IBE
The City of Commerce
IT Remediation SOW
The City of Commerce | IT Remediation SOW Page 2 of 22
IBE
Contents
Overview .......................................................................................................................................... 3 Background ................................................................................................................................. 3 Proposed Solution ............................................................................................................................. 3 Workstream 1: Cisco DUO Multi-Factor Authentication ............................................................. 3 Workstream 2: Microsoft365 Entra ID Connect.......................................................................... 5 Workstream 3: Compute and Storage ........................................................................................ 7 Workstream 4: Aruba ClearPass for the Wire .......................................................................... 10 Workstream 5: Data Backup and Resiliency Veeam................................................................ 12 Workstream 6: IT Documentation ............................................................................................. 15 Workstream 7: Business Continuity Planning........................................................................... 16 Deliverables Review and Acceptance ................................................................................................ 17 Review of Deliverables.............................................................................................................. 17 Acceptance of Deliverables ...................................................................................................... 18 Assumptions ................................................................................................................................... 18 IBE Resources .......................................................................................................................... 18 General Project Assumptions ................................................................................................... 18 Client Contributions................................................................................................................... 18 Change Orders ................................................................................................................................ 18 Investment...................................................................................................................................... 19 Terms and Conditions of Service....................................................................................................... 19 Order Summary & Acceptance ......................................................................................................... 22 The City of Commerce | IT Remediation SOW Page 3 of 22
IBE
Overview
The purpose of this Statement of Work is to define project deliverables, time, and cost estimates for IBE, to deliver professional services to The City of Commerce (“Client”). This Statement of Work is based on an initial scope of work but is not a detailed project plan. A project plan will be created and managed by the technical resources assigned to the project once the Statement of Work has been approved.
Background
The City of Commerce has engaged with IBE to align IT initiatives to today’s demands. Technology is the backbone to a thriving city. Initiatives aim to implement industry best practices by enhancing security through Multi Factor Authentication, simplifying user experience, and extending support of critical lineof-business applications.
Proposed Solution
Workstream 1: Cisco DUO Multi-Factor Authentication
The implementation of Duo Multi-Factor Authentication (MFA) will significantly enhance the City's security posture by adding an essential layer of protection to online systems. This solution will require careful planning, configuration, and user cooperation to achieve maximum effectiveness.
Key Components
• Duo Security Platform: Deployment and configuration of the Duo Security platform, including the Authentication Proxy.
• Application Integration: Integration of Duo MFA with critical applications such as Microsoft 365, FortiGate SSLVPN, and Microsoft Windows Servers.
• User Enrollment: Enrolling all users in the Duo MFA service. • Policy Configuration: Establishment of secure Duo authentication policies based on user groups. • User Training and Support: Provide self-service training, enrollment, and post-cutover support to users.
Deliverables
Phase 1: Project Discovery and Planning
• Duo Authentication Methods: Work with point of contact to determine how users will answer the authentication prompts.
• Pilot User Group Definition: Work with point of contact to determine list of pilot users, up to 20, to test enrollment and authentication.
• Authentication Policy Definition: Work with PoC to determine policies for each application or group.
• Group Definition: Define, up to 4, groups for use in sync, application, or policy configurations.
The City of Commerce | IT Remediation SOW Page 4 of 22
IBE
• User Impact Analysis: Assess potential impacts on users and work with PoC to develop a staged communication plan.
• Duo Licensing: Validate appropriate Duo licensing based on required features.
Phase 2: Duo Setup and Configuration
• User Communication: Deployment Stage Communication.
• Authentication Proxy: Install DUO Authentication Proxy Service. • Duo Application Integration: Integrate Duo with FortiGate SSLVPN, M365 login, Windows Clients, and Windows Servers.
• Duo Authentication Policy Configuration: Define Duo authentication policies to best align with the level of protection desired for the given application.
Phase 3: Duo Pilot and Testing
• User Communication: Pilot Stage Communication.
• Pilot Deployment: Enroll a limited user group (20 users) for application testing and validation. • User Feedback Collection: Gather feedback from pilot users to identify any issues or areas for improvement.
• User and Application Validation: Validate that users, applications, and policies are behaving as expected.
Phase 4: Duo Deployment and User Enablement
• User Communication: Enrollment and Enforcement Communication. • Duo Enrollment: Enroll remaining users in Duo (~345 Users). • Duo Enrollment Support: 2, 8-hour, or 4, 4-hour, user enrollment support blocks are included to aid users in registering their BYOD or Company provided cell phones. • Duo Policy Enforcement: Enforce Duo authentication policies for all applicable users and applications.
Phase 5: Project Closure
• Documentation: We will provide “as built” project documentation1. We may also provide references to additional, vendor provided, documentation. • Project Sign Off: Obtain Project Sign Off from The City of Commerce.
Assumptions
• IBE is not responsible for any training required to support, change, or implement new features of the deployed technology.
• Windows machines to have Duo Authentication installed adhere to these system requirements.
The City of Commerce | IT Remediation SOW Page 5 of 22
IBE
• Customer will need to provide a server instance to install the Authentication Proxy. This can be either physical or virtual. If client has multiple sites, additional Authentication Proxy installations are recommended. System Requirements: Windows Server 2019 or later 2 CPU, 150 GB disk space, and 8 GB RAM.
• Service account credentials for Active Directory will need to be provided if installed on a nondomain joined server." • M365 Duo MFA requires an Entra ID P1 license for each user, license must provided at the start of the project.
• Duo licenses will be procured through the customer's or dealer contract. Each user will require a DUO license.
• If using customer owned Duo licenses an IBE Admin "owner" account needs to be added to the customer's Duo tenant.
• IBE recommends Duo Advantage licenses which allows for policy enforcement, adaptive authentication, and stronger device trust.
• Separate GPO policies will need to be identified for agent rollout. Please refer to goals for specific GPO policies needed for this project.
• Without High Availability on the Authentication Proxy, downtime may be experienced.
Multiple load balancing options are available for use like Citrix NetScaler or F5 load balancers.
• The Authentication Proxy communicates with Duo's service on TCP port 443. This may require an outbound access rule in the local firewall.
• Any workstation not connected to the Active Directory domain will need the Duo agent installed manually. Extra labor charges for installation may apply. • All workstations must be rebooted once the agent is installed. • It is assumed the client will provide either a cell phone or land line. If neither exists, a hard token may need to be procured at an extra charge (approximately $30). • Hardware tokens are a good option for employees who are not willing to use a BYOD for business purposes.
• Windows 10 or higher is required for the Duo agent.
• Entra ID Connect is installed and working and the synchronization is consistent. • If Duo is not synchronized with Active Directory for user and group management, additional labor charges may apply.
• Duo protection for individual workstation logins is not part of the scope. • Duo protection for administrative logins for network devices (switches, firewalls, backup devices, etc.) are not included in this scope of work.
• Anything else not explicitly outlined as a deliverable is excluded from this project.
Workstream 2: Microsoft365 Entra ID Connect
The City of Commerce’s feedback indicated a desire to enhance the user experience within the M365 environment. Specifically, there was a requirement to improve password synchronization between onpremises systems and Microsoft 365. The City of Commerce seeks IBE expertise to optimize this integration.
The City of Commerce | IT Remediation SOW Page 6 of 22
IBE
Key Components
• Entra Connect: This is the on-premises software responsible for synchronizing Active Directory data between Active Directory and Entra ID.
• Synchronization Rules: These rules define which objects (users, groups, contacts) are synchronized and how their attributes are mapped.
• Password Hash Synchronization (PHS): PHS synchronizes a hash of a user's password from an onpremises Active Directory instance to a cloud-based Microsoft Entra instance. • Synchronization Filters: These allow for selective synchronization of objects based on specific criteria.
Deliverables
Phase 1: Project Initiation and Planning
• Environment Evaluation: Determine current configuration state. A change of scope might be necessary if an existing AAD or Entra Connect configuration exists. • Synchronization Scope: Work with point of contact to determine Active Directory Objects (Users, Contacts, Groups, Computers) to be synchronized. • Configuration Scope: Work with PoC to determine sync features that best suit the organization’s current and potential future needs.
• Risk Assessment and Mitigation Plan: Identifying potential risks and defining mitigation strategies.
• Data Validation: Determine the current data disparity between Active Directory and Entra ID. • Communication Plan: Establishing communication channels and frequency.
Phase 2: Microsoft365 Entra ID Connect Configuration
• M365 Management: Install Easy365Manager onto (up to 2) Domain Controllers for user and group management of email addresses.
• Data Backfill: Execute custom scripts to automatically write critical data from Entra ID into Active Directory.
• Data Validation: Work with PoC to validate that user data is in the desired state. • Entra Connect Installation and initial data sync: Perform installation of Entra Connect on appropriate server in staging mode. Set configurations determined in Phase 1 and run necessary scripts to enable feature sets.
Phase 3: Deployment and Validation
• Full Synchronization: Implementation of full synchronization of identified users, groups, and passwords.
• Synchronization Support: Up to 3, 4-hour, support blocks to assist users with accessing M365 services post synchronization.
Phase 4: Project Closure
The City of Commerce | IT Remediation SOW Page 7 of 22
IBE
• Documentation: We will provide “as built” project documentation. We may also provide references to additional, vendor provided, documentation. o As-built documentation captures the finished state of a project completed in accordance with the project plan
• Project Sign Off: Obtain Project Sign Off from The City of Commerce.
Assumptions
Network and Infrastructure Assumptions:
• The client's network infrastructure supports Active Directory and Azure connectivity. • Sufficient bandwidth is available for data synchronization between on-premises and Azure AD. • The client's firewall allows necessary communication ports for Azure AD Connect and cloud services.
• A suitable server meeting the minimum requirements for Azure AD Connect is available for installation. A dedicated server for this purpose is recommended.
Software and Licensing Assumptions:
• The client possesses valid licenses for Microsoft 365, Azure AD, and Active Directory. • Active Directory is in a healthy state and will not need reconfiguration for the project. If Active Directory needs to be configured for any capacity for M365 Sync, a change of scope may be required.
• The client has appropriate licenses for any third-party identity management tools.
Resource and Organizational Assumptions:
• The client provides necessary personnel for project coordination and support activities. • The client has access to required network infrastructure and administrative privileges. • Client assumes full responsibility for ongoing support and maintenance post-project completion. • Any additional scope changes or revisions may result in additional fees.
General Assumptions
• IBE may recommend and install tools to enhance management of specific technologies. Some tools may require a subscription for continued use.
• Post project delivery, management of most M365 Objects will be managed via Active Directory and then synchronized to M365.
Workstream 3: Compute and Storage
The City of Commerce's existing compute and storage infrastructure has become end-of-life. This scope seeks to replace the aging server and storage hardware with up-to-date versions. All current VMs and storage will be migrated to the new cluster with the existing licensing being moved to the new hosts.
Deliverables
The City of Commerce | IT Remediation SOW Page 8 of 22
IBE
Phase 1: Project Planning & Review
• Outline project objectives, deliverables, and resource allocation. • Environment: Review current ESXi environment, ESXi Networking, SAN configuration, and Core Networking.
• Planning, including but not limited to:
o Network consolidation
o Physical layout and positioning
o ESXi/Cluster/vCenter upgrade
o Migration batch creation
o User acceptance
• Additional Considerations:
o Power
o Backup
• Identify any Risks or Concerns
Phase 2: Physical Installation
• Onsite Removal: Removal of retired equipment from rack, if necessary. • Onsite Installation: Install 3 1U Dell Hosts, 1 Dell SAN, 1 Dell SAN disk shelf, and 2 HPE 10Gb blade modules (during maintenance window).
• SAN Cabling: Connect the new SAN to the new SAN disk shelf. • Host Cabling: Connect the new hosts to the management network, data network, and to the new SAN.
• Power Cabling: Connect the new hosts and SAN to the necessary PDUs/outlets. • Properly cable manage all installed cables and apply tags as necessary.
Phase 3: Base Configuration
• Switching: Configure existing switches to allow new hosts and SAN access to the data and management networks.
• Initial Configuration: Perform initial configurations to get hosts and SAN online and perform any registrations necessary.
• Initial Updates: Perform initial updates of firmware on hosts, SAN, and disk shelf. • Initial Installation: Perform initial installation of VMWare software and update to latest patch level.
Phase 4: Cluster Configuration
• Stage vCenter Environment: Perform upgrade of existing vCenter instance to latest and apply any patches during maintenance window.
• Remediation: Troubleshoot and remediate any issues during the upgrade. • Stage Host Networking: Translate current host networking configuration to new hosts port layout.
• vMotion: Configure vMotion network settings on new hosts and perform basic validation checks.
• Stage Cluster Environment: Create a new cluster and add all new hosts.
The City of Commerce | IT Remediation SOW Page 9 of 22
IBE
Phase 5: Testing & Validation
• VM Migration Testing: Perform test VM migrations to all new hosts during a maintenance window. Testing will include a VM from each configured VLAN in the current vCenter. • Remediation: Troubleshoot and remediate any configuration issues found during testing. • Validation: Work with point of contact to validate all VMs are functional across all hosts.
Phase 6: Migration & User Acceptance
• Monitoring and Support: During the VM migration effort, monitoring of migration status and VM support will be provided.
• VM Migrations: A total of 43 VMs, 28 online, will be migrated to the new ESXi cluster and storage.
• Migration Batches: VMs migrations will be categorized into; Non-critical VMs, Critical VMs, Large Critical VMs. Critical VMs and Large Critical VMs will be transferred during a maintenance window and weekend maintenance window respectively.
• Validation: Work with the point of contact to validate VMs after they are migrated. • Old Host Removal: Post VM migration the old hosts and cluster will be removed from vCenter and the licensing applied to the new.
Phase 7: Post Project Support & Project Closure
• Post-Project Support: Will provide a total of 12 hours of post-project support for up to 14 business days.
• Documentation: We will provide “as built” project documentation. We may also provide references to additional, vendor provided, documentation. • Project Closure: Conduct a final review and obtain project sign-off from the City of Commerce.
Assumptions
Network and Infrastructure Assumptions:
• The existing network infrastructure has sufficient capacity and bandwidth to support the new servers and storage.
• Network connectivity and cabling are in place for the new equipment. • The network environment is secure and protected by appropriate firewalls and security measures.
• Final design will be agreed upon during the planning and discovery phase.
Hardware and Software Assumptions:
• VMWare licensing is assumed to be moved from the old hardware to the new. • VMWare licensing is assumed to be adequate to support new configuration. • The purchased hardware (servers, storage, adapters, cables) is compatible and functions as expected.
• Required Microsoft software licenses (Windows Server Datacenter, user CALs) are valid and accessible.
The City of Commerce | IT Remediation SOW Page 10 of 22 IBE
• Adequate power infrastructure, including electrical outlets, power distribution units (PDUs), and circuit breakers, is in place to support the new server hardware and its operational requirements.
• The hardware and software installation process will proceed without major unforeseen issues.
Project Resource Assumptions:
• Necessary personnel with the required skills are available for the project. • The project team has the necessary access and permissions to perform required tasks. • Adequate project management tools and resources are available.
Project Scope Assumptions:
• The “Critical” and “Large Critical” VM quantity is assumed to be 25% of active VMs. • The project scope is limited to the deployment and configuration of the specified hardware and software components.
• Data migration and application migration are included within the project scope. • Requests for additional review or rescoping previously agreed upon deliverables by all parties may result in additional fees.
Workstream 4: Aruba ClearPass for the Wire
Aruba ClearPass is a network access control solution currently implemented by the City of Commerce for wireless network access. This scope seeks to extend the implementation to the wired network, thereby securing the City’s exposed ethernet ports and adding a passive failover instance. The implementation is planned for up to 400 concurrent wired devices with the ClearPass Access Licenses.
Deliverables
Phase 1: Project Planning & Review
• Outline project objectives, deliverables, and resource allocation. • Environment Review: Gather information about the existing network configuration (VLANs, routing), ClearPass Policy Manager settings and configurations, devices connected to the network (APs, printers, etc), and other pertinent items. • Planning, including but not limited to:
o Conversion of single CPPM to Active/Passive
o Maintenance windows
o Wired network policies
o Non 802.1x supported device capture (Printers, Cameras, etc) o Switch vendor specific policy requirements
o Switch configuration changes
o Group policy
o Pilot group (APs, Workstations, Printers, Cameras, etc) The City of Commerce | IT Remediation SOW Page 11 of 22 IBE
• User Acceptance Testing: Create Pilot validation procedure generation with point of contact to validate pilot and final implementations.
Phase 2: Existing ClearPass Upgrade to Latest
• Current Version Update: Update current ClearPass instance to latest version of 6.10. Backup current configuration.
• Next Hop Deployment: Deploy new instance of ClearPass 6.11 and update to latest version. • Restoration Migration: Shutdown 6.10 instance and restore 6.10 backup into new 6.11 instance during maintenance window.
• Next Hop Validation: Work with point of contact to validate migration was successful. • Final Hop Upgrade: Utilize internal, direct upgrade, feature to perform final upgrade to 6.12 version during maintenance window.
• Final Hop Validation: Work with point of contact to validate migration was successful.
Phase 3: ClearPass Deployment & Configuration
• ClearPass Server Deployment: Deploy new ClearPass VM to act as a standby node in an Active/Passive cluster.
• Clustering: Add new server to cluster as a Subscriber, designate as Standby Publisher, configure Virtual IP settings.
• Wired Policy Configuration: Configure ClearPass policies as discovered in the Planning Phase. • Switch Integration: Configure network switches for integration with ClearPass.
Phase 4: Pre-Deployment & Pilot Testing
• Engineering Validation: Work with point of contact to validate the configuration as planned and deployed.
• Remediation: Troubleshoot and remediate any configuration issues found during validation. • Pilot Configuration: Deploy configuration to pilot devices defined in the Planning Phase during a maintenance window.
• Pilot Validation: Work with point of contact to validate the pilot group’s functionality over the course of a 3-day soak period as defined in the Planning Phase.
Phase 5: Full Deployment & Support
• Full Deployment: Configure all access switches with necessary configuration to enable ClearPass for the wire during a maintenance window.
• Deployment Validation: Work with point of contact to re-validate the pilot functionality as defined in the Planning Phase.
• Post-Deployment Support: Will provide a total of 24 hours of post-deployment support for up to 14 business days.
Phase 6: Documentation & Project Closure
• Documentation: We will provide “as built” project documentation. We may also provide references to additional, vendor provided, documentation.
The City of Commerce | IT Remediation SOW Page 12 of 22 IBE
• Project Closure: Conduct a final review and obtain project sign-off from the City of Commerce.
Assumptions
ClearPass Assumptions:
• Existing ClearPass instance is licensed and in a healthy state. • Existing Internal Certificate Authority is fully deployed, in a healthy state, and does not require certificate renewals or OSE upgrades.
• ClearPass Onboard licensing and configuration for BYOD would require a Change of Scope. • Client’s virtualization infrastructure has the capacity necessary for the C1000v Virtual Appliance.
Network Infrastructure Assumptions:
• Existing access switches are compatible with Aruba ClearPass and have the necessary software and support levels.
• Server switches are physically secured and will not be configured for ClearPass authentication. • 802.1x authentication is already deployed for the wireless infrastructure and is compatible with wired authentication.
• Endpoints capable of 802.1x wireless authentication can also support wired 802.1x authentication.
• The network infrastructure supports 802.1x authentication for both wired and wireless connections.
Project Specific Assumptions:
• Additional ClearPass licensing may be required for increased capacity. • The Library network is excluded from this implementation. It is expected that an inventory of the library network devices will be provided.
• Pilot testing may cause interruption to selected devices, this is expected and loss productivity, data, or anything in relation to network connectivity cannot be reimbursed. • Existing hardware and software (Microsoft Active Directory, VMware hypervisors, switches, etc) are assumed to be under warranty, under support, configured to best practices, and support the project requirements.
• Any unforeseen hardware, software, or services identified during the project will require a change of scope.
• Client involvement is required for testing and validation, including potential off-hours or afterhours support. Third-party or vendor involvement may be necessary for certain tasks. • Client assumes full responsibility for the ongoing support, maintenance, and troubleshooting of the Aruba ClearPass for the wired solution following project completion. • Additional project scope or changes to agreed-upon deliverables may result in additional fees.
Workstream 5: Data Backup and Resiliency Veeam
The City of Commerce | IT Remediation SOW Page 13 of 22 IBE
This scope seeks to replace the UniTrends backup appliances with Veeam Backup Software, an HPE StoreOnce Deduplication appliance supporting Immutable Backups, and Azure storage services for offsite backup copies.
Key Components
• Veeam Backup & Replication: The primary software for data protection, backup, and recovery orchestration.
• HPE StoreOnce: A storage appliance for immutable data backup and protection against ransomware.
• Azure Storage: Cloud-based storage platform for offsite backups. • Virtual Infrastructure: The on-premises virtual environment (e.g., VMware) containing the data to be protected.
Deliverables
Phase 1: Project Initiation and Planning
• Project Scope Definition: Outline project objectives, deliverables, and resource allocation. • Environment Assessment: Gather information about existing infrastructure, backup systems, recovery procedures, and data protection policies.
• Gap Analysis: Identify gaps in current backup and recovery capabilities. • Requirements Definition: Define backup and recovery requirements based on business needs. • Veeam Assessment: Evaluate the suitability of Veeam for meeting backup and recovery needs.
Phase 2: Infrastructure Setup and Configuration
• Veeam Backup Server Deployment: Install and configure Veeam Backup Server. • Backup Repository Setup: Configure backup repositories (local, NAS, Azure cloud) based on capacity and performance requirements.
• Offsite Backup: Create Azure backup repository instance • Backup Job Creation: Define backup jobs for critical systems and data, including schedules, retention policies, and compression settings.
• Backup configuration: Configure Veeam backup copy for disaster recovery, defining jobs and target sites.
Phase 3: Testing and Validation
• Backup Verification: Perform test backups to verify data integrity and backup success. • File Restore Testing: Conduct restore tests to validate up to 10 files across 5 servers. • VM Restore Testing: Conduct restore tests to validate up to 2 VMs. • Disaster Recovery Testing: Conduct a file restore test from Azure to validate up to 10 files across 5 servers.
Phase 4: Full Deployment and Optimization
• Full Deployment: Implement backup jobs for all critical systems and data.
The City of Commerce | IT Remediation SOW Page 14 of 22 IBE
• Monitoring and Alerting: Configure Veeam monitoring and alerting. • Performance Optimization: Fine-tune backup jobs for optimal performance and resource utilization.
Phase 5: Project Closure
• Post project support: Will provide up to 8 hours of post-project support up to 10 business days. • Documentation: We will provide “as built” project documentation. We may also provide references to additional, vendor provided, documentation. • Project Closure: Conduct a final review and obtain project sign-off from the City of Commerce.
Assumptions
• Backup restoration testing may incur storage or transfer costs/fees. • Existing on-premises storage infrastructure may require temporary utilization to accommodate data migration during the Veeam implementation phase. The project team will assess and leverage existing storage resources as needed to facilitate a seamless transition (if required.) • Not all Historical data retention platforms can be integrated or migrated to Veeam Data Platform and may require it to be continually maintained by the client. • Existing backup platforms, and tape backup system is considered not in scope. • Deployment phase activities may impact overall network performance. • Final data retention requirements and services may impact monthly recurring fees associated with Microsoft Azure.
• Any existing hardware and software to be repurposed by this effort is in warranty, service agreements are in place and have been configured to best practice/standard applicable to the level of resiliency desired to be achieved by this effort. • Root level access provided for all nodes, devices, and services, associated with this effort. • Testing acceptance requires client associate engagement. This may include off-hours/afterhours periods where the client is requested to validate and approve the change made. • Connectivity: Internal network connectivity must support a minimum of SFP+(10gb.) or 10GbBaseT. A minimum of two additional ports at the server core or Network Core must be available and provided by the client.
• Additional network connections may be requested/required to facilitate best practice changes, achieve manufacture recommendations, or to support existing equipment services not provided to IBE at the time of this contract execution.
• Go live production | postproduction support is defined at Tier2/Tier3 (advanced, SME support.) The Professional Services team reserves the right to request the client provide Tier1/triage go live support if appropriate or not explicitly defined in this scope of work. • Requests for additional review or rescoping previously agreed upon deliverables by all parties may result in additional fees.
The City of Commerce | IT Remediation SOW Page 15 of 22 IBE
Workstream 6: IT Documentation
This scope seeks to establish a robust and efficient IT documentation framework that supports effective operations, compliance, and user experience within the organization.
Key Components
• To establish a robust and efficient IT documentation framework that supports effective operations, compliance, and user experience within the organization. • Enhance operational efficiency: Create standardized procedures and documentation to streamline IT operations, reduce downtime, and improve response times to incidents. • Strengthen compliance and security: Develop comprehensive documentation to ensure adherence to regulatory requirements and protect sensitive information. • Improve user experience: Provide clear and accessible information to end-users, empowering them to resolve common IT issues independently.
• Optimize resource management: Establish a centralized inventory and configuration management system to facilitate efficient resource utilization. • Mitigate risks: Develop and implement incident response plans to minimize the impact of IT disruptions.
• Foster knowledge sharing: Create a knowledge base to facilitate knowledge transfer and collaboration within the IT team.
• Support decision-making: Provide accurate and up-to-date information to support informed decision-making.
Deliverables
Phase 1: Project Initiation and Planning
• Data Gathering: Establish data collection methods and sources for required information. • Project Scope : Outline project objectives, deliverables, and resource allocation. • Gap Analysis: Identify gaps in current backup and recovery capabilities • Documentation Requirements Analysis: Identify specific documentation types to be created.
Phase 2: Documentation Development
• Configuration Documentation: Organize and standardize configuration documentation. • Responsible Use Guideline Documentation
• Network Diagrams: Create visual representations of the network infrastructure. • Inventory Management: Develop and maintain a comprehensive inventory. • Incident Response Planning: Create detailed incident response plans for routine outages. • Compliance and Legal Documentation : who is allowed to do what and access what (RBAC).
Physical and Identity permissions
Phase 3: Documentation Review and Approval
The City of Commerce | IT Remediation SOW Page 16 of 22 IBE
• Internal Review: Conduct internal review of documentation. • Documentation Finalization: Incorporate feedback and finalize documentation.
Phase 4: Documentation Distribution and Maintenance
• Documentation Distribution: Distribute documentation to relevant personnel. • Documentation Repository: Establish a centralized repository for document storage and access. • Documentation Update Plan: Develop a schedule for regular documentation review and updates.
Phase 5: Project Closure
• Project Sign Off: Obtain project sign off.
• Post Project Support
Assumptions
• Project Resources: Adequate personnel, budget, and infrastructure are allocated for project execution.
• Stakeholder Alignment: Key stakeholders support project goals and objectives. • Data Availability: Accurate and complete data is available for documentation development. • Document Accessibility: Existing documentation is accessible and in a usable format. • Subject Matter Expertise: Subject matter experts are available to provide information and clarification.
• Software Availability: Necessary software and tools (e.g., documentation software, collaboration platforms) are available.
• Documentation Repository: The organization has a repository for storing and managing documentation.
Workstream 7: Business Continuity Planning
IBE Security & Compliance professionals assist your company in developing a Business Continuity Plan (BCP) that will allow you to remain operational in the event of a disaster, business disruption or cybersecurity incident. Our team helps identify your company’s assets, business processes, and their exposure to internal and external threats. Whether improving an existing plan or creating a brand-new one, IBE will provide a BCP that is comprehensive, actionable, and incorporates regulatory guidance.
Key Components
• Consultation with Key Management to prepare the Business Continuity Plan • Creating or updating an inventory of critical assets, systems, locations, & backup systems • Developing a Business Impact Analysis of key business processes • Facilitating the BCP Risk Assessment
o Develop threat scenarios
o Analyze impact, probability, severity
o Identify gaps
The City of Commerce | IT Remediation SOW Page 17 of 22 IBE
• Employee Training
• Business Continuity Plan Testing
o Develop test scenarios
o Facilitate tabletop test
o Documentation of BCP test results
o Update BCP based on test results
Deliverables
• Finalization/Reporting
o Finalized Business Continuity Plan for Board or Executive Team Approval o Business Impact Analysis documentation
o BCP Risk Assessment results
o Presentation to Executive Team.
Assumptions
• Project Resources: Adequate personnel, budget, and infrastructure are allocated for project execution.
• Stakeholder Alignment: Key stakeholders support project goals and objectives. • Document Accessibility: Existing documentation is accessible and in a usable format. • Documentation Repository: The organization has a repository for storing and managing documentation.
• IBE’s resources will work with Client personnel to provide information required to understand risk, the technical environment, and existing information security controls, in a very timely fashion to achieve the project objectives, including timelines. • Client will appoint an internal resource to act as a central point of contact for the engagement. • All work is scheduled upon receipt of signed SOW. If specific start or end dates are required, please confirm our ability to meet those dates in advance of executing the agreement. • IBE assumes that this work effort can be delivered during normal business hours unless expressly stated
• Any Physical security controls are reviewed remotely and require staff participation. • Operational Technology (OT) is out of scope for the Business Continuity planning process Deliverables Review and Acceptance
Review of Deliverables
Client must review any “Draft” deliverable referenced above and provide any comments or feedback regarding that draft to IBE in writing within 14 days of receipt of the draft by End User. Any comment or feedback not provided to IBE in writing within this time frame will be considered outside the scope of this Project. Any material change to the deliverable must be requested in writing by Client to IBE upon receipt of the initial draft.
The City of Commerce | IT Remediation SOW Page 18 of 22 IBE
Acceptance of Deliverables
Final versions of deliverables are deemed accepted by Client unless expressly rejected by Client in writing, detailing the basis for such rejection, within 14 days of delivery by IBE.
Assumptions
IBE Resources
IBE will provide subject matter experts to work on the outlined objectives. IBE resources will work in the Client environment and work with Client to provide services. IBE resources may require privileged security access rights to the production environments and will be responsible for production changes as required to perform outlined work.
General Project Assumptions
• Change control procedures, including change request submittal and representation, will be managed by Client with input from IBE. Delays in change control requests and approval for production changes could impact project timelines.
• IBE is not responsible for bugs or feature limitations. Developing custom code to address solution limitations and/or managing Microsoft support cases is out of scope. • Product features or services not documented in this agreement are out of scope unless agreed by both Client and IBE.
Client Contributions
• In addition to a designated liaison with whom IBE can coordinate efforts and who will act as the main point of contact; it is IBE’s understanding that Client will provide people and/or resources necessary to enable successful completion of this project. • Client will identify a resource that will act as the primary contact for this project. IBE will communicate project status, system requirements, issues, etc. to this individual. • Client will provide IBE with remote access accounts to required resources for accessing and supporting the project.
• Client will provide IBE with a suitable workspace that has network connectivity and phone sets while onsite.
• Client will provide computing resources with access to production and test systems to facilitate the needs of the project.
• Client acknowledges that IBE will require information from Client in order for IBE resources to be fully utilized and to perform the services in the schedule and estimated days outlined herein.
Client agrees that it is responsible for ensuring that IBE is provided with such information in a timely manner to avoid delay or additional costs to Client which may result.
Change Orders
Any items not specifically addressed by this document will be addressed by a change order process and will be billed the same pricing structure agreed upon and outlined in this Statement of Work. In the event of a change in scope, you will be notified prior to the billing of any additional services.
The City of Commerce | IT Remediation SOW Page 19 of 22 IBE
Investment
Professional Service
Project Services $479,275
Business Hours: 2029
After Hours: 91
Business Hours Rate: $225
After Hours Rate: $250
Hardware / Software $491,625.79
Please See quotes below
Total Project Cost $970,900.79
All prices are exclusive of any applicable sales or use taxes, and shipping costs.
Project Services pricing from Sourcewell Contract # 030321-KON Hardware/ Software pricing from NCPA Contract: 01-170
Fees
All prices are exclusive of any applicable sales or use taxes. The total project services fee is fixed and will not change unless there is a mutually agreed modification to the scope of work. This model provides cost certainty for the client, ensuring that any additional effort required to complete the project remains the responsibility of IBE, provided the scope remains unchanged. Any requests for changes or additions to the project scope will require a formal change request and may result in additional fees and an extension of the project timeline. Projects in excess of $10,000 require a 50% deposit. Project work will not commence until the deposit is received. The remaining 50% will be billed on project completion.
Terms and Conditions of Service
1. Fees and Payment: Client agrees to pay all fees specified in this Schedule. Payment terms are net 30 days from date of invoice. Client shall be responsible for all applicable taxes arising from the services. IBE Digital may suspend service if Client has failed to pay any undisputed invoice within fifteen (15) days of the due date. Undisputed invoices not paid by the due date may be subject to a monthly service charge which is the lesser of one and one-half percent (1.5%) per month or the highest rate allowed by law.
2. Limited Warranty: (a) IBE Digital warrants for a period of thirty (30) days following delivery (the “Warranty Period”) that all services shall be performed in a professional manner in accordance with generally applicable industry standards. IBE Digital sole liability (and Client’s exclusive remedy) for any breach of this warranty shall be for IBE Digital to re-perform any deficient services, or, if IBE Digital is unable to remedy such deficiency within thirty (30) days, to void the invoice for the deficient services. IBE Digital shall have no obligation with respect to a warranty claim: (i) if notified of such claim after the Warranty Period or (ii) if the claim is the result of third-party hardware or software failures, or the actions of Client or a third party.
The City of Commerce | IT Remediation SOW Page 20 of 22 IBE
(b) THIS SECTION 2 IS A LIMITED WARRANTY AND SETS FORTH THE ONLY WARRANTIES MADE BY IBE DIGITAL. IBE
MAKES NO OTHER WARRANTIES, CONDITIONS OR UNDERTAKINGS, EXPRESS OR IMPLIED, STATUTORY OR
OTHERWISE, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT. ALL SOFTWARE AND HARDWARE PROVIDED OR INSTALLED BY IBE DIGITAL HEREUNDER ARE SUBJECT EXCLUSIVELY TO THE RESPECTIVE MANUFACTURER’S WARRANTY.
3. COMPENSATION FOR HIRING OTHER PARTY’S EMPLOYEES: During the term of this Schedule and for twelve (12) months thereafter, if either party retains the services (whether as an employee, independent contractor or otherwise) of any employee of the other party (or ex-employee within six (6) months of the employee’s termination of employment) who was directly involved in the provision of Services hereunder, the hiring party shall pay to the other party as reasonable compensation for the loss of the employee the sum of Fifty Thousand Dollars ($50,000).
4. LIMITATION OF LIABILITY: (A) NEITHER PARTY SHALL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL,
SPECIAL, OR CONSEQUENTIAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR INTERRUPTION OF
SERVICES, LOSS OF BUSINESS, LOSS OF PROFITS, LOSS OF REVENUE, LOSS OF DATA, OR LOSS OR INCREASED
EXPENSE OF USE), WHETHER IN AN ACTION IN CONTRACT, WARRANTY, TORT (INCLUDING, WITHOUT LIMITATION,
NEGLIGENCE), OR STRICT LIABILITY, EVENIF THE PARTIES HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH LIABILITIES. IBE DIGITAL SHALL NOT BE RESPONSIBLE FOR PROBLEMS THAT OCCUR AS A RESULT OF THE USE OF ANY THIRD-PARTY SOFTWARE OR HARDWARE. (B). EXCEPT FOR GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, IBE DIGITAL’S AND ITS SUBCONTRACTOR’S TOTAL AGGREGATE LIABILITY TO CLIENT ARISING OUT OF SERVICES
PERFORMED UNDER THIS SCHEDULE, REGARDLESS OF THE LEGAL THEORY UPON WHICH SUCH LIABILITY MAY BE
BASED, SHALL NOT EXCEED THE TOTAL PAYMENTS MADE BY CLIENT TO IBE DIGITAL FOR THE SERVICES IN QUESTION IN THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE FIRST OCCURRENCE OF THE EVENT GIVING RISE TO SUCH LIABILITY.
5. Confidential and Proprietary Information: (a) Each party agrees that all know-how, business, technical and financial information it obtains (as a “Receiving Party”) from the disclosing party (as a “Disclosing Party”) constitute the confidential property of the Disclosing Party (“Confidential Information”), provided that it is identified as confidential at the time of disclosure or should be reasonably known by the Receiving Party to be Confidential Information due to the nature of the information disclosed and the circumstances surrounding the disclosure. Except as may be necessary to perform its obligations under this Schedule, the Receiving Party will hold in confidence and not use or disclose any of the Disclosing Party's Confidential Information. The Receiving Party’s nondisclosure obligation shall not apply to information that: (i) was known to it prior to receipt of the Confidential Information; (ii) is publicly available; (iii) is rightfully obtained by the Receiving Party from a third party; (iv) is independently developed by employees of the Receiving Party; or (v) is required to be disclosed pursuant to a regulation, law or court order. (b) Any templates, schematics, processes or technical documentation provided by IBE Digital shall be deemed Confidential Information and proprietary information of IBE Digital without any marking or further designation. Client may use such information solely for its own internal business purposes. IBE Digital shall retain all rights to the aforementioned, which shall be returned to IBE Digital upon termination of the applicable Schedule. (c) IBE Digital shall maintain the confidentiality of protected health information in its possession or under its control in accordance with the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act.
6. Independent Contractor: IBE Digital and Client shall at all times be independent contractors. There is no relationship of partnership, joint venture, employment, franchise or agency created hereby between the parties.
Neither party shall have the power to bind the other or incur obligations on the other party’s behalf without the other party’s prior written consent.
7. Assignment: This Schedule may not be assigned by either party without the prior written consent of the other party, which consent shall not be unreasonably withheld or delayed. No consent shall be required where an The City of Commerce | IT Remediation SOW Page 21 of 22 IBE
assignment is made (i) pursuant to a merger or change of control or (ii) to an assignee of all or substantially all of the party’s assets. Any purported assignment in violation of this section shall be void.
8. Complete Understanding; Modification: This Schedule, as well as any applicable terms of service posted at www.allcovered.com/terms, shall constitute the full and complete understanding and agreement between Client and IBE Digital and supersedes all prior or contemporaneous negotiations, discussions or agreements, whether written or oral, between the parties regarding the subject matter contained herein. Any waiver, modification or amendment of any provision of this Schedule shall be effective only if in writing and signed by both parties.
9. Waiver and Severability: Waiver or failure by either party to exercise in any respect any right or obligation provided for in this Schedule shall not be deemed a waiver of any further right or obligation hereunder. If any provision of this Schedule is found by a court of competent jurisdiction to be unenforceable for any reason, the remainder of this Schedule shall continue in full force and effect.
10. Force Majeure: Neither party shall be liable to the other for any delay or failure to perform any obligation under this Schedule, except for a failure to pay fees, if the delay or failure is due to unforeseen events which are beyond the reasonable control of such party, such as strikes, blockade, war, terrorism, riots, natural disasters, power outages, and/or refusal of license by the government, insofar as such an event prevents or delays the affected party from fulfilling its obligations and such party is not able to prevent or remove the force majeure at reasonable cost.
11. Counterparts. This Schedule may be executed in any number of counterparts and each fully executed counterpart shall be deemed an original. The parties agree (a) that facsimile or electronic signature shall be accepted as original signatures; and (b) that the Schedule, or any document created pursuant to the Schedule, may be maintained in an electronic document storage and retrieval system, a copy of which shall be considered an original. In any legal proceeding relating to the Schedule, the parties waive their right to raise any defense based on the execution of the Schedule in counterparts or the delivery of such executed counterparts by copy, facsimile, or electronic delivery.
The City of Commerce | IT Remediation SOW Page 22 of 22 IBE
Order Summary & Acceptance
Effective Date: The date on which the services described in this Statement of Work are set up and first delivered to you.
Your signature below constitutes your acceptance of this Statement of Work, including our standard terms and conditions available online at the URL link(s) provided below or in hard copy upon request, which you have reviewed and accepted and which are incorporated into this Statement of Work.
This Statement of Work is not binding upon us until signed by a IBE manager, vice president, or executive officer.
Pricing valid for 15 days from the date of this document, pending credit approval. Confidential - not to be distributed to third parties.
Client: The City of Commerce
Signature:
{{_es_signer1_signature }}
Name: {{_es_signer1_fullname }}
Title: {{_es_signer1_title }}
Date Signed: {{_es_signer1_date }}
IBE Digital
Signature:
{{_es_signer2_signature }}
Name: {{_es_signer2_fullname }}
Title: {{_es_signer2_title }}
Date Signed: {{_es_signer2_date }}
SALES QUOTE
Sales Quote No: 40456
Account No:
Date: 10/3/24
CO00
City of Commerce
2535 Commerce Way
Commerce, CA 90040
City of Commerce Ship To:
2535 Commerce Way
Commerce, CA 90040
Bill To:
Sales Person P.O. Number Ship Method Payment Terms Quote Expires On Notes
Sloan Varing FedEx Ground- No Charge 30 Days 11/2/24
NCPA: 01-170
Item No Description Quantity UM Price Disc Amount
DUO-ADVANTAGE Cisco Systems : Cisco Duo Advantage edition Term: 1 year 345.00 EA $70.56 0.00 $24,343.20 Discount
Sales Tax
Freight
Sales Order Total
Subtotal
$0.00
$24,343.20
$0.00
A late charge of 1.5% per month with a minimum charge of $5.00 will be assessed on all past due invoices.
For any billing questions please e-mail [email protected] Thank you for your business!
$24,343.20
$0.00
SALES QUOTE
Sales Quote No: 40455
Account No:
Date: 10/3/24
CO00
City of Commerce
2535 Commerce Way
Commerce, CA 90040
City of Commerce Ship To:
2535 Commerce Way
Commerce, CA 90040
Bill To:
Sales Person P.O. Number Ship Method Payment Terms Quote Expires On Notes
Sloan Varing FedEx Ground- No Charge 30 Days 11/2/24
NCPA 01-170
Item No Description Quantity UM Price Disc Amount
9EA-00643 Microsoft Windows Server Datacenter Edition 48.00 License $1,325.94 0.00 $63,645.12 R18-01853 Microsoft Windows Server 400.00 License $79.38 0.00 $31,752.00 Discount
Sales Tax
Freight
Sales Order Total
Subtotal
$0.00
$95,397.12
$0.00
A late charge of 1.5% per month with a minimum charge of $5.00 will be assessed on all past due invoices.
For any billing questions please e-mail [email protected] Thank you for your business!
$95,397.12
$0.00
SALES QUOTE
Sales Quote No: 40450
Account No:
Date: 10/3/24
CO00
City of Commerce
2535 Commerce Way
Commerce, CA 90040
City of Commerce Ship To:
2535 Commerce Way
Commerce, CA 90040
Bill To:
Sales Person P.O. Number Ship Method Payment Terms Quote Expires On Notes
Sloan Varing NA 30 Days 11/2/24
NCPA 01-170
Item No Description Quantity UM Price Disc Amount
405-AAZY Dell HBA335e Adapter Low Profile/ Full Height 3.00 EA $763.34 0.00 $2,290.02 210-AYJZ Power Edge R650 Server 3.00 EA $17,436.25 0.00 $52,308.75 210-BBOO PV ME5024 STORAGE ARRAY 1.00 EA $57,627.83 0.00 $57,627.83 470-AATP Dell 12GB HD-Mini to HD-Mini SAS Cable 2M 1.00 EA $88.19 0.00 $88.19 210-AQID Dell EMC ME424 Storage Expansion Enclosure 1.00 EA $22,557.75 0.00 $22,557.75 470-ACLT Dell Network OM4 LC-LC Fiber Optic Cable 2 meter 6.00 EA $128.16 0.00 $768.96 J9993A Expansion module - Gigabit Ethernet / 10 Gigabit SFP+ x 8 2.00 EA $6,536.64 0.00 $13,073.28 J9150D SFP+ transceiver module - 10 GigE - 10GBase-SR - SFP+ / LC multi-mode - up to 984 ft
12.00 EA $1,269.12 0.00 $15,229.44
N820-07M Eaton Tripp Lite Series 10Gb/40Gb/100Gb OM3 LSZH Fiber Patch Cable 7M
8.00 EA $31.56 0.00 $252.48
N201-025-YM Tripp Lite Series Cat6 Gigabit Snagless Molded (UTP)Ethernet Cable,PoE, Yellow 25 ft
8.00 EA $20.66 0.00 $165.28
N201P-020-BL Tripp Lite Series Cat6 Gigabit Snagless Molded (UTP)Ethernet Cable,PoE, Blue 20 ft
6.00 EA $33.10 0.00 $198.60
N820-05M-TAA Tripp Lite10Gb Duplex Mulitmode 50/125 OM3 Fiber Patch Cable
6.00 EA $26.50 0.00 $159.00
Discount
Sales Tax
Freight
Sales Order Total
Subtotal
$16,883.76
$181,603.34
$0.00
A late charge of 1.5% per month with a minimum charge of $5.00 will be assessed on all past due invoices.
For any billing questions please e-mail [email protected] Thank you for your business!
$164,719.58
$0.00
SALES QUOTE
Sales Quote No: 40453
Account No:
Date: 10/3/24
CO00
City of Commerce
2535 Commerce Way
Commerce, CA 90040
City of Commerce Ship To:
2535 Commerce Way
Commerce, CA 90040
Bill To:
Sales Person P.O. Number Ship Method Payment Terms Quote Expires On Notes
Sloan Varing FedEx Ground- No Charge 30 Days 11/2/24
NCPA 01-170
Item No Description Quantity UM Price Disc Amount
H9WT9E HPE Foundation Care Software Support 24x7 Tech support for Aruba ClearPass New Licening Access 5yrs
4.00 Each $1,102.08 0.00 $4,408.32
H9WX9E HPE Foundation Care Software Support 24x7 Tech support for Clear Pass Cx000V VMBased Appliance 5yrs
2.00 Each $1,273.92 0.00 $2,547.84
JZ400AAE HPE Aruba ClearPass New Licensing Access- 100 concurrent endpoints ESD
4.00 Each $2,173.71 0.00 $8,694.84
JZ399AAE HPE Aruba ClearPass Cx000V VM-Base Appliance License ESD 1.00 Each $2,484.24 0.00 $2,484.24 Discount
Sales Tax
Freight
Sales Order Total
Subtotal
$0.00
$18,135.24
$0.00
A late charge of 1.5% per month with a minimum charge of $5.00 will be assessed on all past due invoices.
For any billing questions please e-mail [email protected] Thank you for your business!
$18,135.24
$0.00
SALES QUOTE
Sales Quote No: 40451
Account No:
Date: 10/3/24
CO00
City of Commerce
2535 Commerce Way
Commerce, CA 90040
City of Commerce Ship To:
2535 Commerce Way
Commerce, CA 90040
Bill To:
Sales Person P.O. Number Ship Method Payment Terms Quote Expires On Notes
Sloan Varing FedEx Ground- No Charge 30 Days 11/2/24
NCPA 01-170
Item No Description Quantity UM Price Disc Amount
R6U02A HPE StoreOnce 3660 80TB Base System 1.00 EA $57,637.56 0.00 $57,637.56 BB994AAE HPE StoreOnce Encryption E-LTU 1.00 EA $0.98 0.00 $0.98 HU4A6A5 HPE 5Y Tech Care Essential SVC 1.00 EA $0.00 0.00 $0.00 HU4A6A5#YHL HPE StoreOnce 3660 80TB Base System Supp 1.00 EA $38,150.42 0.00 $38,150.42 R7M24A HPE StoreOnce Gen4+ 10/25Gb 2p SFP Adptr 1.00 EA $2,522.49 0.00 $2,522.49 P-VBO365-0U-SU5Y
P-00
Veeam Backup for Microsoft Office 365 Term: 5 years 400.00 License $93.31 0.00 $37,324.00 P-DPPVUL-0I-SU5YP
-00
Veeam Data Platform Premium Edition Universal License (5 years)
6.00 License $8,899.20 0.00 $53,395.20
Discount
Sales Tax
Freight
Sales Order Total
Subtotal
$10,076.92
$199,107.57
$0.00
A late charge of 1.5% per month with a minimum charge of $5.00 will be assessed on all past due invoices.
For any billing questions please e-mail [email protected] Thank you for your business!
$189,030.65
$0.00