2024-08-27; City Council; 02; Master Services Agreement for Hosting Services and Professional Services with Navisite LLC for the Lawson Human Capital Management System Software and Management

CA Review AZ
Meeting Date:

To:

From:

Staff Contact:

Subject:

Districts:

Aug. 27, 2024
Mayor and City Council
Scott Chadwick, City Man ager
Doug Kappel, Enterprise Applications Manager
[email protected], 442-339-2791
Maria Callander, Information Technology Director
[email protected], 442-339-2454
Master Services Agreement for Hosting Services and Professional Services with Navisite LLC for the Lawson Human Capit al Management System Software and Management
All
Recommended Action
Adopt a resolution ratifying and authorizing the City Manager to execute a master services agreement with Navisite LLC for hosting and professional services for the Lawson Human Capital System software in an amount not to exceed $365,988 for a one-year term ending June 30, 2025, authorizing the City Manager to execute the optional three one-year extensions if required, and approving the carryforward of $365,988 from the fiscal year 2023-24 Information Technology Operating Fund budget into the fiscal year 2024-25 budget.

Executive Summary
The city uses the Lawson Human Capital Management System software for its human resources, benefits, employee self-service and payroll applications. Since 2010, the city initially contracted with Velocity Technology Solutions, Inc., which just over three years ago was acquired by Navisite LLC (“Navisite”) to host and service the system.

This proposed master services agreement with Navisite would continue the services until June 30, 2025, with the option for three additional one-year extensions.

The City Council is being asked to authorize the City Manager to execute the master services agreement with Navisite as well as the optional three extensions if the city determines the extensions to be appropriate.

The City Council’s approval is required because Carlsbad Municipal Code Section 3.28.060 - Procurement of Professional Services and Services – designates the City Council as the awarding authority for procurement of professional services and services that will cost the city more than $100,000 per agreement year.

Aug. 27, 2024
Item #2 Page 1 of 52
Staff had expected to present this item to the City Council in the last fiscal year, and the $365,988 cost of the first year of this agreement was included in the Information Technology Department’s fiscal year 2023-24 Operating Fund budget. However, negotiations over the agreement took longer than anticipated. Because of that delay, staff are also asking the City Council to ratify the agreement and approve carrying forward of the unspent fiscal year 2023- 24 Operating Fund budget to the budget for the current fiscal year.

Explanation & Analysis
Background
The City Council approved the initial agreement in 2010 as well as numerous amendments to extend and revise the various services provided by Navisite. The current agreement expired on June 30, 2024. The proposed new master services agreement will continue the services provided by Navisite for a term ending on June 30, 2025, with the option for three one-year extensions.

Service provided
A new master services agreement is required to continue the operation of all the modules of the Human Capital Management System. The agreement calls for Navisite to provide:
• All required hardware, operating system and database licenses, as well as maintenance of the infrastructure necessary to support the Lawson Human Capital Management System application
• Full functional and technical support for the city’s Human Capital Management System and processes
• Extended support, to include existing interfaces with external systems such as the city’s timekeeping and learning management systems
• Customer support at all hours and days of the week
• Active directory services, which allow staff to login into Lawson using the same username and password that is used to login to their network accounts • Process automation that provides for automating manual and process-intensive human resource workflows and workplace standards
• Microsoft add-ins
• Design Studio
• Lawson Business Intelligence reporting system
• Tax applications
• Disaster recovery
• Employee self-service
Fiscal Analysis
The cost of this master services agreement with Navisite is not to exceed $365,988 for the one- year period ending June 30, 2025. Funding for the first year’s services was available in the fiscal year 2023-24 Information Technology Department’s Operating Fund in the amount of $365,988, this amount is being requested as a carryforward budget request from fiscal year 2023-24. (Carryforward budget items carry unspent funds budgeted to have been spent in one fiscal year into the next fiscal year.)
Aug. 27, 2024
Item #2 Page 2 of 52
Funding for the first optional extension, if required, for the second year of the agreement was included in the Information Technology Department’s Operating Fund for the fiscal year 2024- 25 in the amount of $384,287. Funding for the remaining possible extensions, if required, will be included in the annual budget request process for fiscal year 2025-26 and beyond as needed.

Master service agreement summary
Possible extensions
Year 1 Year 2 Year 3 Year 4
Description FY 2024-25 FY 2025-26 FY 2026-27 FY 2027-28 Total Management Services $201,900 $211,995 $222,595 $233,724 $870,214 Cloud Services $164,088 $172,292 $180,907 $189,953 $707,240 Total $365,988 $384,287 $403,502 $423,677 $1,577,454
Next Steps
Staff will complete execution of the agreement and continue working with Navisite to provide continuous operation of the Human Capital Management System.

Environmental Evaluat ion
This action does not require environmental review because it does not constitute a project within the meaning of the California Environmental Quality Act under California Public Resources Code Section 21065 in that it has no potential to cause either a direct physical change or a reasonably foreseeable indirect physical change in the environment.

Exhibit

1. City Council resolution
Aug. 27, 2024
Item #2 Page 3 of 52
RESOLUTION NO. 2024-207

A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF CARLSBAD,

CALIFORNIA, RATIFYING AND AUTHORIZING THE CITY MANAGER TO

EXECUTE A MASTER SERVICES AGREEMENT WITH NAVISITE LLC FOR

HOSTING AND PROFESSIONAL SERVICES FOR THE LAWSON HUMAN CAPITAL SYSTEM SOFTWARE IN AN AMOUNT NOT TO EXCEED $365,988 FOR A ONE YEAR TERM ENDING JUNE 30, 2025, AUTHORIZING THE CITY MANAGER TO

EXECUTE THE OPTIONAL THREE ONE-YEAR EXTENSIONS IF REQUIRED, AND APPROVING THE CARRYFORWARD OF $365,988 FROM THE FISCAL YEAR 2023-24 INFORMATION TECHNOLOGY OPERATING FUND BUDGET INTO THE FISCAL YEAR 2024-25 BUDGET
WHEREAS, the City Council of the City of Carlsbad, California, has determined that the most effective way to operate and support the Lawson Human Capital Management Systems is through the use of a hosted solution; and
WHEREAS, the City of Carlsbad currently contracts with Navisite LLC (Navisite) for Human Capital Management Systems hosting services; and
WHEREAS, the current agreement expired on June 30, 2024, and Navisite continued to provide services without the benefit of an agreement; and
WHEREAS, a new master services agreement is needed with Navisite to continue to provide the services; and
WHEREAS, the current Human Capital Management Systems software (Version 10) is required to have annual support; and
WHEREAS, Navisite will provide hosting and professional services to support Version 10 and application management; and
WHEREAS, the new one-year agreement will, in addition to the hosting services, provide full functional application support for a period ending June 30, 2025; and WHEREAS the new agreement has an option for three one-year extensions; and WHEREAS, the City Manager will have the authority to execute the three one-year extensions in the appropriate year if determined to be required; and WHEREAS, the Information Technology Department expects to have sufficient available budget in the 2023-24 fiscal year end to fund the first year of the agreement; and Exhibit 1
August 27, 2024
Item #2 Page 4 of 52
August 27, 2024
Item #2 Page 5 of 52
WHEREAS, the Information Technology Department has proposed the funding for the first extension of the agreement in the fiscal year 2024-25 budget to fund these services, if required , for the second year of the agreement .

NOW, THEREFORE, BE IT RESOLVED by the City Council of the City of Carlsbad, California, as follows:

1. That the above recitations are true and correct.

2. That the master services agreement between the city and Navisite (Attachment A) is hereby approved and ratified, and the City Manager is authorized to execute all required documents on behalf of the city to enter into the master services agreement .

3. The City Manager is authorized to execute all required documents on behalf of the city for the three optional one-year extensions, if determined to be appropriate .

4. That the total Hosting Services and Professional Services for the Lawson Human Capital Management System from Navisite shall not exceed $365,988 for the one-year term ending June 30, 2025.

5. That the City Manager, or designee, is authorized to carryforward $365,988 from the fiscal year 2023-24 Information Technology Department Operating Fund budget surplus to the current fiscal year Information Technology Department Operating Fund to fund the first year of the Navisite agreement.

PASSED, APPROVED AND ADOPTED at a Regular Meeting of the City Council of the City of Carlsbad on the 27th day of August, 2024, by the fol lowing vote, to wit:

AYES:

NAYS:

ABSTAIN:

ABSENT:

BLACKBURN, BHAT-PATEL, ACOSTA, BURKHOLDER, LUNA.

NONE.

KEITH BLACKBURN, Mayor
SHERRY FREISINGER, City Clerk
{SEAL)
August 27, 2024
Item #2 Page 6 of 52
Master Services Agreement Page 1
Rev.07.2023
Master Services Agreement
This M
aster Services Agreement (this “Master Agreement”) is dated as of July 1, 2024 (the “Effective Date”) and is incorporated by reference into and made a part of each SOW (as defined below) by and between Navisite LLC and its Affiliates, as defined below (the “Company”), and the Customer identified on the signature page to this Master Agreement (the “Customer”). This Master Agreement, along with the applicable SOWs, are referred to herein, collectively, as this “Agreement.” By executing a SOW, the Customer agrees to the terms and conditions set forth in this Master Agreement. The Company and Customer may be referred to herein or in any SOW each as a “Party” and, collectively, as the “Parties.” Capitalized terms used in this Agreement and not otherwise defined shall have the meanings ascribed to them in Section 17.

Section 1: Scope of Services; Performance.

1.1 Services; Deliverables. The Company agrees to provide, and Customer agrees to accept in accordance with the terms and conditions of this Agreement those services described in an applicable SOW (the "Services") and the Deliverables described therein. Company and Customer may, by mutual agreement and in accordance with this Agreement, enter into additional SOWs which, upon execution by both Parties, shall become attachments to and shall be incorporated into this Agreement. Each SOW, together with this Master Agreement, shall be deemed to be a separate agreement by and between the Parties.

1.2 Commencement; Method of Performing Services. Unless otherwise provided in an applicable SOW, the Company shall commence performance of the Services within 30 days after both Parties shall have executed and delivered the applicable SOW. Unless otherwise set forth in the applicable SOW, the Company shall have the right to determine the method, details, and means of performing the Services and delivering the Deliverables.

1.3 Changes to Specifications. Changes to any Specifications in an SOW shall become effective only when a written change order describing such changes and setting forth the terms and conditions thereof (a “ Change Order”) is executed by authorized representatives of both Parties. Each Change Order shall describe any mutually- agreed-upon changes or additions; provide a schedule for the development, installation, implementation of the additional Services or Deliverables and include the applicable fees for the aforementioned changes, modifications, and/or customizations. The Company will not commence, and Customer shall not be liable for any charges associated with any change request until the Company and Customer have approved a final Change Order. In the event that a pending Change Order describes Services or Deliverables which could affect the Company’s performance of other Services or Deliverables under an outstanding SOW, the Company may delay its performance of such Services and delivery of such Deliverables until such time as the applicable Change Order shall have been accepted or rejected in writing by Customer. The Company ’s time for performance under any such affected SOW shall be extended to account for any delays caused by Customer’s failure to accept or reject any Change Order and for any other delays that result from the changes made pursuant to such Change Order.

Section 2: Invoic
ing; Payments. Unless otherwise provided in an applicable SOW, the Company will endeavor to submit invoices to Customer for payment for Services and/or Deliverables on a monthly basis. All initial set-up and other one-time fees will be invoiced upon execution of the applicable SOW. Usage-based overage charges shall be invoiced in arrears and monthly recurring fees will be invoiced for the Current month. However, in no event shall payments due to Company exceed the fees specified in the SOW unless the parties execute an amendment to this Agreement or the applicable SOW . Invoices may be provided to Customer by email. Customer shall pay all undisputed invoices within thirty (30) days of the invoice issuance date. Monthly commitment fees for metered services are not prorated. All invoices shall (i) specifically refer to the SOW to which they relate and (ii) separately set forth reimbursable expenses ( if any), but Company shall not incur any reimbursable expenses without written consent from Customer . Disputed fees (excluding AWS and equipment purchases which must be paid when due regardless of any dispute) must be reported by Customer to the Company in writing as follows: (1) for invoices issued in arrears, within thirty (30) days of the applicable invoice date; and (2) for invoices issued in advance, within sixty (60) days of the applicable invoice date . Without limiting the Company’s rights under Section 9 of this Agreement, if Customer fails to pay any undisputed invoice within fifteen (15) days of the due date , the Company may cease all further work until such time as it receives payment in full. Furthermore, if Customer is more than fifteen (15) days delinquent in any payments to the Company , the Company may modify its payment terms in its sole and absolute discretion, including without limitation, the Company may require further assurances or security from Customer or full payment prior to commencing any Services or delivering any Deliverables under any and all SOWs or other agreements with Customer. All payments shall be made in U.S. Dollars. If Customer fails to pay any undisputed invoice within fifteen (15) days of the due date, Customer shall incur interest at the rate of one and one- half percent (1.5%) per month, assuming 30 -day months, but in no event in excess of the maximum rate allowed by law.

Section 3: Compens
ation.

3.1 Compensation. In consideration of the Deliverables and/or the Services to be performed by the Company, the Company shall be entitled to compensation in accordance with the payment and compensation terms described in the SOW pertaining to such Services and/or Deliverables; provided, however, in the event that such SOW shall Attachment A
Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 7 of 52

IIINAVISITE
Master Services Agreement Page 2
Rev.07.2023
not specify payment and compensation terms, the Company shall be entitled to compensation on a time and materials basis at its then-current rates. Customer acknowledges that p rices listed in a SOW shall remain in effect for the duration of the term specified in the applicable SOW. In the event a SOW does not specify the duration of the pricing listed in such SOW, the prices for the Services and Deliverables described therein shall increase by a maximum of five percent (5%) per annum.

3.2 Public Cloud Hosting Fees. In addition to the compensation described in Section 3.1, when acting as Customer’s Public Cloud reseller, the Company will pass through the cost of all services provided by the Public Cloud to the Company on Customer’s behalf (“Cloud Fees”). The amount of such Cloud Fees will be as determined by the Public Cloud provider from time-to-time and may be increased or decreased in the Public Cloud provider’s sole discretion, whether due to usage charges, changes in base rates or other factors as Public Cloud may determine.

Customer agrees that Company may change the Cloud Fees charged with respect to Public Cloud services at any time based upon changes in rates implemented by Public Cloud provider. Customer acknowledges and agrees that the Cloud Fees can vary based on a variety of circumstances outside the control of the Company (including without limitation hacking attempts, poorly optimized data processing and/or lack of appropriate employee supervision) and the Company shall not have any liability to Customer as a result thereof. In the event Cloud Fees increase as specified above, the parties hereby agree to and shall execute an amendment to the applicable SOW to account for said increased fees.

3.3 Hardware and Software Purchases. Any and all hardware , software and other purchases by the Company for Customer shall be agreed upon in writing by the Parties prior to the Company placing an order. In the event of purchases of $2,000 or more in the aggregate, upon the Company’s request, Customer shall pay 50% of the order amount prior to the Company’s placement of the order. The remaining balance must be paid before delivery, but in no event later than five (5) days after placement of the applicable order.

3.4 Delays in Services and/or Deliverables. Delays. In the event of a delay in the provision of the Services or delivery of any Deliverables , or if additional work outside the scope of an applicable SOW is required by the Company, due to no fault of the Company, the Company may cease provision of the affected Services and Deliverables until such time as the Customer and the Company have entered into an appropriate Change Order to address such delays and additional work.

3.5 Credits. From time to time the Company may, in its sole discretion, offer and/or grant certain incentive credits to Customers pursuant to an applicable SOW . Such incentive credits have no cash value and may not be redeemed in any form except as payment for future Services and/or Deliverables to be provided under the particular SOW pursuant to which such credits were granted. Anything to the contrary notwithstanding, the maximum amount of incentive credits that Customer may redeem under a particular SOW is expressly limited to an amount equal to ten percent (10% ) of the total amount payable by Customer to the Company under such SOW for Services and Deliverables. Unless otherw ise agreed by the Company in writing, the total amount payable under an SOW for purposes of calculating the maximum incentive credit amount shall exclude amounts paid by the Customer to cover the Company’s out of pocket expenses (including without limitation, all AWS Fees and amounts paid for hardware, software and other purchases by the Company on behalf of Customer). In the event that the amount payable for a usage-based Service’s value is less than any maximum amount specified in an applicable SOW, the Company may adjust the amount of such credit downward accordingly without further action on the part of Customer. Third party credits, including those provided by AWS, are solely provided subject to the approval of the applicable third party.

Under no circumstances will the Company guarantee or otherwise contribute these third -party credits or the value they imply.

3.6 Taxes. Customer shall have sole responsibility for the payment of all taxes and duties imposed by all governmental entities, including but not limited to federal, state, local, and foreign sales, use, excise, utility, gross receipts, value added and other taxes, tax-like charges, and tax-related charges, except solely taxes imposed on the net income of the Company.

Section 4: Acceptance.

4.1 Acceptance. Unless otherwise set forth in an applicable SOW, the Services and each Deliverable shall be deemed to be accepted upon the earliest to occur of: (i) receipt by the Company from Customer of written notice that the Service or Deliverable has been accepted by Customer, or (ii) the date which is ten (10) business days after performance of the Service or delivery of such Deliverable to Customer (“Acceptance”), unless Customer shall have previously provided to the Company a written statement describing the nonconformance of the applicable Service or Deliverable. In the event of a dispute, acceptance or rejection shall be determined as provided in Section 10 using the criteria set forth in Section 4.2.

4.2 Criteria. A De
liverable may not be rejected unless it contains a material defect which would prevent such Deliverable from functioning substantially in accordance with the applicable Specification as outlined in the SOW and the Services may not be rejected unless the Services were not performed in a professional and workmanlike manner substantially in accordance with the applicable Specification. Only defects affecting the function, performance or fit of such Deliverable or its failure to substantially satisfy other specific requirements included in the applicable Specification may result in rejection for noncompliance. A determination that the Services or any Deliverable fails to comply with its Specification may not be based upon any No-Fault Condition.

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 8 of 52
Master Services Agreement Page 3
Rev.07.2023
Section 5: Ownership and Rights.

5.1 Ownership of Intellectual Property. Customer retains all right, title and interest in and to any and all Customer Data (as defined in Section 17) along with all software and other works, materials and Intellectual Property created by Customer or its third-party providers and made accessible by Customer to Company in connection with this Agreement (“Customer-Provided Materials”). Customer, not the Company, shall have sole responsibility for the use, accuracy, quality, integrity, legality, reliability, appropriateness, and ownership and/or rights to use, all Customer Data and Customer-Provided Materials. Except for the Company Tools (as defined below) and unless otherwise set forth in an applicable SOW, all Intellectual Property made , conceived, reduced to practice and/or developed by the Company and delivered to Customer as a Deliverable during the term of this Agreement shall be the sole property of Customer upon payment of the applicable fees. To the extent of any interest of the Company in the Deliverable, the Company agrees to assign and, upon its creation, automatically assigns to Customer all right, title and interest in and to such Intellectual Property, without the necessity of any further consideration. The Company hereby further agrees to execute, and to cause its employees, agents and representatives, as applicable, to execute upon request any other lawful documents and likewise to perform any other lawful acts which may be reasonably necessary to secure fully the ownership of such Intellectual Property to Customer, including the execution of applications for patents, and the execution of substitution, reissue, divisional or continuation applications and preliminary or other statements and the giving of testimony in any interference or other proceeding in which said invention or any application or patent directed thereto may be involved.

5.2 The Company Tools.
(a) In order to provide the Services and/or Deliverables, the Company may install certain tools, including without limitation software tools, on Customer’s Environment. Customer hereby consents to the installation and use of such tools solely for the purpose of providing the Services and/or Deliverables during the term of this Agreement (including without limitation any transition period). Such tools shall be for the sole use of the Company and its permitted subcontractors and shall comprise the Company Tools (as defined below). (b) Anything to the contrary notwithstanding, the Company shall retain all right, title and interest in and to (a) any portion of the Company’s Intellectual Property in existence prior to the effective date of this Agreement including, but not limited to software tools, methods and know-how that Company originated and uses in its business, (b) any Intellectual Property created by or on behalf of the Company during the term of this Agreement for the benefit of the Company or its customers generally, but only to the extent such Intellectual Property does not embody or contain Confidential Information of Customer, (c) any information, data, reports, writings, works of art, ideas, source code, inventions or know how that consist solely of improvements to the foregoing, if such improvements can be used by the Company and/or such customers independently of any of Customer’s Confidential Information and (d) Intellectual Property licensed to the Company by third parties (all of the foregoing, collectively, the “Company Tools”). To the extent of any interest of Customer in any Company Tools, Customer agrees to assign and, upon its creation, automatically assigns to the Company or the Company’s designee(s) all right, title and interest in and to such Company Tools, without the necessity of any further consideration. Customer hereby further agrees to execute, and to cause its employees, agents and representatives, as ap plicable, to execute upon request any other lawful documents and likewise to perform any other lawful acts which may be deemed necessary to secure fully the aforesaid Company Tools to the Company or its designee, including the execution of applications for patents, and the execution of substitution, reissue, divisional or continuation applications and preliminary or other statements and the giving of testimony in any interference or other proceeding in which said invention or any application or patent directed thereto may be involved.

5.3 Licenses; Limitations.
(a) In the event that an SOW shall provide that a specific Deliverable shall not be owned by Customer (pursuant to Section 5.1), or a Deliverable comprises the Company Tools, such Deliverables shall be licensed and not sold as set forth herein. Subject to the terms of this Agreement, including without limitation any additional rights or limitations set forth in an applicable SOW, so long as Customer continues to have an effective SOW for the provision of maintenance or management services covering such Deliverables, the Company grants to Customer a worldwide, nonexclusive, non-transferable (except in connection with an assignment of this entire Agreement in accordance with Section 14.10), royalty-free right and license to use, execute, and display each such Deliverable in connection with its Environment.
(b) Unless otherwise provided in an applicable SOW:
(i) Customer agrees that it shall not cause or permit the disassembly, de-compilation, modification or reverse engineering of any Deliverable or otherwise attempt to gain access to the source code to any Software delivered to Customer as part of a Deliverable and/or Service. (ii) Customer shall not, and shall not permit any third-party to take any action which would cause any or all Company Intellectual Property to be placed in the public domain or to become Open-Source Software; and (iii) except as provided in Section 5.1 or in an applicable SOW, Customer acknowledges that this Agreement does not provide Customer with title to or ownership of any Intellectual Property, but only a license of limited use under the terms and conditions of this Agreement.

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 9 of 52
Master Services Agreement Page 4
Rev.07.2023
(c) Unless otherwise provided in a separate written agreement, all third -party software products shall be licensed directly to Customer by the applicable third party pursuant to the terms and conditions of applicable license agreements provided by such third parties. To the extent that any third-party software is sublicensed to Customer by the Company, (i) Contractor warrants it will pass through any applicable third-party warranties to the City to the extent Contractor is legally able to do so, and Contractor will reasonably cooperate in enforcing said warranties; and (ii) the foregoing provisions shall be for the benefit of the Company and its third-party licensors.

5.4 Company Use of Customer Materials. Solely for the purpose of performing the Services and delivering the Deliverables outlined in an executed SOW, the Company shall have the irrevocable, nonexclusive, worldwide, royalty-free right and license during the term of this Agreement to (i) access the Customer Data, (ii) to use, execute, reproduce, display, perform, distribute and prepare Derivative Works based upon the Customer-Provided Materials and Derivative Works thereof and (iii) to authorize or sublicense others fro m time to time to do any or all of the foregoing on its behalf.

5.5 Availability of Support for Customer-Provided Materials. During the term of this Agreement, Customer shall ensure that any and all Customer-Provided Materials are currently supported versions and/or releases of such Customer-Provided Materials, as determined by the supplier or vendor thereof. Customer acknowledges and agrees that, anything to the contrary notwithstanding, the Company shall not be liable for any loss or damage whatsoever which results from the use by the Company of any Customer-Provided Materials, whether such loss or damage occurs because (a) such Customer-Provided Materials are not supported by the applicable supplier or vendor, (b) such Customer-Provided Materials are no longer compatible with other applications employed by Customer or (c) a vendor-provided patch or fix is not available to the Company without charge (each, an “EOL Event”). Customer hereby waives all rights, claims and causes of action in connection therewith and acknowledges and agrees that in the event that Customer continues to use any Customer-Provided Materials after an EOL Event shall have occurred, the Company shall not be in breach of any obligation under or related to this Agreement or liable or responsible for any loss or damage whatsoever caused by such usage (or by virtue of such Customer-Provided Materials no longer being supported) or incur any obligation for any SLA credits or any other amounts related to such Customer-Provided Materials. In the event that an EOL Event impairs the Company’s ability to perform the Services and/or deliver Deliverables, the Company may cease provision of the affected Services and /or Deliverables until such time as the Customer and the Company have entered into an appropriate Change Order to address such EOL Event.

5.6 Certain Warranties and Representations. Customer represents and warrants that it has obtained all rights and licenses necessary for the Company to use all Customer Data and Customer-Provided Materials, as contemplated by this Agreement, including without limitation all consents or authorizations required under applicable laws, rules or regulations relating to the processing of personal data by Company, and that the use by the Company of such Customer Data and Customer-Provided Materials as contemplated by this Agreement will not (a) result in any breach or violation of the rights of any third party by the Company, (b) cause the Company to incur any liability or other obligation to any third party or (c) result in any violation of any laws, rules or governmental regulations. In the event of a breach of the foregoing representations and/or warranties, the Company shall not be required to use the applicable Customer Data and/or Customer -Supplied Materials and the Company may cease provision of the affected Serv ices and /or Deliverables until such time as the Customer and the Company have entered into an appropriate Change Order to address such breach.

5.7 Certain Third-Party Software. Anything to the contrary in this Agreement notwithstanding, any Software provided as part of a Deliverable may link to or be provided with Open-Source Software, which Open-Source Software shall be subject to and licensed by Customer from the appropriate third parties pursuant to the terms and conditions of applicable license agreements provided by such third parties. The Company provides no license directly to Customer to use any third-party software, including without limitation any Open-Source Software.

Section 6: Confi
dential Information.

6.1 Use of Confidential Information. Except as specifically provided in this Agreement, each Party shall treat as confidential all Confidential Information (as defined below) of the other Party, shall not use such Confidential Information except as contemplated under this Agreement, and neither P arty shall disclose such Confidential Information to any third-party. However, Confidential Information may be disclosed to directors, officers, managers, members, partners, employees, attorneys, accountants, financial advisors, contractors or representatives (collectively, “Representatives”) of the receiving Party, but only if such Representatives need to know the Confidential Information in order to assist such Party in performing under or complying with this Agreement, each such Representative has an obligation of confidentiality to such receiving Party no less restrictive than the terms of this Agreement and, in any event, the receiving Party shall be responsible for any breach of this Agreement by its Representatives. The foregoing notwithstanding, this Agreement will not prohibit the receiving Party from compliance with information requests of a legally compulsory nature, such as subpoenas or court orders, or compliance with the California Public Records Act (CA Government Code § 6250 et seq.) and the California Civil Discovery Act (California Code of Civil Procedure § 2016.010 et seq., provided that the receiving Party uses commercially reasonable efforts to provide the disclosing Party with notice of receipt of such information requests that involve intellectual property or trade secrets as soon as reasonably practicable so that Company may seek legal protection of said Confidential Information. The Parties’ obligations under this paragraph shall terminate one (1) year from the latter of the termination date of this Agreement or the date upon which such Confidential Information was returned or destroyed Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 10 of 52
Master Services Agreement Page 5
Rev.07.2023
in accordance with Section 6.5; provided, however obligations with respect to Confidential Information constituting trade secrets and information which is required to be kept confidential under applicable laws or governmental regulations (e.g. without limitation information privacy or data protection laws) shall not expire.

6.2 Data Protection. Company shall implement and maintain commercially reasonable administrative, technical and organizational security measures designed to safeguard against unauthorized access, disclosure or theft of Customer Data and Confidential Information. Such security measures shall be in accordance with generally accepted industry standards and not less stringent than the measures the Company applies to its own data Company shall: (i) provide the applicable Services described in such SOW to Customer solely from data centers located in the United States; (ii) store Customer Data and Confidential Information at rest relating to the applicable Services solely in data centers located in the U.S.; and (iii) notify Customer of any plans to relocate the hosted Services described in the SOW from one data center to another data center. Company: (i) shall not authorize its personnel or contractors to store Customer Data and Confidential Information relating to the applicable Services on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers; or (ii) shall only authorize its personnel and contractors to remotely access Customer Data and Confidential Information relating to the applicable Services to the extent required to provide technical support to Customer. Without the prior written consent of Customer, Company agrees not to use any information collected in connection with Services provided to Customer pursuant to this Agreement or any SOW for any purpose other than fulfilling the Services or Deliverables. Company will use commercially reasonable measure s and efforts to ensure compliance with the preceding sentence of this Section by any contractors, subcontractors, or consultants retained by Company used for the purpose of performing any part of the Services or delivering the Deliverables. Notwithstanding anything in this Section 6.2, this Agreement or any SOW to the contrary, Customer acknowledges and agrees that (i) except for Services provided by Company pursuant to which Company undertakes to record, store, retrieve, use or otherwise process Customer PII (as defined below), Company is authorized to provide Services to Customer from data centers located outside the United States; (ii) Customer Data and Confidential Information that does not comprise Customer PII may be stored by Company in data centers located outside the U.S .; and (iii) configuration, installation, maintenance, planning, migration, diagnostic, support and related services provided to Customer by Company pursuant to this Agreement or any SOW, including, without limitation, services pertaining, affecting or relating to Customer PII, may be provided by Company personnel and contractors located outside the U.S. using portable devices, including personal computers, located outside the U.S.

6.3 General Knowledge. Anything to the contrary in this Agreement notwithstanding, the Company and its personnel shall be free to use and employ its and their general skills, know-how, and expertise, and to use, disclose, and employ any generalized ideas, concepts, know-how, methods, techniques, or skills gained or learned during the course of any assignment, so long as it or they acquire and apply such information without disclosure of any Confidential Information of Customer.

6.4 Marketing. The Company may, for the purpose of marketing its services, divulge (by way of example and without limitation, via a listing on its website or in other promotional materials) to its customers and prospects that the Company has performed Services for Customer.

6.5 Ownership; Return. Except as provided in this Agreement, Confidential Information shall remain the property of the disclosing Party. Upon expiration or earlier termination of this Agreement, the receiving Party shall immediately cease to use the disclosing Party’s Confidential Information and, at the disclosing Party’s written request, either return to the disclosing Party or destroy all Confidential Information and all copies, summaries or reports thereof that are in the possession or control of the receiving Party or its Representatives; provided, that the receiving Party may retain a copy of this Agreement and any records necessary to the extent required by applicable law, rule or regulation so long as such records are kept confidential, but with the understanding that this Agreement is not confidential. Any destruction pursuant to the preceding sentence shall be promptly confirmed in writing.

Section 7: Warranties; Indemnification.

7.1 Warranty; Remedies.
(a) Unless otherwise provided in an applicable Specification or as set forth below, the Company warrants for a period of sixty (60) days from the performance of Services or delivery of a Deliverable, as applicable, that such Services shall have been performed in a professional and workmanlike manner, consistent with generally accepted industry standards, and that such unmodified Deliverable will operate substantially in accordance with its Specification. Anything to the contrary notwithstanding, no warranty shall apply with respect to any No -Fault Condition.
(b) The warranties above shall be contingent upon the continue d satisfaction of all the following conditions:
(i) all software and the Customer’s Environment are implemented and operated by Customer in accordance with all applicable documentation and manufacturer specifications; (ii) Customer is not in breach of any of its representations, warranties and/or obligations set forth in this Agreement; (iii) Customer shall have notified the Company of any warranty defect as promptly as reasonably possible after becoming aware of such defect; (iv ) Customer shall have properly installed and used all updates made available, and any updates recommended by the Company with respect to any third -party products that affect the performance of the Environment; (v) Customer shall have properly maintained all associated equipment and software in accordance with applicable written Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 11 of 52
Master Services Agreement Page 6
Rev.07.2023
specifications provided by the applicable manufacturer of such equipment and software; (vi) Customer shall not have introduced other equipment or software that causes an adverse impact on the Environment ; (vii) Customer shall have paid all undisputed amounts due hereunder and is not in default of any provision of this Agreement; and (viii) Customer shall have made no changes, nor permitted any changes to be made, to the Services and/or Deliverables, other than with the express written approval of the Company. (c) In addition, the Company does not (i) warrant that the Deliverables will run properly on any systems other than those specified in an applicable SOW, that the Deliverables or Services will meet any Customer’s requirements not specified in an appliable SOW, that the Deliverables will operate in the combinations which Customer may select for use, that the operation of the Deliverables will be uninterrupted or error -free, or that all Deliv erable errors will be corrected (ii) provide any warranty with respect to any Third Party Products, but will assign to Customer, to the extent permitted, any warranties given to the Company by the manufacturers or vendors of such Third Party Products and, upon Customer’s reasonable request, will reasonably assist Customer with obtaining warranty coverage, if any, available from the applicable third-parties or (iii) provide any warranty with respect to the failure of any Services or Deliverables or any degradation of performance resulting from Customer software or system environment modifications, including without limitation new reports or patches added to Customer’s Environment, unless such modifications shall have been reviewed and approved by a Company remote database administrator prior to installation.
(d) EXCEPT AS EXPRESSLY PROVIDED IN THIS SECTION 7.1 OR IN AN APPLICABLE SPECIFICATION, THE DELIVERABLES, ANY SERVICES AND ALL OTHER PRODUCTS PROVIDED HEREUNDER ARE BEING PROVIDED “AS IS”

WITHOUT WARRANTY OF ANY KIND AND THE COMPANY HEREBY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS

OR IMPLIED, ORAL OR WRITTEN, WITH RESPECT TO THE DELIVERABLES AND ANY SERVICES INCLUDING, WITHOUT

LIMITATION, ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR ANY PARTICULAR PURPOSE AND NON-

INFRINGEMENT, AND ALL IMPLIED WARRANTIES ARISING FROM STATUTE, COURSE OF DEALING, COURSE OF PERFORMANCE, AND/OR USAGE OF TRADE.

7.2 Exclusive Remedies. If Customer notifies the Company, within the applicable warranty period, that it believes there has been a breach of this warranty, and states in reasonable detail the nature of the claimed breach, then the Company will promptly investigate the matter. If the Company reasonably determines that there has been a breach of the warranty herein, Customer’s exclusive remedies, and the Company's sole liability, will be for (i) the Company to promptly correct or re -perform any defective Services and/or Deliverables so that such Services and Deliverables comply with the performance warranty or (ii) if the Company determines, after making commercially reasonable efforts to remedy the breach, that Company is unable or it is impracticable to correct such breach, Company shall refund Customer prorated prepaid fees for the affected Service, or a portion of the purchase price paid to the Company for the affected Deliverable as reduced in accordance with a three (3) year, straight- line depreciation schedule commencing on the date of delivery of the Deliverable and Company may terminate the applicable SOW. The Parties acknowledge that the provisions of this Section 7 have been negotiated by them and reflect a fair allocation of risk between the Parties.

7.3 Indemnification of Customer.
(a) The Company will defend, indemnify and hold harmless Customer against any third party claim, suit, action, and/or proceeding (a “Claim”) and any costs (including reasonable attorney’s fees), liabilities, losses, expenses, and damages resulting therefrom (“Damages”) in the event that any Services or Deliverables (specifically excluding any Open Source Software) furnished and used within the scope of this Agreement infringe a United States copyright or patent or other intellectual property, provided that: (i) Customer notifies the Company in writing within fifteen (15) days of the claim; provided that Customer’s failure to so notify the Company shall not relieve the Company of any of its indemnification obligations unless such failure materially and adversely affects the Company’s ability to investigate and defend such Claim; (ii) the Company has sole control of the defense and all related settlement negotiations ; provided, that the Company may not settle any such claim in a manner that imposes any unreasonable restrictions or obligations on Customer without Customer’s prior written consent; and (iii) Customer provides the Company with the assistance, information and authority necessary to perform the Company’s obligations under this section. (b) The Company shall have no liability for any Damages or Claim of infringement based on: (i) the Company’s compliance with any of Customer’s particular requirements (e.g. use of any specific process, design, product or software) set forth in any applicable Specification, (ii) use of a superseded or altered release of any Deliverable if the infringement would have been avoided by the use of a current unaltered release of the Deliverable to the extent that (x) it was the obligation of Customer to obtain and install the applicable current unaltered release of the Deliverable where such release was made available t o Customer for no additional cost; or (y) Company provided or made a current unaltered release of the Deliverable available to Customer where such release was made available to Customer for no additional cost and Customer failed to install it; or (iii) the combination, operation or use of any Deliverables furnished under this Agreement with software, hardware or other materials not furnished by the Company, if such infringement would have been avoided by the use of the Deliverable without such software, hardware or other materials; (iv) the adaptation or modification of any Deliverable without the Company’s written approval, if such infringement would have been avoided by the use of the Deliverable without such adaption or modification; (v) a Claim based on Intellectual Property owned by the Customer or any of its Affiliates, to the extent that the Company’s use of such Intellectual Property is in connection with its performance under this Agreement; Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 12 of 52
Master Services Agreement Page 7
Rev.07.2023
(vi) misuse of any Deliverable, Services, Open Source Software or Third Party Products; (vii) any Third Party Products or (viii) any Open Source Software (each, other than items (vii) and (viii), an “Excluded Claim”). (c) In the event a Service or Deliverable is held or is believed by the Company to infringe a third party’s Intellectual Property rights, the Company shall have the option, at its expense, to (i) modify the Service or Deliverable to be non-infringing, (ii) obtain for Customer a license to continue using the Service or Deliverable; or (iii) terminate the license for the infringing Service or Deliverable and (x) use its best efforts to secure for Customer ninety (90) days continued use of the infringing Service or Deliverable following such notice of termination; and (y) refund a portion of the purchase price paid to the Company for such Deliverable, as reduced in accordance with a three (3) year, straight-line depreciation schedule commencing on the date of delivery of the Deliverable, or in the event of a Service, refund any unused prepaid fees.

THIS SECTION 7.3 STATES THE COMPANY’S ENTIRE LIABILITY AND CUSTOMER’S EXCLUSIVE REMEDY FOR THE INFRINGEMENT OF ANY INTELLECTUAL PROPERTY.

7.4 Indemnification of the Company. Customer will defend , indemnify and hold harmless the Company against all C laims and D amages to the Company arising from any (i) violation of the Company’s Acceptable Use Policy; and (ii) Excluded Claims, excepting only those for which the Company is required to indemnify Customer .

This section shall apply provided that (i) Company must notify Customer in writing within fifteen (15) days of the Claim, provided that Company’s failure to so notify Customer shall not relieve Customer of any of its indemnification obligations unless such failure materially and adversely affects Customer’s ability to investigate and defend such Claim; (ii) Customer shall have sole control of the defense and all related settlement negotiations; provided, that Customer may not settle any such claim in a manner that imposes any unreasonable restrictions or obligations on Company without Company’s prior written consent; and (iii ) Company provides the Customer with the assistance, information and authority necessary to perform the Customer’s obligations under this section.

SECTION 7.4 (ii) STATES THE CUSTOMER’S ENTIRE LIABILITY AND COMPANY’S EXCLUSIVE REMEDY FOR THE INFRINGEMENT OF ANY INTELLECTUAL PROPERTY.

Section 8: Limitation of Liability.

8.1 Generally. NEITHER PARTY SHALL HAVE ANY LIABILITY UNDER THIS AGREEMENT FOR ANY INCIDENTAL,

CONSEQUENTIAL, SPECIAL, PUNITIVE OR INDIRECT DAMAGES OR LIABILITIES, INCLUDING WITHOUT LIMITATION

SUCH DAMAGES OR LIABILITIES FOR LOSS OF REVENUE, LOSS OF BUSINESS, FRUSTRATION OF ECONOMIC OR

BUSINESS EXPECTATIONS, WORK DELAYS, LOSS OF PROFITS, OR COST OF CAPITAL, REGARDLESS OF THE FORM

OF THE ACTION, WHETHER IN CONTRACT OR OTHERWISE, EVEN IF A PARTY HERETO HAS BEEN ADVISED, KNOWS, OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGES; PROVIDED, HOWEVER, THAT THE LIMITATION

ON LOST PROFITS SHALL NOT APPLY TO EITHER PARTY'S LIABILITY, IF ANY, FOR EXCEEDING THE SCOPE OF THE

LICENSES GRANTED TO SUCH PARTY BY THE OTHER PARTY AND THAT NO LIMITATION SHALL APPLY TO EITHER PARTY’S LIABILITY, IF ANY, FOR A BREACH OF ITS CONFIDENTIALITY OR INDEMNIFICATION OBLIGATIONS HEREUNDER.

EXCEPT WITH RESPECT TO THE COMPANY ’S BREACH OF ITS OBLIGATIONS RELATING TO CONFIDENTIAL INFORMATION AND ITS INDEMNITY OBLIGATIONS SET FORTH IN SECTION 7.3, THE COMPANY’S LIABILITY FOR

DAMAGES TO CUSTOMER FOR ANY CAUSE WHATSOEVER, REGARDLESS OF THE FORM OF ANY CLAIM OR ACTION,

SHALL NOT EXCEED THE GREATER OF THE AGGREGATE FEES PAID BY CUSTOMER FOR THE DELIVERABLES AND/OR

SERVICES UNDER THE APPLICABLE SOW DURING THE TWELVE MONTH PERIOD IMMEDIATELY PRECEDING THE EVENTS GIVING RISE TO CUSTOMER’S CLAIM (THE “LIMITATION OF LIABILITY”); PROVIDED, HOWEVER, THAT,

NOTWITHSTANDING THE FOREGOING OR ANYTHING IN THIS AGREEMENT OR ANY SOW TO THE CONTRARY, THE PARTIES ACKNOWLEDGE AND AGREE THAT THE COMPANY’S AGGREGATE, CUMULATIVE LIABILITY FOR DAMAGES (WHETHER DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE OR OTHERWISE) UNDER THIS AGREEMENT WILL NOT EXCEED TWO (2) TIMES THE LIMITATION OF LIABILITY FOR ONE OR MORE BREACHES OF THE COMPANY’S OBLIGATIONS RELATING TO: (I) CUSTOMER DATA COMPRISING PERSONALLY IDENTIFIABLE INFORMATION; (II) CUSTOMER CONFIDENTIAL INFORMATION COMPRISING PERSONALL Y IDENTIFIABLE INFORMATION; AND/OR (III) DATA PROTECTION, INCLUDING, WITHOUT LIMITATION, THE COMPANY’S OBLIGATIONS SET FORTH IN SECTIONS 6.2 AND 13 HEREOF . IN NO EVENT WILL THE COMPANY BE LIABLE TO THIRD PARTIES FOR ANY DAMAGES WHATSOEVER.

THE LIMITATION ON THE COMPANY’S LIABILITY IS CUMULATIVE, WITH ALL PAYMENTS TO CUSTOMER FOR CLAIMS OR DAMAGES UNDER THIS AGREEMENT BEING AGGREGATED TO DETERMINE SATISFACTION OF THE LIMIT.

THE EXISTENCE OF ONE OR MORE CLAIMS OR SUITS WILL NOT ENLARGE THE LIMIT. THESE LIMITATIONS APPLY TO ALL CAUSES OF ACTION UNDER OR RELATING TO THIS AGREEMENT (CONTRACT, TORT OR OTHERWISE).

THE COMPANY EXPRESSLY DISCLAIMS, AND CUSTOMER EXPRE

SSLY RELEASES THE COMPANY FROM ANY
LIABILITY ARISING FROM OR ASSOCIATED WITH A C USTOMER’S RESERVED INSTANCE USAGE, LACK OF USAGE,

RECOMMENDATION OR PURCHASE OF RESERVE INSTANCES WHETHER BY C USTOMER DIRECTLY OR BY THE

COMPANY AS INSTRUCTED BY CUSTOMER OR ON THE BASIS OF INFORMATION PROVIDED BY ANY THIRD -PARTY TOOLS.

EXCEPT WITH RESPECT TO THE CUSTOMER’S BREACH OF ITS CONFIDENTIALITY OBLIGATIONS UNDER Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 13 of 52
Master Services Agreement Page 8
Rev.07.2023
SECTION 6 AND ITS INDEMNITY OBLIGATIONS SET FORTH IN SECTION 7.4, THE CUSTOMER’S LIABILITY FOR

DAMAGES TO COMPANY FOR ANY CAUSE WHATSOEVER, REGARDLESS OF THE FORM OF ANY CLAIM OR ACTION,

SHALL NOT EXCEED THE GREATER OF THE AGGREGATE FEES PAID BY CUSTOMER FOR THE DELIVERABLES AND/OR

SERVICES UNDER THE APPLICABLE SOW DURING THE TWELVE MONTH PERIOD IMMEDIATELY PRECEDING THE EVENTS GIVING RISE TO COMPANY’S CLAIM. IN NO EVENT WILL THE CUST OMER BE LIABLE TO THIRD PARTIES FOR ANY DAMAGES WHATSOEVER.

THE LIMITATION ON THE CUSTOMER’S LIABILITY IS CUMULATIVE, WITH ALL PAYMENTS TO COMPANY FOR CLAIMS OR DAMAGES UNDER THIS AGREEMENT BEING AGGREGATED TO DETERMINE SATISFACTION OF THE LIMIT.

THE EXISTENCE OF ONE OR MORE CLAIMS OR SUITS WILL NOT ENLARGE THE LIMIT. THESE LIMITATIONS APPLY TO ALL CAUSES OF ACTION UNDER OR RELATING TO THIS AGREEMENT (CONTRACT, TORT OR OTHERWISE).

8.2 SLA Credits. The credits stated in any applicable Service Level Agreement are Customer’s sole and exclusive remedy for the Company’s failure to meet those criteria for which credits are provided. Customer is not entitled to a credit if Customer is in breach of this Agreement or the applicable SOW at the time of the occurrence of the event giving rise to the credit unless and until Customer shall have remedied the breach. Anything to the contrary notwithstanding, no credit will be due to the extent that the Company’s failure to achieve any service level criteria results from Customer’s acts or omissions.

Section 9: Term and Termination.

9.1 Term of Agreement. This Master Agreement shall be effective so long as any SOW shall remain outstanding and shall remain in force until terminated as provided herein.

9.2 Termination of Agreement. Unless otherwise specified in a particular SOW, a Party (the “Terminating Party”) may terminate this Master Agreement or any SOW:
(a) if the other Party breaches any of its material representations, warranties, covenants or obligations under this Master Agreement or the applicable SOW and such breach results in a material adverse effect to the Terminating Party, upon providing thirty (30) days (or five (5) business days in the case of breach for nonpayment) written notice to the breaching Party, provided, however, that if the breaching Party shall have cured the breach or, other than in the case of non-payment, shall have commenced and continues to diligently pursue a cure of such breach within such thirty (30) day period with the reasonable expectation of success, this Agreement and the applicable SOW shall continue in full force and effect. Notwithstanding the foregoing, a breach by Company of any of its obligations under this Agreement or a SOW that materially and adversely affects a hosting Service provided by Company to Customer must be cured by Company within fifteen (15) days of Company’s receipt of Customer’s notice failing which Customer may terminate the applicable SOW upon written notice to Company. (b) upon giving written notice to the other Party, if the other Party (i) files in any court or agency pursuant to any statute or regulation of any state or country, a petition in bankruptcy or insolvency or for reorganization or for an arrangement or for the appointment of a receiver or trustee of the other Part y or of its assets; ( ii) proposes a written agreement of composition or extension of its debts; (iii) is served with an involuntary petition in bankruptcy or seeking reorganization, liquidation, dissolution, winding-up arrangement, composition or readjustment of its debts or any other relief under any bankruptcy, insolvency, reorganization or other similar act or law of any jurisdiction now or hereafter in effect, which petition is not dismissed within sixty (60) days after the filing thereof; (iv) has any attachment, execution, or similar process issued against it which is not dismissed or stayed within six ty (60) days after the issuance thereof; (v) proposes to be a Party to any dissolution or liquidation; or (vi) makes an assignment for the benefit of creditors or a trust mortgage.

9.3 Effects of Termination. In the event that this Master Agreement or a particular SOW is terminated pursuant to Section 9.2 , with respect to the termination (i) the Company will immediately cease providing the applicable Services and Deliverables, (ii) payment of all amounts due for the applicable Services rendered and Deliverables delivered on or prior to such termination shall become immediately due and payable, (iii) except as otherwise provided in the applicable SOW, any licenses granted by the Company to Customer shall immediately terminate and Customer shall remove any materials containing the Company’s I ntellectual Property from its technology infrastructure; and (iv) Company shall implement an orderly return of Customer Data in a mutually agreeable format at a time agreed to by the Parties. Once the Customer acknowledges receipt of the Customer Data, the Company shall have no obligation to maintain or provide any Customer Data and shall thereafter, unless legally prohibited, delete all Customer Data in its systems or otherwise in its possession or under its control.

Section 10: Dispute Resolution.

10.1 Parties’ Objective. The
Parties recognize that disputes as to certain matters may from time to time arise during the term of this Agreement that relate to either Party’s rights or obligations hereunder. It is the objective of the Parties to establish procedures to facilitate the resolution of disputes arising from, concerning or in any way relating to this Agreement in an expedient manner by mutual cooperation and without resort to litigation. To accomplish this objective, the Parties agree to follow the procedures set forth in this Section 10 if and when a dispute arises under this Agreement.

10.2 Dispute Resolution. Except as set forth below, the Parties shall attempt in good faith to resolve any and Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 14 of 52
Master Services Agreement Page 9
Rev.07.2023
all disputes that arise between them promptly, voluntarily and amicably. Any dispute arising between the Parties relating to, arising out of, or in any way connected with this Agreement (a “ Dispute”), whether before or after expiration or termination of this Agreement, which is not settled by the Parties within thirty (30) days after written notice of such Dispute is first given by a representative of one Party to the other Party in writing, the Parties agree to submit to mediation prior to bringing an action in a court of competent jurisdiction unless the claim is for a breach of Intellectual Property rights or a breach of Section 6 Confidential Information or Data Protection for which the Parties may seek injunctive relief or spec ific performance or any other provisional remedy to protect the Parties’ rights in any Confidential Information or enforce a Party’s confidentiality, privacy obligations, or data protection under this Agreement, if applicable.

Section 11: Insurance.

Company will obtain and maintain for the duration of the Agreement and any and all amendments, insurance against claims for injuries to persons or damage to property which may arise out of or in connection with performance of the services by Company or Com pany’s agents, representatives, employees or subcontractors. The insurance will be obtained from an insurance carrier admitted and authorized to do business in the State of California. The insurance carrier is required to have a current Best's Key Rating of not less than "A-:VII"; OR with a surplus line insurer on the State of California’s List of Approved Surplus Line Insurers (LASLI) with a rating in the latest Best’s Key Rating Guide of at least “A:X”; OR an alien non- admitted insurer listed by the National Association of Insurance Commissioners (NAIC) latest quarterly listings report.

11.1 Coverages and Limits. Company will maintain the types of coverages and minimum limits indicated below unless Customer Risk Manager or City Manager approves a lower amount. These minimum amounts of coverage will not constitute any limitations or cap on Company's indemnification obligations under this Agreement. Customer, its officers, agents and employees make no representation that the limits of the insurance specified to be carried by Company pursuant to this Agreement are adequate to protect Company. (a) Commercial General Liability (CGL) Insurance. Insurance written on an “occurrence” basis with limits no less than $2,000,000 per occurrence and $4,000,000 in the aggregate. (b) Workers' Compensation and Employer's Liability. Workers' Compensation limits as required by the California Labor Code. Workers' Compensation will not be required if Company has no employees and provides, to Customer's satisfaction, a declaration stating this.
(c) Professional Liability. Errors and O missions Liability and Cyber Liability Insurance with limits of not less than $10,000,000 per claim and in the aggregate. Company agrees to maintain coverage for a period of three years following the date of completion of the Services.

11.2 Additional Provisions: Company will ensure that the policies of insurance required under this Agreement contain, or are endorsed to contain, the following provisions:
(a) The Customer will be named as an additional insured on Commercial General Liability which shall provide primary coverage to the Customer.
(b) Company will obtain occurrence coverage, excluding Professional Liability. Errors and Omissions Liability and Cyber Liability Insurance, which will be written as claims-made coverage. (c) This insurance will be in force during the life of the Agreement and any extensions of it and will not be canceled without Company providing Customer at least thirty (30) days prior written notice sent by certified mail pursuant to the Notice provisions of this Agreement.

11.3 Providing Certificates of Insurance . As soon as reasonably practicable following the Parties’ execution of this Agreement, Company will furnish certificates of insurance for the referenced coverages to Customer.

11.4 Failure to Maintain Coverage. If Company fails to maintain any of these insurance coverages, then Customer will have the option to declare Company in breach of its obligation under this Agreement.

Section 12: Customer Obligations, Etc.

12.1 Non-Solicitation. During the Term of this Agreement and continuing for a period of twelve (12) months thereafter, Customer agrees that it will not, and will ensure that its A ffiliates do not, (i) knowingly directly or indirectly, solicit or attempt to solicit for engagement, either as employees, consultants or otherwise, any persons employed by the Company or contracted by the Company to provide Services to Customer, except insofar as such solicitation or attempt to solicit for engagement results solely from a general solicitation of employment not specifically directed towards employees or subcontractors of the Company and (ii) knowingly directly or indirectly, hire or otherwise engage, either as employees, consultants or otherwise, any persons employed by the Company who performed Services for Customer or who Customer became acquainted with during the performance of Services by the Company hereunder, except insofar as such solicitation or attempt to solicit for engagement results solely from a general solicitation of employment not specifically directed towards employees, consultants, or subcontractors of the Company.

12.2 Access and Cooperation. Customer will provide the Company with access to Customer’s Environment Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 15 of 52
Master Services Agreement Page 10
Rev.07.2023
for the purpose of performing the Services and invoicing. Customer must cooperate with the Company’s reasonable investigation of outages, security problems, and any suspected breach of the Agreement. Customer is responsible for keeping its account permissions, billing, and other account information up to date. Customer agrees that its use of any Environment provided or managed by the Company will comply with the Company’s Acceptable Use Policy.

Customer is solely responsible for the suitability of the Services as specified by Customer and Customer’s compliance with any applicable laws, including export laws and data privacy laws. The Company will not use or disclose Customer Data except as materially required to perform the Services or as required by law. Customer must use reasonable security precautions in connection with its use of the Services, including where applicable appropriately securing and encrypting personally identifiable or other sensitive data stored on or transmitted using the Environment. Customer Data is, and at all times shall remain, Customer’s exclusive property.

12.3 Third Party Support and Software. For the Term, if Customer uses any non- Company provided software on its Environment, Customer represents and warrants to the Company that Customer has the legal right to use such software and to grant to the Company the right to use such software on Customer’s behalf. If the Company has agreed to install, patch or otherwise manage software in reliance on Customer’s license with a third party then Customer hereby consents to the Company ’s posting or sharing of Customer’s name, contact information and environment log files with third party support services (including without limitation Ora cle or Microsoft support services) as the Company may deem necessary to perform its obligations under this Agreement, provided that such disclosure shall be subject to Customer’s prior written consent, which shall not be unreasonably withheld, conditioned or delayed, in the event that the Company should be required to disclose any other Confidential Information of Customer to such third parties. The Company may agree to install Third Party Products (for example, Oracle EBS software) on Customer’s behalf as part of the Services. Where such activity requires the acceptance of an End User License Agreement (or similar terms), and only applicable when Customer’s data is being hosted on the Company’s servers or in the Company’s environment. Customer hereby authorizes the Company to accept such terms on Customer’s behalf, agree to be bound by and adhere to such terms, and acknowledge that Customer , and not the Company, is bound by such terms. The Company will promptly identify and provide Customer with a copy of any such terms the Company accepts upon Customer’s behalf upon written request.

Section 13: Privacy and Security.

13.1 Obligations. Without limiting the provisions of Section 8 or obligations under Section 6 , Company will implement commercially reasonable administrative, technical and physical controls to protect Customer Data and Confidential Information in its possession against unauthorized access, use, acquisition, loss or disclosure. Customer acknowledges and agrees that Customer controls the transfer or upload of Customer Data to the Services and Customer’s Environment and that Customer controls and directs the processing, use and disclosure of Customer Data through the Services. The Company stores and processes Customer Data only at Customer's direction and instruction. The Company is not responsible for any data loss, disclosure, transfer, storage or processing that occurs as a result of Customer's acts or omissions or Customer's violation of any provision of this Agreement or appliable laws, rules or regulations.

13.2 Audit Rights. Company shall, at least annually, engage an independent third party to assess the Company’s information security controls (the " Security Audit"). The Audit shall be conducted according to recognized information security industry standards. Upon reasonable written notice, the Company shall provide Customer with a copy of its most recent Security Audit report. Such report and the results of such Security Audit are Confidential Information of the Company.

13.3 Security Breaches. Company shall promptly notify Customer of any incident resulting in the unauthorized access, acquisition, destruction, or loss or alteration of Customer Data (a “Security Incident”). In the event that a Security Incident affecting Customer Data occurs as the result of a breach by the Company of its obligations under Section 6.2 of this Agreement, the Company shall: (a) promptly, and in any event within 72 hours of the Company’s discovery of the Security Incident, notify Customer by telephone, unless shorter time is required by applicable law; (b) use its best efforts to promptly quarantine the data breach and ensure that Customer can securely access the Customer Data; (c) promptly implement necessary remedial measures to ensure a similar Security Incident does not reoccur as soon as reasonably practicable; (d) promptly start an investigation of the Security Incident, (e ) take all appropriate actions to mitigate any material risk that may arise from the Security Incident; and (f) upon Customer's reasonable written request, provide Customer with a written report on outcome of its investigation and responsive actions taken related to the Security Incident. Information regarding any Security Incidents or other notifications pursuant to this Section 13 comprise the Company’s Confidential Information, provided, however, that Customer may disclose the occurrence of a Security Incident to the extent (a) Customer is exercising its legal rig hts, or (b) disclosure is required by Applicable Law or pre-existing contractual obligations to third parties . The forgoing notwithstanding, Customer shall disclose information relating to a Security Incident only to the extent required by applicable laws, rules or regulations, court order, as necessary to comply with pre-existing contractual obligations to third parties, or to exercise its legal rights; provided, however, that Customer shall provide prior written notice thereof to the Company to the extent not prohibited by law . The Company shall cooperate in good faith regarding the timing and manner of any notification to affected parties concerning a Security Incident and disclosures to appropriate governmental entities, which cooperation shall be at Customer’s sole cost and expense, except to the extent such Security Incident arises out of the acts or omissions of the Company.

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 16 of 52
Master Services Agreement Page 11
Rev.07.2023
Section 14: Miscellaneous.

14.1 Delay; Force Majeure. Either Party shall be excused from delays in performing or from its failure to perform hereunder to the extent that such delays or failures result from causes beyond the reasonable control of such Party; provided that, in order to be excused from delay or failure to perform, such Party must act diligently to remedy the cause of such delay or failure.

14.2 No Agency. The Company is acting solely as an independent contractor, Customer does not undertake by this Agreement or otherwise to perform any obligation of the Company , whether by regulation or contract. In no way is the Company to be construed as the agent or to be acting as the agent of Customer in any respect, any other provisions of this Agreement notwithstanding.

14.3 Section Headings; Exhibits. The section and subsection headings used herein are for reference and convenience only and shall not enter into the interpretation hereof. The agreements and other documents referred to herein and attached or to be attached hereto, or to the SOW are incorporated herein to the same extent as if set forth in full herein.

14.4 No Waiver. No delay or omission by either Party hereto to exercise any right or power occurring upon any noncompliance or default by the other Party with respect to any of the terms of this Agreement shall impair any such right or power or be construed to be a waiver thereof. A waiver by either of the Parties hereto of any of the covenants, conditions, or agreements to be performed by the other shall not be construed to be a waiver of any succeeding breach thereof or of any covenant, condition, or agreement herein contained. Unless stated otherwise, all remedies provided for in this Agreement shall be cumulative and in addition to and not in lieu of any other remedies available to either Party at law, in equity, or otherwise.

14.5 Language; Governing Law; Currency. This Agreement shall be entered into by the Parties in the English language. In the event of any translation, the English language version shall be determinative. The validity, construction and performance of this Agreement will be governed by and construed in accordance with the laws of the State of California, applicable to contracts executed in and performed entirely within such Sate, without reference to any choice of law principles of such State. The application to this Agreement of the United Nations Convention on Contracts for the International Sale of Goods is hereby expressly excluded. Customer specifically and irrevocably consents to the personal and subject matter jurisdiction and venue of the federal and state courts of the County of San Diego, State of California and such courts shall have exclusive jurisdiction with respect to all matters concerning this Agreement or the enforcement of any of the foregoing.

14.6 Entire Agreement. This Agreement and each together with any exhibits or addenda annexed thereto or hereto, and any subsequent SOW shall constitute the entire agreement between the Parties relating to the subject matter hereof and thereof and, unless specifically referenced in this Agreement or an applicable SOW, supersede all prior or simultaneous representations, discussions, proposals, negotiations, letters of intent, and all prior non- disclosure, non-competition, non-solicitation and other agreements, whether oral, written or based on a course of dealing or performance, with respect to the subject matter hereof or thereof. Any extraneous terms on Customer’s purchase order or other documents shall be void and of no effect. Each SOW shall be treated as a separate agreement. No amendment, change, waiver, or discharge hereof shall be valid unless it is in writing and is executed by the Party against whom such amendment, change, waiver, or discharge is sought to be enforced.

14.7 Notices. All notices, demands, requests or other communications that may be or are required to be given, served or sent by any Party pursuant to this Agreement will be in writing, will reference this Agreement and shall be transmitted by express courier or hand delivery or facsimile transmission. Each notice that is delivered or transmitted in the manner described in this section shall be deemed sufficiently given, served, sent and received for all purposes at such time as it is delivered to the addressee (with the delivery receipt or the affidavit of messenger or courier being deemed conclusive evidence of such delivery) or at such time as delivery is r efused by the addressee upon presentation, whichever shall occur first. The name of the persons who are authorized to give written notice or to receive written notice on behalf of Customer and on behalf of Company under this Agreement are:

For Customer: For Company:

Name Maria Callander Name Senior Corporate Counsel
Title IT Director Title NaviSite Legal Department
Dept IT Address 400 Minuteman Road
CITY OF CARLSBAD Andover, MA 01810
Address 1635 Faraday Ave Phone 1 (978)-682-8300
Carlsbad, CA 92008

Phone 442.339.2454
Each
Party will notify the other immediately of any changes of address that would require any notice or delivery to be directed to another address.

14.8 Injunctive Relief. It is hereby agreed and acknowledged that it will be impossible to measure in money the damage that would be suffered if the Parties fail to comply with their obligations under Section 6 and/or Section Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 17 of 52
Master Services Agreement Page 12
Rev.07.2023

12.1 of this Agreement and that in the event of any such failure, a Party will be irreparably damaged and will not have an adequate remedy at law. Any such Party shall, therefore, be entitled (in addition to any other remedy to which it may be entitled in law or in equity) to injunctive relief, including specific performance, to enforce such obligations, and if any action should be brought in equity to enforce any of the provisions of this Agreement, none of the Parties hereto shall raise the defense that there is an adequate remedy at law.

14.9 Survival. In the event of any termination of this Agreement, Sections 5, 6, 7, 8, 9.3, 10, 12.1, 14 and 15 hereof shall survive and continue in effect and shall inure to the benefit of and be binding upon the Parties and their legal representatives, heirs, successors, and assigns.

14.10 Assignment. The rights and liabilities of the Parties hereto will bind and inure to the benefit of their respective successors and assigns, as the case may b e; provided that after such assignment, both Customer and Customer’s assignee shall continue to be responsible for Customer’s obligations under this Agreement, unless and until otherwise agreed by the Company in writing. Any attempted assignment in violation of the provisions of this Section will be void. Notwithstanding the foregoing, Company shall have the right to assign this Agreement to any of its Affiliates and to successor in interest that is a result of a sale, merger or acquisition.

14.11 U.S. Government Restricted Rights. Any Software being provided by the Company to Customer under this Agreement and/or any Specification is so provided with “Restricted Rights.” If Customer is the U.S. government, Customer acknowledges that the use, duplication, or disclosure by the U.S. government of such Software is subject to restrictions as set forth in all applicable laws and regulations, including without limitation FAR52.227-14 and DFAR252.227-7013 et seq. or their applicable successors.

14.12 Compliance with Laws. The Parties agree that they shall comply with all applicable laws and regulations of governmental bodies or agencies in their performance under this Agreement. Without limiting the generality of the foregoing, neither Party will knowingly export or re-export, directly or indirectly, any technical data (as defined by the U.S. Export Administration Regulations) produced or provided under this Agreement, or export or re-export, directly or indirectly, any direct product of such technical data, including software, to a destination to which such export or re -export is restricted or prohibited by U.S. or non- U.S. law, without obtaining prior authorization from U.S. Department of Commerce and other competent government authorities to the extent required by those laws.

Section 15: [Reserved]
Section 16: Counterparts. This Agreement may be executed in multiple counterparts, each of which shall be deemed to be an original and together shall be deemed to be one and the same agreement.

Section 17: Definitions. When used in this Agreement the capitalized terms listed in this Section 1 7 shall have the following meanings:
“Affiliates” means the Company and any other entity that, directly or indirectly through one or more intermediaries, controls, is controlled by, or is under common control with, the Company. “Acceptable Use Policy” mea
ns the Company’s acceptable use policy attached hereto as Exhibit A, and which is also available at the Company’s website.
“and/or” means one or the other or both, or any one or all, or any combination of the things or persons in connection with which the words are used.
“Confidential Information” For the Company means any business, trade or technical information of a Party or its Affiliates, which information such Party considers to be confidential or proprietary information, including without limitation business and financial data; business plans; technical information; software; samples; devices; prototypes; designs; specifications; processes; inventions; discoveries; or other Intellectual Property or physical embodiments thereof, whether disclosed orally, visually, in writing, or in document form, by observation or inspection of a Party’s property or facilities or by conversation with the Party’s officers, directors, e mployees, Affiliates or agents; and for the Customer means, data that is sensitive, personal, or not otherwise known to the public . However, Confidential Information excludes any Customer Data or Company information that the receiving Party can demonstrate: (i) was rightfully in the possession of, or was rightfully known by, the receiving Party without an obligation to maintain its confidentiality prior to receipt from the furnishing Party; (ii) was or has become generally available to the public other than as a result of disclosure by the receiving Party or any of its agents; (iii) after disclosure to the receiving Party, was received from a third party who, to the receiving Party's knowledge, had a lawful right to disclose such information to the receiving Party without any obligation to restrict its further use or disclosure; or (iv) was independently developed by the receiving Party without use of or reference to any confidential information of the furnishing Party.
“Customer Data” means all data, including its Confidential Information, which Customer receives, stores, processes or transmits using the Environment, but specifically excludes data related to system usage and/or performance metrics.
“Deliverables” means all physical materials or electronic data developed for or delivered to Customer by the Company under this Agreement as set forth in an applicable SOW but shall not include any Open-Source Software.

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 18 of 52
Master Services Agreement Page 13
Rev.07.2023
“Derivative Work” means a work that is based upon one or more preexisting works, such as a revision, modification, translation, abridgement, condensation, expansion, or any other form in which such preexisting works may be recast, transformed, or adapted, and that, if prepared without authorization of the owner of the intellectual property rights in such preexisting work, would constitute an infringement of such intellectual property rights. “Environment” means the Customer environment and systems for which the Company is providing services and/or Deliverables pursuant to this Agreement.
“Error” means any error, problem, or defect which causes a Deliverable to fail to conform to its Specification, based upon the acceptance criteria set forth in Section 4.2.
“Intellectual Property” means (i) copyrights, trademarks, and patents, and substitutions, divisions, continuations, continuations-in-part, reissues, reexaminations and extensions thereof and supplemental protection certificates relating thereto, and all counterparts thereof in any country in the world, (ii) applications for any of the foregoing and (iii) Know-How.
“Know-How” means inventions, ideas, discoveries, data, instructions, designs, concepts, drawings, prototypes, information, components, processes, methods, tools, developments, innovations, techniques, materials, technology, protocols, procedures, results, formulae, templates, devices, assemblies, modules, algorithms, trade secrets, computer program code or other know -how, whether or not patentable, and improvements, modifications or refinements thereof
.
“No-Fault Condition” means (i) the failure of any Customer-Provided Materials or other components to operate in accordance with their published or advertised specifications, (ii) the lack of availability of support for or updates to any Customer-Provided Materials; (iii) the failure of a Deliverable to properly interface or inter -operate with any Customer or third-party provided hardware, software or other components, which are not specified as part of the applicable SOW, (iv) the failure of any testing apparatus not supplied by the Company to provide accurate measurements, (v) the failure of Customer or any third-party hired by Customer to provide adequate or satisfactory services relating to the testing, installation or acceptance of any Services or Deliverable, (v i) damage of any Deliverable by Customer or any third -party acting on Customer’s behalf, (v ii) alteration or modification of a Deliverable or Service by anyone other than the Company ; (viii) use, adjustment, installation or operation of any Deliverable or Service other than in accordance with instructions furnished by the Company or with an application or in an environment other than as intended or recommended by the Company, (ix) data format or content which produces an unattractive display, requiring only cosmetic or aesthetic changes, unless such format or display is specifically described in the applicable SOW as an essential feature or (x ) failures due to new reports or patches added to the database environment by Customer or its agents, unless such modifications shall have been reviewed and approved by a Company remote database administrator prior to installation and properly installed. “Open-Source Software” means Software that refers to, or is based upon, any form of software license from or substantially similar to any software license provided by the Free Software Foundation, including without limitation GNU General Public License, the GNU Lesser General Public License or the GNU Free Documentation License; or any software that is “copylefted.”
“Personally Identifiable Information” or “PII” means any Customer Data and any other Customer Confidential Information that: (a) directly identifies, or in combination with other information may identify, an individual, including name, mailing address, email address, any identifier that identifies an account, telephone number, social security number, drivers’ license number, government issued identification number, any financial account number or log -in information, Internet Protocol addresses or other persistent device identifiers, or any other data that can be used to identify, contact, or locate an individual more precisely than a state; (b) is governed, regulated or protected by one or more Privacy and Data Security Laws (as defined below); (c) is Protected Health Information (as defined by HIPAA); (d) pertains to the health, employment or finances of an individual; (e) is derived from other Personally Identifiable Information and protected by one or more Privacy and Data Security Laws; or (f) is associated with or linked to any other Personally Identifiable Information, which in combination may identify the individual. “Privacy and Data Security Laws” means all applicable laws regarding privacy, cybersecurity or the receipt, collection, use, storage, processing, sharing, security, disclosure or transfer of Personally Identifiable Information. “SLA” means any provision providing a specified credit remedy for an identified failure to deliver or provide the Services to the identified standard.
“Software” means the software programs in executable form, including all corrections, updates, modifications and enhancements to such software, all related source code, and all documentation and information pertaining to software, whether in online, hard -copy or other form, together with any updates, revisions, new versions and supplements thereto, which is made available by either Party and used, directly or indirectly, by Company or Customer in connection with the Services. The term “Software” shall not include any Open-Source Software or any software licensed to Customer by third parties.
“Statement of Work” or “SOW” means a separate written document by and between the Company and Customer describing the Services and/or Deliverables to be performed for or delivered to Customer; the applicable Specifications; the pricing and the time schedule for performance and for delivery of any such services and/or Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 19 of 52
August 27, 2024
Item #2 Page 20 of 52
Oocuslgn Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Deliverables. A SOW may include without limitation any service schedule, professional service description, or operational service description.
"Specification " means the description and/or specification of the Services to be performed by the Company set forth In the applicable SOW, as may be amended from time to time in accordance with this Agreement, which may include, without limitation, a description of any Services and/or Deliverables to be delivered to Customer; a description of the form, fit and function of any such Deliverables; the pricing and the time schedule for performance and for delivery of any such Services and/or Deliverables.
"Third Party Products " means any products manufactured by third part ies and dellvered to Customer pursuant to this Agreement.

IN WITNESS WHEREOF, the Parties hereto, each acting under due and proper author ity, have caused this Agreement to be executed as of the Effective Date set forth above.

Company

NAVISITE LLC,
a Delaware limited liability company
By:
(sign here)
Gre Clarke - Re ional Vice President
(print name/title)
By:
(sign here)
(print name/title)
APPROVED AS TO FORM:

CINDIE K. McMAHON, City Attorney
BY: d~~
Deputy City Attorney
Master Services Agreement
Rev.07.2023
By:

ATTEST:

AD, a municipal corporation of the
fa
SHERRY FREISINGER, City Clerk
By:

Deputy City Clerk

Page 14 ends

Exhibit “A”

Acceptable Use Policy

Navisite Proprietary and Confidential
Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 21 of 52

IIINAVISITE
Acceptable Use Policy
1 | P a g e

Introduction
This Acceptable Use Policy governs the use of all the hosting services, hosting solutions, cloud services
, managed services and other offerings (the “Services”) made available by Navisite, LLC, a Delaware corporation (“Navisite”), and its suppliers and affiliates. It defines the policies of Navisite which are designed to protect Navisite, its customers and any other persons, parties or entities from any negative impact caused by inappropriate or illegal activities regarding the Services. Any person or entity (“you,” “your” or words of like import) who rece ives access to facilities or Services by or through Navisite shall adhere to this Acceptable Use Policy and agrees to be bound by and subject to the terms and conditions set forth below.

The purpose of this Acceptable Use Policy is to set forth guidelines for the expected conduct of users of t
he Services and the types of actions and content that are contrary to Navisite’s mission and philosophies. Navisite may suspend or terminate your right to access and use the Services if, in its sole determination, it believes you have violated this Acceptable Use Policy.

This Acceptable Use Polic y is an integral part of your agreement with Navisite and is incorporated by reference into the terms pursuant to which Navisite provides you the right to access or use the Services. Access to or use of the Services constitutes your acceptance of this Acceptable Use Policy. Navisite reserves the right to alter this Acceptable Use Policy at any time and such modifications shall become immediately effective upon notification to you of the modified Acceptable Use Policy. By using Navisite’s Services or facilities after the posting of any such modifications, you acknowledge your agreement to those modifications. If at any time you choose not to accept this Acceptable Use Policy, you must immediately discontinue use of all Services and facilities.

Reports of any violations of this Acceptable Use Policy should be sent to [email protected].

Navisite reserves the ri
ght to audit, test, and investigate the security of your environments to ensure that security protections are maintained and that your environments do not bypass, or allow others to bypass Navisite security controls. If, in its sole discretion, Navisite believes that systems located within Navisite’s facilities or through our services are being used in an unlawful or improper manner (whether civil or criminal) or for unlawful or improper activities, Navisite will fully cooperate with civil and criminal-enforcement authorities conducting investigations of such use or activities. Navisite will also support the investigation of the prohibited activities listed below and any other activities that Navisite, in its sole discretion, believes impact the operations or security of Navisite, its customers or other systems accessible by you or any of your employees, agents, representatives, affiliates, customers, clients or users.

Disclaim
er

Navisite is under no duty to monitor the activities of you or any of your employees, agents, represen
tatives, affiliates, customers, clients or users, and Navisite disclaims any responsibility for any misuse of the Services. Navisite has no responsibility for any material or information created, stored, maintained, transmitted or accessible on or through the Services, and is not obligated to

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 22 of 52

IIINAVISITE
Acceptable Use Policy
2 | P a g e

monitor or exercise any editorial control over such material. In the event that Navisite becomes aware that any such material violates this Acceptable Use Policy and/or exposes Navisite to civil or criminal liability, Navisite may, but is not required to, block access to such material. Unless otherwise stated in this Acceptable Use Policy, Navisite disclaims any obligation to any person who has not entered into an agreement with Navisite for use of the Services and has not agreed to the terms of this Acceptable Use Policy.

Acceptable Use
You have access to and may perform management activities on your systems, data and/or content.

You are responsible for ensuring that these activities do not impose risks to, or negatively impact Navisite (including without limitation any of Navisite’s employees, representatives, agents or affiliates), its other customers or other environments or systems. You are also responsible for adhering to all local, state, federal and international laws and regulations relating to all of your operations and the use and access of any computing systems hosted by Navisite or its suppliers.

You must fully comply with all software licenses while using any information technology resources provided by or through Navisite. You are expected to read, understand and conform to the license requirements of any software product(s) you use or install.

Prohibited Activities
You are responsible for ensuring that you do not allow any of your systems hosted by or on behalf of Navisite to be used for any of the following purposes:

1. gaining, or attempting to gai n, unauthorized access to any system that does not belong to you;

2. sending unsolicited e-mail or other messages or communication in any form (e.g., spam);

3. altering, defacing or otherwise causing any unauthorized or unapproved modification of any syste
m belonging to Navisite, another Navisite customer or any other system on the Internet;

4. storing, transmitting or processing material in a manner that violates intellectual-property rights or laws or regulations, including, without limitation, those associated with trade secrets, copyrights, patents and trademarks;

5. violating the privacy rights of others, including, without limitation, the collection of information about individuals without their knowledge or consent, except as allowed by applicable laws and regulations;

6. transmitting or storing any material that is unlawful, obscene, harassing, libelous, abusive or hateful; that encourages unlawful acts; or that may be interpreted as violating the civil rights of others;

7. storing or transmitting material that violates local, state, federal or international laws or regula
tions;

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 23 of 52

IIINAVISITE
Acceptable Use Policy
3 | P a g e

8. engaging in, or permitting any activity that leads to a degradation or denial of service for Navisite, another Navisite customer or any other system or site on the Internet;

9. violating the rules or policies of any other hosting provider, message service, chat room, bulletin board, newsgroup or similar system, service or provider;

10. intentionally, recklessly or negligently omitting, forging, deleting or misrepresenting transmission information – including, without limitation, headers, return-address information and IP addresses – that is intended to cloak or hide the identity or source of information transmitted by your systems, customers or users;
You are prohibited from assisting any persons or entities in using any of your systems maintained by or through Navisite to engage in any of the activities listed above. If you become aware of any such activity, you must remedy the situation immediately. You must also notify Navisite by telephone within four hours and in writing within 24 hours of the detection of a violation by you or any of your employees, agents, representatives, affiliates, customers, clients or users.

You are responsible for ensuring that security controls are not circumvented by way of actions taken by you or individuals accessing your systems.

You must not:

1. configure your system s to bypass security controls, including, without limitation, the installation of programs or services that allow the systems to be managed or accessed insecurely or through unauthorized means;

2. conduct online security audits or tests against or through Navisite systems or networks without coordination with and the explicit, written consent of an authorized officer of Navisite;

3. gain, or attempt to gain, unauthorized access to Navisite networking, security, management, backup, st
orage or monitoring systems;

4. install programs or configure systems to allow the monitoring or “sniffing” of data traveling over a shared network;

5. access, or attempt to access, security -relevant information, such as password files that may, among other things, be used to gain unauthorized access to system accounts;

6. install or use software for the purpose of cracking encrypted data, including, without limitation, stored passwords; or

7. remove or disable security software or services, including, without limitation anti -virus software, logging utilities or authentication services; or

8. violate the CAN -SPAM Act of 2003, as heretofore amended, and other laws and regulations applicable to bulk or commercial email.

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 24 of 52

IIINAVISITE
Acceptable Use Policy
4 | P a g e

Additionally, you

1. are responsible for any misuse of accounts on your systems located at Navisite;

2. must implement measures and procedures to ensure that your accounts are not accessed or used in an unauthorized manner;

3. shall not transfer or allow the transfer of Remote-access accounts from one individual to another, nor share or allow such accounts to be shared between individuals;

4. shall ensure that each user has an individual remote-access account that uniquely and accurately identifies the owner of the account; and

5. assume all responsibility for the consequences of the use of your accounts by an unauthorized individual.

Violations and Remedies
In order to protect its customers’ data security, to ensure that its customers have access to their systems and data and to prevent breaches by other customers from affecting such security and access, Navisite reserves the right to suspend or terminate at any time your account if, in the sole discretion of Navisite, you fail to adhere to this Navisite Customer Acceptable Use Policy or Navisite reasonably believes that your use of any facilities or services has resulted or will negatively impact other customers’ security or use of or access to their respective systems or data (including without limitation, actions by customers that may result in denial of service attacks or other outages, privacy violations or intellectual property infringement) . Navisite will endeavor to provide you with advance notice prior to restricting your access to your environment and services, to the extent that the circumstances of the situation shall merit, but shall not be required to do so in all cases. Navisite has the right to seek legal remedies for any damages, costs or expenses that may be incurred as a result of a violation of any of these policies by you or your employees, agents, representatives, affiliates, customers, clients or users.

Depending on the nature of the violation
or alleged violation, Navisite may be notified of violations in any number of ways, including by an external organization, agency, entity or individual that is affected by your activities or, when a violation is detected internally, by a source within Navisite.

Navisite retains the sole right to determine whether a violation of this policy has occurred . In general, Navisite will attempt to work with you to address violations of this policy in accordance with the steps outlined below but is not required to do so. However, based on the severity of the violation or the number or nature of complaints received, Navisite, in its sole discretion, has the absolute right to immediately terminate all services and facilities access.

Upon notification of a
violation, Navisite will attempt to contact you and describe the violation. In general, your contact will be called or emailed with the information. Navisite will define a specific timeframe within which you must rectify the violation. A letter may be sent to your contact formally notifying you of the violation and setting forth the time frame for you to remedy the violation.

If, in Navisite’s sole discretion, the violation or complained-of violation is such that

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 25 of 52

IIINAVISITE
Acceptable Use Policy
5 | P a g e

Navisite elects not, or is unable, to contact you, Navisite may take whatever steps it deems appropriate under the circumstances.

Navisite reserves the right to immediately suspend any or all access to all facilities and services to you without notice to, or approval from, you, if Navisite, in its sole and absolute discretion, deems such suspension necessary to protect its systems, facilities or interests or those of its employees, representatives, agents, affiliates, customers or other third parties, including, without limitation, in response to any perceived threat of a computer virus, exploit scripts or other malicious software or denial-of-service attack on Navisite’s or its other customers’ or suppliers’ systems or network; provided, however, that Navisite will use commercially reasonable efforts to notify you prior to such suspension.

Nothing in this Acceptable Use Policy shall limit Navisite’s rights and remedies at law or in equity that may be available.

Service Level Credits
No credit will be available under a Navisite service level guaranty or agreement for interruptions of access to facilities or services resulting from your violation of this Acceptable Use Policy. [End of Document]

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 26 of 52

IIINAVISITE

SERVICE S CHEDULE | PROPRIETARY AND CONFIDENTIA L

1 EXHIBIT “B”

STATEMENT OF WORK

Prepared for
City of Carlsbad

1635 Faraday Avenue
Carlsbad, CA 92008
United States

Prepared For:

Doug Kappel
Enterprise Application Manager
[email protected]

8/1/2024
SFOP # 0364888
Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 27 of 52

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL

2 1M+
Databases deployed to
the cloud
Accelerate Your IT Transformation

We work with leaders who are driven by the promise of modernization to build more flexible, resilient organizations that can respond to new demands, lower costs and prepare for whatever comes next. No matter where you are in your journey, we’ll help you navigate the now of IT change and turn your digital transformation ambitions into reality.

We’ll move your
business forward,
starting with what
we can
accomplish
together today.

We’re in this
together, through
good times and
bad, to ensure
your success.

We’re platform-
agnostic and built
around what you
need, not our
personal
preferences.

We move as fast
(or slow) as you
need us to with an
approach that can
be adjusted and
scaled to your
business.

Our global team of
experts have
guided hundreds
of companies
through complex
technical
evolutions.
20+
Years of experience as a
managed service provider
1,500+
IT certifications held by
team members
1,500+
Customers from growing
to large global brands

Modern Cloud
Ser
vices
Committed
Partnership
Unbiased Cloud
Expertise
Organizational
Flexibility
Proven
Methodologies
Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 28 of 52

IIINAVISITE
-
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL
3 Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 29 of 52

IIINAVISITE
Our Services
-
Let us help you accelerate IT transformation and lower costs with comprehensive services and expertise that span platforms and industries.

Application Services
□ Maximize ROI for enterprise apps like Oracle, SAP
and Microsoft, and benefit from custom application
development services.
□ Enable a highly scalable, remote workforce with
managed virtual desktop services in the public and
private cloud.
□ Drive performance, security and availability with our

99.999% service-level agreement guarantees .

Managed Infrastructure Services
□ Get 24x7x365 monitoring and support for private,
public and hybrid clouds.
□ Expand capacity with colocation and managed
hosting in our global data centers.
□ Keep your business up and running with our
disaster recovery services.

Cloud Migration
□ Ensure migration success with end-to-end services
from planning and design through execution.
□ Re-architect for the cloud with our application and
database refactoring services.
□ Work with a verified expert--Navisite is an AWS
Premier Consulting Partner and Azure Expert
MSP.

Data Analytics
□ Work with our data experts to design and build a
transformative analytics roadmap .
□ Gain visibility and access with modem data
warehouse and integration services.
□ Scale as data grows and control costs by only
paying for what you use.

IIIN
Database Services
□ Offload management with remote database
administration (OBA) services.
□ Deploy your favorite databases on AWS and Azure
with our fully managed database as a service
(DBaaS) platform.
□ Get support for all major platforms including SQL
Server, Oracle, MySQL, PostgreSQL, MongoDB and
0B2.

Planning & Strategy
□ Create a successful IT modernization roadmap with
our discovery, assessment, planning and cost
projection services.
□ Get expert guidance around key challenges, costs,
cloud needs and readiness.
□ Plan for disaster recovery with tailored
recommendations .

Cloud Optimization
□ Unlock greater value, lower risk and enable
compliance with our cloud gap analysis and
recommendations.
□ Identify cost drivers and lower your IT spend with
cost optimization services.
□ Continually modernize, innovate and enhance IT
agility with cloud automation .

Security & Compliance
□ Boost your security posture while reducing
complexity with customized services.
□ Manage risk and compliance with proven best
practices and expert guidance.
□ Leverage Al and machine learning to remove
threats before they cause harm.

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL

4 Scope of Services

Upon Customer’s acceptance of the Navisite LLC (Navisite) Service Schedule (this “Service Schedule”), Navisite will provide the following managed services described herein (the “Services”).

Navisite Services: Selected
Services:
1 Application Managed Services
2 Managed Cloud Services
3 Cloud DevOps Services
4 Cloud Cost Optimization
5 Cloud FinOps Service
6 Advanced Security Services
7 Virtual Chief Information Security Officer (vCISO)
8 Data Analytics Managed Services
9 OBIEE/OBIA Managed Service
10 Oracle Fusion Middleware Managed Services
11 Managed Database Services
12 Managed Web Services
13 Operating System Management
14 Physical Infrastructure Managed Services
15 Colocation Services
16 Self Service Cloud Services
17 Microsoft Dynamics Managed Services
18 Microsoft 365 Managed Services
19 Microsoft SharePoint Online Managed Services
20 Mimecast Service
21 Cloud Virtual Desktop
22 Citrix Support Service
23 Desktop-as-a-Service
24 Help Desk Support Service
25 Engagement Management Service
26 ServiceNow Managed Service
27 Salesforce Managed Service
28 Oracle GoldenGate Managed Service
29 Emergency Services
30 Common Services

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 30 of 52

IIINAVISITE
lN
~
□
□
□
□
□
□
□
□
□
~
□
□
□
□
□
□
□
□
□
□
□
□
□
□
□
□
□
~
~

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL
5 Application Managed Services

This section applies to the following Managed Applications purchased by Customer. The specific modules supported will be detailed in Exhibit B.

Application Technical
Support
Functional
Support Application Technical
Support
Functional
Support
Infor ☒ ☒ Oracle Hyperion ☐ ☐
JDE ☐ ☐ Oracle Siebel ☐ ☐
Kronos ☐ ☐ PeopleSoft ☐ ☐
OneStream ☐ ☐ Qlik ☐ ☐
Oracle eBusiness ☐ ☐ SAP ☐ ☐
Oracle Demantra ☐ ☐

24x7x365 Support
Navisite’s Application Managed Service provides Customer with 24x7x365 support for all environments. All events initiated by the monitoring environment will be handled by Navisite application administrator (“Admin”). The Admin will have access to Customer application support personnel, if needed, to support timely troubleshooting and resolution activities.

When a critical event and/or a “down” environment occurs, Navisite will begin the support process immediately upon notification of such event, which is defined as an “acknowledgement” by a Navisite Admin through a ticket update and/or “callback” within the SLA of any such event. Navisite will adhere to a 24x7 escalation and response plan SOP as defined by Customer and Navisite.

Non-critical support requiring downtime must be scheduled and approved by the Customer in writing. All support requests must come through Navisite ticket system and off-hours maintenance must be scheduled through Navisite Primary Admin(s) during normal business hours. Tickets that are not scheduled during these times will be handled on the next business day.

Application Technical Support
Navisite will perform the following services in support of the Customer application:
• Application Monitoring – 24x7 proactive monitoring of all critical services necessary to keep the applications available for users and performing optimally.
• Application Administration – Regular and routine tasks performed by Navisite application administrators to prevent issues and maintain a consistent end user experience. • Application Database Administration – Navisite will perform database administration tasks, to ensure the database environment supports the Application requirements. Navisite will manage the physical database structure and database objects. Documented change requests will be used for tasks such as applying database patches, creating new instances or environments, and stopping and starting database services.

Navisite will provide primary support for database administration. • Application Patching – Specific vendor or third-party recommended patches to remediate known Problems.

Navisite will download patches from the vendor whereby the Customer has a valid maintenance contract and apply, upon Customer approval, to the agreed to non-production environment. Patches will be “promoted” to production upon Customer’s successful testing and approval. • Incident/Problem Management – 24x7 break-fix support for functionality that was previously operational and working. May include logging software defects with the software manufacturer, providing supporting information, and tracking defects to resolution
• Service Request Management - Administrative–Support for handling administrative support requests such as configuring users, printers, promoting objects, and copying data/data refresh. • Change Management – 24x7 work to adhere to both Navisite’s and Customer’s change management policy and procedure for introducing changes.

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 31 of 52

IIINAVISITE
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL

6 • Application Analytics – Navisite will furnish Customer with online access to the analytics platform user interface on a subscription basis for viewing key application performance metrics . Current modules include System Analysis, Monitors, Security and Compliance, and Administration, but others may be added in the future.
• Custom Object Support – Navisite will provide technical support, including break / fix support, for “Custom Objects” (e.g., interfaces, reports, screens, programs, and other objects) that are not part of the Applications delivered by the provider of that software for which the Customer has documentation (e.g., technical and/or functional specification). Creation of new Custom Objects or enhancements to existing Custom Objects are not included in the scope of this Section, but may be addressed via a separate professional services engagement
• Technical Upgrades – Major and Minor technical upgrades are not in scope.

Operational Procedures
Navisite will draft and maintain an Operational Run Book specific to the Customer’s use of the services. The Run Book will include content mutually agreed to by the parties on subjects such as:
• The operational integration between Navisite and Customer support teams; • Instructions for how to access the services;
• Customer Support procedures to include:
– Reporting, escalation, and contact information;
– Key support roles to include Customer Application Owner and Authorized Callers; – Communication protocol for exception management (e.g., escalations); • Change Management communication and coordination; and, • Backup and restoration procedures.

Disaster Recovery
A “Contingency Event” consists of an unplanned event or condition that renders Customer unable to use the services for purposes of providing access to the Applications in productive use, excluding any Customer-provisioned elements such as telecommunications services, hardware, or software separately ordered by Customer that Navisite is not managing as part of its defined Services.

If Navisite experiences a Contingency Event it will provide for restoration of access to the Applications in productive use, after the occurrence of the Contingency Event, through a VPN or other encrypted network connection. The Recovery Time Objective (“RTO”) defines the target amount of time that the Applications remain unavailable. The Recovery Point Objective (“RPO”) represents the target point in time, prior to a Contingency Event, to which data can be recovered. Navisite has the capability to provide multiple levels of service for RTO and RPO based on the business requirements. The specific RTO and RPO for the applications in scope are defined in the Service Level table below.

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 32 of 52

IIINAVISITE
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL
7 Application Functional Support
For customers who select this service, Navisite will perform 24x7 Functional support. Functional Requests include business questions that generally start with “how do I” and require functional application expertise.

Additional Application Management Services
Although not part of the core offering, the following services may be purchased separately:
• Development Bundle – Navisite can include ongoing development hours to help Customers extend the use of their applications throughout the enterprise. Development bundles are procured in groups of hours that are consumed monthly and can accrue within a calendar quarter but not beyond calendar quarters.

Customers provide functional specifications and Navisite provides the Development resources to improve reporting, customize applications, and/or write new interfaces (e.g., RICE objects). • Advisory Services – Navisite can provide ongoing advisory services to provide business, functional, and technical advice to improve the Customer’s use of their application and technology stack. Advisory Services are procured in groups of hours that are consumed monthly and can accrue within a calendar quarter but not beyond calendar quarters. Customers request advisory services through a Service Request.

Customer Obligations for Application Managed Services
• Identify an Application Owner, Authorized Callers, and an Executive Sponsor • Provide the application and database licensing for the run time systems • Notify Navisite of any critical processing periods during which no maintenance should occur with at least five (5) days’ notice.
• Customer will allow Navisite to post all necessary information to the application or third-party vendor’s support portal
• Actively support the implementation of the chosen telecommunications plan • Set the priority for all Incidents based on urgency and impact to the business • Approve the closure of Incidents
• Conduct acceptance testing of all application and technical changes in the environment • Provide reasonable guidance on the “request by date” for all Service Requests • Provide the application, database, and middleware licensing required to operate the applications • Attend Operational Status Meetings and Business Reviews • Provide Navisite a list of users that need access to and what access to the environment • Provide Navisite a list of contacts and escalation procedures for the environment.

Application Service Level Agreement
“Availability” means the ability for a majority of named users to access and use the Applications as designed. Navisite recognizes that the Applications are not available when either a) the Customer logs a Critical Incident detailing that a majority of named users cannot access and/or use the Applications b) a simulated transaction used for monitoring the application fails on two consecutives five minute intervals, or c) when the Applications are scheduled to be down for Scheduled Maintenance governed by Change Management activities.

Service Level Requirement Measurement Methodology and Tools Credit % of Monthly Fee

Application Availability 99.9% -
excluding pre-agreed maintenance
window

The overall Availability of the Applications is calculated as Availability Percentage = ((a - b) x 100) / a, where “a” is the total number of minutes in a given calendar month, and “b” is the total number of minutes that the
Applications are not available in that month.
5%
Application performance:
95% of transactions that meet
baseline requirements
When Application Analytics are in scope, Navisite will use the Application Analytics tool to measure all OLTP
transactions and establish an average response time and thresholds for acceptable performance.
5%
Disaster Recovery Performance
RPO = 24 hours
Once a Contingency Event is declared the amount of
time measured in hours to restore the applications and
2% for each
full hour
Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 33 of 52

IIINAVISITE
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL

8 RTO = 48 hours data for productive use (RTO) and the amount of maximum data loss (RPO).
missed
96% of Service Requests
submitted will be completed on or
before the Committed By Date
Service Desk ticketing system
2%

Contract Variations for Application Management Services

The contract variations stated below supersede the content stated in the section above • Navisite will perform Functional Support through its Customer Service Center ("CSC") staffed from 7:00 AM to 7:00 PM, Central Time, Monday through Friday, excluding Navisite holidays (which will not number more than ten (13) per calendar year) ("CSC Hours"). Functional Support consists of responding to Helpline Issues regarding the functioning and use of the Applications submitted by Customer's "Authorized CSC Contacts" . • Notwithstanding anything in this Service Schedule to the contrary, Customer acknowledges and agrees that Navisite will not perform an annual disaster recovery test pursuant to this Service Schedule

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 34 of 52

IIINAVISITE
lN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL
9 Managed Database Services

This section applies to the following database platforms selected by Customer.

Microsoft SQL ☐ Oracle Database ☒
MySQL ☐ PostgreSQL ☐
MongoDB ☐ DB2 ☐

24x7x365 Production Support
Navisite’s Managed Database Support Service provides Customer with 24x7x365 support for all environments . All events initiated by Navisite monitoring environment will be handled by the team of Navisite database administrators (“DBA team”). The DBA team will have access to Customer application support personnel, if needed, to support timely troubleshooting and resolution activities.

When a critical event and/or a “down” environment occurs, Navisite hereby agrees to begin the support process immediately upon notification of such event, which is defined as an “acknowledgement” by a Navisite DBA through a ticket update and/or “callback” either to occur within the SLA of any such event . Navisite will adhere to a 24x7 escalation and response plan SOP as defined by Customer and Navisite.

Non-critical support requiring downtime must be scheduled and approved by the Customer in writing. All support requests must come through Navisite ticket system, which can be facilitated via our web portal, email or phone call, and off-hours maintenance must be scheduled through Navisite standard ticketing process.

Special Terms and Conditions
• The services described in this section are delivered via a fully managed model only. Hourly support services are described in a separate document.

Database Services
• Database performance monitoring
• Database backup monitoring
• Database critical event monitoring
• Diagnostics installation, configuration, and maintenance. • Maintenance and troubleshooting
• Self-Service dynamic database and systems reports
• Event monitoring
• Proactive DBA maintenance and troubleshooting
• Database high availability support
• Database disaster recovery support

Monitoring
Navisite will proactively monitor all critical services necessary to keep the database environments available for users and performing optimally. This is accomplished through the use of custom scripts tailored to the database environment.

Navisite’s 24x7 Proactive Database Monitoring includes:
• SOP for all monitored events
• Database background processes
• Error log events
• Space allocation and management

Database Maintenance
Navisite will perform all tasks necessary to keep the database up and running for end users/application access and use. Navisite will perform all updates and changes to the database as per standard, agreed upon change control process. Navisite will create and follow SOPs for all routine tasks.

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 35 of 52

IIINAVISITE
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL

10 Navisite’s database maintenance includes:
• SOP for startup/shutdown of all databases
• SOP for change management of database configuration
• Management of all database initialization and configuration parameters • Troubleshooting of database issues

Database Tuning
Navisite will work with the customer to identify critical databases and perform proactive tuning and performance recommendations. The tuning assessment may include aspects of:
• Database memory management
• File I/O statistics
• Process wait statistics
• Database initialization and configuration parameters
• Identification of IO/CPU/Memory intensive SQL statements • Identification and recommendations for change of data file, transaction log files, server configuration changes and potential performance improvements

Patching Management
• Covers patches, service packs, point releases and hotfixes inclusive to the database systems presented in this agreement.
• Navisite works with customers to cooperatively identify and apply service packs in accord with customer needs and requirements.
• The Customer is responsible for all functional testing of their application.

Refreshes
Navisite will refresh Database instances upon Customer request . Clones may include any or all of the various components of an environment. Navisite refresh service includes an SOP for the refresh process.

Space Management
Navisite will work with Customer to manage utilization of storage resources within the database and at the file system level for all managed products. Navisite will be responsible for:
• Determining and implementing optimal data file model
• Setting database growth parameters
• Determining ideal layout for data files on the file system • Monitoring free space
• Managing objects including tables, indexes, and temporary database files

Change Control/Code Migration
Changes recommended by Navisite will be submitted to Customer, via Navisite ticket system, for Customer specific change control requirements and approvals . Approved changes will be scheduled at a mutual agreed upon time. All requests submitted by Customer users of Navisite ticket system is presumed to have completed Customer change control processes and have all the necessary approvals.

Navisite will manage the migration of specified code into the Customer’s environment . Navisite will work with Customer to develop a code migration SOP and Navisite will deploy code as defined in the SOP. Customer is responsible for providing detailed installation documents/instructions for code deployment, validating the deployment, and for all changes to the code and data as a result of a code deployment request.

Database Schema Management
Navisite will work with Customer to define and integrate the following database schema elements on an “as needed” basis:
• Creation and maintenance of new schema objects (tables, indexes, stored procedures, etc.) • Creation and maintenance of linked servers, user privileges, roles, synonyms, grants, etc. • Object storage clause definition for space management • Database object reorganization
Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 36 of 52

IIINAVISITE
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL
11 Database Backup Management
Navisite will work with Customer to define and implement a database backup strategy that meets the business requirements for recovery . Navisite will develop, test, deploy and maintain database backup scripts utilizing native toolsets or infrastructure backup solutions based on business requirements. Navisite’s backup management includes:
• Creating, testing, deploying, and maintaining all database backup scripts • Monitoring database backup jobs to ensure successful completion • Testing database backups to ensure successful recovery with minimal data loss on a yearly basis.

Infrastructure may be provided by Customer or Navisite depending on other services purchased. • Documenting the backup and recovery strategy and process in the Backup and Recovery SOP

Database High Availability Support
Navisite will work with Customer to implement and support the high availability features of the database environment when available. Navisite’s 24x7 High Availability support is dependent on specific platforms and will be scoped and designed during the sales engagement.

Customer Obligations for SQL Administration Managed Services • Customer will provide logical access to systems containing databases • Customer will allow Navisite to post all necessary information to vendor support services for remediation of issues.
• Provide Navisite a list of users that need access and what level of access to the environment. • Provide Navisite a list of any escalation contacts and procedures for the database environment. • Customer to provide server(s) for monitoring tools when remotely managed and not hosted in a Navisite data center.
• Customer is responsible for all hardware, software, and administration related to any non- provided toolsets for backup, and/or replication when remotely managed and not hosted in a Navisite data center.

Contract Variations for Managed Database Services
The contract variations stated below supersede the content stated in the section above • None
Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 37 of 52

IIINAVISITE
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL

12 Emergency Services

The following Navisite services (the “Emergency Services”) may be made available to Customer on an emergency basis when they have not purchased appropriate managed services in advance. Customer shall engage Navisite for these services via the standard ticketing process and the Services will be rendered by Navisite on a best effort basis.

All Services will be billed in arrears and priced at the hourly rates listed in Exhibit C. Any third- party software utilized as part of the Service will be invoiced separately.

Security Engineer Services
Upon Customer’ request a Security Engineer may be engaged to perform the following tasks

• Restoration of workloads via Navisite-provided tools when Navisite is not explicitly managing the tools • Advise Customer of approaches to contain and mitigate threat • Advise Customer of approaches to safely recover environment including additional tools/processes or alternate application and network architectures
• Installation and configuration of anti-malware and similar security software • Reconfiguration of firewall or other network devices in response to a security incident • Provide access to additional specialists (backup engineers, DBAs, etc.) as needed

Third Party Services
Navisite maintains relationships with several third parties who can provide more advanced security and forensic services. Upon Customer’s written (written request can be via email or ticketing process) request, Navisite will engage a third-party and pass through their service costs to Customer.

Emergency Services Service Level Agreement
Emergency Services will be provided on a “best effort” basis from Navisite. Navisite shall not be held liable for any damages caused by the initial threat which gave rise to Customer’s request for Emergency Services. Navisite shall not have any liability to Customer for any damages that may result if Navisite is unable to mitigate the threat or restore Customer’s environment, tools/processes or alternate application and network architectures (collectively “Systems”) to their prior state before the threat was introduced to Customer’s Systems. Customer represents and warrants that it shall not disparage Navisite in any way or on any medium related to Navisite ’s provision or the result of the Emergency Services.

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 38 of 52

IIINAVISITE
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL
13 Common Services

24x7x365 Network Operations Center
Navisite’s Network Operations Center (NOC) provides Customer with 24x7x365 support for all contracted services .

All support requests initiated by the Customer will be handled by Navisite support staff. The support staff will have access to Customer support personnel, if needed, to support timely troubleshooting and resolution activities.

When a critical event and/or a “down” environment occurs, Navisite will begin the support process immediately upon notification of such event, which is defined as an “acknowledgement” by a Navisite support staff member through a ticket update and/or “callback” each within 15 minutes of any such event. Navisite will adhere to a 24x7 escalations and response plan SOP as defined by Customer and Navisite.

All support requests must come through Navisite ticket system, which can be facilitated via our web portal, email or phone call.

Network Operations Center Services
• Level I support services with escalation to L2/L3 personnel • Email, Web-Based or Phone Ticket Submission Options
• Critical Event Monitoring & Alerting
• Standard Support for Non-Critical Issues 8 AM EST – 6 PM EST Monday through Friday, Excluding Customer Holidays
• Non-Urgent Tickets Submitted During Non-Standard Support Hours will be Responded to the Next Business Day
• Urgent Tickets (Defined via table below) will be Supported 24x7

Security Measures
• Dedicated Accounts: Each Navisite user is given a unique account, ensuring that access and actions can be tracked and audited per individual. This enhances accountability and security by preventing shared account usage.
• Multi-Factor Authentication (MFA) : Navisite employs Microsoft MFA to secure access to their network. This involves multiple layers of verification, with passwords and the user’s mobile device. • Restricted Authentication:
o Geofencing: Navisite employs geofencing technology to restrict access based on geographical locations. This means that only users accessing the system from predefined, authorized locations can authenticate and gain access.
o IP Address Restrictions: By restricting authentication to specific IP addresses, Navisite adds another layer of security, ensuring that login attempts from unauthorized or suspicious IP addresses are blocked. This helps in preventing unauthorized access from outside the designated geolocations. • Continuous Monitoring and Automated Alerts : Navisite employs continuous, real- time monitoring of all activities and access attempts within the geofenced area. This ensures that any suspicious or unauthorized activity is detected immediately.
o Automated Alerts: The system is configured to send automated alerts to security personnel whenever there is an attempt to access from an unauthorized location or IP address. This allows for swift response to potential security incidents.
o Constant Vigilance: The combination of real -time monitoring and automated alerts ensures that any anomalies are quickly identified and addressed, maintaining the integrity and security of Customer ’s data.
• Data Security - Encryption of Data in Transit : Network connection between App and DB server is isolated.

End users use the VPN tunnel which is isolated and encrypted. o Isolated Network Connection: The network connection between the application server (App) and the database server (DB) is isolated, meaning it is separated from other network traffic. This isolation helps to prevent unauthorized access and eavesdropping
o Encrypted VPN Tunnel: End users access the system through a Virtual Private Network (VPN) tunnel.

A VPN tunnel encrypts the data transmitted between the user’s device and the network, providing an additional layer of security. This ensures that even if the data is intercepted, it remains unreadable to unauthorized parties.

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 39 of 52

IIINAVISITE
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL

14 • Network Segmentation and Zero Trust Architecture:
o Network Segmentation with VLANs: Virtual Local Area Networks (VLANs) are used to segment the network logically. This means creating separate, isolated networks within the same physical infrastructure. By using VLANs, different types of data (e.g., the Customer's data versus other hosted systems) can be separated, reducing the risk of unauthorized access and improving security management.

Service Reporting
Navisite will make available monthly service- level information on the Customer portal detailing the quality of certain production services. This information may include certain availability data, data on service requests, trouble reports, if applicable, as well as other information. Navisite will provide Level II management and support services to Customers to assist them with questions and problem resolution pertaining to the Hosting Environment. Support calls will be assigned a priority, tracked and resolved as described below.

Customer will contact the NOC for all requests . Support requests shall be made by the Super User via the portal or, if urgent in nature, by phone. Each request will be assigned a priority and associated actions . Due to the differing priorities relating to the reasons a Customer might call for support, Navisite has structured a response plan to address the most critical issues first. When a Customer request is sent in, it should identify the severity of the request by using the severity type described below. Navisite staff taking the incident/request will assign the actual priority.

Priority Description
Urgent Critical infrastructure components or Customer server down or degraded; significantly operational impact.

High Incidents that result in a severe service disruption of the application-production environment and demand immediate attention. No single workaround exists. Business risk is high.

Medium Non-Critical Network components or services down or degraded. Incidents that result in loss of application functionality with some operational impact.

Low Network components or services or application functionality unavailable, but workaround possible with no operational impact; non-critical, deferred maintenance acceptable.

Navisite agrees to maintain “trouble tickets” to track all Customer requests. Regardless of the priority or whether an item is billable, it will be entered into this system. The system will be used, among other things, to track who is working on each task, status and date completed.

Navisite will, according to support priority and response times set forth above, receive and log the service request, diagnose the issue and, if applicable, create an action plan and schedule to address that issue and execute the action plan to resolve the problem upon approval by Customer.

Customer Requirements & Obligations
Customer acknowledges that the scope of services and fees set forth in this Service Schedule is based upon information that Customer has provided to Navisite. Navisite’s obligation to perform the Services and to deliver any Deliverables under this Service Schedule shall be subject to Customer’s fulfillment of the following obligations and requirements in addition to the Customer obligations mentioned previously in the S ervices sections of this Service Schedule:
• Customer shall have a valid license to use or contract through Navisite and to allow Navisite to use all third- party software components necessary for Navisite to perform the Services and for Customer to use all operating systems, applications and databases defined in this Service Schedule. Each Party will promptly notify the other Party if it becomes aware of a licensing problem. • For all Customer supplied hardware and software, Customer shall purchase and maintain all maintenance and vendor support services and will list Navisite as a support contact. Customer is solely responsible for Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 40 of 52

IIINAVISITE
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL
15 complying with the terms and conditions of all software license agreements that control the Customer - Supplied Software.
• Customer will provide Navisite both primary and secondary points of contact for all systems, applications, networking, business and database support. In the event all Customer points of contact are unavailable, Customer shall have made prior arrangements with Navisite to make other support contact arrangements or shall have agreed with Navisite on an applicable escalation process standard operating procedure (SOP). • Customer will provide Navisite with a list of users that need access to and what access to the environment • Customer will provide written notice to Navisite of any Customer initiated changes to systems that may affect Navisite provided services
• Customer will provide Navisite the required assistance, information gathering, and cooperation to deliver all necessary information within a reasonable period of time for Navisite to perform the Services described in this agreement.
• Customer will provide Navisite the required assistance to initiate connectivity using a Navisite specified IPsec site-to-site VPN tunnel or dedicated circuit between Navisite and Customer location(s). • Customer is responsible for supplying computers and other hardware to be used at Customer’s site, Customer’s WAN and Customer’s telecommunications devices and to maintain the foregoing in good working order and condition. Customer bears the entire risk of the performance or non- performance of all Customer- Supplied Software, computers, WAN, LAN and telecommunication devices. • Customer will provide logical access and system/application accounts for all necessary Navisite personnel to properly deliver the service.
• Unless otherwise specified, Customer is responsible for all Active Directory user, device, and group management including Group Policy Objects (GPOs).
• Customer herby represents and warrants that it is the data controller of its Customer d ata and will notify Navisite of any regulatory requirements for protection of Customer data.

In the event Customer fails to meet these requirements, Navisite will not be held responsible for any failure to meet the agreed upon SLA related to the service being provided.

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 41 of 52

IIINAVISITE
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL

16 Service Level Agreements (SLAs)

Service Level Requirement

Measurement Methodology and Tools

Credit % of
Monthly Fee
Service Desk Availability
Availability of the Service Desk
shall be 99.9% of the time during
each month.

Navisite provides a web-based ticketing system for the
submission of requests. If the Customer is unable to
submit a ticket via Navisite’s web-based ticket system, email or the customer support line because these
communication methods are unavailable, upon
restoration of service, a ticket will be created to log the event for measurement purposes against the
availability metric. Scheduled maintenance will be
excluded from the calculation of availability.

5%
Response Time
For tickets submitted each month,
at least 96% of the Response
Times for total volume of Tickets
shall be less than or equal to the
associated service level objectives
detailed below.

Service Desk ticketing system

5%
Change Implementation Failure
For each change implementation
failure during the month that is
caused by Navisite failing to follow
and/or properly execute the
agreed upon/provided procedures.

Service Desk ticketing system

Reporting
Customer will be entitled to credit as outlined below if Customer (1) provides written notice to Navisite of the circumstances giving rise to the credit request, (2) provides such written notice between one and ten calendar days after the last day of the calendar month within which such circumstances occurred and (3) identifies each applicable trouble-ticket number that Navisite network-operations center (the “NOC”) issued, that relates to the SLA and with respect to which Customer seeks credit, including the dates and times on which such trouble tickets were opened and closed.

Credit Policy
For any billing month in which Navisite fails to meet the foregoing guarantee with respect to a particular Service, Customer will, subject to the “Credit Exceptions” listed below, receive, as its sole and exclusive remedy and Navisite’s sole obligation for such failure, credit to its account based on the structure set forth in the chart below and the actual duration of the interruption of such Service, as measured from the issuance of a trouble ticket by the NOC to the restoration of the impacted Service. The amount of credit is stated below as a percentage of the minimum fees due to Navisite for such affected Service for the applicable calendar month.

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 42 of 52

IIINAVISITE
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL
17 CREDIT EXCEPTIONS
• If at any time Customer is in default under the Agreement, Customer will not be entitled to any credit. • Customer is limited to receiving an aggregate credit of 50% of the minimum fees due to Navisite for the applicable calendar month under all SLAs between Customer and Navisite. • Credit will not be issued under this SLA for any covered outage that, as determined by Navisite in its reasonable judgment, results from any of the following:
– Customer-initiated changes, whether implemented by Customer or Navisite on behalf of Customer; – Customer exceeding system capacity;
– viruses, except to the extent that such outage results from a failure to apply a generally available and approved countermeasure within six hours of a documented outbreak; – Customer-required revisions to operating- system software or hardware or software configurations that are not tested and approved by Navisite;
– problems caused by Customer -supplied website content or software (e.g., faulty common gateway interfaces or third-party applications);
– Customer’s failure to adhere to Navisite’s change-management process and procedures; – acts or omissions of Customer; its employees, agents, third- party contractors or vendors; or anyone gaining access to Navisite’s network or to Customer’s website at the request of Customer; – Acts of God or natural disasters;
– any event or condition not wholly within the control of Navisite; – a violation of Navisite’s Acceptable-Use Policy;
– the negligence or willful misconduct of Customer or others it authorized to use the Services; – any failure of any component for which Navisite is not solely responsible, including, without limitation, all Customer-provided or Customer -managed electrical -power sources, networking equipment, computer hardware, computer software or website content;
– any failure of Customer-provided local-access facilities; – any scheduled maintenance announced at least 48 hours in advance, up to an accumulated total of 8 hours per month;
– any emergency maintenance announced at least 60 minutes in advance, up to an accumulated total of 2 hours per month; or
– any failures that cannot be corrected because Customer is inaccessible.

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 43 of 52

IIINAVISITE
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL

18 Service Level Objectives (SLOs)

Service Level Objectives
Service Response Time Notes
Urgent Priority Tickets

15 min response time to
start working on the ticket.

Navisite will work continuously to resolve the issue
and will provide the customer with status updates
every 1 hour on any critical ticket.

High Priority Tickets

2 hours response time to
start working on the ticket.

Tickets can be submitted 24x7 by the customer
and should be addressed per the ticket priority.

Medium Priority Tickets 1 business day response
time to start working on the
ticket.

Tickets can be submitted 24x7 by the customer
and should be addressed per the ticket priority.

Low Priority Tickets

2 business days response
time to start working on the
ticket.

Tickets can be submitted 24x7 by the customer
and should be addressed per the ticket priority.

Clones/Refreshes Up to 3 days to complete
the clone/refresh process.

Tickets can be submitted 24x7 by the customer
and should be addressed per ticket priority.
24-hour notice and 24 hours delivery time if the
time taken for clone is less than 12 hours.
48 hours delivery time if the time taken for clone is
more than 12 hours.

Critical Clones/Refreshes 2 hours response time to
start the clone process.

The clones requested to reproduce SEV1 issues in
PROD can be considered critical. Clones required
for training, consultant visits, etc. are to be treated as non-critical and will be supported based upon
the assigned priority.

Navisite will work continuously to deliver the clone
and will provide the customer with status updates
every 1 hour.

Ticket Priority Description
Urgent Critical infrastructure components or Customer server down or degraded; significantly operational impact.

High Incidents that result in a severe service disruption of the application-production environment and demand immediate attention. No single workaround exists.

Business risk is high.

Medium Non-Critical Network components or services down or degraded. Incidents that result in loss of application functionality with some operational impact.

Low Network components or services or application functionality unavailable, but workaround possible with no operational impact; non-critical, deferred maintenance acceptable.

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 44 of 52

IIINAVISITE
IIIN
SERVICE SCHEDULE | PROP RIETARY AND CONFIDENTIAL
19 Service Fees
The fees f
or the Services described in this Service Schedule (with r espect to all environments described herein) will be as set forth on Exhibit A to this Service Schedule (the “Service Fees”). Any additional or modified Services will be subject to additional fees in accordance with our Statement of Rates or as otherwise set forth in the Master Service Schedule.

Service Schedule Term
This S
ervice Schedule shall take effect as of the “Effective Date” appearing on the signature page hereto. The duration of the initial term of this Service Schedule shall be 12 months from the Effective Date. The initial term may be extended by Customer for up to three (3) successive 12-month renewal terms upon the execution of a mutually agreed upon amendment to this Service Schedule unless Navisite has provided Customer at least 180 days’ prior written notice indicating its desire to allow this Service Schedule to expire as of the end of the then- current term.

In the event that Customer terminates this Service Schedule other than in compliance with Section 9.2 of the Master Agreement, Customer shall, in addition to any other rights or remedies available to Navisite under the Master Agreement, pay to Navisite the remaining amounts owed under the then current term of this Service Schedule. [Signatures Appear on Following Page]
Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 45 of 52

IIINAVISITE
IIIN
August 27, 2024
Item #2 Page 46 of 52
Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C

AVISITE
Signature
This Service Schedule dated as of the Effective Date set forth below is a legal agreement between the Customer and Navisite for the services described above. By signing below, Customer acknowledges and agrees that the terms and conditions of the Master Services Agreement dated as of July 1, 2024 (the "Master Agreement "), between Customer and Navisite shall govern and apply to Customer's purchase and/or license, as applicable, of the products and services as described in this Service Schedule. The Master Agreement is incorporated herein by reference and made a part of this Service Schedule. In the event of a conflict between the terms of the Master Agreement and this Service Schedule, the Master Agreement shall apply unless and only to the extent that this Service Schedule specifically provides that a term or condition is intended to supersede the Master Agreement. References using the pronouns "you" and "your" shall refer to Customer. Capitalized terms used in this Service Schedule without definition shall have the meanings ascribed to them in the Master Agreement.
(Signing parties to this Agreement have the authority to bind their respective organizations) .

Executed by Customer and Navisite as of July 1. 2024 (the "Effective Date").

NAVISITE LLC, CITY OF CARLSBAD
a Delaware limited liability company
By: By:
(sign here)
Greg Clarke - Regional Vice President
(print name/title)
ATTEST·
By: SHERRY FREISINGER, City Clerk
(sign here) By (L ~ di,
Deputy City Clerk
(print name/title)
8/19/2024 Date: _____ _ Date:

APPROVED AS TO FORM:

CINDIE K. McMAHON, City Attorney
BY: d~~
Deputy City Attorney
SERVICE SCHEDU L E I PROPRIETARY AND CONFIDl::NTIAL 20
SERVICE SCHEDULE | PROP RIETARY AND CONFIDENTIAL
21 Exhibit A - Fees & Statement of Rates
This Service Fees Exhibit may be attached to one or more Service Schedules between Navisite and Customer .

Navisite’s standard maintenance services under each of such Service Schedule shall be as set forth opposite the title of the applicable Service Schedule in the table below under the heading, “Applicable Yearly Fees.” Description of Management Services Applicable Yearly
Fees (a)
One Time Setup
Fees (b)
Infor Application Managed Services $103,920 $0
Employee & Manager Self Service $31,200 $0
Infor ADFS $8,400 $0
Microsoft Add-ins $5,400 $0
Infor Process Automation $17,100 $0
Design Studio $3,000 $0
Lawson Business Intelligence (2 core) $22,200 $0
BSI TaxFactory $10,680 $0
Disaster Recovery (48 hour RTO, 24 hour RPO) Included $0 LDAP Bind Included $0
Lawson HR Included $0
Managed Cloud Services Included $0
Managed Database Services Included $0
Operating System Management Included $0
Physical Infrastructure Managed Services Included $0
Total $201,900 $0
Note (a)
– Notwithstanding anything in Section 2 of the Master Agreement to the contrary, Customer hereby requests and directs Navisite to (i) invoice Customer the full amount of the Applicable Year ly Fees for Year 1 on the date on which this Service Schedule is signed by Customer; and (ii) invoice Customer the full amount of the Applicable Yearly Fees for the Optional Extension renewal terms set forth below on the applicable anniversary of the Effective Date, but only in the event Customer elects to extend the initial term of this Service Schedule for one or more 12-month renewal terms. Customer agrees that the full amount of the Applicable Yearly Fees shall be payable to Navisite within thirty (30) days of the invoice issuance date.

Note (b) – The One Time Setup Fees will be invoiced upon contract execution.

For environments that are hosted within Navisite’s data centers, the Applicable Monthly Fees will commence billing after the first data extraction is performed and loaded onto Navisite’s server environment. *Informational Summary of Services and Cloud Compute Costs with 5% CPI Description of Management Services Management
Services
Yearly Fees
Cloud Services
Yearly Fees
Total Applicable
Not to Exceed
Yearly Fees
One Time
Setup Fees
Year 1 $201,900.00 $164,088.00 $365,988.00 $0
Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 47 of 52

IIINAVISITE
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL

22 Year 2 Optional Extension $211,955.00 $172,292.40 $384,287.40 $0 Year 3 Optional Extension $222,594.72 $180,907.02 $403,501.77 $0 Year 4 Optional Extension $233,724.29 $189,952.37 $423,676.86 $0

Note (f) - On the first day of each calendar year and only after Customer has been receiving Services for twelve (12) months under the applicable Service Schedule(s) and/or Statement of Work, pricing for Services and Deliverables shall increase by five percent (5%) of their current pricing.

Cloud Consumption invoicing will commence upon transfer or creation of accounts, organizations, or subscriptions to or by Navisite.

Cloud Service Estimated Yearly Fee Applicable Yearly Fees Metered Billing Enabled Amazon Web Services $0 $0 ☐
Google Cloud Platform $0 $0 ☐
Microsoft Azure $0 $0 ☐
Oracle Cloud Infrastructure $0 $0 ☐
Navicloud $0 $164,088 ☐

Notes
The intent of the Applicable Yearly Fee and associated scope of services provided in this Service Schedule above are to ensure the availability and performance of the in- scope environments in addition to performing the support functions described above. From time to time, Customer may request tasks that fall out of the defined scope of this Service Schedule. These are requests that would follow the change order approval process and would incur additional fees by the Customer . This type of work would be considered project and/or development work . Examples of these types of work efforts would include, but are not limited to major upgrades, platform changes, software development, development of new interfaces, application functionality, workflow or reports, etc . In general, the intent is that these are requests that may require some combination of a scope to be defined, deliverables, a project plan, a project manager and/or will take longer than two days to complete. Before performing this work, Navisite and Customer will mutually agree that the request falls outside of the scope.

Notes
The foregoing charges will apply to any Service Schedule between Navisite and Customer only for standard maintenance services included in the applicable Service Schedule. Any additional services above and beyond such standard services will incur fees as set forth in Navisite’s change order approval process between Customer and Navisite.

My company requires a
Purchase Order Number
for processing invoices:
☒ Yes

☐ No
If Yes, Purchase Order Number is:

Pending

Accounts Payable
Contact Information:

Name: IT Dept
Email: [email protected]
Phone Number: 442.339.2791
Billing Address: 1635 Faraday Ave
Billing Address 2: Click or tap here to enter text.

City, State, ZIP: Carlsbad CA, 92008
Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 48 of 52

IIINAVISITE
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL
23 Exhibit B – Inventory of Scope
Item Unit of Measure Quantity Notes
Infor S3 Production per instance 1
Infor S3 Non-Production per instance 1

Description Hostname Environment CPU Memory Storage OS Version Database Infor S3 c10gidbd01vo606
Non
Production 2 15 472 OracleLinux 6.1
Infor S3 LSF c10gisfp01vr606 Production 4 31 150 RedHat 6.1 Infor S3 LSF c10gisfd01vr606
Non
Production 4 31 150 RedHat 6.1
Database Infor S3 c10gidbp01vo606 Production 2 15 1527 OracleLinux 6.1 PROD Domain
Controller 2 c10gadcp01vw206 Production 2 8 99
Windows
Server
2012 R2
Datacenter
2012
R2
PROD Domain
Controller c10gadcp02vw206 Production 2 8 99
Windows
Server
2012 R2
Datacenter
2012
R2
Infor S3 Terminal
Server c10gitsp01vw206 Production 2 4 198
Windows
Server
2012 R2
Datacenter
2012
R2
Infor S3 LBI c10gibid01vw206
Non
Production 4 6 197
Windows
Datacenter 2019
Infor S3 LBI c10gibip01vw206 Production 4 6 237
Windows
Datacenter 2019
ADFS Server c10gadfp01vw606 Production 2 12 198
Windows
Standard 2016
ADFS Proxy c10gadfp02vw606 Production 2 4 198
Windows
Standard 2016
Infor S3 Ext Web Server
LSF c10gisfd02vr606
Non
Production 2 7 302 RedHat 6.1
Infor S3 Ext Web Server
LSF c10gisfp02vr606 Production 4 7 302 RedHat 6.1
Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 49 of 52

IIINAVISITE
-- -- --------- -
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL

24 Infor S3 Landmark c10gilmd01vw206
Non
Production 4 16 222
Windows
Server
2012 R2
Datacenter
2012
R2
Infor S3 Landmark c10gilmp01vw206 Production 6 16 148
Windows
Server
2012 R2
Datacenter
2012
R2
DEV ADFS for Internal
ADFS c10gadfp03vw606 Production 8 12 198
Windows
Standard 2016
DEV Web Application
Proxy for External
ADFS c10gadfp04vw606 Production 2 4 198
Windows
Standard 2016
Auto Imported c10gilmd01vw208 Production 4 16 169
Windows
Standard 2019
Auto Imported c10gadcp02vw208 Production 2 8 98
Windows
Standard 2019
Auto Imported c10gilmp01vw208 Production 6 16 146
Windows
Standard 2019
Auto Imported c10gadcp01vw208 Production 2 8 98
Windows
Standard 2019
Auto Imported c10gitsp01vw208 Production 2 4 196
Windows
Standard 2019

Note – The Quantities specified in Exhibit B for Storage/Backups are estimates based on discovery information.

Customer agrees to pay Navisite for all additional allocated Storage/Backups beyond these estimates at the agreed upon per GB rate.

Note - Notwithstanding anything to the contrary in the Master Agreement or this Service Schedule and any amendments thereto, all software licenses purchased at the request of Customer will be invoiced for the entire term(s) of the software license agreement.

The Applications within scope of support are:

Applications and Modules Unit of Measure Quantity Notes Infor S3 Named Users 1,800 Up to 1,800 users.

Lawson HR Module Named Users 50 Up to 50 users.

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 50 of 52

IIINAVISITE
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL
25 Exhibit C – Rate Card
The following rate card provides pricing for services of system components that may be added to the Customer environment at Customer request. Applicable services will be itemized and presented to Customer as part of the quarterly true up. The quarterly true up does not include net new services, which should be addressed with the account team via a Service Schedule.

Description of Services Unit Monthly Fee One Time Fee
Emergency Services Per Hour $275 $0
Security Incident Response Per Hour

$275 $0

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 51 of 52

IIINAVISITE
IIIN

SERVICE SCHEDULE | PROPRIETARY AND CONFIDENTIAL

26 Exhibit D – Security Variance

If Customer declines Company´s security recommendations and there is a security incident after the Variance is signed related to the Customer’s declining of Company’s security recommendations which requires work to remediate (“Remediation Work”), Customer agrees to pay Company a security fee (the “Security Incident Fee”), as described in the following tiers:

Customer Services Amount Security Incident Fee
Services equal or over $75,000.00 USD $150,000.00 USD Services between ($15,000.00) USD and ($75,000.00) USD ($75,000.00) USD Services under $15,000.00 USD ($25,000.00) USD

If the Remediation Work by Company exceeds the Security Incident Fee, Company will charge Customer and Customer agrees to pay two hundred and seventy-five ($275.00) USD per hour as additional remediation services, until the Remediation Work is complete. The Parties hereby agree that the Security Incident Fee, and hourly fee are reasonable estimates of Company’s true expenses and/or losses associated with the work expected to address any service interruptions, security incidents and/or other remediation efforts by Company to mitigate the consequences of the Variance.

Docusign Envelope ID: 131F4DA9-B618-496C-A179-A1A884D86E59 Docusign Envelope ID: BEFE8801-B4F7-4633-99FD-02993F29974C Aug. 27, 2024
Item #2 Page 52 of 52

IIINAVISITE
IIIN

Carlsbad City CouncilAugust 27, 2024

Carlsbad City Council
August 27, 2024