreements\Palo Alto Networks\Palo Alto-Draft Agrmt Final.Docx Updated – August 15, 2022

even if CITY has approved lesser insurance requirements for CONTRACTOR, and all subcontractors must agree in writing to be bound by the provisions of this section.

17. THIRD PARTY CLAIMS. In the case of public works contracts, CITY will timely notify CONTRACTOR of third party claims relating to this Agreement . CITY shall be allowed to recover from CONTRACTOR, and CONTRACTOR shall pay on demand, all costs of notification.

18. INDEMNITY. CONTRACTOR shall indemnify, defend, and hold harmless CITY and CITY’s officers, agents and employees against any and all liability, claims, actions, causes of action or demands whatsoever against them, or any of them, before administrative or judicial tribunals of any kind whatsoever, arising out of, connected with, or caused by CONTRACTOR or CONTRACTOR’s employees, agents, independent contractors, companies, or subcontractors in the performance of, or in any way arising from, the terms and provisions of this Agreement whether or not caused in part by a party indemnified hereunder, except for CITY ’s sole active negligence or willful misconduct. Notwithstanding anything to the contrary in this Agreement, the CONTRACTOR’s maximum liability to the CITY under this Agreement shall be the lesser of : 1) the amount actually paid by the CITY to the CONTRACTOR or 2) $704,248.41, inclusive of all attorney’s fees, costs and expenses.

19. ASSIGNMENT. Neither this Agreement nor any rights, interests, duties, liabilities, obligations or responsibilities arising out of, concerning or related in any way to this Agreement (including, but not limited to, accounts, actions, causes of action, claims, damages, demands, liabilities, losses, obligations, or reckonings o f any kind or nature whatsoever, for compensatory or exemplary and punitive damages, or declaratory, equitable or injunctive relief, whether based on contract, equity, tort or other theories of recovery provided for by the common or statutory law) may be assigned or transferred by any party. Any such assignment is prohibited, and shall be unenforceable and otherwise null and void without the need for further action by the non-assigning party or parties.

20. ACCOUNTING RECORDS. CONTRACTOR shall maintain accurate accounting records and other written documentation pertaining to all costs incurred in performance of this Agreement. Such records and documentation shall be kept at CONTRACTOR's office during the term of this Agreement, and for a period of three years from the date of the final payment hereunder, and made available to CITY representatives upon Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA

INDEPENDENT CONTRACTOR'S AGREEMENT – Over $40,000 Page 8 of 11 S:\Agreements\Palo Alto Networks\Palo Alto-Draft Agrmt Final.Docx Updated – August 15, 2022

request at any time during regular business hours.

21. BINDING EFFECT. The rights and obligations of this Agreement shall inure to the benefit of, and be binding upon, the parties to the Agreement and their heirs, administrators, executors, personal representatives, successors and assigns.

22. CORPORATE AUTHORITY. Each individual signing this Agreement on behalf of entities represent s and warrant s that they are, respectively, duly authorized to sign on behalf of the entities and to bind the entities fully to each and all of the obligations set forth in this Agreement.

23. COUNTERPARTS. This Agreement may be executed in any number of counterparts, each of which shall be considered as an original and be effective as such.

24. EXECUTION. This Agreement is effective upon execution. It is the product of negotiation and all parties are equally responsible for authorship of this Agreement. Section 1654 of the California Civil Code shall not apply to the interpretation of this Agreement.

25. EXHIBITS. In the event of a conflict between the terms, conditions or specifications set forth in this Agreement and those in exhibits attached hereto, the terms, conditions, or specifications set forth in this Agreement shall prevail. All exhibits to which reference is made in this Agreement are deemed incorporated in this Agreement, whether or not actually attached.

26. FURTHER ASSURANCES. Each party shall execute and deliver such papers, documents, and instruments, and perform such acts as are necessary or appropriate, to implement the terms of this Agreement and the intent of the parties to this Agreement.

27. GOVERNING LAW. The laws of the State of California will govern the validity of this Agreement and its interpretation and performance. Any litigation arising in any way from this Agreement shall be brought in Kern County, California.

28. INTERPRETATION. Whenever the context so requires, the masculine gender includes the feminine and neuter, and the singular number includes the plural.

29. MERGER AND MODIFICATION. This Agreement sets forth the entire Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA

INDEPENDENT CONTRACTOR'S AGREEMENT – Over $40,000 Page 9 of 11 S:\Agreements\Palo Alto Networks\Palo Alto-Draft Agrmt Final.Docx Updated – August 15, 2022

agreement between the parties and supersedes all other oral or written representations. This Agreement may be modified only in a writing approved by the City Council and signed by all the parties.

30. NON-INTEREST. No CITY officer or employee shall hold any interest in this Agreement (California Government Code section 1090).

31. NOTICES. All notices relative to this Agreement shall be given in writing and shall be personally served or sent by certified or registered mail and be effective upon actual personal service or depositing in the United States mail. The parties shall be addressed as follows, or at any other address designated by notice:

CITY: CITY OF BAKERSFIELD

CITY HALL
1600 Truxtun Avenue
Bakersfield, California 93301

CONTRACTOR: Tec-Refresh, Inc
100 Bayview Circle, Suite 230
Newport Beach, CA 92660

32. RESOURCE ALLOCATION. All CITY obligations under the terms of this Agreement are subject to the appropriation and allocation of resources by the City Council.

33. TITLE TO DOCUMENTS. All documents, plans, and drawings, maps, photographs, and other papers, or copies thereof prepared by CONTRACTOR pursuant to the terms of this Agreement, shall, upon preparation, become CITY property.

34. TAX NUMBERS.

CONTRACTOR’s Federal Tax ID Number 27-3186711
CONTRACTOR is a corporation? Yes X No (Please check one.)

IN WITNESS WHEREOF, the parties hereto have caused this Agreement to be executed as of the date first written above.

Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA

INDEPENDENT CONTRACTOR'S AGREEMENT – Over $40,000 Page 10 of 11 S:\Agreements\Palo Alto Networks\Palo Alto-Draft Agrmt Final.Docx Updated – August 15, 2022

"CITY" “CONTRACTOR”
CITY OF BAKERSFIELD Tec-Refresh, Inc.

By:________________________________ By:_________________________________

KAREN GOH EFREM GONZALES
Mayor President & CEO

APPROVED AS TO CONTENT:

TECHNOLOGY SERVICES DEPARTMENT

By:_______________________________

GREGORY PRONOVOST
Technology Services Director

APPROVED AS TO FORM:

VIRGINIA GENNARO
City Attorney

By:___________________________
ASHLEY E. ZAMBRANO
Deputy City Attorney

Insurance:____________

Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA

INDEPENDENT CONTRACTOR'S AGREEMENT – Over $40,000 Page 11 of 11 S:\Agreements\Palo Alto Networks\Palo Alto-Draft Agrmt Final.Docx Updated – August 15, 2022

COUNTERSIGNED:

By:_______________________________

RANDY MCKEEGAN
Finance Director

Attachment: Exhibit A – Master Service Agreement
Exhibit B – Pricing

Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA Created by:

Efrem Gonzales
Tec-Refresh, Inc.

Prepared for:

Chris Dorroh

City of Bakerseld
Exhibit A
Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA 2024 Tec-Refresh Corporation. All rights reserved. Tec-Refresh® is a trademark of the Tec-Refresh Corporation in the United States.

Master Services Agreement

This Master Services Agreement (“Agreement”) is effective as of the last date on the signature block (“Effective Date”) and is made between Tec-Refresh, Inc., a California corporation, located at 100 Bayview Circle, Suite 230, Newport Beach, California 92660 (“Tec-Refresh”) and City of Bakerseld, located at 1600 Truxtun Avenue, Bakerseld, CA 93301 (“Client”, and collectively with Tec-Refresh, the “Parties” or a “Party”).

WHEREAS, Tec-Refresh is a Managed Security Services Provider which manages IT services, offer backup and disaster recovery, provides network visibility, security and network infrastructure and offers advisory services, business continuity services and cybersecurity services.

WHEREAS Client desires to engage Tec-Refresh to provide the personnel to perform services as may be set forth on individual Project Work Order(s).

NOW, THEREFORE, in consideration of covenants and agreements contained herein, the parties hereto agree as follows:

1. Services. Tec-Refresh shall, to the best of its abilities, provide the personnel (“Personnel”) and services (“Services”) as may be agreed to between the Parties and as necessary to complete the project work orders (“Project Work Order”), in the form attached as Appendix B hereto, requested by the Client.
a. Personnel. Tec-Refresh will source, assess, engage and select Personnel according to the applicable Project Work Order. Tec-Refresh shall have sole discretion over the personnel used to provide the Services, provided that Tec-Refresh shall consult with Client and ensure that the Personnel are in all cases suitably qualied. Tec-Refresh shall use reasonable efforts to provide the Services through the same personnel for the duration of a Project Work Order, provided that should the same personnel be unavailable to provide Services to Client and not at the option of Tec-Refresh, Tec-Refresh may be entitled to replace such personnel with personnel of equivalent qualication and experience on no less than ve (5) business days’ notice to Client. Personnel may include Tec-Refresh’s employees, independent contractors, subcontractors, or agents. If any Personnel of Tec-Refresh is not an employee of Tec-Refresh but a third party engaged by Tec- Refresh to provide Services to Client (i.e., independent contractors, subcontractors or agents), Tec-Refresh understands and agrees that (i) Tec-Refresh shall at all times remain responsible for the performance of and payment for all work by Personnel; (ii) Client shall have no obligation to such third parties; and (iii) the use of such third parties Personnel shall not cause any increase in fees, costs, and/or expenses that would otherwise be payable under this Agreement.

Page 2 of 28 ends

Furthermore, all third parties Personnel providing Services under this Agreement must meet the same requirements and level of experience as required by Tec-Refresh and comply with all terms and conditions of this Agreement, including but not limited to, any obligations of condentiality and data privacy.

2. Payments.

Payment shall be made to Tec-Refresh, Inc., 10 Stevens Street #190, Andover, Massachusetts 01810, in the amount of $704,248.41 and is due net 30. Payment discount terms include a one (1%) percent discount if the bill is paid within 10 days of receipt.

If any invoice is not paid when due, interest will be added to and payable on all overdue amounts at ten (10%) percent per year, or the maximum percentage allowed under applicable laws, whichever is less.

Client shall pay all costs of collection, including without limitation, reasonable attorney fees, expert witness fees and court costs, whether or not litigation is commenced.

In addition to any other right or remedy provided by law, if Client fails to pay for the Services when due, Tec-Refresh has the option to treat such failure to pay as a material breach of this Agreement, may stop work on Client’s project until undisputed payment in full is received and/or may cancel this Agreement and/or seek legal remedies.

3. Client Responsibilities.

a. Consistent and Reliable Communication. In many cases Tec-Refresh’s work is time sensitive.

Client will use its best efforts to respond to each communication within forty-eight (48) hours.

Tec-Refresh will have no responsibility for delays caused by Client’s delayed responses in excess of 24 hours and delays in responding to communications may cause Tec-Refresh to reassign its personnel to different projects. Tec-Refresh will require one point of contact during the Project for clarifying requirements for design, key features, service, security, usability and maintenance issues. If there is a delay in communications that prevents Tec-Refresh’s work from being completed, the particular delayed task, and all others relying on it, may be put on hold.

b. Client Representative. Client will designate the individual as its representative, authorized to receive communications from Tec-Refresh, and to make decision of its behalf (“Client Representative”). Client will inform Tec-Refresh when Client changes the Client Representative.

c. Client Information. Client will only provide Tec-Refresh with information and content that, to the best of its knowledge, does not infringe upon, nor misappropriate any U.S. patent, copyright,

Page 3 of 28 ends

4. Data Processing and Security.

a. The Client will select and maintain all appropriate passwords and change as necessary.

Client agrees to notify Tec-Refresh immediately if Client has any reason to believe that the security of its data has been compromised. Except as set forth in section (b) below, Client will be solely responsible for updating and maintaining all rewalls, virus/malware protection software as is necessary to protect Client’s property.

b. Tec-Refresh shall establish physical and technical safeguards designed to guard against the destruction, loss or alteration of Client’s Personal Data and Personal Information. Without limiting the foregoing, Tec-Refresh shall at all times in connection with this Agreement: (i) maintain and enforce an information security program including administrative, physical and technical security policies and procedures with respect to its processing of Personal Data (as dened below) and Personal Information (as dened below) consistent with commercially reasonable industry practices and standards; (ii) provide technical and organizational safeguards designed to protects against accidental, unlawful or unauthorized access to or use, destruction, loss, or alteration, disclosure, transfer, commingling or processing of such information and ensure a level of security appropriate to the risks presented by the processing of such information and the nature of such information, consistent with commercially reasonable industry practice and standards and (iii) take commercially reasonable efforts to secure its information systems against “hackers” and others who may seek, without authorization to disrupt, damage, modify, access of otherwise use the Personal Data and/or Personal Information contained therein.

c. GDPR. If either (i) Directive 94/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of Personal Data (as dened in the GDPR) and on the free movement of such data (“Directive”), or (ii) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (“GDPR”), are applicable to the Services provided by Tec-Refresh, then the parties will enter into a Data Processing Agreement (“DPA”) that is acceptable to Client and such DPA shall be incorporated herein. For the purposes of GDPR, Client shall be considered the “Controller” and Tec-Refresh shall be considered the “Processor”. Controller will determine the necessity of such an agreement.

d. CCPA. The parties acknowledge and agree that Tec-Refresh may be a service provider for the purposes of the California Consumer Privacy Act (“CCPA”) and may receive Personal

Page 4 of 28 ends

Information) from Client pursuant to this Agreement for a business purpose. Tec-Refresh shall not sell or share any such Personal Information. Tec-Refresh shall not access, retain, use, disclose or dispose any Personal Information provided by Client pursuant to this Agreement except as necessary for the specic purpose of performing the services for Client pursuant to the Agreement, or otherwise as set forth in this Agreement or as permitted by the CCPA. The terms “Personal Information,” “service provider,” “sale,” “share”, and “sell” are as dened in Section 1798.140 of the CCPA. Tec-Refresh certies that it understands the restrictions of this section.

5. Intellectual Property Rights.

a. Tec-Refresh agrees that such information, work product, and other results, systems and information developed by Tec-Refresh and/or Client in connection with such Services (hereinafter referred to collectively as the "Work Product") shall, to the extent permitted by law, be a "work made for hire" within the denition of Section 101 of the Copyright Act (17 U.S.C. 101), and all Work Product shall remain the sole and exclusive property of Client. To the extent that any Deliverable does not constitute a “work made for hire” for Client, Tec-Refresh hereby irrevocably assigns, transfers, and conveys (and agrees to assign, transfer, and convey, without further consideration) to Client, on a worldwide and perpetual basis, all right, title, and interest in and to any and all Deliverables (including all intellectual property rights therein). Tec-Refresh agrees to execute such further documents or take such further actions that may be necessary to register or enforce Client’s intellectual property rights in the Deliverables. Tec-Refresh will assign, and cause all of its Personnel to assign, tall rights, titles, and interests of Tec-Refresh in and to any and all such intellectual property rights of the Work Product to Client.

b. Copyright Exceptions: Tec-Refresh may have the right to reuse portions of the created project, as long as the portions are general solutions to common problems and are not specic to the Client’s project, breach any obligations of condentiality, nor infringe on any of the Client’s intellectual property.

6. Condentiality. In connection with entering into and performing under this Agreement and each SOW, each Party may receive or have access to commercially valuable technical and nontechnical condential or proprietary information of the other Party (including condential or proprietary information of a third party), including information in whatever form, relating to the business of such Party that is not generally known or available to others, including but not limited to, source code and documentation for software, trade secrets, know how, customer lists, pricing strategies, payment terms, the terms of this Agreement and each SOW, marketing and business plans, information concerning such Party’s vendors, and such Party’s contemplated plans, strategies and prospects (“Condential Information”). Each Party hereby agrees that it will not use or disclose any Condential Information

Page 5 of 28 ends

Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA 2024 Tec-Refresh Corporation. All rights reserved. Tec-Refresh® is a trademark of the Tec-Refresh Corporation in the United States. received from the other Party other than as expressly permitted under the terms and conditions of this Agreement or expressly authorized in writing by the other Party. Each Party will use the same degree of care to protect the other Party’s Condential Information as it used to protect its own Condential Information of like nature, but in no circumstances less than reasonable care. Neither Party will disclose the other Party’s Condential Information to any person or entity other than its ofcers, principals, employees, and subcontractors who need access to such Condential Information in order to effect the intent of this Agreement and who are bound by condentiality and non-use terms no less restrictive that those in this Agreement. The restrictions set forth herein do not apply to Condential Information that the Receiving Party can demonstrate (a) was known prior to its disclosure by the Disclosing Party; (b) is or becomes publicly known through no wrongful act of the Receiving Party; (c) has been rightfully received from a third party authorized to make such disclosure without restriction; (d) is independently developed by the Receiving Party; (e) has been approved for release by the Disclosing Party’s prior written authorization; or (f) has been disclosed by court order or as otherwise required by law, provided that the party required to disclose information provides prompt advance notice thereof, to the extent practicable, to enable the Disclosing Party to seek a protective order or otherwise prevent such disclosure. The Receiving Party shall promptly inform the Disclosing Party of all unauthorized disclosures of the Condential Information of the Disclosing Party.

7. Non-Solicitation. During the term of this Agreement and continuing for one (1) year following the termination of the last date of services performed by Tec-Refresh under this Agreement, Client agrees that it will not solicit nor attempt to solicit, divert or hire away any person or otherwise recruit or induce any employee of Tec-Refresh, nor of any the contractors, subcontractors, vendors and/or third party suppliers introduced by Tec-Refresh to Client, to work on any Client project, other third party or to otherwise terminate their employment with Tec-Refresh to work elsewhere. For the avoidance of doubt, general solicitations that do not specically target the Personnel will not be considered solicitations in breach of this provision.

8. Term; Termination.
a. Term. This Agreement shall be effective upon the date specied at the beginning of this Agreement, and shall remain in force until the last services have been provided by Tech-Refresh to Client, unless otherwise terminated as provided herein, provided, however, that this Agreement shall continue to remain in effect with respect to any Project Work Order already in effect hereunder until such Project Work Orders are themselves terminated or expired and/or performance thereunder is completed. The obligations contained in sections 6 (Condentiuality), 7 (Non-Solicitation) and 9 (Indemnication) shall survive the termination of this Agreement for a period of four (4) years.

Page 6 of 28 ends

b. Termination Without Cause. Either Party may terminate this Agreement by giving at least thirty (30) days’ written notice to the other party.

c. Termination with Cause. Either party may immediately terminate the Agreement for a material breach of the Agreement after a written request to thirty (30) days to cure.

In the event of any termination/cancellation of this Agreement, Tec-Refresh may:

(1) Declare all amounts owed to be immediately due and payable; (2) Enter Client’s premises and repossess all supplies, spare parts and other items supplied by Tec-Refresh hereunder for which payment has not been received; and (3) Cease performance of all Services hereunder without liability to Service Recipient.

The foregoing rights and remedies of each party hereto shall be in addition to all other rights and remedies available to them in law and in equity.

9. Indemnication.

a. By Client. Client agrees to defend, indemnify and hold harmless Tec-Refresh and its afliates and subsidiaries, and their respective directors, ofcers, afliates, employees, personnel, representatives, and agents from any and all liabilities, costs and expenses, including reasonable attorneys' fees, arising from third party claims (“Claims”) related to or arising from: (a) infringement of such third party’s proprietary rights, including U. S. copyright, patent, trade secret and trademark rights; (b) any breach by Client of any material representation, warranty or obligation of Client hereunder.

b. By Tec-Refresh. Tec-Refresh agrees to defend, indemnify, and hold harmless Client and its afliates and subsidiaries, and their respective directors, ofcers, afliates, employees, personnel, representatives, and agents from any allegations related to or arising from: (a) Work Product, deliverables, developed content, or services (other than Client Property) which infringes or misappropriates any U.S. patent, copyright, trademark or trade secret or other proprietary right of such third party, (b) any unauthorized disclosure or loss of Client data or breach of applicable privacy and data security laws by Tec-Refresh, Personnel, or those acting on its behalf; (c) breach of any material provision of this Agreement or any applicable SOW by Tec-Refresh or Personnel; (d) any breach by Tec-Refresh or its Personnel of any material representation, warranty or obligation of Tec-Refresh hereunder.

Page 7 of 28 ends

c. Each indemnied Party shall (a) provide prompt written notice of such claim to the indemnifying Party, (b) grant the indemnifying Party the sole right to defend such claim using counsel reasonable acceptable to the indemnied Party, and (c) provide to the indemnifying Party reasonable assistance in such defense.

10. Representations and Warranties.

a. EXCEPT AS EXPRESSLY PROVIDED IN THIS AGREEMENT OR REQUIRED BY APPLICABLE

LAW, ALL WARRANTIES, CONDITIONS, REPRESENTATIONS, INDEMNITIES, AND

GUARANTEES WITH RESPECT TO THE TEC-REFRESH SERVICES, SOFTWARE, PRODUCTS,

AND PROGRAMS, WHETHER EXPRESS OR IMPLIED, ARISING BY LAW, CUSTOM, PRIOR

ORAL OR WRITTEN STATEMENTS BY TEC-REFRESH OR REPRESENTATIVES OR OTHERWISE (INCLUDING, BUT NOT LIMITED TO ANY WARRANTY OF MERCHANTABILITY, SATISFACTION,

AND FITNESS FOR A PARTICULAR PURPOSE) ARE HEREBY OVERRIDDEN, EXCLUDED, AND DISCLAIMED. TEC-REFRESH MAKES NO WARRANTY THAT THE SERVICES OR DELIVERABLES WILL ACHIEVE ANY PARTICULAR CLIENT GOAL OR OBJECTIVE.

b. Each Party represents and warrants that: (i) it is an entity duly organized and validly existing under the laws of its state of organization; (ii) it has the rights necessary to grant the licenses and permissions set forth in this Agreement; (iii) the execution of this Agreement and performance of its obligations do not and will not violate any other agreement to which it is a party; (iv) when signed by both parties, this Agreement constitutes a legal, valid, and binding obligation; and (v) it will abide by all Laws applicable to it.

11. Limitation of Liability. TO THE EXTENT PERMITTED BY APPLICABLE LAW AND EXCEPT FOR A PARTY’S INTENTIONAL OR WILLFUL MISCONDUCT, A PARTY’S MATERIAL BREACH OF CONFIDENTIALITY, OR A PARTY’S INDEMNITY OBLIGATIONS ("EXCLUDED CLAIMS"), NEITHER

PARTY WILL BE LIABLE FOR ANY CONSEQUENTIAL, INDIRECT, SPECIAL, PUNITIVE, OR

INCIDENTAL DAMAGES OR LOST PROFITS, WHETHER FORESEEABLE OR UNFORESEEABLE, BASED ON CLIENT’S CLAIMS (INCLUDING, BUT NOT LIMITED TO, CLAIMS FOR LOSS OF DATA,

GOODWILL, USE OF MONEY OR USE OF THE PRODUCTS / DELIVERABLES, INTERRUPTION IN

USE OR AVAILABILITY OF DATA, STOPPAGE OF OTHER WORK OR IMPAIRMENT OF OTHER

ASSETS OR FAILURE TO OBTAIN DESIRED RESULTS), ARISING OUT OF BREACH OR FAILURE OF

EXPRESS OR IMPLIED WARRANTY, WARRANTY OF MERCHANTABILITY AND FITNESS, BREACH

OF CONTRACT, MISREPRESENTATION, NEGLIGENCE, STRICT LIABILITY IN TORT, OR OTHER USE. EXCEPT FOR EXCLUDED CLAIMS, IN NO EVENT WILL THE AGGREGATE LIABILITY, FOR

EITHER PARTY EXCEED THE FEES PAID BY CLIENT UNDER THE AGREEMENT WITHIN THE ONE

Page 8 of 28 ends

Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA 2024 Tec-Refresh Corporation. All rights reserved. Tec-Refresh® is a trademark of the Tec-Refresh Corporation in the United States. (1) MONTH PERIOD IMMEDIATELY PRECEEDING THE DATE OF THE CLAIM(S). The Parties agree that it may be difcult, if not impossible, to accurately determine the amount of damages that may be incurred in the event of any breach by the other Party, accordingly, it is agreed that one (1) month of fees paid in the month immediately prior to the breach, shall constitute the Parties best estimate of damages, and shall be considered as Liquidated Damages for any breach.

12. Mediation. If a dispute arises out of or relates to this Agreement, or its breach, and the parties have not been successful in resolving such dispute through negotiation, the Parties agree to attempt to resolve the dispute through mediation by submitting the dispute to a sole mediator selected by the Parties or, at any time at the option of a party, to mediation by any recognized alternative dispute resolution service with ofces in Los Angeles County, California. Each Party shall bear its own expenses and an equal share of the expenses of the mediator and the fees of the mediation service provider. The Parties, their representatives, other participants and the mediator shall hold the existence, content and result of the mediation in condence. If such dispute is not revolved by such mediation, the Parties shall have the right to resort to any remedies permitted by law. All defenses based on passage of time shall be tolled pending the termination of the mediation.

Nothing in this clause shall be construed to preclude any Party from seeking injunctive relief at any time to protect its rights. A request by a Party to a court for such injunctive relief or other equitable remedies shall not be deemed a waiver of the obligation to mediate.

13. Waiver of Right to Jury Trial. In the event of a dispute, the Party making a claim will be limited to equitable relief and to recovery of damages as limited herein. The Parties irrevocably waive trial by jury in any action, proceeding or counterclaim, whether at law or in equity, brought by either Party.

14. Amendment to Agreement. This Agreement cannot be modied or amended in any way except by a written instrument signed by both parties.

15. Waiver. No forbearance to exercise any rights or privileges under this Agreement or waiver of any breach of any of its terms shall be construed as a waiver of any such terms, rights or privileges, but the same shall continue and remain in full force and effect the same as if no such forbearance or waiver had occurred.

16. Conict. Should there be any conict between the terms and conditions of this Agreement and a Project Work Order, this Agreement shall prevail as the valid term and condition.

17. Venue and Jurisdiction. In the event of any dispute hereunder, the courts of Los Angeles County, California shall have exclusive jurisdiction over all such disputes. This Agreement shall be interpreted in accordance with the laws of the State of California applicable to contracts made and

Page 9 of 28 ends

Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA 2024 Tec-Refresh Corporation. All rights reserved. Tec-Refresh® is a trademark of the Tec-Refresh Corporation in the United States. performed entirely in California. The Client expressly consents to personal jurisdiction in Los Angeles County, and waives any claim of forum non-conveniens.

18. Validity. Should any provision of this Agreement be held to be void, invalid or inoperative by a court of competent jurisdiction, such invalidity, illegality or unenforceability will not affect the other provisions of this Agreement, and this Agreement will be construed as if such invalid, illegal or unenforceable provision had not been contained herein.

19. Force Majeure.The Parties shall be relieved of their respective obligations under this Agreement during a Force Majeure event. “Force Majeure” means any re, ood, earthquake, pandemic or other Act of God or public disaster; strike or labor dispute; embargo, riot, war, act of terrorism, insurrection or civil unrest; pandemic, outbreaks of infectious disease or any other public health crisis, including quarantine or other employee restrictions, virus, government order, including stay-at-home orders, or any other cause beyond the reasonable control of the Parties, including any service interruptions by third parties (e.g.: Amazon Web Service or Google Cloud Platform), but excluding any negligence or willful misconduct of the Parties. The Parties shall resume their obligations, and the time for a Party’s performance shall be extended for a period similar to the Force Majeure period.

20. Entire Agreement. This Agreement and the applicable Service Order constitutes the entire agreement between the Parties, and supersedes all prior agreements, representations and understandings of the Parties, written or oral. Contract terms and conditions included in any “click wrap”, “shrink wrap”, or other license agreement that accompanies the Services, on any time sheet approval portal, or provided under any Project Work Order resulting from this Agreement are void and have no effect unless Client specically agrees to such license terms in writing.

21. Assignment. This Agreement shall not be assigned by either Party without the consent of the other Party.

22. Notices. All notices permitted or required under this Agreement shall be in writing and shall be delivered in person or mailed by rst class, registered or certied mail, postage prepaid, to the address of the Party specied in this Agreement or such other address as either Party may specify in writing, or to the email addresses noted herein.

23. Counterparts; Electronic Signature. This Agreement may be executed in two or more counterparts, each of which will be deemed an original, but all of which together will constitute one and the same instrument. Counterparts may be signed and/or transmitted by e-mail of a .pdf document, or using electronic signature technology (e.g., via DocuSign or similar electronic signature technology), and that such signed electronic record shall be valid and as effective to bind

Page 10 of 28 ends

Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA 2024 Tec-Refresh Corporation. All rights reserved. Tec-Refresh® is a trademark of the Tec-Refresh Corporation in the United States. the Party so signing as a paper copy bearing such Party’s handwritten signature. The Parties further consent and agree that (1) to the extent a Party signs this Agreement using electronic signature technology, by clicking “SIGN”, such Party is signing this Agreement electronically, and (2) the electronic signatures appearing on this Agreement shall be treated, for purposes of validity, enforceability and admissibility, the same as handwritten signatures.

24. Authority. The undersigned warrant, covenant and represent that each of them is the agent of and has authority to execute and bind their principals to the terms of this Agreement if any such signatory is not a principal executing this Agreement for him or herself.

25. Relationship. Neither the making of this Agreement nor the performance of any provision hereunder shall be construed to constitute either Party or its personnel as the agent, employee or legal representative of the other for any purpose, nor shall this Agreement be deemed to establish a joint venture or partnership between Tec-Refresh and Client or to create any relationship between the parties hereto other than that of independent contracting parties. Tec-Refresh shall have no authority to bind, commit, contract for or otherwise obligate Client in any manner whatsoever.

26. Export Control. Tec-Refresh shall not: (a) permit any third party to access or use the Services; or (b) export any software, technology, or Work Product provided by Tec-Refresh or otherwise remove it from the United States except in compliance with all applicable U.S. laws and regulations. Without limiting the generality of the foregoing, Tec-Refresh shall not permit any third party to access or use the Services or Work Product in, or export such software to, a country subject to a United States embargo (as of the Effective Date, Cuba, Iran, North Korea, Sudan, and Syria).

Page 11 of 28 ends

ACCEPTED AND AGREED TO BY THE AUTHORIZED REPRESENTATIVES OF THE PARTIES:

Client: City of Bakerseld
By:

Name: Chris Dorroh
Address: 1600 Truxtun Avenue, Bakerseld, CA 93301
Phone: 661-852-7010
E-Mail: cdorroh@bakerseldcity.us

Client Authorized Representative: ( ) Check box if same as above.

Name:

Phone:

E-Mail:

Tec-Refresh, Inc.

By:

Efrem Gonzales
Phone: 909-693-4011
E-Mail: [email protected]

Page 12 of 28 ends

Appendix A
Pricing Table 3-Year
This engagement will be conducted as a xed-rate project (Paid upfront, annually). The total value for the Services pursuant to this SOW shall not exceed $704,248.41 as outlined in Sales Proposal QUO-2025 unless otherwise agreed to by both parties via the project change control procedure, as outlined within. A PCR will be issued specifying the amended value if any changes are needed. This is a 3-Year contract, billed annually broken down below:

Year 1: $350,768.23
Year 2: $176,740.09
Year 3: $176,740.09

The gures are based upon approved professional services to complete deliverables pursuant to this SOW. The Tec-Refresh will provide sufcient resources based on the following functional/rate structure.

Palo Alto Networks 3-Year Quantity Price Subtotal

PAN-PRISMA-ACCESS-MU-LCL-

ENTERPRISE
Prisma Access Mobile User Local Enterprise
Edition includes private app access and
outbound internet security for mobile users,
premium security subscription, 5 service
locations, 2 service connections, and standard
success per mobile user per year.
500 $189.73 $94,865.00

PAN-PRISMA-ACCESS-PREMUSG-

SUCCESS
For US Government accounts only. Prisma
Access Premium Success
1 $49,505.73 $49,505.73

Page 13 of 28 ends

Exhibit B
Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA 2024 Tec-Refresh Corporation. All rights reserved. Tec-Refresh® is a trademark of the Tec-Refresh Corporation in the United States.

PAN-CDL-1TB-USG
Cortex Data Lake with 1TB of storage, 1-year,
includes US Government Premium Support
20 $4,511.80 $90,236.00

PAN-CONSULT-ACCESS-

QUICKSTART-MOB
QuickStart Service for Prisma Access Mobile
Users ZTNA SIG
1 $19,434.71 $19,434.71
PAN-EDU-TRAINING-100
Training Credit - To be redeemed with
Authorized Training Partners (ATPs)
400 $122.11 $48,844.00
PAN-PA-3410-AIOPS-NGFW-3YR
AIOps for NGFW subscription, 3-year, PA-
3410.
2 $11,450.41 $22,900.82
PAN-PA-3410-BND-CORESEC-3YR
PA-3410, Core Security Subscription Bundle
(Advanced Threat Prevention, Advanced URL
Filtering, Advanced Wildre, DNS Security
and
SD-WAN ), 3 years (36 months) term.
2 $37,186.91 $74,373.82

PAN-IOT-ENT-PLUS
Enterprise IoT Security Plus product option.

Should be purchased with IoT Security
subscription.
1 $0.00 $0.00
PAN-PA-3410-IOT-DRDL-3YR
PA-3410, IoT subscription, does not require
data lake,
3 years (36 months) term.
2 $28,254.07 $56,508.14
PAN-SVC-PREMUSG-3410-3YR
For US Government accounts only. Premium
support
3 year prepaid, PA-3410
2 $40,620.38 $81,240.76
PAN-PA-3410
Palo Alto Networks PA-3410 with redundant
AC power supplies.
2 $18,729.53 $37,459.06

Page 14 of 28 ends

PAN-XDR-PRO-GB
Cortex XDR Pro for daily ingested GB.

Includes 30 days of ingested data retention,
180 days of alerts and incidents retention and
standard success
100 $0.00 $0.00

PAN-XDR-PREMUSG-SUCCESS
For US Government accounts only. Cortex
XDR Premium Success
1 $0.00 $0.00

PAN-CONSULT-XDR-TB-QS
QuickStart Services for Cortex XDR Pro per
TB
1 $0.00 $0.00
PAN-U42-EOD-24HR-L1
Unit 42 Public Sector Expertise on Demand
Subscription, 24-hour remote response time.

Up to 50 consulting hours.
1 $0.00 $0.00

PAN-CONSULT-DAY-FW
Palo Alto Networks consulting services (per
day) - Minimum 5 days
20 $2,600.00 $52,000.00

PAN-CONSULT-PRJM-DAY-FW
Palo Alto Networks professional services
Project Manager (per day)
5 $2,600.00 $13,000.00
Subtotal $700,958.04
Tax $3,090.37
Shipping $200.00
Total $704,248.41
Please initial that you agree to the price and payment schedule.

Upon completion of this Performance Period, Tec-Refresh and Client will have the option to renew this Agreement for an additional then-stated number of hours at the then-current daily rate for those resources identied.

Page 15 of 28 ends

Appendix B
Project Work Order
(Template Form)
Project Name Change Number
Requested By Date of Request
Presented To
Change Name
Description of Change:

Reason for Change:

Effect on Deliverables (including a list of any affected deliverables):

Effect on Organization:

Effect on Schedule (including Estimated Completion Date for this change):

Page 16 of 28 ends

Effect on Project Cost:

Item Description Hours Dollars
Reduction Increase Reduction Increase

Total Net Change in Cost:

Effect of NOT Approving this Change:

Reason for Rejection (if applicable):

Functional Project Manager
Approved Signature:

Rejected Title: Date:

Tec-Refresh, Inc.

Approved Signature:

Rejected Title: Date:

Page 17 of 28 ends

Statement of Work
Palo Alto Networks
City of Bakerseld
Prepared for:

City of Bakerseld
Chris Dorroh
Prepared by:

Tec-Refresh, Inc.

Efrem Gonzales
SOW#: QUO-2025

Page 18 of 28 ends

THIS STATEMENT OF WORK (“SOW”) is entered into by and between City of Bakerseld ("Client") and Tec-Refresh, Inc. (“Tec-Refresh”). This SOW is subject to the terms and conditions contained in the Master Services Agreement (“MSA”) between the parties and is made a part thereof. Any term not otherwise dened herein shall have the meaning specied in the MSA. In the event of any conict or inconsistency between the terms of this SOW and the terms of the MSA, the terms of the MSA shall govern and prevail.

This SOW #QUO-2025 (hereinafter called the “SOW”), effective as of 10/3/2024, is entered into by and between Tec-Refresh and Client and is subject to the terms and conditions specied below. The Exhibit(s) to this SOW, if any, shall be deemed to be a part hereof. In the event of any inconsistencies between the terms of the body of this SOW and the terms of the Exhibit(s) hereto, the terms of the body of this SOW shall prevail.

Term/Schedule
This project is pay in terms NET30
Functional Role Phone Email
Efrem Gonzales - President & CEO 909-694-4010 [email protected] Mike Tammaro - Sales Operations Manager 617-829-9153 [email protected] Stephen Carabajal - Director of Sales 909-366-2066 [email protected] Miguel Martinez - Chief Technology Ofcer 909-366-5616 [email protected] Cory Holmes - VP of Infrastructure Services 909-366-5615 [email protected] Mike Hang - Director of Managed Services 909-366-2022 [email protected] Jose Ayala - Information Technology Specialist 949-662-2755 [email protected] Project Start Date Project End Date
3/24/2025 3/23/2028

Page 19 of 28 ends

Scope of Work
Tec-Refresh shall provide the Services and Deliverable(s) as follows: Tec-Refresh will provide engineers to support the creation and deployment of the new network infrastructure consisting of Palo Alto Networks Next-Generation Firewall Infrastructure. Our team will provide engineers for the new conguration and deployment for the established days of professional services.

Phased Implementation Timeline
Phase 1: Planning & Preparation (Days 1-5)
Day 1-2: Requirements Gathering & Environment Review
• Conduct kickoff meeting with the City of Bakerseld team. • Gather detailed network and security requirements.
• Identify networks, services, and VPNs to be migrated. • Review current Cisco ASA rewall rules, NAT policies, VPN settings, and network objects.

Day 3: Migration Strategy & Rollback Planning
• Develop migration strategy, including a step-by-step cutover plan. • Dene rollback procedures for minimal downtime and risk mitigation. • Review migration strategy with stakeholders for approval.

Day 4-5: Prepare the Palo Alto PA-3410
• Install and apply the base conguration on the new rewall. • Congure interfaces, zones, and initial security policies. • Enable management access and congure authentication.

Phase 2: Conguration Migration (Days 6-12)
Day 6-7: Translate Cisco ASA Conguration to Palo Alto
• Use Palo Alto migration tools to convert existing rules and policies. • Manually rene access control lists, NAT policies, and VPN settings. • Ensure alignment with best security practices.

Day 8-9: Review & Optimize Conguration
• Perform rule base cleanup to eliminate redundant or unused rules. • Optimize security policies for Zero Trust best practices. • Implement recommended Palo Alto security features such as WildFire, URL Filtering, and Threat Prevention.

Day 10-11: Client Review & Pre-Migration Validation
• Conduct conguration review session with the City of Bakerseld team.

Page 20 of 28 ends

Day 12: Final Pre-Migration Checklist
• Verify rollback procedures.
• Ensure all necessary backups are in place.
• Conrm stakeholder approval for the cutover window.

Phase 3: Migration & Cutover (Days 13-16)
Day 13-15: Firewall Migration & Cutover Execution
• Implement scheduled cutover in the agreed maintenance window. • Migrate congurations to the Palo Alto rewall.
• Validate connectivity, rule enforcement, and VPN functionality.

Day 16: Immediate Post-Migration Validation & Troubleshooting • Conduct initial system health checks.
• Resolve any identied issues in real time.
• Fine-tune congurations based on observed network behavior.

Phase 4: Post-Migration Support & Documentation (Days 17-25) Day 17-20: Full Network Validation & Performance Optimization • Perform extensive testing for all network services, applications, and VPNs. • Address any post-migration issues.
• Optimize performance settings and logging congurations.

Day 21-23: Documentation & Knowledge Transfer
• Provide updated network diagrams and conguration documentation. • Conduct a knowledge transfer session with the City of Bakerseld team. • Deliver troubleshooting guides and key security recommendations.

Day 24 & 25: Final Review & Project Closure
• Conduct a nal review meeting with stakeholders.
• Conrm that all objectives have been met.
• Obtain formal project acceptance and closure sign-off Conguration
Migrate existing rewall and network congurations to the new Palo Alto PA-3410 rewall. Additionally, we will ensure the best practices are met on the new conguration to ensure that the City of Bakerseld team is better protected from cybersecurity threats.
• Planning
• Requirements Gathering: Collaborate with the client to gather detailed requirements and identify networks and services to be migrated.

Page 21 of 28 ends

Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA 2024 Tec-Refresh Corporation. All rights reserved. Tec-Refresh® is a trademark of the Tec-Refresh Corporation in the United States. • Environment Review: Assess the existing Cisco ASA conguration and the target Palo Alto environment.
• Migration Strategy: Develop a comprehensive migration plan, including a rollback strategy. • Conguration Migration:
• Translate existing Cisco ASA congurations into the Palo Alto format, ensuring that all access control rules, NAT policies, VPN congurations, and network objects are accurately migrated.
• Utilize Palo Alto’s migration tools where applicable to streamline the process and reduce manual errors.
• Customize congurations to align with best practices for security and performance. • Conduct thorough review sessions with the client to verify the accuracy of the migrated congurations.

Migration
• Remote Support: Provide remote assistance during scheduled cutover windows to:
• Migrate congurations and services.
• Validate connectivity and functionality.
• Troubleshooting: Address any issues encountered during the migration.

Post-Migration Support
• Verication: Conrm all networks and services are functioning as expected. • Documentation: Deliver updated network diagrams and conguration documentation. • Support: post-migration support to resolve any unforeseen issues.

Additional services available during this engagement:

Advisory Services
Tec-Refresh will provide advisory services to City of Bakerseld's information technology team to assist with IT related project redesign and recommended best practices. This includes recommended next steps such as backup and disaster recovery with ransomware protection, managed detection and response, next generation endpoint protection, etc.

Page 22 of 28 ends

Tuning Services
Assist with tuning to ensure that your rewall and network infrastructure is running at peak performance.

Tuning services may include optimizing rewall rules, conguring policy settings, adjusting security proles, and ne-tuning network settings to improve overall efciency and throughput.

Upgrade Services
Assist with upgrading your rewall and network software to the latest version. This includes verifying that your system meets the minimum requirements, backing up your conguration, downloading and installing the new software, and testing to ensure that all features and functions are working correctly.

Troubleshooting Services
Help troubleshoot issues with your rewall and network infrastructure. This includes identifying the root cause of problems, diagnosing network connectivity issues, analyzing system logs and trafc patterns, and working with you to resolve any issues that are affecting the performance or security of your network.

Policy Review
Review your rewall policies to ensure that they are aligned with your organization's security requirements. This includes assessing your current security posture, reviewing your existing policies and rules, identifying areas where policies can be improved, and recommending changes to help mitigate security risks and improve overall protection.

Support
During this project, the Client will have direct access to Tec-Refresh engineers during standard business hours, Monday through Friday 8:00AM to 5:00PM PST. The Client will be able to contact Tec-Refresh engineers via the following methods:
• Email: [email protected]
• Phone: 909.366.5621
• Web: https://tec-refresh.com/support
Deliverable Materials
• Network Diagram
• Physical Topology

Page 23 of 28 ends

Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA 2024 Tec-Refresh Corporation. All rights reserved. Tec-Refresh® is a trademark of the Tec-Refresh Corporation in the United States. • Logical Topology
• Deployment Documentation
• Summary of delivered services
• Recommendations
Assumptions
• The Client agrees to pay in terms NET30.
• The Client will provide access to necessary information regarding the implementation, migration and cutover of the new Palo Alto Firewalls.
• Services will be delivered remotely.
• The Client will provide necessary access to complete agreed upon scope.

Page 24 of 28 ends

Project Change Control Procedure
The following process will be followed if a change to this SOW is required:
● A Project Change Request (PCR) will be the vehicle for communicating change. The PCR must describe the change, the rationale for the change, and the effect the change will have on the project. ● The designated Project Manager of the requesting party (Tec-Refresh or Client) will review the proposed change and determine whether to submit the request to the other party. ● Both Project Managers will review the proposed change and approve it for further investigation or reject it. Tec-Refresh and Client will mutually agree upon any charges for such investigation, if any. If the investigation is authorized, the Client Project Managers will sign the PCR, which will constitute approval for the investigation charges. The Tec-Refresh will invoice the Client for any such charges. The investigation will determine the effect that the implementation of the PCR will have on SOW price, schedule, and other terms and conditions of the Agreement. ● Upon completion of the investigation, both parties will review the impact of the proposed change and, if mutually agreed, a change Authorization will be executed. ● A written Change Authorization and PCR must be signed by both parties to authorize the implementation of the investigated changes.

Completion Criteria
Tec-Refresh shall have fullled its obligations when any one of the following rst occurs:
● Tec-Refresh accomplishes the activities described within this SOW, including delivery to Client of the materials listed in the section entitled “Deliverable Materials,” and Client accepts such activities and materials without unreasonable objections. No response from Client within two business days of deliverables being delivered by Tec-Refresh is deemed acceptance. ● The Tec-Refresh and/or the Client has the right to cancel services or deliverables not yet provided with 10 business days advance written notice to the other party.

Page 25 of 28 ends

Invoice Schedule
The Client will be invoiced for the consulting services and T&L expenses. Standard Contractor invoicing is assumed to be acceptable. Invoices are due upon receipt and services are pay in terms NET30.

The Client will be invoiced all costs associated with out-of-pocket expenses (including, without limitation, costs, and expenses related to meals, lodging, local transportation, and any other applicable business expenses) listed on the invoice as a separate line item. Reimbursement for out-of-pocket expenses in connection with the performance of this SOW, when authorized and up to the limits set forth in this SOW, shall be in accordance with Client’s then-current published policies governing travel and associated business expenses, which information shall be provided by the Client Project Manager. The limit of reimbursable costs pursuant to this SOW is estimated to be 15% of the fees unless otherwise authorized in writing and agreed to by both parties via the project change control procedure outlined within.

Invoices shall be submitted, referencing this Client’s SOW Number to the address indicated above. Each invoice will reect charges for the time period being billed and cumulative gures for previous periods. Terms of payment for each invoice are NET30. The Contractor shall provide Client with sufcient details to support its invoices, including timesheets for services performed and expense receipts and justications for authorized expenses unless otherwise agreed to by the parties. Payments for services invoiced that are not received within 30-days from the date of invoice will be subject to a 2% penalty per calendar month.

Invoices shall be mailed to the following contact and address:

Ship to Address:

Bill to Address:

Accounts Payable Contact:

Accounts Payable Email Address:

Accounts Payable Phone Number:

Tax Exempt: (If yes, please upload le) Yes No Agreed and Accepted:

Tec-Refresh, Inc.

Efrem Gonzales
City of Bakerseld
Chris Dorroh

Page 26 of 28 ends

Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA Terms and Conditions: Net 30
Please remit all purchase orders and invoices to:

Tec-Refresh, Inc.
10 Stevens Street #190
Andover, MA, 01810
United States
1600 Truxtun Avenue Fl 3
Bakersfield, CA 93301
United States
Ship To
City of Bakersfield, CAShip To Name
1600 Truxtun Ave Fl 3
Bakersfield, California 93301
United States
Bill To
City of Bakersfield, CABill To Name
(661) 326-3506Phone
[email protected]
Director, Technology ServicesTitle
Gregory PronovostContact Name
(617) 829-9617Phone
[email protected]
Sales Operations AdminTitle
Matthew TammaroPrepared By
Stephen CarabajalOpportunity Owner
1/30/2025Expiration Date
QUO - 2025Quote #
100 Bayview Circle, Suite 230
Newport Beach, CA 92660
US
Company Address
Contact Information
Address Information
Product Code Quote Line Item Description Quantity Sales Price Total Price

PAN-PRISMA-ACCESS-MU-LCL-ENTERPRISE
Prisma Access Mobile User Local Enterprise Edition
includes private app access and outbound internet
security for mobile users, premium security subscription, 5 service locations, 2 service connections, and standard success per mobile user per year
500.00 $189.73 $94,865.00
PAN-PRISMA-ACCESS-PREMUSG-SUCCESS For US Government accounts only. Prisma Access Premium Success 1.00 $49,505.73 $49,505.73

PAN-PRISMA-ACCESS-MU-ADEM-AIOPS
Prisma Access AI-powered Autonomous Digital
Experience Management add-on, includes DEM for
mobile user to application monitoring, predictive
analytics & Access Analyzer powered by AI/ML/Formal
and standard customer success per unit per year.
500.00 $121.18 $60,590.00
PAN-CDL-1TB-USG Cortex Data Lake with 1TB of storage, 1-year, includes US Government Premium Support 20.00 $4,511.80 $90,236.00 PAN-CONSULT-ACCESS-QUICKSTART-MOB QuickStart Service for Prisma Access Mobile Users ZTNA SIG 1.00 $19,434.71 $19,434.71
PAN-EDU-TRAINING-100 Training Credit - To be redeemed with Authorized Training Partners (ATPs) 400.00 $122.11 $48,844.00 PAN-PA-3410-AIOPS-NGFW-3YR AIOps for NGFW subscription, 3-year, PA- 3410 2.00 $11,450.41 $22,900.82
PAN-PA-3410-BND-CORESEC-3YR
PA-3410, Core Security Subscription Bundle (Advanced
Threat Prevention, Advanced URL Filtering, Advanced
Wildfire, DNS Security and SD-WAN ), 3 years (36
months) term

2.00 $37,186.91 $74,373.82
Enterprise IoT Security Plus product option. Should be

Page 27 of 28 ends

Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA Terms and Conditions: Net 30
Please remit all purchase orders and invoices to:

Tec-Refresh, Inc.
10 Stevens Street #190
Andover, MA, 01810
United States
$704,248.41Grand Total
$200.00Shipping and
Handling
$3,090.37Tax
$700,958.04Subtotal
Palo Alto PA3410 (3 Year) w/ Unit 42 + Cortex
Add On & Professional Services
Cost Breakdown:

Year 1: $350,768.23 - Year 1 of subscriptions +
HW, Quickstart, Training, Taxes, Shipping and
Professional Services
Year 2: $176,740.09
Year 3: $176,740.09
TOTAL CONTRACT VALUE: $704,248.41
Memo
0023256161Vendor Quote #
Axia Cooperative
CONTRACT NUMBER:
240160-12
CONTRACT EXPIRATION:

August 18, 2027
Contract #
PAN-IOT-ENT-PLUS purchased with IoT Security subscription. 1.00 $0.00 $0.00 PAN-PA-3410-IOT-DRDL-3YR PA-3410, IoT subscription, does not require data lake, 3 years (36 months) term. 2.00 $28,254.07 $56,508.14
PAN-SVC-PREMUSG-3410-3YR For US Government accounts only. Premium support 3-year prepaid, PA-3410 2.00 $40,620.38 $81,240.76 PAN-PA-3410 Palo Alto Networks PA-3410 with redundant AC power supplies 2.00 $18,729.53 $37,459.06

PAN-XDR-PRO-GB
Cortex XDR Pro for daily ingested GB.

Includes 30 days of ingested data retention, 180 days of alerts and incidents retention and standard success
100.00 $0.00 $0.00
PAN-XDR-PREMUSG-SUCCESS For US Government accounts only. Cortex XDR Premium Success 1.00 $0.00 $0.00
PAN-CONSULT-XDR-TB-QS QuickStart Services for Cortex XDR Pro per TB 1.00 $0.00 $0.00
PAN-U42-EOD-24HR-L1
Unit 42 Public Sector Expertise on Demand
Subscription, 24-hour remote response time. Up to 50
consulting hours.

1.00 $0.00 $0.00
PAN-CONSULT-DAY-FW Palo Alto Networks consulting services (per day) - Minimum 5 days 20.00 $2,600.00 $52,000.00
PAN-CONSULT-PRJM-DAY-FW Palo Alto Networks professional services Project Manager (per day) 5.00 $2,600.00 $13,000.00
Totals

Page 28 of 28 ends

Docusign Envelope ID: 54E56125-2C1C-458E-A7B1-EF7226ED64DA Certificate Of Completion
Envelope Id: 54E56125-2C1C-458E-A7B1-EF7226ED64DA
Status: Sent
Subject: Complete with Docusign: Tec-Refresh Final Agrmt.pdf Source Envelope:

Document Pages: 39
Signatures: 2
Envelope Originator:

Certificate Pages: 5
Initials: 0
City Clerk's Office
AutoNav: Enabled
EnvelopeId Stamping: Enabled
Time Zone: (UTC-08:00) Pacific Time (US & Canada)
[email protected]
IP Address: 174.46.226.5
Record Tracking
Status: Original
2/14/2025 8:51:50 AM
Holder: City Clerk's Office
[email protected]
Location: DocuSign
Security Appliance Status: Connected
Pool: StateLocal
Storage Appliance Status: Connected
Pool: City of Bakersfield
Location: DocuSign
Signer Events
Signature
Timestamp
Efrem Gonzales
[email protected]
President and CEO
Tec-Refresh, Inc.

Security Level: Email, Account Authentication
(None)
Signature Adoption: Pre-selected Style
Using IP Address: 24.147.209.140
Sent: 2/14/2025 8:53:47 AM
Resent: 2/14/2025 11:19:22 AM
Resent: 2/14/2025 11:19:53 AM
Viewed: 2/14/2025 11:27:11 AM
Signed: 2/14/2025 11:28:52 AM
Electronic Record and Signature Disclosure:

Accepted: 2/14/2025 11:27:11 AM
ID: 865c643b-20f2-48be-b11a-29f53df61c91
Gregory Pronovost
[email protected]
Technology Services Director
City of Bakersfield, Technology Services Department
Security Level: Email, Account Authentication
(None)
Signature Adoption: Uploaded Signature Image
Using IP Address: 174.46.226.5
Sent: 2/14/2025 11:28:56 AM
Viewed: 2/14/2025 11:31:28 AM
Signed: 2/14/2025 11:31:40 AM
Electronic Record and Signature Disclosure:

Accepted: 2/14/2025 11:31:28 AM
ID: f6fea8b7-f9d5-42c1-b256-fedd981ed31a
Jena Covey
[email protected]

RISK MANAGER
Security Level: Email, Account Authentication
(None)
Sent: 2/14/2025 11:31:43 AM
Electronic Record and Signature Disclosure:

Accepted: 2/12/2025 2:02:12 PM
ID: 84c274f6-db28-4379-a624-6eda59d45c52
In Person Signer Events
Signature
Timestamp
Editor Delivery Events
Status
Timestamp
Agent Delivery Events
Status
Timestamp
Intermediary Delivery Events
Status
Timestamp
Certified Delivery Events
Status
Timestamp

Carbon Copy Events
Status
Timestamp
Witness Events
Signature
Timestamp
Notary Events
Signature
Timestamp
Envelope Summary Events
Status
Timestamps
Envelope Sent
Hashed/Encrypted
2/14/2025 8:53:48 AM
Envelope Updated
Security Checked
2/14/2025 11:19:21 AM
Payment Events
Status
Timestamps
Electronic Record and Signature Disclosure

ELECTRONIC RECORD AND SIGNATURE DISCLOSURE
From time to time, City of Bakersfield (we, us or Company) may be required by law to provide to you certain written notices or disclosures. Described below are the terms and conditions for providing to you such notices and disclosures electronically through the DocuSign system.

Please read the information below carefully and thoroughly, and if you can access this information electronically to your satisfaction and agree to this Electronic Record and Signature Disclosure (ERSD), please confirm your agreement by selecting the check-box next to ‘I agree to use electronic records and signatures’ before clicking ‘CONTINUE’ within the DocuSign system.

Getting paper copies
At any time, you may request from us a paper copy of any record provided or made available electronically to you by us. You will have the ability to download and print documents we send to you through the DocuSign system during and immediately after the signing session and, if you elect to create a DocuSign account, you may access the documents for a limited period of time (usually 30 days) after such documents are first sent to you. After such time, if you wish for us to send you paper copies of any such documents from our office to you, you will be charged a $0.00 per-page fee. You may request delivery of such paper copies from us by following the procedure described below.

Withdrawing your consent
If you decide to receive notices and disclosures from us electronically, you may at any time change your mind and tell us that thereafter you want to receive required notices and disclosures only in paper format. How you must inform us of your decision to receive future notices and disclosure in paper format and withdraw your consent to receive notices and disclosures electronically is described below.

Consequences of changing your mind
If you elect to receive required notices and disclosures only in paper format, it will slow the speed at which we can complete certain steps in transactions with you and delivering services to you because we will need first to send the required notices or disclosures to you in paper format, and then wait until we receive back from you your acknowledgment of your receipt of such paper notices or disclosures. Further, you will no longer be able to use the DocuSign system to receive required notices and consents electronically from us or to sign electronically documents from us.

All notices and disclosures will be sent to you electronically Electronic Record and Signature Disclosure created on: 6/28/2022 10:51:05 AM Parties agreed to: Efrem Gonzales, Gregory Pronovost, Jena Covey Unless you tell us otherwise in accordance with the procedures described herein, we will provide electronically to you through the DocuSign system all required notices, disclosures, authorizations, acknowledgements, and other documents that are required to be provided or made available to you during the course of our relationship with you. To reduce the chance of you inadvertently not receiving any notice or disclosure, we prefer to provide all of the required notices and disclosures to you by the same method and to the same address that you have given us. Thus, you can receive all the disclosures and notices electronically or in paper format through the paper mail delivery system. If you do not agree with this process, please let us know as described below. Please also see the paragraph immediately above that describes the consequences of your electing not to receive delivery of the notices and disclosures electronically from us.

How to contact City of Bakersfield:

You may contact us to let us know of your changes as to how we may contact you electronically, to request paper copies of certain information from us, and to withdraw your prior consent to receive notices and disclosures electronically as follows:

To contact us by email send messages to: [email protected]

To advise City of Bakersfield of your new email address To let us know of a change in your email address where we should send notices and disclosures electronically to you, you must send an email message to us at [email protected] and in the body of such request you must state: your previous email address, your new email address. We do not require any other information from you to change your email address.

If you created a DocuSign account, you may update it with your new email address through your account preferences.

To request paper copies from City of Bakersfield
To request delivery from us of paper copies of the notices and disclosures previously provided by us to you electronically, you must send us an email to [email protected] and in the body of such request you must state your email address, full name, mailing address, and telephone number. We will bill you for any fees at that time, if any.

To withdraw your consent with City of Bakersfield
To inform us that you no longer wish to receive future notices and disclosures in electronic format you may:
i. decline to sign a document from within your signing session, and on the subsequent page, select the check-box indicating you wish to withdraw your consent, or you may; ii. send us an email to [email protected] and in the body of such request you must state your email, full name, mailing address, and telephone number. We do not need any other information from you to withdraw consent.. The consequences of your withdrawing consent for online documents will be that transactions may take a longer time to process..

Required hardware and software
The minimum system requirements for using the DocuSign system may change over time. The current system requirements are found here: https://support.docusign.com/guides/signer-guide- signing-system-requirements.

Acknowledging your access and consent to receive and sign documents electronically To confirm to us that you can access this information electronically, which will be similar to other electronic notices and disclosures that we will provide to you, please confirm that you have read this ERSD, and (i) that you are able to print on paper or electronically save this ERSD for your future reference and access; or (ii) that you are able to email this ERSD to an email address where you will be able to print on paper or save it for your future reference and access. Further, if you consent to receiving notices and disclosures exclusively in electronic format as described herein, then select the check-box next to ‘I agree to use electronic records and signatures’ before clicking ‘CONTINUE’ within the DocuSign system.

By selecting the check-box next to ‘I agree to use electronic records and signatures’, you confirm that:
 You can access and read this Electronic Record and Signature Disclosure; and  You can print on paper this Electronic Record and Signature Disclosure, or save or send this Electronic Record and Disclosure to a location where you can print it, for future reference and access; and
 Until or unless you notify City of Bakersfield as described above, you consent to receive exclusively through electronic means all notices, disclosures, authorizations, acknowledgements, and other documents that are required to be provided or made available to you by City of Bakersfield during the course of your relationship with City of Bakersfield.

Bakersfield City CouncilFebruary 26, 2025

Bakersfield City Council
February 26, 2025