Agenda packet, second session — East Palo Alto City Council, October 20, 2026 (part 1 of 2)

EAST PALO ALTO CITY COUNCIL

REGULAR SESSION AMENDED AGENDA
Tuesday, October 20, 2026, 6:00 PM
EPA Government Center
2415 University Avenue, First Floor
East Palo Alto, CA 94303
NOTICE
This meeting will be held virtually and in- person at the Council Chambers located on 2415 University Ave, First Floor East Palo Alto, CA 94303. The virtual portion of this City Council meeting will be conducted in accordance with City of East Palo Alto Resolution adopted pursuant to Assembly Bill 361.

The public may participate in the City Council Meeting via Zoom Meeting or by attending inperson in the Council Chambers at 2415 University Ave, First Floor East Palo Alto, CA 94303.

Community members may provide comments by emailing [email protected], submitting a speaker card at the meeting, or using the RAISE HAND feature when the Mayor or City Clerk call for public comment. Emailed comments should include the specific agenda item on which you are commenting.

Please click this URL to join
https://us06web.zoom.us/j/87883753030
Or join by phone:

Dial (for higher quality, dial a number based on your current location):

US: +1 669 900 6833 or
+ 1 346 248 7799 or
+ 1 253 215 8782 or
+ 1 312 626 6799 or
+ 1 929 205 6099 or
+ 1 301 715 8592
Webinar ID: 878 8375 3030
International numbers available: https://zoom.us/u/aMWYF4KT East Palo Alto City Council October 20, 2026 Agenda
1 1

1. CALL TO ORDER AND ROLL CALL

2. APPROVAL OF THE AGENDA

3. APPROVAL OF CONSENT CALENDAR

3.1 Award Contract for Street Sweeping Services
Recommendation: Adopt a resolution authorizing the City Manager to award to and negotiate and execute an agreement with SCA of CA, LLC (SCA), in a form approved by the City Attorney, for a term of three years, with the option for two (2), one-year extensions, in an amount not-to-exceed $417,982.75.

3.2 City Council Meeting Minutes
Recommendation: Adopt September 1, 2026, City Council Meeting minutes for the Regular and Special Meeting

3.3 Proclamation Of the City of East Palo Alto Joining America the Entrepreneurial and Celebrating East Palo Alto the Entrepreneurial Recommendation: Accept the proclamation.

3.4 Award IT Consulting Agreements with Altioras Civic Consulting Corp. for City Website, Intranet and Consulting Assistance and with Apogee Global RMS for vCISO Support Services
Recommendation: Adopt a resolution:

1. Authorizing the City Manager to award, negotiate, and execute an agreement, in a form approved by the City Attorney, with Altioras Civic Consulting Corp. for City Website, Intranet and Consulting Assistance up to one hundred and twenty-nine thousand, five hundred dollars ($129,500) through June 30, 2028; and

2. Authorizing the City Manager to amend the City Website, Intranet and Consulting Assistance project contract after execution for any change orders needed up to ten percent over the contract amount, which in any case would not exceed one hundred and forty-two thousand, four hundred and fifty dollars ($142,450); and

3. Authorizing the City Manager to award, negotiate, and execute an agreement, in a form approved by the City Attorney, with Apogee Global RMS for vCISO Support Services up to three hundred fifty thousand dollars ($350,000) through December 31, 2031; and

4. Finding that the proposed actions do not constitute a “project” with the meaning of the California Environmental Quality Act (“CEQA”) pursuant to CEQA Guidelines sections 15378(b)(4) and (5) in that it is a governmental fiscal, organizational or administrative activity that will not result in direct or indirect changes in the environment.

East Palo Alto City Council October 20, 2026 Agenda
2 2

3.5 Response to the 2025–2026 San Mateo County Civil Grand Jury Report, “Is Our Flock of ALPR Cameras Properly Tended?”
Recommendation: Adopt a resolution:

1. Authorizing the Mayor to execute, and the City Manager to submit, the City’s response to the 2025–2026 San Mateo County Civil Grand Jury report titled “Is Our Flock of ALPR Cameras Properly Tended?”; and

2. Finding that action being considered does not constitute a “Project” within the meaning of the California Environmental Quality Act (CEQA), pursuant to CEQA Guideline section 15378 (b)(5), in that it is a government administrative activity that will not result in direct or indirect changes in the environment.

4. CLOSED SESSION

5. PUBLIC COMMENT

6. ADJOURN CITY COUNCIL MEETING AND RECONVENE TO THE EAST PALO

ALTO SANITARY DISTRICT MEETING

7. EPASD CONSENT
CALENDAR 7.1
Cash Disbursement Report for August 2026
Recommendation:

Accept the cash disbursement report required pursuant to California Health and Safety Code Section 6794.

8. EPASD POLICY AND ACTION

8.1 Addendum 2 to Palo Alto RWQCP Partner Agreement
Recommendation: EPASD Board adopt a resolution to amend the partner agreement between EPASD and the Palo Alto RWQCP with the proposed Addendum 2 presented here within.

9. EPASD PUBLIC COMMENT

10. ADJOURN EAST PALO ALTO SANITARY DISTRICT BOARD MEETING AND

RECONVENE TO THE CITY COUNCIL MEETING
East Palo Alto City Council October 20, 2026 Agenda
3 3

11. INFORMATIONAL REPORTS

11.1 Measure JJ Anti-Displacement Program Utilization Report Recommendation:

Receive special presentations from WeHOPE, Community Legal Services of East Palo Alto (CLSEPA) and Legal Aid Society of San Mateo County (Legal Aid SMC), Samaritan House, and East Palo Alto Community Alliance and Neighborhood Development Organization (EPACANDO) on the use of Measure JJ anti-displacement funds, launched in 2026.

12. SPECIAL PRESENTATIONS

12.1 Youth Commission Introductions
Recommendation: Introduce the inaugural members of the Youth Commission 12.2 Reimagine Dumbarton Presentation
Recommendation: Receive an update from Samtrans staff on the Reimagine Dumbarton project

13. POLICY AND ACTION

13.1 Rent Stabilization Board Appointments
Recommendation: Make board/committee appointments to the Rent Stabilization Board (RSB); and appoint applicants for Regular or Alternate Seats for the body using the selection process recommended by staff.

14. PUBLIC HEARINGS

14.1 Inclusionary Housing Alternative Compliance Option for West BayshoreNewell Improvements at Woodland Park (“West Bayshore-Newell Improvements”) Residential Project at 1-9 Newell Court, APNs 063-513- 820, 063-513-880, and additional locations, described herein.

Recommendation: Adopt a resolution:
1) Finding and determining that the proposed alternative, as set forth in Attachment 2 of the staff report, for the West Bayshore-Newell Improvements residential development project at 1-9 Newell Court (APNs 063-513-820 and 063- 513-880) and other locations described herein (“Project”), to provide 124 rental units, deed-restricted at 80 percent of Area Median Income (“AMI”) meets the Inclusionary Housing Ordinance (“IHO”) requirements under Section 18.37.080 of the East Palo Alto Municipal Code (“EPAMC”) based on reasons East Palo Alto City Council October 20, 2026 Agenda
4 4
offered by the applicant or other substantial evidence provided at the public hearing;
2) Providing direction on the replacement of rent-stabilized units that are or were occupied by households with incomes above lower income, as authorized by California Government Code Section 65915(c)(3)(C), by selecting one of the following options:
a. Require that each such unit be replaced with a unit of equivalent size that is made available at affordable rent to, and occupied by, low-income households, subject to a recorded regulatory agreement with a term of at least 55 years under Government Code Section 65915(c)(3)(C)(i), and in perpetuity to the extent required by EPAMC Section 18.48.220(D); or b. Require that each such unit be replaced as a unit subject to the City’s Rent Stabilization Ordinance (“RSO”), EPAMC Chapter 14.04, under a recorded regulatory agreement with the City as required by EPAMC Section

18.48.220(D), as described in the Analysis section of this report; and 3) Directs staff to include the selected option as a recommended condition of approval in the Project entitlement resolution to be presented to the Planning Commission. Replacement units for currently rent-stabilized units occupied by lower-income households, including units presumed to be occupied by lower-income households under Government Code Section 65915(c)(3)(B), must be deed-restricted under state law and as such are not subject to local agency discretion; and
4) Finding that the action being considered does not constitute a “Project” within the meaning of the California Environmental Quality Act (“CEQA”) pursuant to CEQA Guidelines sections 15378(b)(4) and (5) in that it is a governmental fiscal, organizational or administrative activity that will not result in direct or indirect changes in the environment.

14.2 Inclusionary Housing Alternative Compliance Option for the O’KeefeManhattan Improvements at Woodland Park (“O’Keefe-Manhattan Improvements”) Residential Project at 300 O’Keefe Street, APN 063- 441-240, and additional locations, described herein.

Recommendation: Adopt a resolution:
1) Finding and determining that the proposed inclusionary housing alternative, as set forth in Attachment 2 of the staff report, for the O’KeefeManhattan Improvements residential development project at 300 O’Keefe Street, APN 063-441-240, and additional locations described herein (“Project”), to provide 172 rental units, deed-restricted at 80% of Area Median Income (“AMI”), meets the Inclusionary Housing Ordinance (“IHO”) requirements under Section 18.37.080 of the East Palo Alto Municipal Code (“EPAMC”) based on reasons offered by the applicant or other substantial evidence provided at the public hearing.

East Palo Alto City Council October 20, 2026 Agenda
5 5
2) Providing direction on the replacement of rent-stabilized units that are or were occupied by households with incomes above lower income, as authorized by California Government Code Section 65915(c)(3)(C), by selecting one of the following options:
a. Require that each such unit be replaced with a unit of equivalent size that is made available at affordable rent to, and occupied by, low-income households, subject to a recorded regulatory agreement with a term of at least 55 years under Government Code Section 65915(c)(3)(C)(i), and in perpetuity to the extent required by EPAMC Section 18.48.220(D); or b. Require that each such unit be replaced as a unit subject to the City’s Rent Stabilization Ordinance (“RSO”), EPAMC Chapter 14.04, under a recorded regulatory agreement with the City as required by EPAMC Section

16. COUNCIL REPORTS

17. ADJOURNMENT
East Palo Alto City Council October 20, 2026 Agenda
6 6
This AGENDA is posted in accordance with Government Code Section 54954.2(a) This Notice of Availability of Public Records: All public records relating to an open session item which are not exempt from disclosure pursuant to the Public Records Act, that are distributed to the majority of the City Council will be available for public inspection at the City Clerk’s Office, 2415 University Avenue, East Palo Alto, CA at the same time that the public records are distributed or made available to the City Council. Such documents may also be available on the East Palo Alto website www.cityofepa.org subject to staff’s ability to post the documents prior to the meeting.

Information may be obtained by calling (650) 853-3100.

The City Council meeting packet may be reviewed by the public in the Library or the City Clerk's Office. Any writings or documents pertaining to an open session item provided to a majority of the City Council less than 72 hours prior to the meeting, shall be made available for public inspection at the front counter at the City Clerk's Office, 2ND Floor, City Hall, 2415 University Avenue, East Palo Alto, California 94303 during normal business hours. Information distributed to the Council at the Council meeting becomes part of the public record. A copy of written material, pictures, etc. should be provided for this purpose.

East Palo Alto City Council Chambers is ADA compliant. Requests for disability related modifications or accommodations, aids or services may be made by a person with a disability to the City Clerk's office at (650) 853-3127 no less than 72 hours prior to the meeting as required by Section 202 of the Americans with Disabilities Act of 1990 and the federal rules and regulations adopted in implementation thereof.

DECLARATION OF POSTING
This Notice is posted in accordance with Government Code §54954.2(a) or §54956. Members of the public can view electronic agendas and staff reports by accessing the City website. Under penalty of perjury, this Agenda was posted to the public at least 72 hours prior to the meeting.

POSTED: October 9, 2026
AMENDED: October 15, 2026
ATTEST:

James Colin
City Clerk
Upcoming meetings:

Special Meeting November 10, 2026 6:00 PM
Regular Meeting November 17, 2026 6:00 PM
Regular Meeting December 1, 2026 6:00 PM
East Palo Alto City Council October 20, 2026 Agenda
7 7
CONSENT ITEM 3.1

EAST PALO ALTO

CITY COUNCIL

STAFF REPORT
DATE: October 20, 2026
TO: Honorable Mayor and Members of the City Council
VIA: Melvin E. Gaines, City Manager
BY: Humza Javed, Public Works Director
Diana Tran, Environmental Services Aide
SUBJECT: Award of Contract for Street Sweeping Services Recommendation

1. Adopt a resolution authorizing the City Manager to award to and negotiate and execute an agreement with Sweeping Corporation of America of CA, LLC (SCA), in a form approved by the City Attorney, for a term of three years, with the options for two one-year extensions (with Council likewise delegating authority to the City Manager for such optional extensions), in an annual amount not-to-exceed $417,982.75 (plus possible requested CPI in future years); and

2. Find that the proposed action is categorically exempt from the California Environmental Quality Act (CEQA), pursuant to CEQA Guidelines Section 15301(c)(1) and 15308 Alignment with City Council Strategic Plan
This recommendation is primarily aligned with:

Priority: Public Health, Safety, and Quality of Life
Priority: Public Infrastructure and Utilities
Background
Federal regulations outlined in the Clean Water Act (1972) and the ensuing National Pollution Discharge and Elimination System (NPDES) require municipalities to prevent pollution from entering U.S. waters. To keep streets clean of debris, prevent pollutants from entering storm drains and receiving waters, and meet federal, State, and regional stormwater regulatory requirements, the City of East Palo Alto began utilizing street sweeping services in 1992. 8 CONSENT ITEM 3.1
Sweeping Corporation of America of CA, LLC (SCA) is the current street sweeping contractor for the City of East Palo Alto and has had a contract with the City since January 2, 2017. The most recent contract with SCA was awarded on January 2, 2023, for an annual not-to-exceed amount of $361,750 and would have expired on December 31, 2025; however, an amendment was authorized by the City Council to extend the contract term to December 31, 2026.

The purpose of this staff report is to recommend the selection of SCA as the citywide street sweeping service contractor.

Analysis
Proposal Review
City staff released a request for proposals (RFP) in accordance with its purchasing policy through an advertisement on August 31, 2026, and shared the RFP link with the trade journals. The RFP closed on September 21, 2026, and the City received one proposal in response.

Public Works staff have worked with SCA during the current contract term. Although there are occasional complaints from residents regarding sweeping quality, the contractor tends to address the issues and respond to the complaints in a timely manner. Staff is generally satisfied with SCA’s work for the following reasons:
 This contractor was able to complete the work within the allocated funds;  Excellent responsiveness and consistent high-quality customer service;  Experienced and licensed staff, with regular trainings for operators and drivers;  Excellent equipment maintenance and noted responsiveness to replacement of equipment or driver exchange if issues arise;
 Verifiable quality assurance standards, including GPS-supported route accountability and daily route monitoring.

Summary of Contract Terms
City staff proposes, and the SCA representative agrees, to substantially the following terms which will be included in the final contract language:
 Service will begin on January 1, 2027 (following expiration of the prior contract extension); o Contract duration is for three years, with an option of two, one-year extensions at the City Manager’s request and upon mutual agreement consistent with the attached resolution;
 Cost of service shall be $349,982.75 per year for routine street sweeping services (including debris disposal), and up to $417,982.75 per year with additional services such as unscheduled service, emergency service, and emergency debris removal. There is an option for the contractor to request an annual increase consistent with the current Consumer Price Index, upon fulfillment of the contract terms; 9 CONSENT ITEM 3.1
 The contract shall be subject to the payment of prevailing wages, per State law;  Contractor shall sweep streets according to the schedule provided in the RFP which is located at the following link:
<https://www.cityofepa.org/sites/default/files/fileattachments/public_works/page/25356/s treet_sweeping_rfp.pdf >;
 The sweeping schedule may be amended by the City by written agreement with a minimum two week advance notification to contractor;
 Street sweeping shall be verified by City audit and contractor quality assurance of 95% effectiveness and timeliness;
 Contractor shall dispose of all waste associated with fulfilling the terms of the contract;  Contractor shall provide all water necessary to fulfill the terms of the contract without the need for potable water provided by the City of East Palo Alto;  Contractor shall ensure adequate dust control by means of no visible airborne dust;  Performance Measures shall be indicated in the following parameters:
o All equipment used shall be in compliance with the Bay Area Air Quality Management District (BAAQMD) by providing the City with equipment that meets or exceeds air quality standards set forth in the Mobile Source Compliance Plan, upon final adoption;
o All vehicles shall be equipped with Global Positioning Satellite (GPS) systems provided real-time data monitored by SCA dispatchers; tracks including time, date, and vehicle speed and location shall be provided to the City within 24 hours of request;
o Back-up equipment and personnel shall be available at all normally scheduled sweeping times;
o When the City has provided the Contractor with more than 5 complaints of a similar nature in a thirty-day period, Contractor shall provide the City with an assessment of complaint trends, and offer solutions for resolving the matter; o If the City indicates that there is a potential concern regarding equipment or personnel, Contractor shall seek to address the concern(s) in a meaningful way, such as replacement of equipment that does not provide excellent sweeping capability or replacement of a driver that is not fulfilling the duties as specified in the contract in a respectful and courteous manner;
o Contractor shall provide the City with the following information regarding Supervisors and Street Sweeper Operators/Drivers, including back-ups:
 Introduce all employees working in the City to the staff person(s) responsible for contract management prior to providing service in the City;  Inform City staff of training schedule and release to independent duty once training is completed;
 Provide written notice to staff within 24 hours of an emergency staffing change, or 24 hours prior to a new or replacement driver working in the City;  Provide at least once-a-month meetings with the City staff person to assess performance and seek ways to improve service;
o Provide monthly service reports indicating any late or missed routes, challenges identified during the sweeping route (such as illegal dumping, obstacles in the roadway, equipment failure, etc);
10 CONSENT ITEM 3.1
o Offer twenty-four hour telephone availability for emergency sweeping requests, along with immediate dispatch, as necessary;
o Monthly solid waste disposal tonnage reporting;
o Written response to complaints within 24 hours.

Fiscal Impact
The cost of this service is $349,982.75 in Calendar Year 2027 for base sweeping services, including debris disposal, and up to $417,982.75 in Calendar Year 2027 with additional services such as unscheduled service, emergency service, or emergency debris removal. This first half of this cost is included in the Public Works Environmental Division budget for FY 2026/2027.

Public Notice
The public was provided notice by making the agenda and report available on the City’s website and on a bulletin board located at City Hall: 2415 University Avenue, East Palo Alto.

Environmental
The proposed action is categorically exempt from the California Environmental Quality Act (CEQA), pursuant to CEQA Guidelines Section 15301(c)(1), as it involves “cleaning and other maintenance” of existing streets, sidewalks, gutters, and similar facilities. No improvements are proposed within the existing right of way and no expansion will occur of existing facilities. As a separate and independent basis, this action is exempt from CEQA pursuant to CEQA Guidelines section 15308 in that implementation of the agreement constitutes maintenance, restoration, enhancement or protection of natural resources and the environment.

Government Code § 84308
Applicability of Levine Act: No, as the contract was competitively bid.

Analysis of Levine Act Compliance: Not applicable.

Attachments

1. Resolution
11 1 of 1
RESOLUTION NO.

A RESOLUTION OF THE CITY COUNCIL

OF THE CITY OF EAST PALO ALTO

AUTHORIZING THE CITY MANAGER TO AWARD, NEGOTIATE, AND EXECUTE A CONTRACT

WITH SWEEPING CORPORATION OF AMERICA FOR CITY-WIDE STREET SWEEPING SERVICES

FOR A TERM OF THREE YEARS WITH THE OPTION FOR TWO ONE-YEAR EXTENSIONS (AUTHORIZING THE CITY MANAGER SUCH OPTIONAL EXTENSION AUTHORITY AS WELL) AT A COMPENSATION RATE OF UP TO $417,982.75 PER YEAR
WHEREAS, the current street sweeping contract for the City of East Palo Alto expires on December 31, 2026; and
WHEREAS, the City of East Palo Alto issued a request for proposals (RFP) based on a scope of services necessary to clean the City streets and eliminate the potential of litter and debris from entering the City’s storm drain system and the nations’ waterways; and WHEREAS, the City of East Palo Alto advertised the RFP on August 31, 2026, and received one proposal from Sweeping Corporation of America (SCA); and WHEREAS, SCA is the current street sweeping provider for the City of East Palo Alto and has been effectively providing services to the City since 2017; and WHEREAS, staff has negotiated the Calendar Year 2027 cost of this service up to an amount of $417,982.75, with possible requested CPI increases in future years.

NOW, THEREFORE, BE IT RESOLVED THAT THE CITY COUNCIL OF THE CITY OF EAST PALO ALTO HEREBY:

1. Finds the foregoing recitals are true and correct, and are incorporated by this reference into this action;

2. Authorizes the City Manager to execute a contract with SCA for citywide street sweeping services for a term of three years with the option for two one-year extensions (with Council likewise delegating authority to the City Manager for such optional extensions) at a Calendar Year 2027 compensation rate not –to exceed $417,982.75, allowing possible requested CPI increases in future years; and

3. Finds the proposed action is categorically exempt from the California Environmental Quality Act (CEQA), pursuant to CEQA Guidelines Section 15301(c)(1), as it involves “cleaning and other maintenance” of existing streets, sidewalks, gutters, and similar facilities. No improvements are proposed within the existing right of way and no expansion will occur of existing facilities. As a separate and independent basis, this action is exempt from CEQA pursuant to CEQA Guidelines section 15308 in that implementation of the agreement constitutes maintenance, restoration, enhancement or protection of natural resources and the environment.

PASSED AND ADOPTED this 20th day of October 2026, by the following vote:
12 1 of 1
AYES:

NOES:

ABSENT:

ABSTAIN:

Webster Lincoln, Mayor
ATTEST: APPROVED AS TO FORM:

James Colin, City Clerk John Le, City Attorney
13 CONSENT ITEM 3.2

EAST PALO ALTO

CITY COUNCIL

STAFF REPORT
DATE: October 20, 2026
TO: Honorable Mayor and Members of the City Council
VIA: Melvin E. Gaines, City Manager
BY: James Colin, City Clerk
SUBJECT: City Council Meeting Minutes
Recommendation
Adopt October 6, 2026, City Council Meeting Minutes.

Attachments

1. October 6, 2026, City Council Meeting Minutes.
14 EAST PALO ALTO CITY COUNCIL

REGULAR MEETING ACTION MINUTES
Tuesday, October 6, 2026, 6:00 PM
EPA Government Center
2415 University Avenue, First Floor
East Palo Alto, CA 94303

1. CALL TO ORDER AND ROLL CALL
Mayor Lincoln called the East Palo Alto City Council Regular Meeting to order at 6:07 PM.

City Clerk James Colin read a written statement from Vice Mayor Abrica regarding his absence following the passing of his brother, Miguel “Mike” Acosta. City Clerk James Colin confirmed a quorum was present.

Attendee Name Title Status Arrived
Webster Lincoln Mayor Present
Ruben Abrica Vice Mayor Absent
Carlos Romero Councilmember Present
Mark Dinan Councilmember Present
Martha Barragan Councilmember Absent

2. APPROVAL OF THE AGENDA
Motion by Mayor Lincoln, seconded by Councilmember Dinan, to approve the agenda.

Motion carried 3-0 by voice vote (Ayes: Lincoln, Dinan, Romero; Noes: None; Absent:

Abrica, Barragan).

3. APPROVAL OF CONSENT CALENDAR
Items 3.9 and 3.11 were pulled for separate consideration. No public comment was received on the remaining items.

Motion by Councilmember Dinan, seconded by Councilmember Romero, to approve the Consent Calendar, excluding Items 3.9 and 3.11. Motion carried 3-0 by voice vote (Ayes:

Lincoln, Dinan, Romero; Noes: None; Absent: Abrica, Barragan).

Consent Calendar Items:

3.1 Monthly Cash Treasury Report for August 2026

3.2 First Contract Amendment for the O'Connor Pump Station Phase I

3.3 On-Call Emergency Contract Services for storm response

3.4 FY 2026-27 Personnel Update
15 3.5 Breast Cancer Awareness Month Proclamation

3.6 Proclamation for Native American Day

3.7 Proclamation for Age Up Day

3.8 Authorize Contracts for On-call Temp Agency (22nd Century and Robert Half)

3.10 City Council Meeting Minutes

3.9 Proclamation for Domestic Violence Awareness Month
The proclamation declaring October 2026 Domestic Violence Awareness Month was read and presented to Robin Jensen, Manager of Prevention and Community Engagement, Communities Overcoming Relationship Abuse (CORA).

Public comment: Gail Dixon.

Motion by Councilmember Romero, seconded by Councilmember Dinan, to approve the proclamation. Motion carried 3-0 by voice vote (Ayes: Lincoln, Dinan, Romero; Noes: None;

Absent: Abrica, Barragan).

3.11 Proclamation for the Day of Remembrance
Mayor Lincoln read the proclamation recognizing October 7, 2026, as a day of remembrance in East Palo Alto. Public comment was limited to one minute per speaker.

Public comment: Batool Zaro, Rami, Ravneel, Mia O’Brien, Luis Rosas, Elaine Elbizel, Syna Saberi, Elle, Anna Stepanenko, Adti, Robin, Igal, Yuval, Hagid, Mario, Gail Dixon, Liban Sheik, Hibah, L
In response to a question from Councilmember Romero, the City Attorney advised that Municipal Code Section 2.08.080 requires the concurrence of a majority of all Councilmembers, or three affirmative votes, for Council action.

Motion by Councilmember Dinan, seconded by Mayor Lincoln, to approve the proclamation.

Motion failed 2-1 by voice vote (Ayes: Lincoln, Dinan; Noes: Romero; Absent: Abrica, Barragan). The City Clerk advised that the motion did not receive the three affirmative votes required under Municipal Code Section 2.08.080. The City Attorney noted the Council may reconsider the matter at a later date.

4. CLOSED SESSION
None.

5. PUBLIC COMMENT
Public comment was limited to two minutes per speaker. The following individuals addressed the Council: Gail Dixon, Luis Rosas, Mario, Ravneel, Raymond Goins, Isaac Stevenson, 16 Zaineb, Avram Finkelstein, James Aziz, Moran, David Reiber, Ayesha Raymond, Rebecca Eisenberg, Mojgan M., Taylor.

No action was taken.

6. ADJOURN CITY COUNCIL MEETING AND RECONVENE TO THE EAST PALO

ALTO SANITARY DISTRICT MEETING
Not reached.

7. EPASD CONSENT CALENDAR

7.1 Cash Disbursement Report for August 2026
Continued to the October 20, 2026 regular meeting, if agendized.

8. EPASD POLICY AND ACTION

8.1 Addendum 2 to Palo Alto RWQCP Partner Agreement
Continued to the October 20, 2026 regular meeting, if agendized.

9. EPASD PUBLIC COMMENT
Not reached.

10. ADJOURN EAST PALO ALTO SANITARY DISTRICT BOARD MEETING AND

RECONVENE TO THE CITY COUNCIL MEETING
Not reached.

11. SPECIAL PRESENTATIONS

11.1 Youth Commission Introductions
Continued to the October 20, 2026 regular meeting, if agendized.

12. POLICY AND ACTION

12.1 Rent Stabilization Board Appointments
Continued to the October 20, 2026 regular meeting, if agendized.

13. INFORMATIONAL REPORTS
17 13.1 Citywide Lighting Assessment Project
Continued to the October 20, 2026 regular meeting, if agendized.

13.2 Code Enforcement Update
Continued to the October 20, 2026 regular meeting, if agendized.

13.3 Update on the City’s SAFER Bay Project
Continued to the October 20, 2026 regular meeting, if agendized.

14. PUBLIC HEARINGS

14.2 Inclusionary Housing Alternative Compliance Option for the O’KeefeManhattan Improvements at Woodland Park (“O’Keefe-Manhattan Improvements”) Residential Project at 300 O’Keefe Street, APN 063-441- 240, and additional locations, described herein
Continued to October 20, 2026, as noticed on the amended agenda.

15. COUNCIL REPORTS
Not reached.

16. ADJOURNMENT
Due to a family emergency that would have left the Council without a quorum, Mayor Lincoln adjourned the meeting at 7:39 PM. Items not heard were continued to the October 20, 2026 regular meeting, if agendized, subject to confirmation by the Agenda Committee.

The next regular meeting is scheduled for Tuesday, October 20, 2026, at 6:00 PM. 18 CONSENT ITEM 3.3

EAST PALO ALTO

CITY COUNCIL

STAFF REPORT
DATE: October 20, 2026
TO: Honorable Mayor and Members of the City Council
VIA: Melvin E. Gaines, City Manager
BY: James Colin, City Clerk
SUBJECT: Proclamation Of the City of East Palo Alto Joining America the Entrepreneurial and Celebrating East Palo Alto the Entrepreneurial
Recommendation
Present the Proclamation for Joining America the Entrepreneurial and Celebrating East Palo Alto the Entrepreneurial
Attachments

1. Proclamation
19 PROCLAMATION OF THE CITY OF EAST PALO ALTO

JOINING AMERICA THE ENTREPRENEURIAL AND

CELEBRATING EAST PALO ALTO THE

ENTREPRENEURIAL
WHEREAS, as America marks its 250th startup birthday in 2026, we must celebrate the entrepreneurial spirit that built our nation, states, and cities, forged by starters, makers, doers, and dreamers who pursued a better future; and
WHEREAS, the American Dream is at risk, and because America belongs to the living generation, it is our turn to renew the nation’s entrepreneurial spirit; and WHEREAS, entrepreneurs are essential to fostering economic prosperity, creating homegrown jobs, raising incomes, generating wealth, building stronger communities, diversifying goods and services, and reducing inequality and poverty; and WHEREAS, each of us has the power to be a Founder of our nation’s future, and we encourage every resident to take action that builds a more perfect union; and WHEREAS, entrepreneurs have played a critical role in revitalizing East Palo Alto, and it is fitting to publicly recognize and celebrate the vital contributions of entrepreneurs to the prosperity and well-being of our community;
NOW, THEREFORE, BE IT RESOLVED that I, Webster Lincoln, Mayor of the City of East Palo Alto, together with the City Council, do hereby proclaim that the City of East Palo Alto will join “America the Entrepreneurial” and take actions to encourage more entrepreneurship across our city; and
BE IT FURTHER PROCLAIMED that the City of East Palo Alto shall celebrate its entrepreneurs and entrepreneurial spirit throughout 2026 as “East Palo Alto the Entrepreneurial” during our nation’s 250th startup birthday year.

Date: October 20, 2026
Webster Lincoln, Mayor
20 CONSENT ITEM 3.4

EAST PALO ALTO

CITY COUNCIL

STAFF REPORT
DATE: October 20, 2026
TO: Honorable Mayor and Members of the City Council
VIA: Melvin E. Gaines, City Manager
BY: Regina Rubier, Assistant to the City Manager
Jimmie Tulabing, IT Manager
Shiri Klima, Assistant City Manager
SUBJECT: Award IT Consulting Agreements with Altioras Civic Consulting Corp. for City Website, Intranet and Consulting Assistance and with Apogee Global RMS for vCISO Support Services
Recommendation
Adopt a resolution:

Priority No. 3: Governance, Organizational Strength, and Fiscal Sustainability Executive Summary
In the spring, the City Council approved the City’s Five-Year Information Technology Strategic Plan, which included various Information Technology (“IT”) projects mapped out over the coming five years to improve City services and increase cybersecurity. With existing IT staff focused primarily on essential day-to-day operations and technology needs, and with the need for some levels of expertise most small cities do not have in-house, staff prepared and posted two requests for proposals (“RFPs”) listing projects being outsourced in year one in order to advance strategic initiatives without disrupting ongoing services. After reviewing proposals and holding interviews, staff recommends award of contracts for the City Website, Intranet and Consulting Assistance Project and for virtual Chief Information Security Officer (“vCISO”) Support Services.

Staff will return in the future to request award of the remaining year one outsourced projects.

Background
On April 7, 2026, the City Council approved the City’s Five-Year Information Technology Strategic Plan (“IT Strategic Plan,” available starting on page 93 of https://d3n9y02raazwpg.cloudfront.net/cityofepa/85398a9a-d23b-11f0-bb28-005056a89546- 3408cd31-ecd7-4429-9d91-65986d552499-1775610342.pdf), establishing a framework for modernizing the City’s technology infrastructure, increasing cybersecurity, and strengthening its internal operational systems. The IT Strategic Plan identifies several initiatives intended to improve the City’s ability to manage data, support employees, and increase organizational efficiency, and most importantly, enhance public services.

Among the initiatives identified in the IT Strategic Plan is the need to modernize the City’s website in anticipation of the State’s 2028 accessibility requirements (A4), develop an internal intranet (A4.1), and address a variety of cybersecurity needs. The aforementioned projects are to commence in Year 1 of the IT Strategic Plan, which begins in Fiscal Year 2026-27. On June 16, 2026, the City Council adopted the Fiscal Year 2026-27 Annual Budget, which included funding and/or resources to advance these projects and a host of smaller cybersecurity fixes lumped together.

Analysis
On July 28 and 29, 2026, staff published two RFPs listing a variety of IT projects as well as generally cybersecurity needs. The proposals for the projects were due on August 24, 2026, and the proposals for the cybersecurity consultant were due on August 26, 2026.

These services were competitively solicited under Article IV of the City's Purchasing Ordinance (East Palo Alto Municipal Code Chapter 2.84) and Resolution No. 11-2025. The City Website, Intranet and Consulting Assistance contract falls within the Tier 2 services range (over $75,000 22 CONSENT ITEM 3.4
and up to $220,000), and the vCISO contract, measured by its total value, falls within the Tier 3 services range (over $220,000); each therefore carries City Council award authority. Notice of each RFP was posted and published more than the minimum period before proposals were due (at least 10 days for Tier 2 and 15 days for Tier 3) as required by Municipal Code Sections

2.84.540 and 2.84.550.

Municipal Code Sections 2.84.540 and 2.84.550 also require staff to publish RFPs in relevant trade journals in order to get the message out to many possible proposers. In this case, staff instead published the projects RFP on the Municipal Information Systems Association of California (MISAC) website, which brought in many projects proposals, and some of these vendors also proposed regarding the vCISO RFP. Additionally, the City’s IT Manager advised all vendors who separately inquired about the security initiatives in the City’s IT Strategic Plan to monitor the City’s website for updates on the vCISO RFP. Staff received a total of 69 timely proposals, 38 of which are for the City Website, Intranet and Consulting Assistance Project and for Virtual Chief Information Security Officer (“vCISO”) Support Services.

A. The City Website, Intranet and Consulting Assistance Project The City’s website is outdated and currently bogged down with a lot of outdated information and links that no longer work. It does not make easily available the most commonly sought information, and it does not utilize modern technology to further simplify such searches.

Additionally, the absence of a centralized intranet limits the City’s ability to efficiently communicate internal information and provide employees with consistent access to policies, procedures, forms, templates, and other resources. A centralized intranet would provide a common location for internal information and help reduce the amount of time staff spend locating and sharing documents and information across departments. Thus, this project requires both updating our current website and creating an Intranet.

The City received eight proposals for the City Website, Intranet and Consulting Assistance Project (Project numbers A4 and A4.1 in the IT Strategic Plan). The IT Manager, City Clerk and Assistant City Manager, along with Daly City’s Information Services Manager, read all proposals for this project and scored them on a rubric that allowed up to thirty points for the approach and work plan, thirty points for the firm and team members’ qualifications, twenty points for cost and overall value, and twenty points for responsiveness and deliverables’ quality. The final average scores ranged from 66 to 81, and staff then interviewed the top three proposers.

Staff now recommends that the City Council authorize the City Manager to award, negotiate, and execute an agreement with Altioras Civic Consulting Corp. for a not-to-exceed amount of one hundred and twenty-nine thousand, five hundred dollars ($129,500). In its proposal and interview, Altioras demonstrated a thorough plan to evaluate website platform options (plus critical experience with our currently preferred platform), to sort through the City’s current website pages to determine relevance and use, and to remove all dead links. The team members have strong experience in website production and the use of AI to speed that process. The 23 CONSENT ITEM 3.4
proposal included a clear timeline on deliverables, and the company offered a competitive price for completing the project. For these reasons, staff recommends this consultant for the City Website, Intranet and Consulting Assistance project.

Furthermore, staff needs up to a ten percent contingency for the project in the amount of twelve thousand, nine hundred and fifty dollars ($12,950). Staff recommends that the City Council authorize the City Manager to amend the contract as necessary for any change orders needed up to this extra ten percent contingency. The City Manager’s authority to amend this contract would not exceed one hundred and forty-two thousand, four hundred and fifty dollars ($142,450).

If the City Council takes the recommended action, staff expects this project to commence immediately after a contract is signed with the consultant and for the project to be completed by fall of 2027.

B. Virtual Chief Information Security Officer (“vCISO”) Support Services A virtual Chief Information Security Officer (“vCISO”) is an independent consultant engagement that provides strategic security leadership and supports implementation of the cybersecurity projects in the IT Strategic Plan over the coming five years.

The City received thirty timely proposals for the vCISO Support Services (which does not have a Project Number in the IT Strategic Plan but rather oversees many cybersecurity projects listed in that plan). Menlo Park’s IT Manager, Daly City’s Information Services Manager, Pacifica’s Information Systems and Technology Manager, and East Palo Alto’s IT Manager read all proposals for this project and scored them on a rubric that allowed up to thirty points for the approach and work plan, thirty points for the firm and team members’ qualifications, twenty points for cost and overall value, and twenty points for responsiveness and deliverables’ quality. The final average scores ranged from 46.50 to 92.75, and staff then interviewed the top five proposers.

Staff now recommends that the City Council authorize the City Manager award, negotiate and execute a five-year agreement to Apogee Global RMS, LLC for a not-to-exceed amount of three hundred fifty thousand dollars ($350,000) through December 31, 2031. In its proposal and interview, Apogee Global RMS will deliver a highly customized, budget-aligned vCISO strategy specifically tailored to the City's municipal environment. Apogee’s structured approach relies on a six-phase Cyber Risk Engagement Playbook V1 that provides clear management steps, work product controls, and a smooth 6- to 12-month operational handover to City staff. Designed to be able to be completed by a two-person IT team, the methodology batches stakeholder interactions and leverages pre-built templates to maximize operational efficiency. Furthermore, the firm establishes strong governance through regular Council presentations, vCISO-led status meetings, and annual tabletop exercises covering both technical and executive crisis response.

Ultimately, this senior, public-sector-focused team offers a thoroughly detailed, action-ready delivery model that ensures long-term institutional resilience for the City. For these reasons, staff recommends this consultant for vCISO Support Services.
24 CONSENT ITEM 3.4
If the City Council takes the recommended action, staff expects this work to commence immediately after a contract is signed and for the work to continue for five years.

Fiscal Impact
In the FY 2026-27 Budget process, the City Council appropriated funds for all IT capital projects (including cybersecurity projects). This is sufficient for these two contracts. Additionally, in March, City staff applied to the California Office of Emergency Services (CalOES) for a cybersecurity grant up to $250,000; on August 4, 2026, the City was notified that it was awarded the full $250,000 grant. Thus, no additional appropriations are needed at this time.

Public Notice
The public was provided notice by making the agenda and report available on the City’s website and on a bulletin board located at City Hall: 2415 University Avenue, East Palo Alto.

Environmental
The proposed action does not constitute a “project” with the meaning of the California Environmental Quality Act (“CEQA”) pursuant to CEQA Guidelines sections 15378(b)(4) and (5) in that it is a governmental fiscal, organizational or administrative activity that will not result in direct or indirect changes in the environment.

Attachment

1. Resolution regarding the City Website, Intranet and Consulting Assistance Project and vCISO Support Services

2. Altioras Proposal for City Website, Intranet and Consulting Assistance Project

3. Apogee Global RMS Proposal for vCISO Support Services

4. Scoring Rubric - City Website, Intranet and Consulting Assistance Project

5. Scoring Rubric - vCISO Support Services
25 Resolution No. XX-2026 1 of 3
RESOLUTION NO XX– 2026

A RESOLUTION OF THE CITY COUNCIL

OF THE CITY OF EAST PALO ALTO

AUTHORIZING THE CITY MANAGER TO AWARD, NEGOTIATE AND EXECUTE AGREEMENTS FOR INFORMATION TECHNOLOGY (“IT”) STRATEGIC PLAN

PROJECTS, INCLUDING THE CITY WEBSITE, INTRANET AND CONSULTING

ASSISTANCE PROJECT AS WELL AS FOR THE VIRTUAL CHIEF INFORMATION SECURITY OFFICER SUPPORT SERVICES; AND AUTHORIZING THE CITY

MANAGER TO AMEND THE CITY WEBSITE, INTRANET AND CONSULTING

ASSISTANCE PROJECT CONTRACT AFTER EXECUTION FOR ANY CHANGE ORDERS NEEDED UP TO 10% OVER THE CONTRACT AMOUNT
WHEREAS, on April 7, 2026, the City Council of the City of East Palo Alto (“City”) approved the City's Five-Year Information Technology Strategic Plan (“IT Strategic Plan”), establishing a framework for modernizing the City's technology infrastructure, increasing cybersecurity, strengthening internal operational systems, improving data management, and enhancing public services; and
WHEREAS, the IT Strategic Plan identifies several priority technology initiatives for the first year, including modernization of the City's website, development of an internal intranet, and a variety of cybersecurity initiatives; and WHEREAS, on June 16, 2026, the City Council adopted the Fiscal Year 2026-27 Annual Budget, which included funding and resources to advance the IT Strategic Plan projects described herein; and
WHEREAS, on July 28 and 29, 2026, City staff issued two requests for proposals (“RFPs”) for the IT Strategic Plan projects and cybersecurity consulting services and received a total of 69 timely proposals; and
WHEREAS, City staff evaluated proposals based upon the proposers' approach and work plan, qualifications and experience, cost and overall value, responsiveness, and quality of deliverables, and interviewed the highest-scoring proposers for the applicable projects; and
WHEREAS, the City Website, Intranet and Consulting Assistance Project is intended to modernize the City's website, address federal website accessibility requirements under Title II of the Americans with Disabilities Act, improve the City's public-facing digital information, and establish a centralized internal intranet to improve employee access to policies, procedures, forms, templates, and other resources; and WHEREAS, the virtual Chief Information Security Officer (“vCISO”) Support Services will provide the City with contracted strategic cybersecurity leadership and 26 Resolution No. XX-2026 2 of 3
support implementation of cybersecurity initiatives identified in the IT Strategic Plan over a five-year period; and
WHEREAS, funding for the applicable IT capital and cybersecurity projects was included in the Fiscal Year 2026-27 adopted budget, plus the City was notified of award of a $250,000 cybersecurity grant on August 4, 2026, from the California Office of Emergency Services (CalOES), so no additional appropriation is required at this time.

NOW, THEREFORE, BE IT RESOLVED THAT THE CITY COUNCIL OF THE CITY OF EAST PALO ALTO HEREBY:

SECTION 1. City Website, Intranet and Consulting Assistance Project.

The City Council hereby authorizes the City Manager to award, negotiate, and execute an agreement, in a form approved by the City Attorney, with Altioras Civic Consulting Corp. for the City Website, Intranet and Consulting Assistance Project in an amount not to exceed One Hundred Twenty-Nine Thousand Five Hundred Dollars ($129,500) through June 30, 2028.

The City Manager is further authorized to amend the agreement, following execution, for change orders necessary to complete the project in an amount not to exceed ten percent (10%) of the contract amount, or Twelve Thousand Nine Hundred Fifty Dollars ($12,950), resulting in a maximum authorized contract amount of One Hundred Forty-Two Thousand Four Hundred and Fifty Dollars ($142,450).

SECTION 2. Virtual Chief Information Security Officer Support Services.

The City Council hereby authorizes the City Manager to award, negotiate, and execute an agreement, in a form approved by the City Attorney, with Apogee Global RMS for virtual Chief Information Security Officer Support Services in an amount not to exceed three hundred fifty thousand dollars ($350,000) through December 31, 2031.

SECTION 3. CEQA Determination.

The City Council finds and determines that the actions authorized by this Resolution do not constitute a “Project” within the meaning of the California Environmental Quality Act (“CEQA”), pursuant to CEQA Guidelines section 15378(b)(4) and (5), because they consist of governmental fiscal, organizational, or administrative activities that will not result in direct or indirect physical changes in the environment.

PASSED AND ADOPTED this 20th day of October 2026, by the following vote:
27 Resolution No. XX-2026 3 of 3
AYES:

NOES:

ABSENT:

ABSTAIN:

Webster Lincoln, Mayor
ATTEST: APPROVED AS TO FORM:

James Colin, City Clerk John D. Lê, City Attorney
28 Website, Intranet,
and Strategic Consulting
STRONGER COMMUNITIES.

SMARTER GOVERNMENT.
www.altiorascivic.com
7901 4th St N STE 300 St. Petersburg, FL 33702, USA
Prepared for:

City of East Palo Alto
Date:

August 24, 2026
EPA Year 1 IT Strategic Plan
Implementation Support Services
Projects A4 and A4.1
29 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 1
Table of Contents
A. Cover Letter .............................................................................................................................................. 2 B. Firm Profile and Qualifications.................................................................................................................. 4 Firm information....................................................................................................................................... 4 C. Project Understanding, Approach and Work Plan.................................................................................... 6 Part 1 - Project A4.1 Strategic Consulting................................................................................................. 8 Part 2 - Project A4 Website and Enterprise Intranet................................................................................ 9 Proposed schedule.................................................................................................................................. 13 D. Project Team........................................................................................................................................... 15 E. Relevant Experience and References...................................................................................................... 18 F. Cost Proposal .......................................................................................................................................... 20 Project A4.1 - Strategic Consulting ......................................................................................................... 20 Project A4 - Website and Enterprise Intranet......................................................................................... 20 G. Exceptions................................................................................................................................................... 23 Authorization .......................................................................................................................................... 23 30 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 2
A. Cover Letter
August 24, 2026
Jimmie Tulabing
IT Manager
City of East Palo Alto
2415 University Avenue
East Palo Alto, CA 94303
Re: Projects A4 and A4.1 - Website, Intranet, and Strategic Consulting Dear Mr. Tulabing:

East Palo Alto does not need another broad website study. The City's strategic plan and RFP already describe the problem: staff find the current publishing tools difficult, residents need a clearer route to services, and employees do not have a formal intranet. The August 17 answers also show the size of the job - approximately 5,526 public pages and 4,506 attachments - and confirm that the City wants A4.1 completed before A4 begins. What this proposal covers are that projects A4.1 and A4 are treated as one connected assignment, with separate scope, hours, pricing, and approval points.

Altioras Civic proposes one team for both parts. During A4.1, we will crawl the full public site, review accessibility and content health, talk with the people who publish and answer resident questions, design a service-based information structure, and confirm the platform and implementation plan. The same people will then configure the public website and intranet, move the content the City decides to keep, train staff, launch the sites, and remain through stabilization.

Our preferred planning baseline is CivicPlus Municipal Websites Central with CivicPlus Intelligence for the public site and SharePoint Online for the intranet. This is not a recommendation to leave the current site untouched. It is a move from the City's current publishing experience to CivicPlus's current Web Central product, with built-in AI support for editing and content review and an integrated resident Agent. That direction preserves the Municode connection and may avoid the migration and retraining cost of changing vendors. A4.1 will make it earn the decision against Granicus govAccess and a qualified managed Drupal or WordPress option. The selected product must document the required 99.9% service commitment, current SOC 2 report, support coverage, backup and recovery, accessibility commitments, open integration options, and a Year 1 price that fits the City's budget.

AI will be used as a working tool, not a sales feature. Codex and other controlled tools can scan the public website, group related pages, find duplicates and broken links, identify likely stale content, draft plainlanguage rewrites, prepare redirect and migration files, and rerun quality checks after every release.

Nothing will publish automatically. City content owners approve the new structure, the pages that remain public, translations, chatbot answers, and final publication.

The fixed price is $29,500 for A4.1 and $100,000 for A4, a combined savings of $30,500 against the City's two Year 1 budgets. The A4 price includes an identified $40,000 allowance for the initial platform, hosting, chatbot, and site-quality tools. The lower price reflects a smaller delivery team and the practical use of automation for inventory, classification, migration preparation, and repeatable quality checks. It does not reduce the content coverage, City workshops, accessibility testing, training, or launch support described in this proposal. Years 2 and 3 are shown separately so the City can see the ongoing cost before it signs a platform agreement.
31 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 3
Independence and disclosure
Altioras Civic has no reseller, commission, referral, ownership, or other financial arrangement with CivicPlus, Microsoft, Granicus, or another website or intranet provider. The preferred baseline reflects the City's starting point and budget, not a payment to Altioras. CivicPlus, Granicus, and the managed opensource option will be scored before procurement proceeds.

Altioras Civic takes no exceptions to the RFP or the City's standard Contractor and Professional Services Agreement, subject to final confirmation of insurance certificates and endorsements before execution. We appreciate the opportunity to help East Palo Alto make its public website easier to use and give staff a reliable place to work from.

Sincerely,
Leroy Clifton Guice
CEO
Altioras Civic Consulting Corp.

Email: [email protected] | Tel. 407 619 1973
32 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 4
B. Firm Profile and Qualifications
Municipal technology work led by senior staff
Altioras Civic is a boutique consulting firm focused on municipalities and public agencies. Our work covers technology strategy, project management, cloud platforms, cybersecurity, data and integrations, business process improvement, managed operations, and organizational change. We keep the number of assignments manageable so the people introduced in the proposal remain involved after the contract is signed.

That operating model fits East Palo Alto. The City has approximately 126 permanent staff and two IT employees. A large delivery team would create more meetings and handoffs than the City needs. Our fiveperson team has one Project Manager, brings specialists into the work when their skills are needed, and leaves the City with working files, scripts, page inventories, governance rules, training, and maintenance instructions.

Firm information
Firm detail Response
Legal name Altioras Civic Consulting Corp.

Trade name Altioras Civic
Primary office 7901 4th St N STE 300, St. Petersburg, Florida 33702 Years in business Established officially 2026 with working business experience since 2022.

Municipal practice Technology strategy, digital services, ERP, data, integrations, cybersecurity, project management, change, and managed operations
Website www.altiorascivic.com
Why the work fits our practice
• Municipal service design. We start with the service a resident or employee is trying to complete, then decide what the page, form, search result, workflow, or platform must do. • Content with public consequences. The content review addresses public records, meeting information, permits, payments, public safety, wastewater, development, employment, policies, forms, and other City-specific material.
• Accessibility. Automated scans are paired with keyboard, screen-reader, zoom, contrast, and task testing. Accessibility is a publishing practice, not a launch-day score. • Technical delivery. SharePoint, Microsoft 365, identity, APIs, security, data handling, and support responsibilities are designed together rather than left for the final week. • Staff ownership. Editors work in the configured site during training. Job aids use East Palo Alto pages and approval paths, not generic vendor demonstrations.
• Responsible AI. The public chatbot is grounded in approved City sources, shows the source behind an answer, and sends uncertain questions to the right City contact. 33 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 5
A smaller firm with useful capacity
Altioras Civic combines senior advisory work with hands-on production. The Project Manager runs meetings, decisions, budget, and vendor coordination. The platform lead configures Microsoft 365, integrations, and the AI-supported production tools. The accessibility and content lead owns the information structure, plain language, and accessibility checks. The analyst runs inventories, migration files, redirects, and repeatable QA. The Principal joins the decisions where cost, risk, contract terms, or scope need executive attention.

This keeps rates below those of large consulting firms while giving the City access to the people who can solve the problem. The proposed rates range from $90 to $150 per hour, and the fixed fees protect the City's Year 1 budgets.

No conflict of interest
Altioras Civic has no conflict of interest related to Projects A4 or A4.1. Platform providers receive no preference because of a commercial relationship. Product claims, prices, accessibility reports, security documents, service commitments, and references will be checked before the City commits. Any conflict identified later will be disclosed immediately.

Quality, continuity, and ownership
• One accountable owner. The Project Manager checks every deliverable against earlier City decisions and comments.
• Second review. A specialist checks platform, accessibility, security, content, or AI work in their area before it goes to the City.
• Continuity. Key personnel will not be replaced without City approval. The City is not charged to bring an Altioras replacement up to speed.
• City-owned work. Inventories, scripts, design decisions, page templates, redirect files, procedures, training, and reports belong to the City and are delivered in editable formats. 34 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 6
C. Project Understanding, Approach and Work Plan
What the City is trying to accomplish
The public website and staff intranet serve different audiences, but they share one management problem:
information needs an owner, a place to live, an approval path, and a review date. A modern platform will not solve the problem if outdated pages are carried forward, departments do not know what they own, or the chatbot reads material no one trusts.

The work therefore begins with content and services, not colors and home-page layouts. Residents should be able to pay, apply, report, attend, find, contact, or understand without knowing which department owns the service. Employees should be able to find a policy, form, procedure, contact, template, announcement, or project resource without searching old email chains and shared drives.

Known starting point
• Current platform. The public website is hosted by CivicPlus, which acquired Municode. • Content volume. The last reported inventory contained approximately 5,526 unique pages and 4,506 attachments.
• Intranet. The City does not have a formal, structured intranet today. • Choice. The City is open to SharePoint, a co-hosted intranet, or a separate platform, judged on function, maintenance, security, and total cost.
• Sequence. A4.1 comes first. Its assessment, requirements, and information architecture become the approved plan for A4.
• Budget. The A4 Year 1 budget must cover implementation, platform costs, content migration, training, chatbot functionality, and current-year support.
• Strategic-plan outcome. The strategic plan calls for a unified digital front door: a clearer public route to City services and a dependable internal home base for staff.

Platform selection position
Preferred public-site baseline - CivicPlus Municipal Websites Central Evaluate a move to CivicPlus Web Central with CivicPlus Intelligence, including the AI Editing Assistant, AI Content Advisor, and CivicPlus Agent. This may offer the lowest transition risk because the City already uses CivicPlus/Municode. A4.1 will confirm which Intelligence features are included in the City's proposed subscription and what each option costs. The platform still must meet the City's contract, security, accessibility, support, API, and usability tests.

Staff intranet - SharePoint Online
Create a SharePoint home site and hub in the City's Microsoft 365 tenant. Entra ID controls access. Standard department sites and libraries provide policies, forms, templates, HR and IT resources, announcements, leadership updates, staff recognition, directories, calendars, and project information. Metadata, ownership, versioning, audit history, and retention settings are aligned with City records rules. Power Automate supports review and publishing workflows where licensing permits. 35 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 7
AI - Codex for production, selected platform AI for residents and editors Codex helps Altioras inventory, classify, draft, migrate, and test public content. If CivicPlus is selected, CivicPlus Intelligence supports editors and CivicPlus Agent answers resident questions from approved sources. A competing platform must provide equivalent controlled editing, content-health, and resident-answer capabilities or integrate a City-approved alternative. Any intranet agent waits until permissions and information ownership are ready.

Three public-site options evaluated in A4.1
Option Why it is credible Main question for East Palo Alto CivicPlus Web Central +
Intelligence
Purpose-built municipal CMS; Municode
connection; built-in AI editing and
content guidance; CivicPlus Agent
May reduce migration, retraining,
and integration cost; incumbent
terms still need scrutiny
Granicus govAccess
Purpose-built government CMS; dragand-drop tools; forms, workflows, accessibility, and broad digital-service
options
Clean vendor change and strong
government features; likely larger
migration and integration effort
Managed Drupal or
WordPress
Open CMS on a qualified SOC 2 cloud host
with a controlled AI search or chat service
May lower software fees and
increase design flexibility; requires
stronger support, security, update,
and integration ownership
How the City will select the public platform
• Resident tasks, search, mobile use, forms, and municipal service delivery - 20%. • Editor usability, approvals, content ownership, and ongoing maintenance - 15%. • Accessibility tools, documented conformance, and document support - 15%. • Built-in AI editing, content-health, search, and resident-answer capabilities - 10%. • APIs and fit with payments, 311, permits, calendars, agendas, code, and other City services - 10%. • Security, availability, backup, recovery, support, privacy, and data return - 10%. • Implementation, migration, training, and launch effort within Year 1 - 10%. • Five-year total cost, including subscriptions, add-ons, vendor services, City labor, and annual increases - 10%.

Conditions before platform commitment
• The selected provider supplies a current SOC 2 Type II report or acceptable equivalent for City review. • The subscription contract includes at least 99.9% availability, encryption in transit and at rest, automated backup and recovery commitments, incident notification, data-return terms, and regular security and software updates.
• The provider names an implementation and escalation contact and provides 24/7 technical support for platform incidents, as required by the RFP.
• The platform supports WCAG 2.1 AA at launch and provides tools and training that help editors maintain accessible content; WCAG 2.2 is used where practical. • The CMS provides intuitive editing, role-based permissions, approval workflows, mobile-responsive templates, search, redirects, forms or form integration, and supported APIs. 36 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 8
• The quoted Year 1 amount fits the $40,000 platform and tool allowance shown in Section F. • The City confirms a lawful procurement path and approves the platform before configuration begins.

Part 1 - Project A4.1 Strategic Consulting
Fixed fee: $29,500 | City budget: $40,000 | Planned duration: eight weeks | Planned effort: 222 hours A4.1 turns the existing strategic-plan recommendation into a buildable plan. The City receives the complete website and attachment inventory, an approved information architecture, platform requirements, content ownership, migration rules, accessibility priorities, an intranet design, and an implementation backlog that fits the A4 budget.

Step 1 - Start the project and scan what exists
Weeks 1 and 2 establish the project and replace guesswork with a complete inventory. • Kickoff. Confirm participants, approvals, procurement questions, access, meeting dates, communication, file locations, and the definition of launch. • Public-site crawl. Crawl every discoverable page and attachment and record URL, title, type, department, depth, inbound links, last-modified signals, file size, and status. • Automated checks. Find broken links, redirect chains, duplicate titles, orphaned pages, missing headings, image-alt problems, unreadable files, mobile issues, and common WCAG failures. • AI-assisted classification. Group related material by resident task and department; flag likely duplicates, stale pages, conflicting instructions, overly complex writing, and attachments that may be better as HTML.
• Manual review. Test representative templates and high-use tasks using keyboard navigation, screenreader checks, zoom, contrast, form labels, focus order, and mobile devices. Automated scans do not replace this work.

What the City receives: project plan, stakeholder plan, full content and attachment inventory, currentstate heat map, website and intranet maturity score, accessibility findings, and an early risk list.

Step 2 - Learn how residents and staff use the information Weeks 2 through 5 focus on real tasks rather than asking departments for a wish list. • Department sessions. Meet with content owners and service staff across the seven departments, including the people who answer calls, process forms, post notices, and maintain calendars. • Resident tasks. Use analytics, search terms, 311 topics, front-desk questions, and staff input to identify the services people look for most often. Keep clear phone, in-person, and mail routes for residents who cannot or prefer not to complete a service online.
• Short user tests. Ask a small City-recruited group of residents and employees to complete common tasks on the current site and proposed navigation. Record where they hesitate, search, backtrack, or abandon the task.
• Intranet needs. Identify the policies, forms, directories, HR resources, IT help, templates, announcements, calendars, and department material employees need regularly. • Language and equity. Identify high-use information that should be available in Spanish and establish a human-reviewed translation process. AI may prepare a first draft; a qualified reviewer approves public wording.
37 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 9
What the City receives: top-task list, service journey findings, stakeholder needs, intranet content inventory, and a prioritized content backlog.

Step 3 - Approve the structure, platform, and build plan Weeks 5 through 8 turn the findings into decisions the implementation team can use. • Information architecture. Design resident-first navigation around tasks such as pay, apply, report, request, attend, find, contact, and learn, while preserving clear department routes. • Page and content models. Define standard service, department, project, notice, event, form, contact, and policy pages, including required fields and ownership. • Platform selection. Run focused demonstrations and score CivicPlus Web Central, Granicus govAccess, and a qualified managed Drupal or WordPress option against the approved criteria. Obtain budgetary pricing and review security, accessibility, AI, support, and contract documents. • Migration rules. Assign each item one action: keep, rewrite, combine, archive, remove, remediate, or replace with accessible HTML. City owners approve the action. • Governance. Name page owners and publishers, set review dates, define emergency publishing, establish approval routes, and create a simple process for new content. Document current and future publishing workflows so departments understand who drafts, reviews, approves, posts, and maintains each type of information.
• Implementation plan. Set the build sequence, content batches, testing, training, cutover, rollback, support, City workload, and acceptance checks.

What the City receives: approved requirements, platform recommendation, information architecture, clickable wireframes, content models, current- and future-state publishing workflow diagrams, governance guide, migration plan, prioritization and remediation-sequencing matrix, procurement support material, implementation schedule, budget assumptions, and an executive presentation.

A4.1 approval gate
The City decides before A4 begins
The City approves the selected public platform, SharePoint intranet, information architecture, Year 1 price, migration rules, governance roles, implementation plan, and procurement action. CivicPlus is the planning baseline, but the City sees the scored comparison and five-year cost before it decides.

Part 2 - Project A4 Website and Enterprise Intranet
Fixed fee: $100,000 | City budget: $120,000 | Planned duration: approximately seven months after A4.1 | Altioras labor: 454 hours
A4 builds what the City approves in A4.1. Work proceeds in short content and configuration batches so staff can see the site take shape, correct problems early, and learn the new tools before launch.

Step 4 - Configure the platforms and design the working sites Weeks 9 through 14 establish the public-site and intranet foundations. • Public site. Configure templates, navigation, search, permissions, workflows, alerts, calendars, forms or form links, analytics, redirects, accessibility tools, AI editing features, and the approved visual design in the selected platform.
38 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 10
• Intranet. Configure the SharePoint home site, hub navigation, standard department sites and libraries, directory, news, leadership messages, staff recognition, calendars, HR and IT resources, forms, templates, metadata, versioning, retention settings, search, and publishing permissions. • Integrations. Connect or clearly route residents to payments, 311/service requests, permits, agendas, calendars, forms, employment, public records, municipal code, and other confirmed systems. • Security. Use least-privilege roles, multifactor authentication, named owners, audit logs, controlled administrative access, and separate public and staff content. • Design review. Test desktop and mobile layouts with City staff and a small user group before full content migration begins.

Step 5 - Clean, rewrite, and move content
Weeks 11 through 24 are the main production period. The full inventory is processed, but not every item receives the same treatment.
• Whole-site triage. AI and scripted checks assign a recommended action to all discoverable pages and attachments. City content owners accept or change the recommendation in manageable department batches.
• Priority rewrite. Altioras provides hands-on review and plain-language rewriting for up to 350 highuse, high-risk, or cross-department public pages. • Standard migration. Approved pages that fit the new content models are migrated using vendor tools or controlled scripts, then checked for title, owner, links, headings, images, attachments, and redirects.
• Document accessibility. The fixed fee includes review and remediation, HTML replacement, or accessible alternative treatment for up to 150 priority attachments. The remaining attachment inventory is ranked and scheduled; inaccessible material is not described as compliant merely because it was copied.
• Archive and retention. The City Clerk and content owners decide which historical material remains online, moves to an archive, or is retired under the City's records rules. • Delta migration. A short content freeze and final-change log prevent updates made during the project from disappearing at cutover.
• Redirects. Create and test redirects for retained high-value URLs so bookmarks and search results continue to work.

Step 6 - Put the resident chatbot to work safely
The selected resident-answer tool will begin with a controlled set of approved public sources and common questions. CivicPlus Agent is the baseline if CivicPlus is selected; another platform must provide equivalent controls and source grounding.
• Approved sources only. Start with current service pages, contacts, calendars, municipal code, and other City-approved public content.
• Useful answers. Answers link back to the City source and include the department or service route when a person needs help.
• Clear limits. The chatbot does not make eligibility decisions, provide legal advice, collect sensitive personal information, or invent an answer when the source is unclear. • Human handoff. Uncertain, urgent, safety-related, or account-specific questions route to the appropriate City channel.
39 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 11
• Testing. Test common questions, Spanish questions, misspellings, hostile prompts, prompt-injection attempts, outdated information, and questions the bot should refuse. • Ongoing improvement. Monthly unanswered-question and low-confidence reports show where the website or the answer set needs work.

Step 7 - Test, train, launch, and stabilize
Weeks 21 through 34 cover acceptance, staff preparation, cutover, and early support. • Functional testing. Check navigation, search, forms, calendars, integrations, permissions, approvals, notifications, links, downloads, redirects, and chatbot handoffs. • Accessibility testing. Run automated scans across the staged site and manual checks on representative templates, top tasks, forms, navigation, and priority documents. • Performance and resilience. Confirm page performance, mobile behavior, encryption, monitoring, backup, recovery, 24/7 vendor support, support contacts, incident handling, software updates, and service-level reporting.
• Role-based training. Train administrators, publishers, and department editors in separate working sessions using East Palo Alto pages. Provide recordings, job aids, and an editor checklist. • Launch. Use an approved cutover and rollback plan, DNS and certificate checklist, content freeze, redirect test, communications plan, and launch-day support. • Stabilization. For 30 days after launch, track defects, resident questions, failed searches, chatbot gaps, editor issues, accessibility findings, and vendor tickets through closure.

What the City receives: configured public website and intranet, migrated approved content, redirect file, accessibility results, testing records, chatbot configuration, editor and administrator training, job aids, publishing and support procedures, final executive presentation, and a 12-month maintenance calendar.

How AI Shortens the Work Without Taking Control
The City has too much content for a page-by-page manual review to fit the Year 1 budget. AI is useful here because it can perform the repetitive first pass quickly and consistently. Human reviewers remain responsible for meaning, legal or policy statements, accessibility acceptance, translation, and publication.

Use What AI does What people still do
Inventory
Codex reads the public crawl results and
prepares a structured inventory of pages,
files, links, titles, headings, owners, and
likely content types.

A content lead reviews the classification rules
and samples each batch.

Cleanup
AI flags duplicate, stale, conflicting,
complex, or poorly structured material and
proposes keep, combine, rewrite, archive,
or remove.

Department owners decide what the City
keeps and approve factual changes.

Writing
AI drafts plain-language page summaries,
service steps, titles, metadata, FAQs, alttext suggestions, and Spanish first drafts.

City owners and qualified language reviewers
approve public wording.

Migration
Codex prepares migration manifests, file
naming, redirect maps, link updates, and
repeatable validation scripts.

Altioras checks samples and exceptions; City
owners sign off on content batches.
40 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 12
Use What AI does What people still do
Testing
Automated routines rerun broken-link,
metadata, accessibility, content-age,
redirect, and page-comparison checks after
each release.

Manual keyboard, screen-reader, mobile,
workflow, and task testing remains required.

Maintenance
Monthly scans identify broken links, aging
content, failed searches, unanswered
chatbot questions, and pages without
owners.

Editors correct the content; the AI does not
publish on its own.

Rules for City information
• Only public website content is processed in Codex unless the City separately approves an enterprise environment and handling rules for nonpublic information. • No police, personnel, legal, account, payment, protected, or other sensitive data is entered into a consumer AI service.
• AI output is labeled as a draft until a named person reviews it. • No AI tool receives direct publishing rights to the website or intranet. • The chatbot uses approved City sources, links to those sources, records questions for service improvement, and provides a human route when it cannot answer safely. • SharePoint agents or Microsoft 365 Copilot are enabled only after site ownership, access, sharing, retention, and restricted content have been reviewed.
• The City receives the prompts, decision rules, inventories, scripts, and maintenance instructions needed to continue the work or move it to another provider.

Accessibility is part of the build
East Palo Alto's reported population is below 50,000. Current U.S. Department of Justice guidance gives public entities in that population group until April 26, 2028, to meet WCAG 2.1 Level AA for covered web content and mobile apps. Our proposed launch gives the City time to correct remaining legacy documents and establish ongoing publishing controls before that date. The City should obtain legal advice on specific exceptions and records; Altioras does not provide legal opinions. • No score-only acceptance. A site can pass an automated scan and still be difficult or impossible to use.

Manual checks are included.
• Shared responsibility. Templates, content, attachments, embedded services, forms, videos, and thirdparty links are tracked separately so responsibility is clear. • Ongoing practice. Editors receive a pre-publication checklist, accessible-document guidance, and a route for help.
• Maintenance. Quarterly scans and annual manual sampling are included in the optional maintenance service.

Project Management
The Project Manager handles the schedule, meetings, document requests, platform vendors, decisions, budget, and review comments. The City's two-person IT team is not expected to run the consulting assignment.
41 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 13
• Every-other-week meeting. Meetings occur every other week. The City receives an agenda and written update before each meeting showing completed work, next steps, schedule, spending, decisions, and risks.
• Working sessions. A short working session may be added during design, migration, testing, or launch when a decision cannot wait for the next regular meeting. • Project controls. Altioras maintains the project plan, content backlog, decision list, issue and risk list, platform action list, budget forecast, and City comment record. • Review and approval. Deliverables are reviewed in working drafts, corrected while discussions are fresh, and approved by the City before the next major step begins. • Budget visibility. Invoices show person, role, date, task, hours, rate, amount, remaining budget, and current estimate to finish.

Proposed schedule
Work Oct Nov Dec Jan Feb Mar Apr
MayJun
A4.1 kickoff, crawl, and baseline X X
A4.1 interviews, IA, and user testing X X
Platform comparison, selection, and A4
approval X
Public site and intranet configuration X X
Content decisions, rewrite, and
migration

X X X X
Chatbot setup and testing X X
Functional and accessibility testing X X
Training and launch preparation X
Launch and 30-day stabilization X
The schedule assumes notice to proceed in October 2026 and completion by June 2027. It will be confirmed at kickoff against procurement timing, platform availability, City calendars, and content-owner capacity.

Major City decisions
• Week 1: approve the project plan, participants, access, and working schedule. • Week 4: confirm top resident and employee tasks and the content-priority rules. • Week 6: approve the draft information architecture and page models. • Week 8: approve the selected public platform, SharePoint intranet, Year 1 price, migration rules, and A4 implementation plan.
• Month 4: approve the working design and representative public and intranet pages. • Month 6: accept priority content batches, chatbot answer set, and testing plan. • Month 7: approve launch readiness, cutover, communications, and support. • Month 8: accept stabilization results, maintenance calendar, and final handoff. 42 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 14
City participation
• Executive sponsor. Provide executive decisions, approve major scope and platform choices, and remove crossdepartment blockers. • City project lead and IT. Coordinate access, participants, procurement, security documents, Microsoft 365 administration, and City review dates.
• Department content owners. Explain services, identify current material, approve keep/rewrite/archive decisions, review draft pages, and accept migrated content.
• City Clerk and legal reviewers. Advise on records, notices, public meetings, retention, archives, and the treatment of historical content.
• Human Resources and department representatives. Review employee information, access, policies, forms, and department resources for the intranet.
• Residents and employees recruited by the City. Participate in short task tests and provide practical feedback on navigation and wording.

Working assumptions and exclusions
• The City provides timely access to platform contracts, analytics, search reports, domain and DNS contacts, Microsoft 365 administrators, content owners, and available accessibility or security reports. • The City confirms its exact CivicPlus product and Microsoft 365/SharePoint licensing during A4.1. • A4.1 and A4 are awarded together or A4 begins promptly after A4.1 approval; a material delay may require schedule and price confirmation.
• The fixed fee includes full-site automated inventory and classification, hands-on review and rewriting of up to 350 priority public pages, and priority treatment for up to 150 attachments. • City staff make final records, legal, policy, translation, and publication decisions. • The platform allowance is based on budgetary planning, not a vendor quote. No vendor commitment is made until the City approves the quote and terms.
• Travel is not separately charged. Work is primarily remote, with up to two planned onsite visits included if requested by the City.
• Excluded unless added by written amendment: custom transactional applications, payment processing, replacement of 311 or permitting systems, full remediation of every legacy PDF, legal opinions, penetration testing, custom mobile apps, video captioning at scale, and licenses above the stated allowances.

Additional ideas available to the City
• Website stewardship. Quarterly content, accessibility, search, and chatbot review after launch. • Staff AI pilot. A controlled Microsoft 365 Copilot or SharePoint agent pilot after intranet permissions and information ownership are ready.
• Document accessibility. Additional PDF remediation or conversion of document-heavy services into accessible HTML pages and digital forms.
• Language access. Additional professionally reviewed Spanish content beyond the agreed high-priority service pages.
• Service automation. Deeper integrations or workflow automation for 311, forms, permitting, payments, records requests, HR, and IT service requests.
43 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 15
D. Project Team
Five people with clear responsibilities
The same core team carries the work from the first crawl through launch. The staffing model avoids separate strategy and implementation teams and gives East Palo Alto one Project Manager throughout.

Proposed person Role Hours Primary responsibility
Leroy Guice, M.S., ITIL
Principal-in-Charge / Digital
Government Advisor 33
Executive decisions, platform and
contract review, quality, escalation
A. Andaleon Project Manager / Service
Design Lead 182
Day-to-day delivery, stakeholder work,
IA, governance, training
Cyrus R.

Platform, Integration, and
AI Lead 200
CMS selection, SharePoint, integrations,
security, Codex workflows, chatbot
Vince J.

Content Migration & Web
Development 156
WCAG review, content models, plain
language, migration acceptance
Jerome Z. Content Migration Analyst 105
Inventory, migration files, redirects, QA,
documentation
Leroy Guice, M.S., ITIL - Principal-in-Charge / Digital Government Advisor Planned effort: 33 hours across A4.1 and A4.

Leroy provides executive oversight and joins the decisions that affect platform direction, procurement, cost, risk, or launch. He remains available to the City Manager, Assistant City Manager, and IT Manager throughout the engagement.
• Relevant background. More than 18 years leading public-sector technology strategy, procurement, cloud modernization, and vendor governance; MS and active PMP. • Work on this assignment. Reviews the A4.1 findings, target architecture, vendor terms, Year 1 budget, major risks, launch recommendation, and final executive presentation.

A. Andaleon - Project Manager / Service Design Lead
Planned effort: 182 hours across A4.1 and A4.

A. Andaleon is East Palo Alto's day-to-day contact from kickoff through stabilization. He runs the interviews, user testing, information architecture, governance decisions, schedule, budget, vendor coordination, training plan, and City approvals.
• Relevant background. Web Designer and Digital Strategist with experience in project management, UI layout, front-end optimization, digital marketing, and development of usercentered websites. His portfolio includes GovGenie, a government-contracting platform for which he designed the web interface and user experience with emphasis on intuitive navigation and functional layout. His combination of project management, web design, UX, and digital strategy is directly relevant to EPA's need to improve the usability, organization, and effectiveness of its 44 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 16
public-facing digital services. His role would help ensure that website recommendations reflect both City business requirements and the needs of residents, businesses, and other community users.
• Work on this assignment. Assess the City's website platform and technical architecture; evaluate integration requirements and opportunities; support API, authentication, data exchange, security, and performance considerations; identify appropriate opportunities for AI-enabled search, content discovery, automation, or other digital-service enhancements; develop technical recommendations for a scalable and maintainable future-state platform.

Cyrus R. - Platform, Integration, and AI Lead
Planned effort: 200 hours across A4.1 and A4.

Cyrus R. translates the approved design into the selected public CMS and SharePoint environments. He also builds the controlled crawl, content-processing, migration, redirect, and QA routines used by the team. • Relevant background. Senior Full-Stack Engineer with 7+ years of experience designing and deploying production systems, including cloud-based applications, APIs, microservices, databases, third-party integrations, and AI-enabled solutions. His recent work includes OpenAI, LangChain/RAG, AWS and Azure environments, bidirectional API integrations, RBAC, data synchronization, and technical leadership from discovery through production deployment. Cyrus provides the strongest technical architecture capability for EPA's website modernization effort. His background in integrations, cloud platforms, secure application architecture, and AI technologies supports the City's need to evaluate how its website can better connect with other systems, improve digital-service delivery, and accommodate future capabilities. • Work on this assignment. Assess the City's website platform and technical architecture; evaluate integration requirements and opportunities; support API, authentication, data exchange, security, and performance considerations; identify appropriate opportunities for AI-enabled search, content discovery, automation, or other digital-service enhancements; develop technical recommendations Vince J. - Content Migration & Web Development
Planned effort: 156 hours across A4.1 and A4.

Vince J. will provide implementation support for page development, responsive layouts, CMS updates, database-related activities, and website troubleshooting; assist with migrated-content formatting and validation; support testing across devices and browsers; identify usability or performance issues and support corrective actions. He will also own the parts of the project residents and editors experience directly: navigation, page models, plain language, accessibility, document treatment, mobile use, and content acceptance. He will assist with content inventory, collection, cleanup, categorization, and migration; verify migrated pages against source materials; identify missing, duplicate, outdated, or inconsistent information; support link, formatting, document, and metadata validation; document. • Relevant background. Web Developer experienced in responsive website development, website maintenance, troubleshooting, UI/UX improvements, database integration, and website performance optimization. He has developed operational web applications involving records management, search and filtering, dashboards, analytics, and structured data. His exposure to local-government records and administrative information provides useful context for handling municipal website content. His technical and records-management background supports EPA's 45 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 17
need for accurate, organized, and quality-controlled migration of departmental and public-facing information.
• Work on this assignment. He strengthens the implementation and migration workstream by providing hands-on web development and troubleshooting capacity. His experience with responsive interfaces, structured records, search, and database-backed systems supports EPA's objective of delivering a reliable, user-friendly, and maintainable municipal website. Leads the accessibility audit and manual testing, writes content and document rules, reviews priority pages, leads user tests, checks migrated content, and trains publishers and editors.

Jerome Z. - Content Migration Analyst
Planned effort: 105 hours across A4.1 and A4.

Jerome Z. manages the detail that determines whether a migration works: page and file inventories, owners, actions, batches, links, redirects, exceptions, and final checks. • Relevant background. Jerome's combination of WordPress, database, web development, and digital-record experience is directly applicable to the structured migration of EPA's existing website content. He can support both the technical and quality-assurance aspects of moving City information into a redesigned website environment. Full-stack developer with experience in WordPress, responsive web development, databases, API integration, content organization, authentication, and performance optimization. His project experience includes organizing business information into a WordPress website and developing a community information management system with centralized digital records and secure document processing. • Work on this assignment. Support website content inventory and migration planning; map existing content to the future information architecture; assist with page creation and CMS configuration; migrate and validate content; identify formatting, metadata, broken-link, and content-quality issues; perform migration QA and support remediation prior to launch.

Availability and Continuity
The proposed team is planned for an October 2026 start and work through June 2027, subject to confirmation before submission. The Project Manager remains the primary contact. Key personnel will not be replaced without City approval, and the City will not be billed for transition time caused by an Altioras staffing change.

Specialist resources and subcontractors
The contracted specialists identified above report to the Altioras Project Manager and follow the same security and project controls. Altioras remains responsible for their work, confidentiality, insurance compliance, schedule, payment, and deliverables. No subcontracted work begins without the City Manager's written consent. Platform vendors are not Altioras subcontractors; the City may contract with them directly or approve a documented pass-through arrangement. 46 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 18
E. Relevant Experience and References
The references provided demonstrate experience directly relevant to the City of East Palo Alto’s website consulting scope. Collectively, they reflect successful delivery of public-sector digital initiatives involving website strategy and modernization, stakeholder engagement, content and information architecture, accessibility, platform and technology advisory, content migration, and ongoing digital governance. These engagements demonstrate the team’s ability to work effectively with government stakeholders and deliver practical, user-centered website solutions aligned with municipal operational needs and community expectations.

Reference Project 1 - govegenie.com
Client Reference Abraham Xiong - CEO
Email & Telephone [email protected] | (404) 932-2111 Project Period June 2022 - October 2024
Work performed Architected a multi-service SaaS platform from scratch — Express.js REST API, React frontend, Next.js 14 auth service, and admin dashboard; rebuilt the company’s SPA with Next.js and migrated backend services to a Serverless Framework architecture on AWS, deployed via Elastic Beanstalk and CodeBuild CI/CD.

Designed and maintained a 130+ table PostgreSQL database (Sequelize ORM) and engineered a serverless AWS data pipeline (S3 > SQS > Lambda > PostgreSQL) paired with a Puppeteer-based scraper to automate procurement data ingestion, keeping tens of thousands of records continuously current.

Integrated OpenSearch/Elasticsearch with a Logstash sync pipeline, enabling full-text search with keyword, NAICS code, agency, and date-range filtering — substantially reducing query times on large dataset tables.

Built a real-time bid management system featuring Kanban boards, threaded comments, task assignments, and S3 file attachments — enabling distributed teams to collaborate on government proposals end-to-end.

Implemented Firebase authentication (server-side token validation, HttpOnly sessions, RBAC, hCaptcha), integrated Stripe for tiered subscription billing, built an in-platform CRM module, and managed multienvironment Docker deployments with Mixpanel analytics and Chart.js dashboards.

Reference Project 2 – urbanhomeinteriordesign.com
Client Reference Jodi Mason - CEO
Email & Telephone [email protected] | (519) 974-4663 Project Period Aug 2024 - December 2024
Work performed Rebuilt and modernized the existing website using the Elementor design framework, transitioning legacy page structures, layouts, and content into a more flexible, scalable, and maintainable WordPress/Elementor environment. The work included redesigning and standardizing page templates, improving content organization and visual consistency, refining navigation and page hierarchy, and configuring reusable design components to support more efficient ongoing website administration and content updates.
47 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 19
The engagement also included a comprehensive review of the website’s search engine optimization configuration and overall technical readiness. SEO activities included assessment and recalibration of page titles, metadata, heading structures, internal linking, URL structure, indexing controls, image optimization, and other on-page SEO elements. Additional validation was performed to identify technical issues that could affect crawlability, search visibility, site performance, and user experience, with recommended adjustments implemented to strengthen overall website discoverability and maintainability.

The resulting website environment provided a more modern and user-friendly digital experience while giving administrators greater flexibility to manage content, maintain consistent page standards, and support future enhancements without extensive redevelopment. This experience is directly relevant to municipal website consulting engagements requiring platform modernization, content restructuring, SEO optimization, usability improvements, and sustainable website governance.

Reference Project 3 – urbanhomeinteriordesign.com
Client Reference Annette Corbin - CEO
Email & Telephone [email protected]
Project Period January 2023 – March 2023
Work performed Designed and developed the website from the ground up using WordPress and the Elementor page-building framework, establishing the site architecture, page layouts, navigation structure, content hierarchy, and reusable design components. The implementation focused on creating a scalable, responsive, and user-friendly website environment that could be efficiently maintained and expanded as organizational needs evolved.

Performed comprehensive SEO review and optimization across the site, including assessment and configuration of page titles, metadata, heading structures, image attributes, internal linking, URL structure, indexing settings, and other on-page SEO elements. Technical checks were also conducted to identify opportunities to improve site crawlability, search visibility, page performance, and overall discoverability.

Configured and integrated Google Analytics to establish ongoing website performance measurement and reporting capabilities. Analytics tracking was implemented to support monitoring of key metrics such as website traffic, user behavior, page engagement, traffic sources, and content performance, providing stakeholders with actionable data to evaluate digital effectiveness and inform future website enhancements.
48 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 20
F. Cost Proposal
Year 1 price
Total not-to-exceed price - $129,500
Project A4.1 is fixed at $29,500. Project A4 is fixed at $100,000, including $60,000 of Altioras implementation labor and a $40,000 budgetary allowance for initial platform, hosting, chatbot, and site-quality costs. This is $30,500 below the City's combined Year 1 budgets.

Hourly rates
Labor category Hourly rate
Principal-in-Charge / Digital Government Advisor $130
Project Manager / Service Design Lead $140
Platform, Integration, and AI Lead $150
Accessibility and Content Lead $130
Content Migration Analyst $90
Project A4.1 - Strategic Consulting
Labor category Hours Rate Amount
Principal-in-Charge / Digital Government Advisor 16 $130 $2,080 Project Manager / Service Design Lead 76 $140 $10,640
Platform, Integration, and AI Lead 54 $150 $8,100
Accessibility and Content Lead 46 $130 $5,980
Content Migration Analyst 30 $90 $2,700
A4.1 total 222 $29,500
Project A4 - Website and Enterprise Intranet
Labor category Hours Rate Amount
Principal-in-Charge / Digital Government Advisor 17 $130 $2,210 Project Manager / Service Design Lead 106 $140 $14,840
Platform, Integration, and AI Lead 146 $150 $21,900
Accessibility and Content Lead 110 $130 $14,300
Content Migration Analyst 75 $90 $6,750
Altioras A4 labor total 454 $60,000
49 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 21
Item Included purpose Amount
Selected public website
platform
Year 1 subscription, cloud hosting, support, and
vendor onboarding allowance $30,000
Selected resident AI assistant Year 1 chatbot or digital-agent allowance $7,500 Site-quality and accessibility
tools Year 1 scanning and monitoring allowance $2,500
Platform and tool allowance
total Subject to City-approved vendor quote and terms $40,000 A4 total Altioras labor plus platform and tool allowance $100,000 The platform amounts are budgetary allowances because the City had not supplied a current vendor quote.

A4.1 obtains and checks actual pricing before the City commits. If a required first-year quote exceeds the allowance, Altioras will identify choices such as removing an optional module, negotiating terms, changing the procurement path, or comparing another qualified platform. Altioras will not exceed the A4 not-toexceed price without written City authorization.

Estimated Years 2 and 3
Ongoing item Year 2 Year 3 Pricing note
Website hosting, support, chatbot,
and site-quality tools $41,200 $42,436 Budgetary estimate; assumes 3% annual increase SharePoint Online $0
incremental
$0
incremental
Assumes current City Microsoft 365
licensing covers planned use
Optional Altioras website
stewardship $18,000 $18,540 Monthly scans, quarterly review, editor help, and chatbot/content report Total with optional Altioras
stewardship $59,200 $60,976 Licenses or services outside the stated assumptions are additional Optional services not included in the Year 1 total
Optional service Price What it adds
Website stewardship $1,500 per month
Monthly scan; quarterly content,
accessibility, search, and chatbot review;
editor office hours
Microsoft 365 Copilot /
SharePoint agent pilot
$12,000 plus Microsoft
usage or licenses
Permission review, limited pilot, test plan,
staff training, and decision report
Additional document
remediation
$90 per hour or fixed fee by
batch
PDF, Office file, caption, transcript, or HTML
conversion beyond included priority volume
Additional Spanish content
$90 per hour plus
professional language
review
Drafting, page setup, and review beyond
agreed priority services
50 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 22
Optional service Price What it adds
Custom integration or workflow $140 per hour under a Cityapproved work order Deeper API, form, 311, permitting, payment,
HR, or service workflow
Commercial terms
• Project budgets. A4.1 and A4 are separate not-to-exceed amounts. Funds do not move between projects without written City approval.
• Expenses. No separate travel or ordinary reimbursable expense is charged. Up to two planned onsite visits are included.
• Third-party costs. Platform and tool costs are billed at actual approved cost up to the allowance, without Altioras markup. Unused allowance remains with the City. • Billing. Invoices are monthly in arrears and include hours, rates, tasks, amount, remaining budget, and forecast to finish.
• Changes. Work outside the stated scope requires a written change approved by the City before the work begins.
• Price period. The fixed fees remain firm through the planned June 2027 completion if the project starts by October 2026 and the stated assumptions hold.
51 EAST PALO ALTO PROJECT A4 and A4.1 | Website, Intranet, and Strategic Consulting www.altiorascivic.com 23
G. Exceptions
Altioras Civic takes no exceptions to the City's RFP or standard Contractor and Professional Services Agreement. Required insurance certificates, endorsements, W-9, business license, and corporate registration will be provided before contract execution.

Altioras will confirm registration and good standing with the California Secretary of State by the proposal deadline, as applicable, and will obtain the East Palo Alto business license before contract execution.

The selected website platform will carry its own subscription terms. Those terms are not an exception to the Altioras professional services agreement. The City will review and approve the platform agreement, security and accessibility documents, service commitments, data-return provisions, price, and procurement path before a subscription is executed.

Authorization
The undersigned is authorized to execute legal documents and negotiate on behalf of Altioras Civic Consulting Corp.

Authorized signature: __________________________________________

LEROY CLIFTON GUICE
CEO
24 August 2026
52 A P O G E E · G L O B A L R M S EPA vCISO Support Services A P O G E E
G L O B A L R M S
Integrated Enterprise Risk Management
R E S P O N S E T O R E Q U E S T F O R P R O P O S A L EPA vCISO Support Services
City of East Palo Alto · Information Technology Division Submitted in response to the RFP issued July 29, 2026 by the City of East Palo Alto, in accordance with the requirements and timeline set forth by the City.

S U B M I T T E D T O
City of East Palo Alto
Information Technology Division
Jimmie Tulabing, IT Manager
[email protected]
S U B M I T T E D B Y
Apogee Global RMS, LLC
M. K. Palmore, Founder & Principal Advisor
2059 Camden Ave., Suite 242, San Jose, CA 95124
(408) 256-2198 · [email protected]
Federal SDVOSB · California DVBE (ID 2043568) · Maryland CSB & VSBE UEI NFDUQKK8E6N3 · CAGE 08WU4 · Submission Date: August 26, 2026 A P O G E E G L O B A L R M S , L L C · SDVOSB · CA DVBE · MD CSB/VSBE · Page 1 of 18 53 A P O G E E · G L O B A L R M S EPA vCISO Support Services S E C T I O N A · C O V E R L E T T E R
August 26, 2026
Jimmie Tulabing
Information Technology Manager
City of East Palo Alto — Information Technology Division 2415 University Avenue, East Palo Alto, CA 94303
[email protected]
Re: East Palo Alto vCISO Support Services Proposal from Apogee Global RMS, LLC Dear Mr. Tulabing:

Apogee Global RMS, LLC submits this proposal as Prime Contractor for the City of East Palo Alto vCISO Support Services engagement. We have reviewed the RFP dated July 29, 2026, the Q&A released August 19, 2026, the City's IT Strategic Plan, and Attachment 2 (Contractor and Professional Services Agreement) in full. We propose without exception to the scope of services as written, and we confirm the ability to deliver against every element of the scope, schedule, and evaluation criteria.

The City has described the role precisely, and that precision is worth naming. East Palo Alto is not asking for a security assessment with a report at the end. It is asking for a security executive: one accountable person who owns the governance program, sets the biweekly agenda after the first meeting, sits in front of the City Council and explains what the risk actually is, holds the incident response plan and has tested it, and — for the first six to twelve months — does a meaningful amount of the hands-on work personally while training two IT staff to take it over.

That last part is unusual to see stated so plainly in an RFP. It is the part most proposals will avoid. We answer it directly in Section C.

Three principles organize our response.

One named person, accountable — and, uniquely, the right one for a Police Department scope. Consistent with Q&A C.4, we name a single vCISO — M. K. Palmore, our Founder and Principal Advisor — as the primary point of contact for the Assistant City Manager and IT Manager. Mr. Palmore is a U.S. Naval Academy graduate, retired U.S.

Marine Corps officer, and retired FBI senior executive who spent twenty-two years at the Bureau and led one of its largest cybersecurity investigative programs at the San Francisco Field Office. That background is not incidental to a City whose scope includes a Police Department with CJIS obligations: he is fluent in CJIS-regulated environments, in federal-local investigative coordination, and in the public-facing pressures a governing body feels after a cyber event. He subsequently served as VP & Field CISO (Americas) at Palo Alto Networks and cybersecurity executive at Google Cloud, is CISSP-credentialed, and completed the Carnegie Mellon CISO Executive Program. Behind him stands a Deputy vCISO who is the designated alternate, a dedicated Program Manager who runs the engagement cadence, and the Apogee firm-intelligence practice (RRAG) — described in Section D — so the City is buying continuity, delivery discipline, and a multi-domain enterprise risk view, not a solo practitioner.

Effort sized to the budget in the open. The City disclosed a $70,000 annual budget and asked proposers to recommend the level of effort that fits inside it (Q&A C.1, E.1). We show our arithmetic in Section F. The proposal sequences the full scope into a Year 1 build phase and a lighter, steady-state phase for Years 2–5, consistent with the operational-to-strategic transition the City described at Q&A B.2. We would rather tell the City honestly what $70,000 buys than promise the full scope at a number that does not cost the work.

Exit designed from Day 1. The City stated that procurement administration and daily operational management should shift to City IT staff within six to twelve months. A vCISO whose commercial interest runs against that transfer will not make it happen. Our program is built to hand those functions over on that timeline, with the A P O G E E G L O B A L R M S , L L C · SDVOSB · CA DVBE · MD CSB/VSBE · Page 2 of 18 54

"
"

&

& H &
#
$C
&

&&

#
-
+& 45//
"<

A,
BB
)"%*)"")%*)!") 6
)+,7
8)
.7

,
**)+")

*'
*") '"#

"9)'
.)#%
#9)
&

MC
"

&3"
#
"
,56,73

& &&
3"

"

&GD
"

"

/:

, EF
5

A5&

,

1#:
"

&
""

&
"

&
&

&
"C

& H#C
"
/
6?,?,

"

6"

H( & 9,3

&" 3

"

6"

H81
C

&
&

K

"

H

&
&G&
&
""
";'
#Q
&C

&CH
&
""

"D
@C
"

MC
" #
,6C&G

"

&G
"

&"&
"

"

"&T

&
HC
&

#

*
+)9 '%

"9)'")+
*#
")
7
.:/;/
"<

A,
BB

&

" K&%

Q
().0
&O
&,

#G
&
&
,56,7
G /,7
5
""&
8.
()(*1

57G /()-8*20

&

%

(0
()(Q1
&
&,7/,7(23)+Q)8Q1 &5,7/57(23)+Q)8+1G
#

""
&
&
"&
"

&C9&,
T
"

J

C;'
#-#
, ,
&

"&
& ""

C;'
#Q#

*"
)"
!.

"#/ #$#

%
&'
"

&

"<

A,
BB@()*+
&
#
,
(-(
,

+*.(-/-)01(*23(.+0"4 ! "

###

K&

"<

A,
BB &

K&
&G#
A
"U

444444444444444444444444444444444444444

/</"#*
%
&'
"

&
V

K&,

A,
BB

' ,56,7
57,7?5,7
8 .0
55 A P O G E E · G L O B A L R M S EPA vCISO Support Services S E C T I O N B · F I R M P R O F I L E A N D Q U A L I F I C A T I O N S B.1 Firm overview and years in business
Apogee Global RMS, LLC ("Apogee") is a practitioner-led, veteran-owned enterprise risk management firm headquartered in San Jose, California, roughly fifteen miles from East Palo Alto City Hall. The firm was organized in California on February 7, 2018 and has operated continuously for over eight years. Apogee is not a body shop; every engagement is delivered by senior practitioners who ran the discipline before they advised on it. Our Founder is a retired FBI cyber executive and former Field CISO at Palo Alto Networks and Google Cloud; our supporting bench is drawn from federal law enforcement, active fractional-CISO practice in state government, and California municipal policing. We are deliberately positioned as a credible operator alternative to the Big 4 for public-sector clients that need executive-grade counsel without enterprise-level overhead.

The firm's organizing thesis is the Nexus of Risk — that cyber, physical, and human-capital risk are three expressions of one underlying organizational vulnerability, grounded in COSO ERM and ISO 31000. For a City that has recently absorbed a sanitary district, runs a Police Department with CJIS obligations, and holds resident PII across seven departments with only two IT staff, that framing is not academic. The controls that fail in local government are rarely purely technical.

B.2 Relevant service areas
Apogee delivers through three integrated practice pillars, each aligned to the scope of this RFP:
• Enterprise Risk Operations — Cyber. Fractional CISO and vCISO services; NIST CSF 2.0, NIST SP 800-53, and CIS Controls maturity assessments and roadmaps; policy and standards drafting; cybersecurity governance and executive/Board reporting; incident response planning, tabletop exercises, and incident-command support; third-party and cloud provider risk assessments; procurement security requirements support; awareness and phishing program evaluation and enhancement. • Enterprise Risk Operations — Physical & OT. Physical security risk playbook (available for optional scope) and OT/ICS/SCADA advisory (available for the future-phase inclusion referenced at Q&A A.2–A.3). • Strategy & Organizational Resilience. Executive and Council-level briefings, cybersecurity budget planning and cost modeling, program governance rhythms, and structured knowledge transfer to internal IT staff — directly responsive to the knowledge-transfer element scored under Criterion 4.

Frameworks Apogee aligns to: NIST CSF 2.0 (primary, per Q&A D.1) · NIST SP 800-53 · CIS Controls v8 · CJIS Security Policy v6.0 · HIPAA Security Rule · PCI DSS 4.0 · NIST AI RMF 1.0 · CISA Zero Trust Maturity Model · ISO/IEC 27001 · MITRE ATT&CK.

B.3 Public sector and municipal experience
Apogee's proposal-ready references catalog contains eleven fact-panelled past-performance references across federal, state and local, U.S. military, healthcare, and international government work. Three are directly relevant to this engagement and are carried into Section E in full: (i) a Fractional CISO and federal compliance advisory engagement (NextStage.AI) covering NIST-baselined cybersecurity program work end-to-end — the closest scope analog to this RFP; (ii) an executive cybersecurity advisory engagement with SailPoint Technologies (publiclytraded enterprise identity security company) — evidence of Palmore's operating credibility with sitting CISO-level leadership; and (iii) a recurring executive-instruction engagement with the California Police Chiefs Association covering AI governance and public safety leadership — Palmore was Lead Faculty and Subject Matter Expert. The catalog also carries a Municipal Public Safety Leadership Transformation engagement for a city government, a NIST CSF 2.0 State Judiciary assessment, and international cybersecurity capacity-building delivered on behalf of the A P O G E E G L O B A L R M S , L L C · SDVOSB · CA DVBE · MD CSB/VSBE · Page 4 of 18 56 A P O G E E · G L O B A L R M S EPA vCISO Support Services U.S. Department of State. All three primary references are described with dates, scope, outcomes, and contact information in Section E.

B.4 California local government experience
California local government experience is preferred rather than required (§I; Q&A F.3). Apogee is a Californiaheadquartered firm operating in the California public sector: our Principal Advisor's twenty-two-year FBI career culminated in leadership of the Bureau's San Francisco cybersecurity investigative program, serving Northern California local, state, and federal partners including municipal police departments across the Bay Area. He is currently retained as Lead Faculty and Subject Matter Expert for the California Police Chiefs Association's AI governance and public safety leadership curriculum. Our operating knowledge extends to the California Public Records Act, CJIS obligations as they apply to a municipal Police Department, California Government Code procurement practice, and the California DVBE program under which we are certified. Our physical proximity to City Hall is a practical asset: quarterly on-site presence, in-person Council briefings, and unscheduled incident touchpoints do not require air travel.

B.5 Relevant qualifications, certifications, and insurance • Certifications and credentials held by named personnel: CISSP; Carnegie Mellon CISO Executive Program; MBA (Pepperdine); U.S. Naval Academy; retired FBI senior executive; FBI SWAT Operator; Federal Court– qualified expert witness (Palmore). Captain, U.S. Navy (Ret.); SES-level CIO for Navy Special Access Programs; CTO for a live 24/7 broadcast platform; MS Computer Science (Rensselaer); MS National Resource Strategy (National Defense University); Chief Information Security Officer Certificate (National Defense University); U.S. Naval Academy; qualified Naval Nuclear Engineer; Certified Ethical Hacker; CNSSI 4012, CNSSI 4016, NSTISSI 4011, NSTISSI 4015 (Torruella). A qualified and experienced Program Manager (PMP or equivalent) will be assigned from Apogee's PgM bench to run the engagement cadence and hold milestones and deliverables — identified by name upon contract award.
• Firm certifications: Federal SDVOSB · California DVBE (ID 2043568) · Maryland CSB & VSBE. UEI NFDUQKK8E6N3; CAGE 08WU4; SAM.gov active for all federal award types. • Insurance coverages carried: Professional Liability (Errors & Omissions), Commercial General Liability, and Cyber Liability, at limits meeting or exceeding those expected under Attachment 2, Exhibit C; certificates and additional-insured endorsements will be produced prior to execution. • Registration and licensure: California Secretary of State registration and City of East Palo Alto business license will be produced at contract approval, per Q&A E.7.

A P O G E E G L O B A L R M S , L L C · SDVOSB · CA DVBE · MD CSB/VSBE · Page 5 of 18 57 A P O G E E · G L O B A L R M S EPA vCISO Support Services S E C T I O N C · E N G A G E M E N T U N D E R S T A N D I N G A N D A P P R O A C H C.1 What the City is actually asking for
A five-year vCISO engagement covering all City departments, the Police Department, and the Sanitary District — a baseline of approximately 400 endpoints spanning workstations, servers, mobile, IoT, network infrastructure, external IPs, and physical locations (Q&A A.1). OT/ICS/SCADA environments associated with wastewater and traffic systems are out of core scope, with a stated possibility of inclusion in a future phase (Q&A A.2–A.3). The RFP's scope bullets obscure the actual shape of the work; naming that shape is the first job of this section. There are four distinct workstreams, and they do not run at the same tempo:
• Governance and executive reporting — continuous. Biweekly Security Governance Meetings (agenda, written status, emerging-risk disclosure, budget tracking); quarterly or semi-annual City Council and executive presentations with prior coordination and briefing rehearsals with the Assistant City Manager and IT Manager; and running risk-decision documentation.
• Assessment, roadmap, and policy — front-loaded then annual. Baseline NIST CSF 2.0 maturity assessment (with CIS Controls v8 secondary), risk scoring matrix, current-state and target-state diagrams (security controls, data flows, incident escalation paths), a prioritized sequencing roadmap keyed to the City's existing Security Projects List, and a policy/standards refresh mapped to CJIS, HIPAA, and PCI-DSS where applicable. • Incident response and tabletop exercises — sustained. Enterprise IR Plan development and maintenance, tabletop exercises delivered at a frequency proposed under Q&A B.4 (recommended: two per year, alternating technical IR tabletop and executive/Council-level crisis exercise), and executive incidentcommand advisory during any active event (with the deeper 24/7 availability priced as an optional add-on per Q&A B.3).
• Third-party risk, procurement security, and awareness program oversight — recurring. Approximately five to ten third-party and cloud provider assessments annually (Q&A B.5), security requirements input to City IT procurements, and evaluation-and-enhancement of the existing awareness and phishing program (Q&A B.7).

C.2 The part of this engagement most proposals will avoid — and how we answer it Q&A B.2 is the most consequential answer in the document: procurement administration and daily operational management fall to the vCISO initially, with those functions shifting to City IT staff within six to twelve months.

Q&A B.1 adds that the engagement "may require a combination of both advisory guidance and hands-on operational support, configuration oversight, or control implementation." That is a request for a vCISO who will do operational work in Year 1 and then deliberately make themselves unnecessary for it. Two things follow, both reflected in our approach and cost proposal:
• Two engagement phases, priced accordingly. A heavier operational ramp in Months 1–12 (Year 1 build phase); a lighter, more strategic steady state from Month 13 across Years 2–5. A flat five-year fee either overprices Years 2–5 or underprices Year 1. Section F states both. • Two-tier rate structure. Q&A B.1 explicitly asked whether fees differ by work type. They do. Strategic advisory hours (governance, policy, executive briefings) are billed at the Principal Advisor rate; hands-on operational hours (procurement administration, configuration oversight, control implementation, IR command) are billed at a separate operational rate. Both are shown in Section F. • Knowledge transfer as a named deliverable set. Runbooks, policy templates, an assessment instrument the IT Manager can rerun without us, and structured training for the two-person IT team are dated deliverables — not aspirations. Criterion 4 scores this element explicitly.

A P O G E E G L O B A L R M S , L L C · SDVOSB · CA DVBE · MD CSB/VSBE · Page 6 of 18 58 A P O G E E · G L O B A L R M S EPA vCISO Support Services C.3 Proposed methodology — the Apogee Cyber Risk Engagement Playbook Apogee does not improvise methodology per engagement. Advisory and assessment work runs under the Cyber Risk Engagement Playbook V1 (v1.0, December 15, 2025) — a six-phase operational manual with defined role authorities and quality checkpoints. Mapped to a five-year fractional engagement beginning October 2026:

Phase Duration Core outputs

1. Diagnose Months 1–3 NIST CSF 2.0 baseline maturity; risk scoring matrix; current-state
diagrams (controls, data flows,
escalation); asset and third-party
inventory review.

2. Design Months 3–4 Target-state architecture; prioritized sequencing roadmap;
policy/standards refresh plan; IR
Plan v1; awareness program
evaluation report.

3. Deploy Months 4–12 Policy and IRP adoption; two
tabletop exercises; procurement
security requirements input to Year
1 IT Strategic Plan procurements;
hands-on operational ramp with
training of City IT staff.

4. Defend & Develop Year 2 onward Steady-state governance rhythm; annual reassessment against the
same instrument; ongoing thirdparty reviews; refreshed IR Plan and tabletops; continuous training.

5. Demonstrate Ongoing / annual Council-ready dashboards; annual maturity movement report; budget
tracking; documented risk
acceptance decisions; regulatorready evidence set.

6. Handover checkpoint Month 12 Formal readiness review with Assistant City Manager and IT
Manager; documented shift of
procurement administration and
daily operational management to
City IT staff.

C.4 Stakeholder engagement — designed for a two-person IT team The City has 125.95 FTE across seven departments and exactly two IT staff, one of whom primarily runs the helpdesk (Q&A C.3). The City asked proposers to describe how they will minimize operational impact on City staff.

That is a scored question. Our answer is a set of design choices, not a promise:
• Batch the demands. Discovery interviews are scheduled in consolidated blocks rather than drip-fed across weeks. The same conversation serves the baseline assessment, the policy gap analysis, and the continuitydocumentation review — not three separate meetings.

A P O G E E G L O B A L R M S , L L C · SDVOSB · CA DVBE · MD CSB/VSBE · Page 7 of 18 59 A P O G E E · G L O B A L R M S EPA vCISO Support Services • Do the reading first. The City holds substantial material — prior assessments, the Network and Security Plan Recommendations report, model policies, and the prioritized Security Projects List — released on contract execution (Q&A A.7, E.2). The vCISO reads before asking. Every question answered by an existing document is a question not put to a two-person IT team.
• Route through one point of contact. The IT Manager is the primary contact (Q&A C.3). Departmental access is coordinated through that one point rather than solicited directly. The IT Manager controls the load on the organization.
• Bring the artifact, not the blank page. Policies, runbooks, IRP structures, and assessment instruments arrive as tailored drafts built from Apogee templates — not as workshops that ask City staff to generate content.

C.5 Delivery model, on-site presence, and City staff participation Delivery is remote-first, hybrid, consistent with Q&A C.2. On-site presence is scheduled for: (i) engagement kickoff and initial stakeholder meetings; (ii) formal City Council presentations, which are typically held in person; and (iii) up to four additional on-site touchpoints per year — quarterly by default, or as triggered by an incident or a major milestone (annual assessment, tabletop exercise, IR Plan revision). Because Apogee is headquartered in San Jose, we do not charge travel or per-diem for on-site presence at City Hall; the four-times-per-year cap stated in Q&A C.2 is our floor, not our ceiling.

City staff participation required (baseline estimate): Assistant City Manager — approximately two hours per month for governance meetings plus prep for quarterly/semi-annual Council briefings. IT Manager — approximately four to six hours per month for governance, discovery, and coordination in Year 1, decreasing in steady state. Department representatives (rotating) — approximately one hour per quarter for third-party review and continuity documentation input. Total City staff impact is designed to sit under ten hours per month organization-wide in steady state.

C.6 Assumptions, dependencies, and success factors
• Assumption. The City releases held-back material — asset inventories, architecture and data-flow diagrams, network segmentation state, prior assessments, the Network and Security Plan Recommendations report, model policies, Security Projects List, compliance artifacts, and awareness platform detail — within thirty days of contract execution (Q&A A.5–A.7, D.2). The 90–120 day deliverable set depends on it. • Assumption. OT/ICS/SCADA environments are out of core scope; any future inclusion is separately scoped and funded (Q&A A.2–A.3). Priced under Optional Task 2 in Section F. • Assumption. Approximately five to ten third-party and cloud provider assessments annually, with depth agreed at contract execution (Q&A B.5).
• Dependency. Availability of the Assistant City Manager and IT Manager for the biweekly cadence and Council briefing rehearsals. The governance cadence is the engagement's heartbeat; if it lapses, the program becomes a document set.
• Dependency. Written City decisions at defined points. A vCISO advises; the City owns the risk decisions.

Documenting accepted risk is part of the service.
• Success factor. Measurable NIST CSF 2.0 maturity movement from a documented baseline, using the same assessment instrument each year so movement is real, not an artifact of a changed method. • Success factor. The transfer of procurement administration and daily operational management to City IT staff on the six-to-twelve-month timeline the City set — evidenced by dated handovers, not asserted.

C.7 Optional tasks and ideas
Priced separately in Section F, consistent with §IV.F and Q&A E.5:
• Optional Task 1 — 24/7 emergency advisory availability with a defined response commitment for out-ofhours incident-command support (requested at Q&A B.3).

A P O G E E G L O B A L R M S , L L C · SDVOSB · CA DVBE · MD CSB/VSBE · Page 8 of 18 60 A P O G E E · G L O B A L R M S EPA vCISO Support Services • Optional Task 2 — OT/ICS/SCADA cybersecurity assessment for the wastewater and traffic environments, scoped now and exercised when the City is ready (Q&A A.2–A.3). • Optional Task 3 — Penetration testing and vulnerability scanning delivered on an as-needed authorized basis through a US-based partner under Apogee prime accountability. • Optional Task 4 — Additional tabletop exercises beyond the core-included frequency, including an executive- or Council-level crisis exercise — a distinct exercise from a technical IR tabletop, rarely run in cities of this size.
• Optional Task 5 — Security requirements support for the concurrent Year 1 IT Strategic Plan procurements (ERP, website/intranet, GIS, records digitization, eBid). The City raised this connection at Q&A B.6. Each of those procurements will move City data; each needs security and data-residency requirements written before the RFP goes out, not after the contract is signed.

A P O G E E G L O B A L R M S , L L C · SDVOSB · CA DVBE · MD CSB/VSBE · Page 9 of 18 61 A P O G E E · G L O B A L R M S EPA vCISO Support Services S E C T I O N D · T E A M
The City prefers a single named vCISO as primary point of contact and continuity, supported by a team with a clearly identified lead, defined supporting roles, and a stated mechanism for continuity and accountability (Q&A C.4). Apogee proposes a small, senior bench organized around one accountable executive. All personnel are USbased; Apogee uses no offshore resources on this engagement. No subcontractors are proposed.

D.1 Proposed team, roles, and monthly-hour allocation
Name / Role Function on this engagement Key credentials Yr 1 hrs/mo — Steady state
M. K. Palmore Proposed Project
Manager, Named vCISO & Project
Executive (§IV.D)
Primary point of contact for Assistant City
Manager and IT Manager. Owns governance
program; sets biweekly agenda after Meeting 1;
leads Council presentations; direct CJIS
interlocutor for the Police Department scope;
final signoff on all deliverables. Holds the
"Proposed Project Manager" designation §IV.D
requires — with the assigned PgM below acting
as day-to-day cadence lead reporting to him.

CISSP; CMU CISO Exec;
MBA; USNA / USMC
officer; retired FBI
executive (San Francisco
Cyber); ex–Palo Alto
Networks Field CISO; ex–
Google Cloud Cyber Exec.
12 — 10
Ramberto Torruella Deputy vCISO &
Designated Alternate
Operational execution lead; primary continuity
backup; attends all governance meetings; runs
baseline NIST CSF 2.0 assessment; owns policy
drafting, IR Plan development, and third-party
reviews; hands-on operational ramp in Year 1.

Captain, USN (Ret.);
former SES-level CIO,
Navy Special Access
Programs ($500M+,
6,000+ users); CTO (live
24/7 platform); MS Comp
Sci (RPI); MS Nat'l
Resource Strategy (NDU);
CISO Certificate (NDU);
CEH; CNSSI 4012/4016;
NSTISSI 4011/4015.
10 — 8
Program Manager (PgM) (to be assigned
from Apogee's PgM bench)
Engagement cadence and program governance:
biweekly meeting agendas and formal written
status reports; risk register and roadmap
upkeep; deliverable scheduling against Playbook
phase gates; evidence and citation discipline;
City stakeholder logistics. Qualified and
experienced Program Manager to be assigned to
ensure milestones and deliverables are held;
identified by name upon contract award.

PMP or equivalent
program-management
credentials; public-sector
program delivery.
4 — 3
Apogee RRAG — Firm Intelligence &
Multi-Domain Risk Practice
Continuous multi-domain risk monitoring
feeding the biweekly status report and Council
briefings: cyber threat intel calibrated to
municipal exposure; physical-security and civilunrest indicators; operational and supply-chain risk; AI governance developments; state and
local regulatory movement. This is the
enterprise-risk overlay a City cannot get from a
single vCISO.

Rogue Risk Advisory
Group — Apogee's
proprietary multi-domain
risk intelligence cell
(cyber, physical,
operational, geopolitical,
AI, human capital);

NIST/CIS/NIST AI RMF
anchored.

Included —
Included
Total blended monthly effort — Year 1: ~26 hours per month (governance-heavy build phase, per §F.2 arithmetic).

Steady-state Years 2–5: ~21 hours per month. Both figures include the RRAG multi-domain risk-intelligence overlay at no incremental hourly charge — an enterprise-risk overlay that is priced separately in most vCISO proposals if it is offered at all.

A P O G E E G L O B A L R M S , L L C · SDVOSB · CA DVBE · MD CSB/VSBE · Page 10 of 18 62 A P O G E E · G L O B A L R M S EPA vCISO Support Services D.2 Continuity and accountability — how the mechanism actually works Q&A C.4 asked specifically how continuity and accountability are maintained. Our answer is a mechanism, not a reassurance:
• Named alternate with real engagement. Ramberto Torruella is designated as Deputy vCISO and alternate, and attends every biweekly governance meeting during Year 1 and every other meeting in steady state. The assigned Program Manager attends every meeting throughout the term. The relationship is not cold if the named vCISO is invoked.
• Documented engagement record. A running engagement journal — decisions, risk acceptances, action items, evidence links — is maintained in a shared record. Context does not live in one person's head. • Escalation path. The Apogee Founder-Principal Advisor structure means the Assistant City Manager has a standing escalation path even when the named vCISO is unavailable. • Substitution controls. Any substitution of the named vCISO requires thirty (30) days' written notice to the City and the City's written approval, with a resume of the proposed replacement provided in advance.

D.3 Resumes — key personnel (purpose-cut to vCISO scope) M. K. Palmore — Named vCISO & Project Executive
Education & credentials. BS, Political Science, U.S. Naval Academy · MBA, Entrepreneurship, Pepperdine · CISSP, (ISC)² · CISO Executive Program, Carnegie Mellon University · FBI SWAT Operator (retired) · Federal court–qualified expert witness.

Relevant experience (last 5 years). Founder & Principal Advisor, Apogee Global RMS (2018–present) — fractional CISO / cybersecurity advisory to State Judiciary (3,000+ employees; NIST CSF 2.0 assessment and remediation roadmap), California Police Chiefs Association (recurring AI-governance and public safety leadership instruction), municipal public safety leadership transformation, and federal cybersecurity compliance advisory. Cybersecurity Executive, Google Cloud (Office of the CISO). Vice President & Field CISO (Americas), Palo Alto Networks — cybersecurity executive counsel to Fortune 500 and critical-infrastructure clients across the Americas. Assistant Special Agent in Charge, FBI Cybersecurity Division, San Francisco — led one of the Bureau's largest cybersecurity investigative teams covering Northern California local, state, and federal partners. Federal court testimony and hundreds of federal warrants executed as case agent and supervisor.

Ramberto Torruella — Deputy vCISO & Designated Alternate Education & credentials. BS, Physics — U.S. Naval Academy · MS, Computer Science — Rensselaer Polytechnic Institute · MS, National Resource Strategy & International Relations — National Defense University (Eisenhower School) · Chief Information Security Officer Certificate — National Defense University · Qualified Naval Nuclear Engineer · Certified Ethical Hacker (EC-Council) · CNSSI 4012 (Senior System Managers), CNSSI 4016 (Risk Analysts), NSTISSI 4011 (INFOSEC Professionals), NSTISSI 4015 (System Certifiers) — NDU · CISSP (ISC² — 2013, credential lapsed 2025; disclosed for transparency).

Relevant experience (last five years). Captain, U.S. Navy (Ret.), with three decades leading mission-critical systems where downtime is not an option. Chief Technology Officer, KEXP (2023–2026) — modernized a live 24/7 broadcast and streaming platform, sequencing six simultaneous end-of-life/end-of-support forcing functions with no service-impacting outage during transition. Chief Information Officer for Navy Special Access Programs (2021– 2023) at SES level — governed $500M+ in distributed platforms serving 6,000+ engineers; expanded network monitoring coverage from 16 to 157 metrics; converted 70% of contract tasks to firm-fixed-price; reduced requirements rework by 90%; conducted architecture and cybersecurity reviews for three- and four-star leaders.

Assistant Professor at NDU's Eisenhower School (2019–2021), teaching National Security Strategy and leading the Cyberspace and Advanced Computing Industry Study. CIO / Director of Communications & Networks (N6), U.S.

Naval Forces Europe–Africa / U.S. 6th Fleet (2016–2019). Currently a Fractional CTO/CISO advising mid-market and A P O G E E G L O B A L R M S , L L C · SDVOSB · CA DVBE · MD CSB/VSBE · Page 11 of 18 63 A P O G E E · G L O B A L R M S EPA vCISO Support Services government clients on cyber posture, platform modernization, and de-risked replacement of core systems under fixed deadlines — the exact discipline this five-year engagement requires. Joined Apogee as Risk Advisor in May 2026.

Program Manager (PgM) — to be assigned from Apogee's PgM bench Assignment. A qualified and experienced Program Manager will be assigned to this engagement from Apogee's Program Management bench to ensure that milestones and deliverables are held throughout the five-year term.

The assigned PgM will hold PMP or equivalent program-management credentials and have public-sector engagement delivery experience appropriate to a five-year municipal vCISO program. Apogee will identify the assigned PgM by name upon contract award, and any subsequent substitution will require thirty (30) days' written notice to the City and the City's written approval, on the same substitution controls that apply to the Named vCISO.

Function on this engagement. Owns the engagement cadence end-to-end: biweekly agendas, formal written status reports, risk register and roadmap upkeep, deliverable scheduling against the Cyber Risk Engagement Playbook phase gates, evidence and citation discipline for regulator-ready documentation, and City stakeholder logistics. Attends every biweekly governance meeting throughout the term. The role is what protects a two-person City IT team from becoming the program's coordinator.

Apogee RRAG — Firm Intelligence & Multi-Domain Risk Practice What it is. The Rogue Risk Advisory Group is Apogee's proprietary multi-domain risk intelligence cell — the operational expression of the firm's Nexus of Risk thesis that cyber, physical, operational, geopolitical, AI, and human-capital risks are causally interconnected and should be advised as one connected system rather than in silos.

Why it matters for a City of 28,872 with two IT staff and a Police Department. A single vCISO can watch cyber threats. A City needs more than that. The Council will ask about AI adoption in policing before this contract's second year; the Police Department will face threat-actor targeting tied to case work; the Sanitary District subsidiary sits inside a national conversation about municipal water-system attacks; and the City itself is exposed to the geopolitical, supply-chain, and vendor-incident vectors that reach local government whether or not the local government is watching for them. RRAG provides that watch. It feeds the biweekly status report's emergingrisk disclosures, sources the Council briefings, and produces the calibrated intelligence that turns a vCISO into a genuine enterprise risk advisor. Included in the retainer at no incremental hourly charge — a differentiator most firms at this budget cannot offer at all.

D.4 Subcontractors
No subcontractors are proposed on the core scope of this engagement. Apogee delivers the vCISO scope entirely with directly-engaged, US-based personnel identified above. For Optional Tasks 2 and 3 (OT/ICS/SCADA assessment and penetration testing), we would engage US-based specialty partners under Apogee prime accountability, subject to City approval and full identification in advance, consistent with Q&A E.7. No offshore resources are used at any tier of the delivery stack, on core scope or optional tasks.

A P O G E E G L O B A L R M S , L L C · SDVOSB · CA DVBE · MD CSB/VSBE · Page 12 of 18 64 A P O G E E · G L O B A L R M S EPA vCISO Support Services S E C T I O N E · R E L E V A N T E X P E R I E N C E A N D R E F E R E N C E S Three engagements are presented, selected against the RFP's scope: fractional CISO plus federal compliance advisory (NextStage.AI); executive cybersecurity advisory to a Fortune-1000 identity-security company (SailPoint); and California public safety executive instruction (California Police Chiefs Association). Reference contacts have been notified they may be called. Non-California municipal experience is evaluated equally with California experience (Q&A F.3); the three references together evidence fractional-CISO delivery discipline, executive cybersecurity counsel to CISO-level leadership, and California public safety and CJIS operating credibility.

Reference 1 — Fractional CISO and Federal Compliance Advisory (NextStage.AI) Client organization NextStage.AI (technology company pursuing federal certification) Engagement Fractional Chief Information Security Officer plus federal compliance advisory:
comprehensive compliance assessment against a federal baseline (FedRAMP Moderate), development and implementation of remediation strategies, security engineering support to compliance posture, and executive-level program governance under Apogee's Cyber Risk Engagement Playbook.

Dates Six-month engagement completed 2024
Apogee personnel role M. K. Palmore, Founder & Principal Advisor — engagement executive; Apogee delivered as Prime Contractor.

Outcomes Closed all compliance gaps against the federal baseline; positioned the client to progress toward federal compliance certification and pursue federal contracts; established a repeatable governance cadence; delivered structured knowledge transfer to internal engineering leadership.

Reference contact Josh Chu, Chief Technology Officer, NextStage.AI — direct phone and email provided to the City on written request coordinated through M. K. Palmore ([email protected]). Mr. Chu has been notified he may be contacted for reference.

Reference 2 — Executive Cybersecurity Advisory (SailPoint Technologies) Client organization SailPoint Technologies (publicly-traded enterprise identity security company) Engagement Executive cybersecurity advisory to SailPoint's information-security leadership:
independent advisor engagement on security-program direction, board- and executive-level cybersecurity communication, cybersecurity leadership development, and risk-posture counsel across an enterprise environment materially larger than East Palo Alto's.

Dates Advisory engagement across 2024 – 2025
Apogee personnel role M. K. Palmore, Founder & Principal Advisor — engagement executive; Apogee delivered as Prime Contractor.

Outcomes Delivered executive-level cybersecurity counsel used by SailPoint's informationsecurity leadership on strategy, board communication, and leadership development. The engagement evidences Palmore's ability to hold trusted advisor status with a sitting CISO of a public identity-security company — the same executive-counsel discipline the City is procuring.

A P O G E E G L O B A L R M S , L L C · SDVOSB · CA DVBE · MD CSB/VSBE · Page 13 of 18 65 A P O G E E · G L O B A L R M S EPA vCISO Support Services Reference contact Sree Kancharla, SailPoint Technologies — email: [email protected].

Direct phone provided to the City on written request coordinated through M. K.

Palmore ([email protected]). Ms. Kancharla has been notified she may be contacted for reference.

Reference 3 — California Police Chiefs Association — AI Governance and Public Safety Leadership Instruction
Client organization California Police Chiefs Association (CPCA) End beneficiary California municipal police chiefs and command-level public safety executives Engagement Two-cohort executive instruction covering AI governance for public safety agencies and the leadership disciplines required to navigate accelerating technology change; anchored in the NIST AI Risk Management Framework and aligned to California POST executive development priorities.

Dates Two cohorts delivered 2024 and 2025 (recurring instructional relationship) Apogee personnel role M. K. Palmore — Lead Faculty and Subject Matter Expert; Apogee delivered as Prime Contractor.

Outcomes Delivered executive-level AI governance instruction to two cohorts of California police chiefs; sustained recurring instructional relationship with CPCA; translated NIST AI RMF into actionable guidance for California municipal law enforcement — evidence of Palmore's operating fluency with California public-safety leadership and CJIS-obligated environments.

Reference contact Chief Max Bosel (Ret.), California Police Chiefs Association — email:
[email protected]. Direct phone provided to the City on written request coordinated through M. K. Palmore ([email protected]).

Chief Bosel has been notified he may be contacted for reference.

A P O G E E G L O B A L R M S , L L C · SDVOSB · CA DVBE · MD CSB/VSBE · Page 14 of 18 66 A P O G E E · G L O B A L R M S EPA vCISO Support Services S E C T I O N F · C O S T P R O P O S A L
F.1 Monthly retainer — two phases; escalator; travel
Budget-fit context (Q&A C.1, E.1): The City disclosed a $70,000 annual budget and asked for the level of effort within it. $70,000/yr = $5,833/mo. Section D.1 models ~26 blended hours/mo in Year 1 (operational build) and ~21 blended hours/mo in steady state (Years 2–5), across the entire named team plus the RRAG multi-domain riskintelligence overlay. Travel and per-diem for on-site presence at City Hall or the Sanitary District are not charged; Apogee is headquartered in San Jose.

Line Included / Description Fee
Retainer — Year 1 (build) Named vCISO (Palmore) + Deputy vCISO/Designated Alternate (Torruella) + a qualified and experienced Program Manager assigned from Apogee's PgM bench, plus the Apogee RRAG multi-domain risk-intelligence overlay; ~26 blended hrs/mo; biweekly governance meetings; all §III core deliverables; up to 4 on-site touchpoints/yr.
$5,833 / month
($69,996 / yr)
Retainer — Steady state
(Yrs 2–5)
Same team plus RRAG overlay; ~21 blended hrs/mo; annual reassessment; ongoing third-party reviews; refreshed IR Plan & tabletops; sustained knowledge transfer to City IT staff.
$5,833 / month
($69,996 / yr)
Annual escalator (§IV.F) CPI-U (San Francisco–Oakland–Hayward, prior 12 months), capped at 3.0%, applied on each contract anniversary starting Year 2. If CPI-U is <0 the rate holds flat; the cap applies only upward.

Per CPI-U, capped 3.0%
Travel & reimbursables No travel or per-diem for on-site presence at City Hall or the Sanitary District.

Any non-local travel authorized in advance, at cost, no markup. $0 (Bay Area)
Value read — the "more for less" the City is actually being offered. At $70K/yr the City receives, inside one retainer:
a named vCISO (Palmore — retired FBI San Francisco cyber executive who carries CJIS and public-safety fluency directly, former Field CISO at Palo Alto Networks, cybersecurity executive at Google Cloud); a Deputy vCISO who is the designated alternate and operational execution lead (Torruella — Captain, U.S. Navy, Ret., and former SESlevel CIO for Navy Special Access Programs); a qualified and experienced Program Manager, assigned from Apogee's PgM bench, who runs the engagement cadence and holds milestones and deliverables so a two-person City IT team does not have to; and the Apogee RRAG multi-domain risk-intelligence overlay, which supplies the enterprise-risk view (cyber, physical, operational, geopolitical, AI, human capital) that a City with a Police Department, a Sanitary District subsidiary, and a public-facing Council actually needs. Most vCISO proposals at this budget deliver a single practitioner with an offshore analyst pool. Q&A C.4 prohibits the offshore construct; we do not use it.

F.2 Hourly rate table (required by §IV.F; two tiers per Q&A B.1) Team member / role Strategic advisory rate Operational / hands-on rate M. K. Palmore — Named vCISO & Project Executive $395 / hr $345 / hr Ramberto Torruella — Deputy vCISO & Designated Alternate $295 / hr $255 / hr Apogee RRAG — Firm Intelligence & Multi-Domain Risk
Practice
$225 / hr $195 / hr
Program Manager (PgM) — to be assigned from Apogee's
PgM bench
$175 / hr $175 / hr
Q&A B.1 answer: Yes — strategic advisory and hands-on operational hours carry different rates, as shown.

Retainer hours cover the mix modeled in Section D.1; work beyond the retainer, or reclassified retainer hours at the City's option, are billed at the rates above.

A P O G E E G L O B A L R M S , L L C · SDVOSB · CA DVBE · MD CSB/VSBE · Page 15 of 18 67 A P O G E E · G L O B A L R M S EPA vCISO Support Services F.3 Optional tasks — priced separately (§IV.F, Q&A E.5) Optional task Description Fee

1. 24/7 Emergency Advisory Named response (Palmore or Torruella, primary answer within 30 min) for out-of-hours incident-command support. Standby + incident hours at Strategic Advisory rate.
$2,500/mo standby
+ incident hrs

2. OT/ICS/SCADA Assessment Scoped assessment for wastewater and traffic environments (Q&A A.2–A.3 future phase); IEC 62443 anchored; delivery via US-based partner under Apogee prime accountability.
$18,500 fixed
(assessment)

3. Penetration Testing External and/or internal pen-test on authorized basis; US-based partner under Apogee prime accountability.

From $9,500 /
engagement

4. Additional Tabletops Additional technical IR tabletop or executive/Council-level crisis exercise (distinct from technical IR tabletop).
$4,500 / exercise

5. Year 1 IT Strategic Plan
Procurement Security
Security requirements input to concurrent ERP, website/intranet, GIS, records digitization, and eBid procurements — written before the RFP goes out, not after the contract is signed (Q&A B.6).
$12,000 /
procurement flat, or
$195/hr T&M
A P O G E E G L O B A L R M S , L L C · SDVOSB · CA DVBE · MD CSB/VSBE · Page 16 of 18 68 A P O G E E · G L O B A L R M S EPA vCISO Support Services S E C T I O N G · E X C E P T I O N S
§IV.G is a forfeiture clause: "If not identified in RFP but identified later, the City has the option to move to the next best proposer, regardless of where we are in the process." We treat this section accordingly. The exceptions below are stated in this proposal, not reserved for negotiation.

G.1 Intellectual property — deliverables vs. underlying methodology §III of the RFP states that all final deliverables produced under this RFP shall become the property of the City.

Apogee agrees that all client-specific final deliverables produced for the City — the NIST CSF 2.0 baseline assessment report, the risk register, the current-state and target-state diagrams, City-adopted policies and standards, the Incident Response Plan, tabletop after-action reports, and Council-facing briefings — become the property of the City, with a royalty-free perpetual license back to Apogee to retain a copy for its own records.

Exception: Apogee's pre-existing, generally applicable methodologies, frameworks, playbook structures, assessment instruments, policy templates, and know-how — including the Cyber Risk Engagement Playbook V1, the Physical Security Risk Playbook, the RRAG advisory framework, and any templates Apogee brings to the engagement — remain the intellectual property of Apogee. The City receives a royalty-free, perpetual, nonexclusive license to use, copy, and adapt those methodologies and templates in their City-tailored form for the City's own internal use. Apogee retains the right to use its own underlying methodology on other engagements.

This carve-out is standard for practitioner-led advisory work and is necessary to make knowledge transfer (scored under Criterion 4) meaningful without transferring the firm's practice.

G.2 Limitation of liability
Exception: Apogee's aggregate liability under any resulting agreement is capped at the fees actually paid to Apogee in the twelve (12) months preceding the claim. Consequential, incidental, special, exemplary, and punitive damages are excluded on both sides. Claims must be brought within twenty-four (24) months of the event giving rise to them. Standard carve-outs — willful misconduct, gross negligence, breach of confidentiality, indemnification obligations, and IP infringement — apply.

G.3 Indemnification
Exception: Apogee's indemnification is limited to third-party claims arising out of Apogee's negligent acts or omissions or willful misconduct in the performance of the services, subject to the liability cap in G.2. Apogee does not accept uncapped or first-party indemnity, or indemnification for claims arising out of the City's use of deliverables outside Apogee's written scope, or for the City's independent acts or omissions.

G.4 Insurance
No exception to Exhibit C's limits is taken at this time; Apogee carries Professional Liability (E&O), Commercial General Liability, and Cyber Liability at limits meeting or exceeding those expected under Exhibit C, and will produce certificates of insurance and additional-insured / waiver-of-subrogation endorsements to the extent commercially available in the market prior to execution. Any endorsement Apogee's carrier will not issue in the form specified will be identified and negotiated to a commercially reasonable equivalent prior to contract execution.

G.5 Generative AI use — proactive disclosure
This RFP does not require disclosure of generative-AI use in delivery. We disclose it proactively as a matter of professional posture. Apogee uses generative-AI tools selectively in delivery for drafting, summarization, and research assistance, under a firm-level AI Governance Policy modeled on the NIST AI Risk Management Framework. City data is never used to train third-party models. Any AI-produced content used in a City deliverable A P O G E E G L O B A L R M S , L L C · SDVOSB · CA DVBE · MD CSB/VSBE · Page 17 of 18 69 A P O G E E · G L O B A L R M S EPA vCISO Support Services is reviewed and adopted by the responsible Apogee practitioner before delivery; the practitioner, not the tool, holds accountability. A vCISO advising a City on its own AI governance while silently using AI tools on City data would be a position that ages badly; we disclose ours.

G.6 No other exceptions
Apogee takes no exception to the scope of services as written in §III, to the submittal and evaluation processes in §V–§VIII, to the protest procedures in §X, or to the general terms and conditions in §XI. We understand and accept that public-records treatment under §XI applies to information submitted with this proposal, and we have not marked any portion as confidential or proprietary.

A P O G E E G L O B A L R M S , L L C · SDVOSB · CA DVBE · MD CSB/VSBE · Page 18 of 18 70 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – Project A4 and A4.1. City Website, Intranet, and Consulting Assistance Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 71 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – Project A4 and A4.1. City Website, Intranet, and Consulting Assistance Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 72 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – Project A4 and A4.1. City Website, Intranet, and Consulting Assistance Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 73 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – Project A4 and A4.1. City Website, Intranet, and Consulting Assistance Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 74 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – Project A4 and A4.1. City Website, Intranet, and Consulting Assistance Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 75 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – Project A4 and A4.1. City Website, Intranet, and Consulting Assistance Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 76 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – Project A4 and A4.1. City Website, Intranet, and Consulting Assistance Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 77 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – Project A4 and A4.1. City Website, Intranet, and Consulting Assistance Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 78 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: 22nd Century Technologies, Inc Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 79 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: Apogee Global_ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 80 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ArtifexIT Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 81 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: BITDIRECT Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 82 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: CDW_ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 83 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: CISO Operator_ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 84 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer:Concourse Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 85 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: Consultadd Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 86 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 87 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 88 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 89 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 90 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 91 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 92 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 93 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 94 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 95 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 96 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 97 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 98 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 99 # Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 100
# Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 101
# Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 102
# Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 103
# Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 104
# Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

TOTAL WRITTEN PROPOSAL
SCORE 100 TOTAL POINTS EARNED: ____
RFP Scoring Rubric – vCISO Support Services
Proposer: ___________________________ Evaluator: ___________________________ Date: __________________ Evaluator guidance: Score independently using the ranges above. Consider the specific project scope, named team, comparable California/local-government experience, implementation feasibility, cost transparency, and usable City deliverables. Record concise evidence for each score. 105
# Evaluation Criterion Points
Possible Insufficient Basic / Acceptable Strong / Competent Excellent / Comprehensive PointsAwarded Evaluator Notes / Evidence 1 Approach and Work Plan
30 0–5: No coherent or feasible work plan; weak
understanding of City needs; major omissions.
6–15: General approach but limited detail,
sequencing, tailoring, or project controls.
16–25: Clear, logical methodology; realistic
milestones, roles, reporting, and deliverables.
26–30: Thorough, City-tailored, implementation-ready plan with strong risk, dependency, stakeholder, and changemanagement approach. ____
2 Firm and Team Qualifications
30 0–5: Little or no comparable publicsector/municipal experience; proposed staff not qualified.
6–15: Some relevant experience and qualifications,
but limited comparable projects, technical depth,
or capacity.
16–25: Strong municipal/public-sector experience;
qualified named team; credible references and
availability.
26–30: Extensive comparable experience; exceptional
named team, specialized expertise, successful outcomes, strong references, and continuity.
____
3 Cost Proposal and Overall Value
20 0–5: Cost is incomplete, unclear, internally
inconsistent, or significantly unreasonable.
6–10: Pricing is understandable but high, lightly
supported, or misaligned with the proposed effort
and deliverables.
11–15: Reasonable, transparent pricing with labor
rates/hours and a generally appropriate staffing mix.
16–20: Competitive and well-supported not-to-exceed cost; clear assumptions; strong alignment of price, effort,
deliverables, and City value.
____
4 Responsiveness and Deliverables
Quality
20 0–5: Materially non-responsive; required
information or meaningful deliverables are
absent.
6–12: Addresses most requirements but has gaps
in completeness, clarity, documentation, or
deliverable definition.
13–17: Fully responsive; clear, practical, decisionready deliverables, reporting, and implementation support.
18–20: Fully responsive and exceptionally usable; concrete deliverables, knowledge transfer, templates/training, and executive-ready communication.
____

EAST PALO ALTO

CITY COUNCIL

STAFF REPORT
DATE: October 20, 2026
TO: Honorable Mayor and Members of the City Council
VIA: Melvin E. Gaines, City Manager
BY: Jeff Liu, Chief of Police
SUBJECT: Response to the 2025–2026 San Mateo County Civil Grand Jury Report, “Is Our Flock of ALPR Cameras Properly Tended?”
Recommendation
Adopt a resolution:

Executive Summary
On August 3, 2026, the San Mateo County Civil Grand Jury (Grand Jury) released a report examining whether automated license plate reader (ALPR) operators in San Mateo County comply with California law and with their own ALPR policies (Report). The Report requests that the City Council respond to five findings (F3, F5, F6, F7, and F8) and five recommendations (R3, R5, R6, R7, and R8). State law requires the City Council to respond to the presiding judge of the Superior Court within 90 days. The proposed response (Attachment 2) agrees with three findings, disagrees partially with one, and disagrees with one o. It commits the City Attorney’s Office to a written determination on the City’s data sharing with two university police departments, the Police Department to revise its ALPR policy and expand its audits by early 2027, and the City to seek a further amendment to its agreement with Flock Safety. 107
CONSENT ITEM 3.5
Alignment with City Council Strategic Plan
This recommendation is primarily aligned with:

Priority: Public Health, Safety, and Quality of Life
Background
ALPR systems are camera-based systems that capture license plate images and related data and compare them against law enforcement watch lists. (Report, pp. 2–3.) California regulates ALPR systems through Senate Bill 34 (2015), codified at Civil Code sections 1798.90.5 through 1798.90.55. Among other things, those sections require an ALPR operator to adopt and post a usage and privacy policy and limit a public agency’s sharing of ALPR information to other public agencies, except as otherwise permitted by law. (Report, pp. 4–5.) As of March 30, 2026, the Police Department operated 25 ALPR cameras (Report, p. 3), using the Flock Safety platform (Report, pp. 12, 14). As of April 13, 2026, the Department’s Flock account had 308 network-sharing relationships, two of them with private university security entities. (Report, p. 12.) The Grand Jury rated the Department’s ALPR policy as conspicuously posted and current, its audit practices as “Partial; publicly posted,” its data retention as consistent with its policy, its data-sharing process as “Not described,” and its Flock contract as lacking California-specific terms. (Report, p. 14.)
Under Penal Code section 933, subdivision (c), the governing body of a public agency must respond to the presiding judge within 90 days after the Grand Jury submits its final report. Under Penal Code section 933.05, the response to each finding must state agreement or disagreement in whole or in part, with an explanation of any disagreement. The response to each recommendation must state that it has been implemented; that it will be implemented, with a timeframe; that it requires further analysis, with a timeframe not to exceed six months from publication of the Report; or that it will not be implemented, with an explanation. (Report, p. 18.) Analysis
The table below summarizes the findings and recommendations directed to the City and the proposed responses. The full text of each is in the response (Attachment 2).

Item Grand Jury finding or
recommendation (summary)
Proposed City response
F3 Sharing with two private university
security entities without establishing
that they are public agencies or that
the sharing is otherwise permitted by
law.

Agrees.

F5 Audit reports insufficient to Disagrees partially.
108
CONSENT ITEM 3.5
Item Grand Jury finding or
recommendation (summary)
Proposed City response
substantiate compliance with
California law and the ALPR policy.

F6 Flock contract lacks provisions
specific to California ALPR law.

Agrees.

F7 Records did not substantiate that the
policy’s written-request and
agreement process was followed.

Disagrees.

F8 Policy lacks criteria for approving
and terminating in-state sharing.

Agrees.

R3 Obtain a written legal and factual
determination for the university
shares, or terminate them.

Will be implemented by January 31,
2027.

R5 Audits should substantiate
compliance with law and policy.

Will be implemented beginning with
the January 2027 audit.

R6 Add California compliance and
nondisclosure terms to the Flock
contract.

Will be fully implemented by June
30, 2027; partly implemented by the
April 2026 amendment.

R7 Update policy to reflect the actual
sharing-approval process.

Will be implemented by January 31,
2027.

R8 Add written criteria for approval,
denial, review, and termination of instate sharing.

Will be implemented by January 31,
2027.

Finding F3 and Recommendation R3 (university data sharing). The Report found that the Department shares ALPR data with security entities serving Stanford University and the University of the Pacific without establishing that they qualify as public agencies or that the sharing is otherwise permitted by law. (Report, pp. 11–12, 16.) Civil Code section 1798.90.55(b) permits a public agency to share ALPR information only with another public agency, and only as otherwise permitted by law. (Report, p. 5.) The proposed response agrees with the finding. Staff had originally believed sharing was permissible under a theory of deputization by a public agency (i.e., Santa Clara County and City of Stockton). However, under R3, by January 31, 2027, the City Attorney’s Office will prepare a written legal and factual determination for each university recipient, and the Department will terminate any sharing relationship for which no lawful basis exists.

Finding F5 and Recommendation R5 (audits). The proposed response disagrees partially with F5. California law requires an ALPR policy to describe a process for periodic system audits but does not prescribe a format or methodology (Report, p. 13), and the Department conducts and posts the monthly audits its ALPR policy requires (Policy 428.5(d)). The response agrees, 109
CONSENT ITEM 3.5
however, that those audits do not yet document every element of the policy, including approval of sharing relationships. Under R5, beginning with the January 2027 audit, the Department will review a monthly sample of queries internally, confirm regularly that each data-sharing recipient has an approval and agreement on file and qualifies to receive the data, and publish a summary of the results.

Finding F6 and Recommendation R6 (Flock contract). The City’s agreement with Flock contains a general compliance-with-laws clause (Section 11.1) but no provisions specific to California ALPR law. An April 30, 2026 amendment already bars Flock from sharing or distributing the City’s data except as the agreement expressly provides. Section 5.3 of the agreement, however, still allows Flock to disclose data to third parties in some circumstances (e.g., when required by law or to detect, prevent or otherwise address security, privacy, fraud or technical issues). The proposed response commits the City to seek a further amendment, modeled on the Town of Colma’s agreement, that requires Flock to comply with California ALPR law and narrows Section 5.3. Because the agreement renews automatically, the City will either amend it before the next renewal date or give notice of non-renewal, and the revised ALPR policy will require these vendor terms in any future ALPR contract. The City also controls its own data-sharing settings in Flock and can end any sharing relationship without amending or terminating the agreement. (Report, p. 7.)
Findings F7 and F8 and Recommendations R7 and R8 (sharing policy). The proposed response disagrees with F7 because the Department’s ALPR policy does not require written requests or executed agreements, so the Department did not depart from its policy. It agrees with F8 that the policy lacks criteria for approving and terminating in-state sharing relationships.

By January 31, 2027, the Department will revise its ALPR policy to describe the process actually used and to add written criteria for the approval, denial, annual review, and termination of each sharing relationship.

Fiscal Impact
Adoption of the resolution has no direct fiscal impact. The policy and audit changes described in the response will be carried out with existing Police Department staff. Any cost associated with an amendment to the Flock agreement will be identified before the amendment is executed.

Public Notice
The public was provided notice by making the agenda and report available on the City’s website and on a bulletin board located at City Hall: 2415 University Avenue, East Palo Alto.

Government Code § 84308
110
CONSENT ITEM 3.5
Applicability of Levine Act: No.

Analysis of Levine Act Compliance: Not applicable.

Attachments

1. Resolution

2. Response to the San Mateo County Civil Grand Jury Report

3. 2025–2026 San Mateo County Civil Grand Jury Report, “Is Our Flock of ALPR Cameras Properly Tended?” (August 3, 2026)
111
RESOLUTION NO. XX-2026

A RESOLUTION OF THE CITY COUNCIL

OF THE CITY OF EAST PALO ALTO

AUTHORIZING THE MAYOR TO EXECUTE AND THE CITY MANAGER TO SUBMIT A RESPONSE TO THE AUGUST 3, 2026, SAN MATEO COUNTY CIVIL GRAND JURY REPORT TITLED, “IS OUR FLOCK OF ALPR CAMERAS PROPERLY TENDED?”
WHEREAS, on August 3, 2026, the San Mateo County Civil Grand Jury released a report titled “Is Our Flock of ALPR Cameras Properly Tended?” (Report); and WHEREAS, the Report examined whether operators of automated license plate reader (ALPR) systems in San Mateo County comply with California law governing ALPR systems and whether their practices align with their adopted ALPR policies; and WHEREAS, the Report requests that the City Council of the City of East Palo Alto (“City”) respond to Findings F3, F5, F6, F7, and F8 and Recommendations R3, R5, R6, R7, and R8; and
WHEREAS, Penal Code section 933, subdivision (c), requires the governing body of a public agency to comment to the presiding judge of the superior court on the findings and recommendations pertaining to matters under its control within 90 days after the grand jury submits its final report, and Penal Code section 933.05 prescribes the form of that response; and
WHEREAS, the City has prepared a response to the Report.

NOW, THEREFORE, BE IT RESOLVED THAT THE CITY COUNCIL OF THE CITY OF EAST PALO ALTO HEREBY:

1. Finds the foregoing recitals are true and correct, and are incorporated by this reference into this action; and

2.Authorizes the Mayor to execute the City’s response to the San Mateo County Civil Grand Jury Report “Is Our Flock of ALPR Cameras Properly Tended?” and the City Manager to submit the response to the presiding judge of the San Mateo County Superior Court; and

3. Finds that the action being considered does not constitute a “project” within the meaning of the California Environmental Quality Act (CEQA), pursuant to CEQA Guidelines section 15378, subdivision (b)(5), in that it is an organizational or administrative activity of government that will not result in direct or indirect physical changes in the environment.

PASSED AND ADOPTED this 20th day of October 2026, by the following vote:
112
AYES:

NOES:

ABSENT:

ABSTAIN:
______________________
Webster Lincoln, Mayor
ATTEST:
_____________________
James Colin, City Clerk
APPROVED AS TO FORM:
______________________
John D. Lê, City Attorney
113

Page 1 of 4 ends

October 20, 2026
The Honorable Stephanie G. Garratt
Presiding Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center, 8th Floor
Redwood City, CA 94063-1655
Dear Judge Garratt:

Thank you for the opportunity to review and comment on the San Mateo County Civil Grand Jury report titled “Is Our Flock of ALPR Cameras Properly Tended?” released on August 3, 2026 (Report). The City Council of the City of East Palo Alto approved the responses below at its October 20, 2026 meeting.

The City’s Responses to the Findings:

The Report requests that the City respond to Findings F3, F5, F6, F7, and F8, as shown on page 17 of the Report.

F3. The ALPR operator shared ALPR information with private university security entities but did not establish that the receiving entity was a “public agency” as defined in Civil Code section 1798.90.55(b), or that the sharing was otherwise permitted by law within the meaning of Civil Code section 1798.90.55(b).

City of East Palo Alto: The City agrees with this finding. The records the Police Department produced to the Grand Jury did not include a determination that the two university recipients are public agencies or that the sharing is otherwise permitted by law.

F5. The audit reports produced by the ALPR operator were insufficient to substantiate compliance with applicable California law and the operator’s published ALPR policy.

City of East Palo Alto: The City disagrees partially with this finding. The City agrees that the audit reports the Police Department produced to the Grand Jury did not address every element of the Department’s ALPR policy, including the approval and documentation of data-sharing relationships, as reflected in the City’s responses to Findings F7 and F8.

The City disagrees with the finding to the extent it suggests the Department’s audits do not support compliance with California law. As the Grand Jury notes, California law requires an ALPR policy to describe a process for periodic system audits but does not 114

Page 2 of 4 ends

prescribe an audit format or methodology. (Report, p. 13.) Department Policy 428 requires monthly ALPR system audits (Policy 428.5(d)); the Department conducts those audits and posts them online, and the Grand Jury rated them as “Partial; publicly posted.” (Report, p. 14.) The City will expand the scope of those audits as described in its response to Recommendation R5.

F6. The ALPR operator’s Flock Safety contract does not include provisions specifically requiring compliance with applicable California ALPR laws.

City of East Palo Alto: The City agrees with this finding. The City’s agreement with Flock Safety does not contain provisions specific to California ALPR law of the kind found in the Town of Colma’s agreement. Section 11.1 of the agreement requires both parties to “comply with all applicable local, state and federal laws, regulations, policies and ordinances and their associated record retention schedules, including responding to any subpoena request(s).” In addition, an amendment executed on April 30, 2026 prohibits Flock and its personnel and subcontractors from using the City’s data for any purpose other than fulfilling Flock’s obligations to the City, including “sharing or distributing the Customer Data . . . other than as expressly provided in this Agreement.” F7. The operator’s ALPR policy described a process requiring written requests and executed agreements for ALPR data-sharing relationships; however, the records produced did not substantiate that this process was followed or that the required agreements were obtained.

City of East Palo Alto: The City disagrees wholly with this finding. The Department’s ALPR policy (Policy 428) does not describe or require a process of written requests and executed agreements for data-sharing relationships. Because the policy contains no such requirement, the Department did not fail to follow its policy by not obtaining written requests or agreements. The Grand Jury’s own assessment rates the Department’s datasharing process as “Not described.” (Report, p. 14.) The absence of a documented approval process is the subject of Finding F8, with which the City agrees, and the Department will adopt a documented approval process and approval criteria as described in the City’s responses to Recommendations R7 and R8.

F8. The operator’s ALPR policy did not establish criteria governing the approval of instate ALPR data-sharing requests or the termination of existing network-sharing relationships.

City of East Palo Alto: The City agrees with this finding.

The City’s Responses to the Recommendations:

The Report requests that the City respond to Recommendations R3, R5, R6, R7, and R8, as shown on page 17 of the Report.
115

Page 3 of 4 ends

City of East Palo Alto: This recommendation has not yet been implemented, but will be implemented by January 31, 2027. The City Attorney’s Office will prepare a written legal and factual determination for each university recipient addressing whether it is a “public agency” under Civil Code section 1798.90.5(f) or whether the sharing is otherwise permitted by law, and the Police Department will retain that determination. If the determination finds no lawful basis for a sharing relationship, the Department will terminate it.

R5. The audit reports produced by the ALPR operator should substantiate compliance with applicable California law and the operator’s published ALPR policy.

City of East Palo Alto: eThe Police Department will continue its monthly ALPR system audits and will expand its audit program as follows: (1) each monthly audit will review a sample of queries to confirm that each recorded a valid case or incident number or justification, with case-specific details kept internal so that ongoing investigations are not disclosed; (2) at least annually, the Department will confirm that each recipient on its datasharing list has an approval and agreement on file and is a California public agency, or that the sharing is otherwise permitted by law; and (3) at least annually, the Department will confirm that ALPR data are deleted in accordance with the retention period stated in its ALPR policy. Publicly posted audit reports will summarize the results.

R6. Upon contract renewal, the ALPR operator should incorporate contractual language requiring vendor compliance with applicable California law and prohibiting vendors from disclosing ALPR data to unauthorized third parties. Operators should consider provisions similar to those contained in the Town of Colma contract with Flock.

City of East Palo Alto: This recommendation has not yet been fully implemented, but will be implemented by June 30, 2027. On April 30, 2026, the City and Flock Safety executed an amendment that prohibits Flock and its personnel and subcontractors from sharing or distributing the City’s ALPR data except as the agreement expressly provides. The City will seek a further amendment, using the Town of Colma’s agreement as a model, that (1) requires Flock to comply with California law governing ALPR data, including Civil Code sections 1798.90.5 through 1798.90.55, and (2) limits Flock’s right under Section 5.3 of the agreement to disclose the City’s data to third parties to disclosures required by law or legal process.

The revised ALPR policy described in the City’s responses to Recommendations R7 and R8 will require that any ALPR contract the Department enters into, renews, amends, or extends include terms requiring the vendor to comply with California ALPR law and prohibiting disclosure of ALPR data to unauthorized third parties. Because the City’s 116

Page 4 of 4 ends

agreement with Flock Safety renews automatically, the City will, before the next renewal date, either amend the agreement to include those terms or give notice of non-renewal and include those terms in any replacement agreement.

Independent of any contract amendment, the City retains control over its ALPR data.

Under Section 4.1 of the City’s agreement with Flock Safety, as amended April 30, 2026, all right, title, and interest in the City’s data belong to and are retained solely by the City.

As the Grand Jury notes, “each customer agency retains control over its own data and is responsible for determining who may access it and under what conditions.” (Report, p.

7.) The Police Department can therefore end any data-sharing relationship on its own, without amending or terminating the agreement.

R7. The ALPR operator should update its ALPR policy to accurately reflect the process used to approve ALPR data-sharing relationships.

City of East Palo Alto: This recommendation has not yet been implemented, but will be implemented by January 31, 2027. The Police Department is updating its data-sharing procedures to align with current standards, best practices, and legal requirements, and will revise its ALPR policy to describe the process the Department uses to approve datasharing relationships, which the current policy does not address.

R8. The ALPR operator should include in their ALPR policies written criteria governing the approval, denial, periodic review, and termination of in-state ALPR network-sharing relationships.

City of East Palo Alto: This recommendation has not yet been implemented, but will be implemented by January 31, 2027. The revised ALPR policy will include written criteria governing the approval, denial, periodic review, and termination of in-state data-sharing relationships. At a minimum, the criteria will require that each recipient be a California public agency or that the sharing be otherwise permitted by law; that each request and its approval be documented; that every active sharing relationship be reviewed at least annually; and that any relationship that no longer meets the criteria be terminated. The revised policy will also require that any ALPR contract the Department enters into, renews, amends, or extends include the vendor terms described in the City’s response to Recommendation R6.

On behalf of the City Council of the City of East Palo Alto, thank you for the opportunity to review and comment on the Report.

Sincerely,
Webster Lincoln
Mayor
City of East Palo Alto
117
2025 – 2026 San Mateo County Civil Grand Jury Page 1
Is Our Flock of ALPR Cameras
Properly Tended?
San Mateo County Civil Grand Jury
2025-2026
Release Date: August 3, 2026
118
2025 – 2026 San Mateo County Civil Grand Jury Page 2
ISSUE | SUMMARY | BACKGROUND | METHODOLOGY | DISCUSSION | FINDINGS RECOMMENDATIONS | REQUEST FOR RESPONSES | RESPONSE REQUIREMENTS | BIBLIOGRAPHY | APPENDIX
ISSUE
Over the past year, Automated License Plate Readers (ALPRs) have come under increasing public scrutiny. This report examines whether ALPR operators in San Mateo County (SMC) are in full compliance with applicable California law and whether their practices align with their adopted ALPR policies.

SUMMARY
Automated License Plate Readers have become widely deployed in SMC, with more than 500 cameras now in operation by law enforcement agencies (LEAs) within the County. The rapid increase in ALPR deployment has been accompanied by California legislation governing ALPR use, and also by increased media coverage of alleged violations. Over the past year, SMC LEAs have made notable operational improvements, particularly with respect to out-of-state data sharing. Most changes were driven by stronger default compliance made by Flock Safety (Flock), now the dominant ALPR platform among the SMC operators reviewed. But SMC ALPR operators continue to have many of the same operational deficiencies identified by a 2019 California State Audit that investigated four operators elsewhere in California. Many of the required policy documents are deficient or need significant revision to accurately reflect current operations, and audit materials produced were inconsistent in scope and rigor. Although the materials reviewed did not identify current sharing by SMC operators with out-of-state entities, most operators did not document criteria, process, or controls governing in-state sharing in a manner sufficient to demonstrate compliance with law. This report presents findings and recommendations to promote transparent operation of ALPR systems consistent with public safety, privacy, and applicable law.

BACKGROUND
Automated License Plate Readers
Automated License Plate Readers (ALPRs) are camera-based systems that automatically capture and analyze license plates on passing vehicles. Cameras are typically located at fixed roadside locations along high-traffic corridors, major intersections, city entry/exit routes, areas with high crime rates, and transportation infrastructure (bridges, tunnels, freeways). These systems combine high-speed cameras, infrared illumination, and optical character recognition software to convert license plate images into searchable digital data. Law enforcement agencies use ALPR systems to locate stolen vehicles, identify vehicles connected to criminal investigations, generate investigative leads, and assist in locating missing persons. When connected through regional or national networks, ALPR systems allow investigators to reconstruct vehicle movements across jurisdictions.

Digital imaging, optical character recognition, and large-scale data storage allow ALPR systems to process large numbers of license plates quickly and automatically. Modern systems can read thousands of plates per hour and store the results in databases that investigators can search later.

When a motor vehicle is detected by an ALPR as it passes through the camera's field of view, a digital record is generated recording the vehicle's license plate number, an image of the plate, a 119
2025 – 2026 San Mateo County Civil Grand Jury Page 3
contextual image of the vehicle (make, model, color, etc.), the date and time of the scan, the location of the camera, and the identification number of the camera device. Once the image is captured, the digital record is immediately transmitted to a cloud-based database that compares the scanned license plate and other vehicle data against law enforcement watch lists, often referred to as “hot lists,” that may include information on vehicles that have been reported stolen, those associated with criminal investigations, outstanding warrants, or connected to missing persons or Amber Alerts.

When a match occurs, the system can send an alert to officers or dispatch centers in real time.

ALPR cameras are usually deployed as part of a network such that when the same vehicle is detected by multiple cameras, investigators can analyze those detections to determine travel routes and timelines. By default, only data captured by cameras within that local jurisdiction are available.

LEAs typically elect to contribute their data to regional databases or multi-jurisdictional systems that allow sharing across multiple cities, counties, or states. The ability to share data among multiple jurisdictions is more effective in assisting law enforcement in their investigations as suspects rarely limit their travel within a single jurisdiction.

As of March 30, 2026, more than 582 ALPR cameras were deployed across SMC. These cameras are operated by municipal police departments within their respective jurisdictions and by the San Mateo County Sheriff’s Office (SMCSO) in unincorporated areas and in jurisdictions where the Sheriff provides contracted law enforcement services. The only police department in SMC with no ALPR cameras is Broadmoor.

Operator Cameras as of
3/30/2026
Comments
Atherton 53 Earliest in SMC, 2020.

Belmont 10
Brisbane 16
Burlingame 18
Colma 11
Daly City 44
East Palo Alto 25
Foster City 20
Half Moon Bay 14 Separate Flock contract, operated by
SMCSO.

Hillsborough 22
Menlo Park 32
Pacifica 10
Redwood City 25
San Bruno 54
San Mateo 66
120
2025 – 2026 San Mateo County Civil Grand Jury Page 4
Operator Cameras as of
3/30/2026
Comments
San Mateo County Sheriff's
Office
109 Includes unincorporated SMC (except
Broadmoor), Portola Valley, San Carlos
and Millbrae.

South San Francisco 37
Woodside 26 Separate Flock contract, operated by
SMCSO
Key Issue
ALPRs and the sharing of image data across jurisdictional lines have created controversy with respect to issues of privacy. While not the focus of this report, some civil liberties groups, including the American Civil Liberties Union (ACLU), argue that vehicle tracking could affect freedom of association if it reveals attendance at protests, political meetings, or religious gatherings (First Amendment).

Others, including the Electronic Frontier Foundation (EFF) question whether large-scale tracking of vehicle locations over time could constitute a search under constitutional law (Fourth Amendment).

While the focus of this report is not to investigate the constitutional issues surrounding ALPRs, data sharing among law enforcement agencies has become a significant public concern and has, in some communities, resulted in the suspension or termination of ALPR programs. Although no such actions have occurred in SMC, several Bay Area jurisdictions—including Mountain View, Los Altos Hills, Santa Clara County, and Santa Cruz—have discontinued their use of ALPR systems.

This report evaluates, based on records obtained during the investigation, whether SMC LEAs satisfy California law governing the use of ALPR systems and the sharing of ALPR data. Civil Code section 1798.90.51 requires APLR operators to implement and publicly post a usage and privacy policy. This report also evaluates whether the policies produced accurately describe actual operations.

Legislative Framework
California has enacted legislation governing the use of ALPR systems, with a focus on transparency, accountability, and limitations on data sharing. The primary statutory framework was enacted by Senate Bill 34 (SB 34) (Stats. 2015, Ch. 532), codified at Civil Code sections 1798.90.5 through 1798.90.55.

Effective January 1, 2016, SB 34 imposes requirements governing the collection, storage, access, and sharing of ALPR data. SB 34 applies to both operators of ALPR systems and entities that access ALPR data. Among other requirements, ALPR operators must adopt written usage policies, maintain detailed audit logs, implement reasonable security measures, and provide an opportunity for public comment prior to implementing an ALPR program. The California Department of Justice has issued guidance on SB 34 in Information Bulletin No. 2023-DLE-06.

In addition to SB 34, Senate Bill 54 (SB 54) (Stats. 2017, Ch. 495), known as the California Values Act (Gov. Code § 7284 et seq.) restricts the use of state and local law enforcement resources for 121
2025 – 2026 San Mateo County Civil Grand Jury Page 5
federal immigration enforcement purposes. SB 54 limits the sharing of certain information with federal immigration authorities and reinforces the principle that local law enforcement data systems, including ALPR databases, must not be used in a manner inconsistent with California law. The California Department of Justice has issued guidance clarifying these restrictions in Information Bulletin No. 2025-DLE-08.

In 2025, the California Legislature passed Senate Bill 274, which would have imposed additional restrictions and oversight. The bill proposed limiting retention periods for non-matching records and expanding state-level review of ALPR use. However, SB 274 was vetoed by Governor Gavin Newsom, who concluded that SB 274 did “not strike the delicate balance between protecting individual privacy and ensuring public safety,... particularly with respect to cold cases.” Collectively, these statutes establish a legal framework that emphasizes transparency, accountability, and restricted data sharing, while placing primary responsibility for compliance on individual law enforcement agencies.

Data Sharing and Side-Sharing
The effectiveness of ALPR systems depends in large part on the ability of LEAs to share data across jurisdictions. Within most ALPR platforms, each agency organizes its cameras into one or more networks that govern both system configuration and data sharing. Agencies may control which other agencies can discover their networks and whether access requests are automatically approved or require explicit authorization. Once access is granted, authorized users from another agency may query shared ALPR data without further approval.

While this model enhances investigative capability—particularly in cases involving vehicles that travel across jurisdictional boundaries—it also places responsibility on each agency to ensure that data sharing practices comply with California law. Civil Code section 1798.90.55(b) provides that a public agency shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law. The SMCCGJ found that data sharing practices vary widely among agencies, with some limiting access to nearby jurisdictions and others permitting broad sharing within the state. The decentralized nature of these sharing controls creates a structural risk:
compliance with California law depends not on system-enforced restrictions, but on how individual agencies configure and manage their networks. As a result, even where written policies are compliant, system configurations may permit data sharing practices that are inconsistent with statutory requirements. In general, as the size of a network increases and more law enforcement agencies are granted access, the risk of misuse correspondingly increases.

A related concern is the practice commonly referred to as “side-sharing.” For purposes of this report, “side-sharing” refers to the practice in which a California ALPR operator conducts a network query on behalf of an organization that is not authorized to access the data directly—typically an out-ofstate or federal agency—and then provides the results outside of the ALPR system. In such cases, audit records reflect that the query was initiated and used by a California agency, when in fact the request originated from, and the results were delivered to, an external entity.

Because the ALPR audit logs reviewed by the SMCCGJ record only the identity of the querying agency and do not capture the ultimate recipient of the data, side-sharing is inherently difficult to detect. Activity that appears compliant on its face may, in fact, circumvent the restrictions imposed by California law, including limitations on sharing ALPR data with entities outside the state. 122
2025 – 2026 San Mateo County Civil Grand Jury Page 6
Side-sharing may involve attempts to access ALPR data outside of established sharing arrangements, including by law enforcement personnel who do not have authorized access. For example, a federal immigration agency may seek to obtain ALPR data from a California jurisdiction in a manner inconsistent with the restrictions imposed by SB 54. Such access could be facilitated by directly contacting personnel within a California LEA and requesting that they conduct an ALPR query on behalf of the external agency.

This issue has been the subject of media reporting and public concern, although verification in specific instances is challenging due to the limitations of available audit data. Media coverage of public statements by certain law enforcement officials has further highlighted the potential risk.

The SMCCGJ found that existing controls to prevent or detect improper data sharing, including sidesharing, are limited. While the ALPR platform provides audit logs, role-based access controls, and, more recently, anomaly detection tools, these features rely on agency-level oversight and do not provide a comprehensive or system-enforced safeguard. There is no centralized mechanism to prevent a user from conducting a query on behalf of an unauthorized entity or to ensure that query results are used solely for authorized purposes.

As a result, compliance with California law in this area depends largely on the policies, training, and oversight practices of individual agencies. In the absence of stronger technical controls or more robust audit capabilities, the risk of unauthorized data access—whether through misconfiguration or side-sharing—remains a significant concern.

Flock Safety
Flock Safety is the largest provider of ALPR systems in the United States and the primary provider of ALPR systems used by LEAs in SMC. The company provides both the physical camera infrastructure and a cloud-based software platform that enables agencies to collect, store, search, and share vehicle detection data. This represents a significant market shift from Vigilant Solutions, who was the most common provider in 2019.

Note that while nearly all ALPR cameras in SMC are provided by Flock, Pacifica also operates 4 Axon mobile cameras that were not investigated by SMCCGJ. Also, ALPR data collected by Flock cameras may also be forwarded to intelligence fusion systems that include other types of surveillance data. Some SMC LEAs use C3.ai, and SMC has recently funded a pilot with Peregrine Systems. These systems are capable of sharing data among agencies and across state boundaries but were not investigated by SMCCGJ and have not received wide media attention.

Flock cameras are typically installed at fixed locations such as major intersections, highways, and entry or exit points to a community. These cameras do not continuously track vehicles; rather, they capture individual “snapshots” or detections as vehicles pass through a camera’s field of view. Each detection includes a license plate number, vehicle characteristics (such as make, color, and body type), and metadata including the date, time, and location of the observation.

This information is transmitted to Flock’s cloud-based platform, where it is indexed and made searchable. Authorized users access the system through a web-based interface, allowing them to query historical detections or monitor real-time alerts. For example, agencies may create “hotlists” of vehicles of interest—such as stolen vehicles or those associated with criminal investigations— which trigger notifications when detected by any connected camera. 123
2025 – 2026 San Mateo County Civil Grand Jury Page 7
A key feature of the system is its ability to aggregate data across multiple cameras and jurisdictions.

While a single camera provides only a point-in-time observation, multiple detections across different locations can allow investigators to infer travel patterns or identify a vehicle’s movement over time.

All user activity—including searches, alerts, and administrative actions—is recorded in audit logs.

These logs are intended to support oversight and accountability by providing a record of how the system is used. Although Flock hosts the data and provides the technical infrastructure, each customer agency retains control over its own data and is responsible for determining who may access it and under what conditions.

Data Sharing Framework
A defining feature of the Flock platform is its ability to facilitate data sharing among law enforcement agencies. This capability is implemented through a system of configurable “Networks,” which function as both administrative groupings and sharing mechanisms. Each agency organizes its cameras into one or more networks and determines whether those networks are visible to other agencies within the platform. When a network is made visible, other agencies may discover it— typically through a map-based interface—and request access.

These access requests are routed to a designated administrator within the owning agency. Depending on how the system is configured, the administrator may review and approve each request individually, or the system may automatically approve requests based on predefined criteria. Once access is granted, users from the approved agency can query the shared data directly, without needing to request permission for each individual search.

This model allows investigators to search for vehicles across jurisdictional boundaries, which can be particularly useful in cases involving regional travel or coordinated criminal activity. At the same time, it introduces complexity, as each agency must determine which other agencies should be granted access and under what conditions.

Agencies can limit sharing in several ways, including restricting access to specific agencies, geographic regions, or operational groupings. Importantly, sharing permissions are not transitive: if Agency A shares data with Agency B, and Agency B shares data with Agency C, Agency C does not automatically gain access to Agency A’s data.

Private entities, such as commercial businesses or homeowners’ associations, participate in the system differently. Their cameras are not visible within the shared network interface, and they do not independently request access to law enforcement data. Instead, data from private cameras is typically shared directly with local LEAs through arrangements managed with Flock outside the standard user interface.

While this network-based architecture enables collaboration and enhances investigative capabilities, it also places primary responsibility on each agency to manage its sharing relationships in a manner consistent with applicable laws and local policy.

Concerns
Beginning in 2025, a number of media reports and public records analyses brought increased attention to the use of ALPR systems, particularly with respect to how data was being shared among law enforcement agencies. These reports identified instances in which California agencies had configured their systems in a manner that allowed access to ALPR data by out-of-state entities, a practice inconsistent with California law.
124
2025 – 2026 San Mateo County Civil Grand Jury Page 8
Within SMC, the Menlo Park Police Department acknowledged prior instances in which ALPR data had been shared across state lines. Similar issues were identified in other jurisdictions throughout California, suggesting that these were not isolated occurrences but rather reflected broader challenges in how the systems were configured and used.

In addition to concerns regarding system configuration, analysis of audit data highlighted issues related to how queries were conducted and documented. In some cases, users entered generalized descriptions such as “Investigation,”1 without specifying a particular law enforcement purpose.

While such entries are not necessarily improper, they limit the ability of agencies, auditors, and the public to determine whether queries were conducted for authorized purposes.

Taken together, these findings raised questions not only about compliance with legal requirements, but also about the adequacy of system controls and oversight mechanisms. They also underscored the degree to which proper use of the system depends on both technical configuration and user behavior.

System Controls and Vendor Response
In response to these concerns, Flock implemented a series of changes beginning in 2025, aimed at reducing the likelihood of improper data sharing and improving the ability of agencies to monitor system use. These changes reflect a shift from a system that relied heavily on user discretion to one that incorporates more structured controls and constraints.

One of the most significant changes involved restrictions on data sharing across state lines. Prior to 2025, agencies had broad discretion to configure sharing relationships, including the ability to enable “Nationwide” access or establish direct connections with out-of-state agencies. Although such configurations were inconsistent with California law, they were technically permitted within the system.

To address this issue, Flock implemented a phased set of changes. Nationwide sharing was first disabled by default in February 2025 and then permanently removed in March 2025, eliminating the ability for California agencies to broadly expose their data to agencies outside the state. In June 2025, Flock further restricted sharing by disabling the ability to create new out-of-state sharing relationships.

Importantly, these changes did not automatically terminate existing shared relationships. Instead, Flock undertook a process of customer outreach and education, encouraging agencies to review and modify their configurations. As a result, most agencies voluntarily discontinued such arrangements, although some pre-existing relationships remain subject to ongoing legal proceedings. As of this writing, the City of El Cajon is the only California agency with ALPR network sharing relationships extending outside the state. In October 2025, the California Attorney General filed an action against El Cajon alleging non-compliance with SB 34; the case is currently in litigation.

In addition to changes in sharing controls, Flock introduced enhancements aimed at improving how system use is documented and monitored. Historically, users were able to enter free-form text to 1 Analysis done by the SMCCGJ on all 2025 network queries in California on one SMC LEA’s data found that 13.1% of queries entered only “Investigation” as the “Reason” for performing the query. 125
2025 – 2026 San Mateo County Civil Grand Jury Page 9
describe the purpose of a query in a “Reason” field. In practice, this resulted in inconsistent and often vague entries2, limiting the effectiveness of audit review.

In December 2025, Flock augmented this approach by requiring users to select an “Offense Type” from a standardized list3based on National Incident-Based Reporting System (NIBRS) codes.

Within California, categories inconsistent with SB 54 are disabled. This change provides a more consistent framework for documenting queries and enables more meaningful analysis of system use.

Many agencies have supplemented this requirement by mandating the entry of a case number, linking each query to a specific investigation. This case number is useful for auditing queries within a department but is ineffective for analysis of network queries as LEAs in California do not share a common case management system.

Flock also expanded its audit and monitoring capabilities. Audit logs continue to record all user activity, but additional tools have been introduced to support review. Activity logs track changes to system configuration, including modifications to sharing settings, while the Transparency Portal allows agencies to publish usage statistics and audit summaries.

In April 2026, Flock introduced “Audit Assistance,” an automated tool that analyzes system activity and identifies patterns that deviate from an agency’s typical usage. These alerts are intended to assist administrators in identifying potential misuse, including unusual query patterns or activity that may warrant further review (side-sharing).

Additional controls have been implemented to restrict system access and reinforce appropriate use.

These include limitations on “guest” users outside the agency’s domain and role-based access controls that allow agencies to tailor system permissions based on user responsibilities. Flock’s terms of service also prohibit use of the system on behalf of unauthorized individuals or agencies.

While these changes represent meaningful improvements, they are primarily designed to support and guide user behavior rather than to enforce compliance directly. As such, their effectiveness depends on how agencies configure and use the system.

Training and Compliance Support
Flock provides training on system operation, legal use, and compliance requirements as part of its onboarding process. Agencies may supplement this training with local policies, procedures, and internal controls tailored to their operational environment. While these resources support compliance, they do not substitute for agency responsibility to ensure that system use is consistent with applicable laws and policies.

Remaining Limitations
Notwithstanding these enhancements, important limitations remain in the system’s ability to prevent or detect improper use.

First, while audit logs provide a record of which agency conducted a query and when it occurred, they do not capture how the resulting information is ultimately used or shared. This means that even 2 The search reason “warrant” could refer to a warrant issued by a California judge for an authorized law enforcement purpose, or alternatively to an administrative warrant issued by a federal agency such as ICE. Numeric strings typically correspond to sections of California penal code, but many LEA’s listed a crime category such as “theft” or “burglary”.

The SMCCGJ found no accepted usage of the “Reason” field across or even within LEAs. 3 A list of these offense codes is provided in Appendix A. 126
2025 – 2026 San Mateo County Civil Grand Jury Page 10
where a query appears appropriate on its face, there is no direct way to determine whether the results were subsequently provided to an unauthorized party.

Second, the system does not technically prevent a user from conducting a query on behalf of another individual or agency (side-sharing). Although such conduct may violate policy or law, it is not inherently detectable through system controls alone. As a result, certain forms of misuse— particularly those involving indirect access—are difficult to identify through audit data.

Finally, the effectiveness of audit and monitoring tools depend on active review by agency personnel. Identifying potential issues requires not only access to audit data but also the time, expertise, and judgment to interpret that data. This introduces variability in how different agencies monitor system use and respond to potential concerns.

These limitations illustrate that, while system-level controls can reduce risk, they cannot fully eliminate it. Effective oversight requires a combination of technical controls, clear policies, and consistent enforcement.

Conclusion
Flock has implemented a number of substantive changes to its platform in response to concerns regarding data sharing and legal compliance. These changes have improved transparency, standardized key aspects of system use, and provided agencies with additional tools to monitor activity.

At the same time, the system continues to rely heavily on agency-level decisions regarding configuration, access, and oversight. Certain risks—particularly those associated with indirect or unauthorized use—cannot be fully mitigated through system design alone.

As a result, responsibility for ensuring compliance with Civil Code sections 1798.90.5 through 1798.90.55 ultimately rests with each individual law enforcement agency. The effectiveness of the system, therefore, depends not only on the capabilities of the technology but also on how it is implemented and governed at the local level.

METHODOLOGY
To determine whether ALPR operators in SMC comply with applicable California law and whether their practices align with their adopted ALPR policies, the SMCCGJ began by reviewing the content available on the public websites of each LEA in the County. Most LEA websites include information regarding ALPR usage and transparency, often with a link to the agency’s Flock Transparency Portal, which is maintained by Flock on behalf of its customers.

The SMCCGJ issued document requests to all ALPR operators in SMC, seeking ALPR policies, recent audit reports, current Flock contracts, and any supporting documentation demonstrating compliance with California law and agency policy. Findings based on nonproduction reflect the absence of responsive records produced to the SMCCGJ, not a conclusive determination that no responsive record exists.

The SMCCGJ was able to identify an ALPR policy document for every SMC ALPR operator, which guided the examination of compliance with that policy. For some operators we were provided an organization audit report, which lists all ALPR queries initiated within that LEA. The organization audit was visually reviewed in a spreadsheet, which is feasible for what is at most a few hundred rows. Some operators provided a network audit report, which lists all ALPR queries initiated by 127
2025 – 2026 San Mateo County Civil Grand Jury Page 11
other Flock customers on that operator’s data. As the network audit report can be quite large (upwards of 25,000/month), analysis of this data was carried out by first loading it into a database.4 The SMCCGJ examined network sharing reports from the operators that provided them. This information is also publicly available through Flock Safety’s Transparency Portal. The network sharing reports identify the agencies and entities with which each operator shares ALPR data.

The SMCCGJ conducted interviews with several LEAs in SMC, with representatives of Flock, and with the Northern California Regional Intelligence Center (NCRIC).The SMCCGJ collected media reports related to ALPR implementations in SMC, in the state of California, and nationwide.

DISCUSSION
Public Interest
Issues related to the use of ALPR systems have received significant public attention in both SMC and throughout California. Several communities within the County have debated canceling their ALPR contracts or exploring alternative provider. As of this date, all have decided to continue operations with Flock. An article on ALPR usage published by Palo Alto Online on December 29, 2025, was the publication’s most-downloaded article of the year.

For the general public, it can be difficult to determine the root cause of security breaches reported in the media. Coverage has variously attributed these incidents to product design limitations, accidental or intentional misconfiguration, and inadequate operator training. As discussed earlier in this report, ALPR system functionality has evolved in response to public concerns, with enhancements intended to facilitate compliance with applicable laws.

Sharing Within San Mateo County
This investigation found that the extent of data sharing among SMC ALPR operators varies significantly, with the number of network sharing relationships ranging from three in Woodside to 335 in San Bruno. During the course of this investigation, one SMC operator reduced the scope of their network sharing after evaluating the public safety value of broader data access against local privacy considerations. Some LEAs felt that broad access was valuable in addressing the pattern of crimes committed in their community. Others felt that sharing too broadly would not solve more crimes and could risk losing the support of their local community.

As of December 2025, no SMC operators were found to be sharing ALPR data with entities outside California. The investigation did identify instances in which SMC operators shared ALPR data with private organizations, specifically security agencies serving Stanford University and University of the Pacific. Under Civil Code section 1798.90.55(b), a public agency may share ALPR information only with another “public agency” and only as otherwise permitted by law. The materials produced did not establish that the private university security recipients meet the definition of a “public agency” or that an applicable statutory exception authorizes the sharing. It remains the responsibility of each LEA to determine whether such entities qualify as public agencies under applicable law. If deemed public agencies, these entities would be subject to the same statutory and policy requirements governing ALPR use.
4 The network audit report was delivered in comma-separated value format, was then bulk-loaded into a MySQL database and then queried using the Structured Query Language. 128
2025 – 2026 San Mateo County Civil Grand Jury Page 12
The table below summarizes these findings.

Operator Network
Shares
2/26/2026
Network
Shares
4/13/2026
Private University
Security Shares
4/13/2026
Apparent Sharing
Guideline
Atherton 315 317 2
Belmont 157 145 2 Adjacent Counties
Brisbane 93 92 1 50-mile radius
Burlingame Not available 357 2
Colma 321 326 2
Daly City Not available Not available not available Flock portal is not enabled.

East Palo Alto 303 308 2
Foster City Not available Not available Not available Flock portal excluded network sharing report.

Half Moon Bay Not available 290 0
Hillsborough 303 318 2
Menlo Park 247 242 1
Pacifica 276 283 2
Redwood City 102 100 1 Bay Area Counties
San Bruno 331 335 2
San Mateo 283 280 0
San Mateo County
Sheriff's Office
299 300 2 Reduced in February to
adjacent Counties.

South San Francisco 15 15 0 San Mateo County
Woodside 3 3 0 Adjacent towns
Public Commentary
Under Civil Code section 1798.90.55(a), a public agency that operates an ALPR system must provide the opportunity for public comment. The SMCCGJ did not identify any instances in which ALPR cameras were deployed without the required public notice and discussion.

ALPR Policies
California law requires each ALPR operator to adopt a written ALPR policy and to post that policy in a conspicuous manner (Civ. Code, §§ 1798.90.53(a)–(b); 1798.90.51 (a)–(b)). The California Department of Justice provides a model ALPR policy template, which agencies may adopt or 129
2025 – 2026 San Mateo County Civil Grand Jury Page 13
modify. Some departments also utilize policy templates developed by Lexipol, a provider of standardized law enforcement policy materials.

The following section evaluates each SMC law enforcement agency’s ALPR policy, including whether it is conspicuously posted, and assesses whether the agency’s actual operations are consistent with its stated policy.

Summary Matrix of ALPR Policy and Operational Findings
Policy Posting and Currency. Most LEAs and police departments provided an ALPR policy in response to the SMCCGJ document request. The SMCGJ reviewed each policy for alignment with the policy templates and guidance provided by the State of California and Lexipol. The SMCCGJ also reviewed each department’s public website to determine whether the policy was conspicuously posted in accordance with California DOJ guidance 2023-DLE-06, and whether the publicly posted version matched the version provided in response to the document request.

Audit Practices. The SMCCGJ requested copies of recent audit reports from each LEA. Where an audit frequency was specified in an agency’s ALPR Policy, the SMCCGJ reviewed the materials provided to determine whether audits appeared to have been conducted at the stated intervals. The SMCCGJ also examined the contents and scope of each audit report.

For purposes of this investigation, a “strong” audit is one that substantiates compliance with both applicable California law and each material element of the LEA’s stated ALPR Policy. California law requires a policy to describe monitoring and “a process for periodic system audits,” but does not prescribe a uniform audit report format or methodology. The labels “strong,” “partial,” and “weak” are assessment terms used in this report and are not statutory classifications.

In the absence of meaningful audit controls, the public has limited assurance that an agency’s stated policies are being consistently implemented in practice. By contrast, a “weak” audit examines only selected legal or policy elements and does not comprehensively evaluate operational compliance.

Finally, the SMCCGJ reviewed whether audit reports were made available to the public or presented to the relevant city, town, or county governing body.

Data Retention. Civil Code section 1798.90.51(b)(2)(D) requires each ALPR policy to specify a data retention period after which ALPR data will be deleted unless it is associated with an active investigation or otherwise retained pursuant to law. The SMCCGJ compared the retention period stated in each agency’s ALPR policy with the retention period displayed on Flock’s Transparency Portal and, where available, the retention provisions contained in the agency’s Flock contract.

Matching retention periods were classified as “consistent,” while differing retention periods were classified as “inconsistent.” We did not examine in detail the process by which Flock deletes data after the stated retention period, as this topic has been addressed by third-party audits.

Data Sharing Process. Each policy must describe criteria and a process for sharing ALPR data. We examined this statement to ensure that it prohibits the sale of ALPR data, out-of-state sharing, sharing to private parties, and usage for other than valid law enforcement purposes. We examined any written guidelines and processes for receiving and approving requests for sharing data, and for any documentary evidence supporting the implementation of that process. Most policies included the sharing process description and documented from templates, but our interviews and document requests did not find an LEA who followed the process described in this “Template.” Several LEAs described the sharing process provided by the Flock platform, which is what we heard described 130
2025 – 2026 San Mateo County Civil Grand Jury Page 14
during interviews as the adopted process. The LEAs with outdated policies described an outdated sharing process mediated by NCRIC. No LEA’s policy described guidelines for ALPR data sharing within California, though several outlined coherent criteria for what sharing requests to approve.

Contract Terms. The SMCCGJ reviewed the 14 Flock contracts provided in response to its document requests. One contract included an addendum with California compliance provisions (“CA terms”) requiring Flock to adhere to California law governing the protection, access, and disclosure of ALPR data maintained on behalf of California LEA customers, consistent with recommendations previously issued by the California State Auditor.

The absence of express contractual compliance terms does not itself establish a violation of California law, which applies regardless of contract language. In this report, the presence or absence of such terms is evaluated as an additional contractual compliance control.

The table below summarizes the SMCGJ’s assessment of ALPR policy compliance and operational alignment among LEAs in SMC.

Agency Policy Posting /
Currency
Audit Practices Data
Retention
Data
Sharing
Process
Contract
Terms
Atherton Not conspicuous;
current, but with
multiple versions
Strong;
published in
Council
Minutes
Inconsistent Template No CA
terms
Belmont Conspicuous;
current
Strong; not
published
Consistent Flock No CA
terms
Brisbane Not conspicuous;
current
Audit reports
not provided
Consistent Template No CA
terms
Burlingame Not conspicuous;
current
Audit reports
not provided
Consistent Template Contract
not
provided
Colma Not conspicuous;
current
Strong; not
published
Inconsistent Template CA terms
included in
addendum
Daly City Conspicuous,
outdated (NCRIC
references)
Strong, regular
audit; not
published
Inconsistent Outdated No CA
terms
East Palo Alto Conspicuous;
current
Partial; publicly
posted
Consistent Not
described
No CA
terms
131
2025 – 2026 San Mateo County Civil Grand Jury Page 15
Agency Policy Posting /
Currency
Audit Practices Data
Retention
Data
Sharing
Process
Contract
Terms
Foster City Conspicuous;
current, but broken
link to policy
Audit reports
not provided.

Inconsistent Template No CA
terms
Hillsborough Not conspicuous;
Outdated (NCRIC
references)
Audit reports
not provided.

Consistent Outdated No CA
terms
Menlo Park Not conspicuous;
current
Weak;
published in
City Council
minutes.

Consistent Template No CA
terms
Pacifica Conspicuous;
current
Brief, but
strong; not
published
Consistent Flock Contract
not
provided
Redwood City Conspicuous,
outdated (NCRIC
references)
Strong; not
published
Inconsistent Outdated No CA
terms
San Bruno Conspicuous;
current
Partial; not
published
Consistent Flock No CA
terms
San Mateo Conspicuous;
current
Weak; not
published
Consistent Template No CA
terms
SMC Sheriff's
Office
Conspicuous;
current
Partial;
published in
BOS minutes.

No stated
retention
Template No CA
terms
South San
Francisco
Conspicuous;
current
Partial; not
published.

Consistent Template No CA
terms
Woodside Conspicuous (via
SMC SO) and
current
Strong;
published in
Town Council
minutes
Consistent Template Contract
not
provided.

As shown above, while several agencies demonstrate strong alignment between policy and operational practices, others exhibit deficiencies in audit procedures, inconsistencies in stated data retention practices, and incomplete or inaccurate documentation of data-sharing processes and decisions. These findings highlight the absence of standardized ALPR governance and oversight practices across SMC.
132
2025 – 2026 San Mateo County Civil Grand Jury Page 16

FINDINGS
This section summarizes findings based on evidence produced or otherwise reviewed by the SMCCGJ. The accompanying table identifies the findings assigned to the governing body of each LEA based on the evidence described in this report.

F1. The ALPR operator’s ALPR policy was not posted in a manner that appears consistent with the California Attorney General’s guidance on “conspicuous” posting.

F2. The ALPR operator’s ALPR Policy appears to be outdated because it describes ALPR operations as mediated by NCRIC, a practice the investigation found was discontinued several years ago.

F4. The ALPR operator did not produce records demonstrating that audits required by its ALPR policy had been conducted.

F5. The audit reports produced by the ALPR operator were insufficient to substantiate compliance with applicable California law and the operator’s published ALPR policy.

F6. The ALPR operator’s Flock Safety contract does not include provisions specifically requiring compliance with applicable California ALPR laws.

F7. The operator’s ALPR policy described a process requiring written requests and executed agreements for ALPR data-sharing relationships; however, the records produced did not substantiate that this process was followed or that the required agreements were obtained.

F8. The operator’s ALPR policy did not establish criteria governing the approval of in-state ALPR data-sharing requests or the termination of existing network-sharing relationships.

F9. The retention period specified in the operator’s ALPR Policy does not match the retention period as reported by the Flock transparency portal or Flock contract.

RECOMMENDATIONS
While the recommendations below are generally applicable to all LEAs in SMC, some recommendations have already been implemented by some LEAs. The accompanying table identifies the recommendations directed to the governing body of each LEA reviewed by the SMCCGJ.

R1. The ALPR operator should conspicuously post the current version of their ALPR Policy as required by Civil Code sections 1798.90.51(a)–(b).

R2. The ALPR operator with outdated ALPR policies should revise those policies to accurately reflect current operational practices.

R3. The ALPR operator currently identified as sharing ALPR data with private university security entities should obtain and retain a written legal and factual determination that the recipient is a “public agency” under Civil Code section 1798.90.5(f), or that the sharing is otherwise permitted by law; if no lawful basis exists, the operator should terminate the sharing relationship. 133
2025 – 2026 San Mateo County Civil Grand Jury Page 17
R4. The ALPR operator should prepare audit reports in accordance with the frequency stated in the operator’s published ALPR policy.

R5. The audit reports produced by the ALPR operator should substantiate compliance with applicable California law and the operator’s published ALPR policy.

R7. The ALPR operator should update its ALPR policy to accurately reflect the process used to approve ALPR data-sharing relationships.

R8. The ALPR operator should include in their ALPR policies written criteria governing the approval, denial, periodic review, and termination of in-state ALPR network-sharing relationships.

R9. The ALPR operator should update their ALPR policy or Flock contract terms, as necessary, so that the stated retention rule accurately reflects operations.

REQUEST FOR RESPONSES
Pursuant to Penal Code 933.05, the Civil Grand Jury requests responses from the following governing bodies:

Respondent Findings Recommendations
Atherton Town Council F1, F3, F6, F7, F8, F9 R1, R3, R6, R7, R8, R9 Belmont City Council F3, F6, F8 R3, R6, R8
Brisbane City Council F1, F3, F4, F5, F6, F7, F8 R1, R3, R4, R5, R6, R7, R8 Burlingame City Council F1, F3, F4, F5, F6, F7, F8 R1, R3, R4, R5, R6, R7, R8 Colma City Council F1, F3, F5, F7, F8, F9 R1, R3, R5, R7, R8, R9 Daly City City Council F3, F6, F7, F8, F9 R3, R6, R7, R8, R9 East Palo Alto City Council F3, F5, F6, F7, F8 R3, R5, R6, R7, R8 Foster City City Council F3, F4, F5, F6, F7, F8, F9 R3, R4, R5, R6, R7, R8, R9 Half Moon Bay Town Council F3, F5, F6, F7, F8, F9 R3, R5, R6, R7, R8, R9 Hillsborough Town Council F1, F2, F3, F4, F5, F6, F7, F8 R1, R2, R3, R4, R5, R6, R7, R8 Menlo Park City Council F1, F3, F5, F6, F7, F8 R1, R3, R5, R6, R7, R8 Millbrae City Council F3, F5, F6, F7, F8, F9 R3, R5, R6, R7, R8, R9 Pacifica City Council F3, F5, F6, F8 R3, R5, R6, R8
Portola Valley Town Council F3, F5, F6, F7, F8, F9 R3, R5, R6, R7, R8, R9 City Council of Redwood City F2, F3, F5, F6, F7, F8, F9 R2, R3, R5, R6, R7, R8, R9 San Bruno City Council F4, F5, F6, F7, F8 R4, R5, R6, R7, R8 San Carlos City Council F3, F5, F6, F7, F8, F9 R3, R5, R6, R7, R8, R9 134
2025 – 2026 San Mateo County Civil Grand Jury Page 18
Respondent Findings Recommendations
Ken Binder, San Mateo County
Sheriff
F3, F5, F6, F7, F8, F9 R3, R5, R6, R7, R8, R9
San Mateo City Council F4, F5, F6, F7, F8 R4, R5, R6, R7, R8 South SF City Council F5, F6, F7, F8 R5, R6, R7, R8
Woodside Town Council F5, F6, F7, F8 R5, R6, R7, R8

RESPONSE REQUIREMENTS
California Penal Code Section 933.05 provides as follows (emphasis added):
(a) For purposes of subdivision (b) of Section 933, as to each grand jury finding, the responding person or entity shall report one of the following:
(1) The respondent agrees with the finding.
(2) The respondent disagrees wholly or partially with the finding, in which case the response shall specify the portion of the finding that is disputed and shall include an explanation of the reasons therefor.
(b) For purposes of subdivision (b) of Section 933, as to each grand jury recommendation, the responding person or entity shall report one of the following actions:
(1) The recommendation has been implemented, with a summary regarding the implemented action.
(2) The recommendation has not yet been implemented, but will be implemented in the future, with a timeframe for implementation.
(3) The recommendation requires further analysis, with an explanation and the scope and parameters of an analysis or study, and a timeframe for the matter to be prepared for discussion by the officer or head of the agency or department being investigated or reviewed, including the governing body of the public agency when applicable. This timeframe shall not exceed six months from the date of publication of the grand jury report.
(4) The recommendation will not be implemented because it is not warranted or is not reasonable with an explanation therefor.

Under Penal Code section 933(c), the governing body of a public agency must respond within 90 days after the grand jury submits its final report, and an elected county officer or agency head for which the grand jury has responsibility under Penal Code section 914.1 must respond within 60 days regarding matters under that officer’s or agency head’s control. 135
2025 – 2026 San Mateo County Civil Grand Jury Page 19

BIBLIOGRAPHY
Automated License Plate Readers, Report 2019-118, California State Auditor, February 2020.

California Automated License Plate Reader Data, 2023-DLE-06, California Department of Justice.

National Crime Information Center Administration of Warrants, 2025-DLE-08, California Department of Justice, April 7, 2025.

A Delicate Balance: Privacy vs. Protection, Report of the San Mateo County Civil Grand Jury, 2016–2017.

FOOTNOTES
1 Analysis done by SMCCGJ on all 2025 network queries in California on one SMC LEA’s data found that 13.1% of queries entered only “Investigation” as the Reason for performing the query. 2 The search reason “warrant” could refer to a warrant issued by a California judge for an authorized law enforcement purpose, or alternatively to an administrative warrant issued by a federal agency such as ICE. 3 A list of these offense codes is provided in Appendix A. 4 The network audit report was delivered in comma-separated value (CSV) format, bulk-loaded into a MySQL database and analyzed using the Structured Query Language (SQL).
5 https://www.paloaltoonline.com/police/2025/11/05/east-palo-alto-leaders-push-back-on-license-plate-readers-amid-privacyconcerns/ 6 https://www.coastsidenews.com/news/half-moon-bay-to-revisit-license-plate-reader-program-and-ice-policies/ 7 https://www.almanacnews.com/news/2025/12/29/the-years-biggest-stories/ 136
2025 – 2026 San Mateo County Civil Grand Jury Page 20
Appendix A - Flock Safety Offense Types
137
EPASD BOARD MEETING CONSENT ITEM 7.1

EAST PALO ALTO

SANITARY DISTRICT

STAFF REPORT
DATE: October 20, 2026
TO: Honorable Members of the City of East Palo Alto City Council, Governing Board to the East Palo Sanitary District, a Subsidiary of the City of East Palo Alto VIA: Melvin E. Gaines, General Manager
BY: Tomohito Oku, District Treasurer
Jessica Y Caballero, Financial Services Manager
SUBJECT: Cash Disbursement Report for August 2026
Recommendation
Accept the cash disbursement report required pursuant to California Health and Safety Code Section 6794.

Alignment with City Council Strategic Plan
This recommendation is primarily aligned with:

Priority: Governance, Organizational Strength, and Fiscal Sustainability Priority: Public Health, Safety, and Quality of Life
Background
On November 15, 2023, the San Mateo Local Area Formation Commission (“LAFCo”) unanimously approved the City of East Palo Alto’s application requesting that the East Palo Alto Sanitary District (“District” or “EPASD”) be made a subsidiary of the City of East Palo Alto.

On October 1, 2024, the reorganization of the District as a subsidiary of the City of East Palo Alto (City), and the City Council its governing board, became effective. Prior to and since that time, staff has worked diligently toward a peaceful and smooth transition. To that end, one aspect of that transition has required staff to review local rules and regulations of EPASD that may require amendment in light of the reorganization.

California Health and Safety Code (H&S) Section 6794 allows the Board to adopt a procedure 138
EPASD BOARD MEETING CONSENT ITEM 7.1
that provides for checks or warrants to pay claims and demands without approval by the Board of Directors before payment if the District Treasurer determines that the demands are payable within the District’s approved budget.

On December 3, 2024, the Board adopted an ordinance amending various provisions of the Sanitary District Code including Section 303 Appointed Positions, which authorizes District Treasurers to perform duties including the deposit and withdrawal of funds of the District, issuance of checks or warrants to pay claims and demands without approval by the Board before payment if the District Treasurer determines that the demands are payable within the District’s approved budget.

Furthermore, H&S Section 6794 requires staff to present cash disbursements to the Board at the next regular Board meeting and seek Board approval if demands exceed the District’s approved budget.

This staff report is provided for informational purposes and details all cash disbursements for the month ending August 2026, as approved by the District Treasurer. As of August 31, 2026, actual expenses remain within the District’s approved budget. Year-to-date expenditures total $0.8 million, compared to the adopted budget of $9.8 million, representing 9% of the budget spent to date.

Analysis
The following cash disbursements have been approved by the District Treasurer pursuant to the District Code Section 303, and are hereby reported to the Board:

EPASD Cash Disbursement Reports
For Period Ending August 31, 2026
Vendor Name Invoice Number Description Check Amount Check Issue Date AppleOne, Inc 01-72558 94 Staffing Services $ 4.00 8/7/2026 AppleOne, Inc 01-72642 11 Staffing Services $ 4.00 8/7/2026 AppleOne, Inc 01-73071 20 Staffing Services $ 416.91 8/7/2026 AppleOne, Inc 01-7332828 Staffing Services $ 1,925.60 8/3/2026 AppleOne, Inc 01-7336679 Staffing Services $ 1,925.60 8/7/2026 AppleOne, Inc 01-7342316 Staffing Services $ 1,913.57 8/7/2026 AppleOne, Inc 01-7348573 Staffing Services $ 1,925.60 8/14/2026 AppleOne, Inc 01-7350470 Staffing Services $ 1,925.60 8/21/2026 CALIF PUBLIC EMPLOYEES' H911 EPASD HEALTH PREMIUM $ 9,634.12 8/31/2026 CITY OF PALO ALTO 7800007745 1st Qtr FY26-27 Primary Sedimentaiton Tank & Electrical Upgrade SR $ 677,640.28 8/14/2026 Degree HVAC, Inc 43897 Quarterly Maintenance $ 250.00 8/14/2026 Islas Maintenance Cleaning, LLC 2983 EPASD Janitorial Services $ 2,050.00 8/7/2026 MacLeod Watts Inc 070726EPASD Actuarial Valuation of Other Post-Employment Benefit Programs as of June 30,2025 $ 7,300.00 8/14/2026 PACIFIC GAS & ELECTRIC 2205881930-5 07/2026 PACIFIC GAS & ELECTRIC EPASD 2205881930-5 FOR 6/13/26-7/14/26 $ 20.21 8/7/2026 SAN MATEO DAILY JOURNAL 17944 Notice of Public Hearing 6/15/2026 $ 1,008.00 8/28/2026 $ 707,943.49
139
EPASD BOARD MEETING CONSENT ITEM 7.1
Fiscal Impact
There is no budget impact by this action as the year-to-date cash disbursements did not exceed the District’s approved budget.

Public Notice
The public was provided notice by making the agenda and report available on the City’s website and on a bulletin board located at City Hall: 2415 University Avenue, East Palo Alto.

Environmental
The proposed action is not a “project” under California Environmental Quality Act (CEQA) pursuant to CEQA Guideline section 15378(b)(4) because it is a fiscal activity which does not involve any commitment to any specific project which may result in a potentially significant impact on the environment.

Government Code § 84308
Applicability of Levine Act: No, as the proposed action involves no entitlement.

Analysis of Levine Act Compliance: Not applicable.

Attachments: None.
140
EPASD POLICY AND ACTION ITEM 8.1

EAST PALO ALTO

SANITARY DISTRICT

STAFF REPORT
DATE: October 20, 2026
TO: East Palo Alto Sanitary District Board
VIA: Melvin E. Gaines, General Manager
BY: Matt Vining, Utility Manager
SUBJECT: Palo Alto RWQCP Addendum 2 to the partner agreement with EPASD Recommendation

1. Adopt a resolution approving Addendum 2 to the partner agreement between the Palo Alto Regional Water Quality Control Plant (RWQCP) and EPASD and authorizing Palo Alto to utilize an interim line of credit to finance EPASD’s allocated share of the Addendum 2 project costs, following review and comment on the proposal by the EPASD Advisory Committee.

Alignment with City Council Strategic Plan
This recommendation is primarily aligned with:
 Priority: Governance, Organizational Strength, and Fiscal Sustainability  Priority: Public Infrastructure and Utilities
Background
The Palo Alto Regional Water Quality Control Plant (RWQCP) is currently implementing over $460 million in capital improvements identified in its 2012 Long Range Facilities Plan (LRFP), including major projects such as the Secondary Treasury Upgrades (WQ-190001), Advanced Water Purification System (WQ-19003), and Headworks Facility Replacement (WQ-16002).

These projects are in various stages of design and construction and are funded through a combination of State Revolving Fund (SRF) loans, grants, and debt financing.

The 2012 Long Range Facilities Plan established a comprehensive pathway for modernizing the 141
EPASD POLICY AND ACTION ITEM 8.1
RWQCP to meet future regulatory requirements, accommodate partner agency flows, and replace aging infrastructure. Many early-phase projects have been completed using SRF loans, which provided favorable interest rates and stable long-term funding.

Several remaining projects, including major process upgrades and facility replacements, do not currently have SRF commitments. In addition, updated cost estimates reflect inflation, increased construction costs, and newly identified facility needs. To ensure continuity of construction and design work, the RWQCP partners authorized a line of credit mechanism through amendments to existing partnership agreements.

The amendments enable the line of credit mechanism, currently anticipated to run approximately five years, though Addendum Two does not itself fix a maximum term and instead authorizes Palo Alto to negotiate repayment terms directly, enabling the facility to proceed with critical interim financing while staff continue working with state agencies to secure SRF or other longterm funding sources.

City of Palo Alto Staff initiated a comprehensive update to the LRFP in 2024. The LRFP Update, currently underway, will reassess and reprioritize capital improvement needs over the next 50 years, incorporating consideration of updated regulatory requirements, emerging contaminants, and the current condition and performance of existing RWQCP infrastructure. The update will refine project scopes and cost estimates for remaining projects from the 2012 LRFP and identify additional capital improvements necessary to maintain reliable and compliant plant operations.

The LRFP Update is expected to significantly increase RWQCP’s overall capital needs, highlighting the importance of flexible financing tools such as the proposed LOC.

On November 4, 2025, the City of Palo Alto Finance Committee received an update of the capital improvement program, LRFP Update, capital and O&M cost allocations, program funding strategies and reserve policy. Staff’s funding strategies include the following sources:
• State Revolving Fund (SRF) loans administered by the State Water Resources Control Board
• U.S. Environmental Protection Agency Water Infrastructure Finance and Innovation Act (WIFIA) loans
• Utility revenue bonds issued through capital markets
• Line of Credit (LOC)
• Capital budget for smaller or shorter-term projects.

Analysis
The purpose of this staff report is to seek the EPASD Board’s approval of Addendum Two to the existing partner agreement, which is required before the City of Palo Alto may utilize the line of credit (LOC) for the authorized RWQCP projects. Palo Alto is seeking similar approval from the governing bodies of the participating RWQCP partner agencies.

The LOC is intended to serve as an interim financing mechanism to provide funding for nearterm capital needs while Palo Alto continues to pursue longer-term financing. The LOC will allow the RWQCP to advance necessary capital projects without delaying design or construction while 142
EPASD POLICY AND ACTION ITEM 8.1
permanent financing is being secured. Project costs financed through the LOC are expected to ultimately be refinanced through a utility revenue bond. A subsequent amendment to the partner agreement is anticipated at some future date to establish the methodology and requirements for each partner’s applicable share of the long-term debt service.

Addendum Two primarily addresses partner agency cost-sharing responsibilities and authorizes Palo Alto to utilize the LOC for planned capital improvements. Amendments with the participating agencies maintain the proportional cost allocation methodology established in the respective partner agreements. The interim financing capacity will be used to:
 Complete smaller capital improvement projects currently in construction or ready to bid;  Advance the design of larger projects requiring additional time to secure long-term financing; and
 Maintain progress on the RWQCP modernization program without delays that could increase future costs or risk regulatory non-compliance.

Addendum Two authorizes up to $31 million in total project costs, consisting of:
 $18 million for Headworks Project improvements;
 $1 million for Outfall Project improvements;
 $12 million for deferred minor capital projects; and
 Emergency projects, as needed, within the overall $31 million authorization to maintain continuous, compliant, and safe plant operations.

Approval of Addendum Two by the EPASD Board would authorize Palo Alto to utilize the LOC to finance EPASD’s allocated share of these project costs. During the interim financing period, EPASD will be responsible for its proportionate share of interest costs associated with applicable LOC draws, as further described in the Fiscal Impact section.

Palo Alto staff will return to the Palo Alto City Council and partner agencies, as applicable, at key milestones for budget appropriations, project awards, and approval of future long-term financing instruments.

EPASD Advisory Committee Input
The EPASD Advisory Committee received a presentation and provided feedback on this proposed Addendum at a September 24, 2026 Special Meeting. The EPASD AC passed a unanimous vote to recommend that the EPASD Board accept the terms of Addendum 2 to the RWQCP Partners Agreement, with the comment that the Advisory Committee and Board look further into how EPASD’s allocation and capacity maximum are calculated and determined by the RWQCP and City of Palo Alto Finance Committee.
143
EPASD POLICY AND ACTION ITEM 8.1
Fiscal Impact
Addendum Two authorizes up to $31 million in total project costs. Under the Agreement, each partner is responsible for its proportional share of project costs based on the capacity allocation established in Exhibit H. EPASD’s capacity allocation is 7.64%. Accordingly, if the full $31 million authorization is utilized, EPASD’s allocated share of the project costs would be approximately $2.37 million ($31 million × 7.64%).

Palo Alto intends to use the line of credit (LOC) as an interim financing mechanism for the authorized project costs. During the LOC period, EPASD will be responsible for its proportionate share of interest costs incurred on amounts drawn from the LOC for project costs. These LOC interest costs will be included in Palo Alto’s quarterly partner billings. Assuming an interest rate of approximately 4% to 5%, the actual interest cost to EPASD will depend on the amount and timing of LOC draws and the period that each amount remains outstanding.

The project costs financed through the LOC, including the outstanding LOC principal, are expected to be subsequently refinanced through a utility revenue bond. Addendum Two does not establish EPASD’s long-term debt-service payment requirements for that financing. A subsequent addendum will establish the methodology and requirements for EPASD’s payment of its applicable share of the utility revenue bond debt service, including principal and interest.

EPASD currently funds its RWQCP obligations through sewer service charges. The additional capital and financing obligations resulting from Addendum Two will need to be incorporated into EPASD’s long-range financial planning and future sewer rate requirements. Current sewer service charges are not expected to fully absorb these additional costs. The precise rate impact is not yet known and will be evaluated through an upcoming rate study, which will determine the timing and level of future rate adjustments needed to support EPASD’s share of RWQCP costs over the next 5–10 years.

Public Notice
The public was provided notice by making the agenda and report available on the City’s website and on a bulletin board located at City Hall: 2415 University Avenue, East Palo Alto.

Environmental
The action being considered does not constitute a “Project” within the meaning of the California Environmental Quality Act (CEQA), pursuant to CEQA Guideline section 15378 (b)(5), in that it is a government administrative activity that will not result in direct or indirect changes in the environment.
144
EPASD POLICY AND ACTION ITEM 8.1
Government Code § 84308
Applicability of Levine Act: No, as the proposed does not involve an entitlement.

Analysis of Levine Act Compliance: Not applicable.

Attachments

1. Resolution

2. RWQCP Proposed Addendum 2 Draft

3. RWQCP Amended Agreement with EPASD

4. Partner’s Meeting Slides September 2, 2026
145
Resolution No. XX-2026 1 of 2
RESOLUTION NO. XX– 2026

A RESOLUTION OF THE BOARD

OF THE EAST PALO ALTO SANITARY DISTRICT

APPROVING ADDENDUM TWO TO THE PARTNER AGREEMENT WITH THE PALO

ALTO REGIONAL WATER QUALITY CONTROL PLANT (RWQCP) AUTHORIZING THE

USE OF AN INTERIM LINE OF CREDIT FOR CAPITAL IMPROVEMENTS WHEREAS, the East Palo Alto Sanitary District (EPASD) is a partner agency utilizing the Palo Alto Regional Water Quality Control Plant (RWQCP) for wastewater treatment services; and WHEREAS, the RWQCP is currently implementing over $460 million in critical capital improvements identified in its Long Range Facilities Plan (LRFP) to modernize infrastructure, replace aging facilities, and ensure regulatory compliance; and WHEREAS, several remaining process upgrades and facility replacements do not currently have State Revolving Fund (SRF) loan commitments, and updated cost estimates reflect increased construction costs and inflation; and
WHEREAS, the RWQCP has proposed "Addendum Two" to the existing partner agreement, which authorizes a Line of Credit (LOC) mechanism, currently anticipated to run approximately five (5) years though Addendum Two does not itself fix a maximum term and instead gives Palo Alto authority to negotiate repayment terms, to serve as an interim financing tool to maintain project momentum while long-term permanent financing is secured; and
WHEREAS, under the established proportional cost allocation methodology (Exhibit H), EPASD’s capacity allocation is 7.64%, making its estimated maximum share of the authorized project costs approximately $2.37 million; and
WHEREAS, EPASD will be responsible for its proportionate share of interim interest costs incurred on amounts drawn from the LOC, which will be billed quarterly and subsequently refinanced through a long-term utility revenue bond under a future separate addendum; and WHEREAS, the EPASD Advisory Committee has reviewed the proposal and provided its comments and recommendations regarding the adoption of Addendum Two; and WHEREAS, this action is a government administrative activity that does not constitute a "Project" under the California Environmental Quality Act (CEQA) pursuant to CEQA Guideline section 15378(b)(5).

NOW, THEREFORE, BE IT RESOLVED THAT THE BOARD OF THE EAST PALO ALTO SANITARY DISTRICT HEREBY:

1. Approval of Addendum Two: The Board of Directors hereby approves Addendum Two to the partner agreement with the Palo Alto Regional Water Quality Control Plant (RWQCP). 146
Resolution No. XX-2026 2 of 2

2. Authorization of Interim Financing: The Board authorizes the City of Palo Alto to utilize the Line of Credit (LOC) mechanism to finance EPASD’s allocated 7.64% share of the authorized capital project costs, up to a maximum total project authorization of $31 million.

3. Execution of Documents: The Board authorizes the General Manager, or their designee, to execute Addendum Two and take all necessary administrative actions to implement the terms of the agreement.

4. Financial Integration: Staff is directed to incorporate these additional capital and interim financing obligations into the District’s long-range financial planning and the upcoming sewer rate study.

PASSED AND ADOPTED this 6th Day of October 2026, by the following vote:

AYES:

NOES:

ABSENT:

ABSTAIN:

Ruben Abrica, Board President
ATTEST: APPROVED AS TO FORM:

James Colin, Secretary John D. Lê, District Counsel
147

ADDENDUM TWO TO THE SECOND RESTATED AND AMENDED

AGREEMENT BETWEEN THE CITY OF PALO ALTO AND THE EAST PALO

SANITARY DISTRICT FOR WASTEWATER TREATMENT AND DISTRICT

OUTFALL
This Addendum Two to the Second Restated and Amended Agreement Between the City of Palo Alto and the East Palo Sanitary District for Wastewater Treatment and District Outfall is made and entered into on [DATE], by and among the CITY OF PALO ALTO (“Palo Alto”), a municipal corporation under the laws of the State of California, and the East Palo Alto Sanitary District (“District”), a special district formed under the Sanitary District Act of 1923, individually a “Party” and collectively the “Parties”.

RECITALS
A. On May 17, 2021, the Parties entered into an agreement entitled the Second Restated and Amended Agreement Between the City of Palo Alto and the East Palo Sanitary District for Wastewater Treatment and District Outfall (“Second Restated and Amendment Agreement Agreement” or “Agreement”).

B. That agreement affirmed the Parties’ respective rights and obligations regarding treatment of wastewater conveyed from the District’s sanitary sewer system at the City’s Regional Water Quality Control Plant, payment of treatment costs, ongoing debt service for major capital improvement projects (as that term is defined therein) to the Regional Water Quality Control Plan, the District’s sanitary sewer outfall line, and pretreatment programs.

C. Section 6 of the agreement established the Parties’ approval of funding and cost sharing for various major capital improvement projects identified and described therein.

D. On December 5, 2022, approved Addendum One to the Agreement to provide for the Parties’ respective funding and cost-sharing obligations for the planning and design and construction phases of the Secondary Treatment Upgrades Project.

E. Palo Alto owns and operates the regional sewage treatment plant that is part of a sewerage system owned and operated by Palo Alto. Palo Alto is responsible for making capital additions to the system. Under the Agreement, any major capital additions for the replacement of obsolete or worn-out units require an agreement by the Parties amending the Basic Agreement.

F. The Parties now desire to amend the Agreement to approve the construction of certain capital additions and authorize Palo Alto to pursue and obtain financing to fund the costs of the capital additions described herein.

NOW, THEREFORE, in consideration of the terms, conditions and covenants set forth in this Addendum No. Two, the Second Restated and Amended Agreement Between the City of Palo Alto and the East Palo Sanitary District for Wastewater Treatment and District Outfall (the “Agreement”) is hereby amended, as follows:

AGREEMENT
NOW, THEREFORE, in consideration of the terms, conditions and covenants set forth in this Addendum Three, to the Second Restated and Amendment Agreement is hereby amended, as follows:
148
SECTION 1. Section 8, Paragraph (a) is added to read as follows:
“a. DESIGN, CONSTRUCTION, AND IMPLEMENTATION OF THE HEADWORKS

PROJECT, OUTFALL PROJECT, AND MINOR CAPITAL, AND EMERGENCY PROJECTS.

1. Projects covered by this Addendum. Palo Alto and East Palo Alto Sanitary District hereby approve the following projects (the “Projects”):

A. Headworks Project: Design services for the Headworks Facility Replacement Project, including preparation of bid-ready construction documents, coordination and approvals from applicable regulatory and permitting agencies, and engineer's opinions of probable construction cost (OPCC) at major project milestones.

B. Outfall Project: Design services and potential construction for the Parallel Outfall Project and Existing Outfall Rehabilitation Project, including preparation of bid-ready construction documents, coordination and approvals from applicable regulatory and permitting agencies, and engineer's opinions of probably construction cost at major project milestones, and related construction activities.

C. Deferred minor capital projects including, but not limited to:
i. Sludge Thickener Rehabilitation design services and construction services, including preparation of bid-ready construction documents, coordination and approvals from applicable regulatory and permitting agencies, and engineer's opinions of probably construction cost at major project milestones, replacement of the instrumentation and controls, and repair of tank surfaces for the three in-service and for the one out-ofservice sludge thickeners. ii. Ventilation Improvements construction, including improvements to the loadout bay mechanical ventilation equipment at the Sludge Dewatering and Loadout Facility.
iii. Plant Records Modernization Projects, including digitizing and rectifying the Plant’s process and instrumentation diagram drawings, creating a digital interactive operation and maintenance manual, and GIS mapping of plant facilities.

D. Emergency projects: In response to, or to prevent, an infrastructure failure, the use of on-call engineering services, construction, and construction management services contracts required to maintain continuous, compliant, and safe operation of the plant at the discretion of the Plant Manager.

2. Project Costs authorized by this Addendum. The total Project Costs authorized by addendum is $31 million. Each Party shall pay its share of the Project Costs in proportion to the capacity it owns in the Joint System or portion thereof as shown in Exhibit “H” to Second Restated and Amendment Agreement Agreement. As used in this Paragraph, the term “Project Costs” means all costs incurred in connection with the design, bidding, construction, and implementation of the Projects and shall include, but not be limited to:
149
engineering and other consultants’ fees and costs; deposits, applicable permit fees; construction costs; all costs to apply for and secure necessary permits from all required regional, state, and federal agencies; plan check and inspection fees; startup, commissioning and initial maintenance; insurance; costs associated with financing costs, including issuance costs and interest; and legal and administrative expenses. The estimated amount of Project Costs for each of the projects is as follows:

A. Headworks Project: $18 million
B. Outfall Project: $1 million
C. Deferred minor capital projects: $12 million
i. Sludge Thickener Rehabilitation: $10 million
ii. Other minor capital projects: $2 million
Emergency Projects are not assigned a separate estimated amount and may be undertaken as needed, with costs included within the total Project Costs authorized amount of $31 million.

3. The Parties further agree that Palo Alto shall have the authority to manage project expenditures within the approved total amount of $31 million, including the authority to authorize individual expenditures consistent within each project’s budget; reappropriate funds among the project budgets; establish and adjust contingency reserves; approve additional expenditures funded from contingency reserves. Palo Alto will provide the Parties with quarterly updates on Project expenditures.

4. Financing and Payment of Project Costs by the Parties. The Parties authorize Palo Alto to obtain and administer a line of credit to fund the costs of the Projects. Palo Alto shall have full authority to negotiate the terms of the line of credit, including interest rate (fixed or variable), draw procedures, repayment terms, collateral requirements, covenants, and fees.

Palo Alto’s payment obligations with respect to the line of credit will be evidenced by one or more notes. The Parties acknowledge that Palo Alto may obtain the line of credit in its own name, and the Parties agree to cooperate with Palo Alto's financing efforts, including by providing financial information and executing supporting resolutions as reasonably requested. Palo Alto shall maintain records of all financing costs attributable to each draw on the Line of Credit.

District will pay its respective shares of any Project Costs within thirty (30) business days of receipt of the quarterly billing statement sent by Palo Alto. Palo Alto shall not send more than once invoice in any thirty day period. If a Party disputes the correctness of an invoice, it shall pay the invoice in full and the dispute shall be resolved after payment in accordance with Paragraph 19 of the Basic Agreement and shall not offset any payment due.

5. Tax Covenants.

A. Definitions. The following definitions relate to the covenants set forth in Section 8(a)(5)(B):
150
i. “Bonds” mean obligations the interest on which is intended to be excluded from gross income under the Code, including bonds, notes, leases, credit agreements and other evidences of indebtedness.
ii. "Code" means the Internal Revenue Code of 1986 as it may be amended from time to time, together with applicable proposed, temporary and final regulations promulgated, and applicable official public guidance published, under the Code.

B. Tax Covenants
i. Private Activity Bond Limitation. The parties will assure that any portion of the Joint System financed by Bonds will not be so used as to cause the Bonds to satisfy the private business tests of section 141(b) of the Code or the private loan financing test of section 141(c) of the Code. ii. Federal Guarantee Prohibition. The parties will not take any action or permit or suffer any action to be taken if the result of such action would be to cause any of the Bonds to be "federally guaranteed" within the meaning of section 149(b) of the Code.
iii. Maintenance of Tax-Exemption. The parties will take all actions necessary to assure the exclusion of interest on the Bonds from gross income under the Code.
iv. Record Retention. The parties will retain their records related to the use of any portion of the Joint System financed by Bonds for least 3 years after the Bonds (including any refunding bonds) mature or are redeemed (whichever is earlier).
v. Certificates. In connection with the issuance of Bonds, the parties will execute documentation requested by Palo Alto's bond counsel as support for its opinion as to the exclusion of interest on the Bonds from gross income under the Code.

SECTION 2. Except as modified herein, the Second Restated and Amended Agreement shall remain unchanged, and is hereby ratified and confirmed. [SIGNATURE PAGE FOLLOWS]
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
1 Welcome
Please grab some food and your seats!
We would also like to extend a special welcome to any new attendees 186
2 RWQCP

PARTNERS

SEPTEMBER

MEETING
RWQCP,

ADMIN BUILDING
SEPTEMBER 2, 2026
187
3 RWQCP – RWQCP PARTNERS JUNE MEETING
Objectives
• Communicate
Developments Since June 2026
Meeting
• Prepare the Plant and
the Partners for Future Needs
• Reserve Policy Update
• Provide Transparency on Long
Range Facilities Plan Update
(LRFPU)
Agenda
• Introduction and Schedule
• Reserves Policy Study
• Line of Credit
Break
• 1900 Embarcadero Way
• Long Range Facilities Plan Update
• 10-Year Capital Improvement Projects
• Annual Budget Forecast Preparation
• Capital Program Updates
• Ongoing Project Overview
188
4 UPCOMING SCHEDULE
AUGUST8/7: Climate Action and
Sustainability Committee for
Biosolids Facility Plan Update
8/10: Council Items
Carollo LRFPU Amendment;
LOC Approval
8/12 : August Strategies &
Challenges
8/24: 2470 Lab Pivot Furniture
Contract PA Council Approval
SEPTEMBERToday 9/2: Partners Mtg
9/TBD: Initial Mgmnt Review of
FY28 Operating
Expenses(OPEX) Budget
OCTOBER10/6: Finance Committee for
Reserve Policy Study
10/TBD: Next Strategies &
Challenges Mtg
10/19: Partner amendments
for LOC to Palo Alto Council
10/TBD: Council Mtg for 1900
for Embarcadero Purchase after
purchase negotiated
NOVEMBER11/16: City Council Acceptance
of Biosolids Facility Plan and
Park Dedication Ordinance
11/19: Annual Partners
Forecast Mtg
11/TBD: Headwork Design
Amendment to Council
11/TBD: Outfall Design
Amendment to Council
11/TBD: Construction
Management Amendment for
Gravity Thickener
189
5 Reserve Policy Studies
• Staff Reserve Recommendations
• Status Update
• Review Recommended Reserve Types,
Targets/Calculations, and Ramp-up
• Discussion and Next Steps
190
6 RESERVE POLICY RECOMMENDATIONS SUMMARY
Follow a 5-year ramp up schedule with a fixed rate/percentage increase for all reserve funds.

O&M Reserves:

Operations Outlay: 20% of Annual Operating Costs.

Other Outlay: 100% of Minor CIP Annual Authorization.

Capital Reserves:
10%-20% of Average Annual 5-yr Capital Plan.

Debt Reserves:

Match debt convenance requirements (City charter and covenant; typically one year’s debt payment).

Rate Stabilization Reserves:

Eliminate. Part of existing CPA policy, but RWQCP Partners establish sewer rates within their jurisdictions.

Reserve Implementation
Reserve Types and Targets
191
7 RECOMMENDED FY2033 RESERVE TARGETS
Partner Fixed Share Debt Reserve Capital
Reserve
FY27 Flow &
Load Share Other Outlay Operations Outlay Total Target
Plant Targets* -- $16,868,000 $3,322,000 -- $5,200,000 $9,040,000 $34,430,000 Palo Alto 38.16% $6,266,000 $1,268,000 36.01% $1,873,000 $3,255,000 $12,662,000 Mountain View* 37.89% $6,669,000 $1,259,000 41.50% $2,158,000 $3,752,000 $13,838,000 Los Altos 9.47% $1,555,000 $315,000 7.94% $413,000 $718,000 $3,001,000 Los Altos Hills 1.58% $259,000 $52,000 2.02% $105,000 $183,000 $599,000 Stanford 5.26% $864,000 $175,000 6.75% $351,000 $610,000 $2,000,000 EPASD 7.64% $1,255,000 $254,000 5.78% $301,000 $523,000 $2,333,000 O&M Reserve
*Includes AWPS Debt Reserve Requirement which only MV contributes to 192
8 RECOMMENDED 2029 - 2033 RESERVE BALANCES:
5-YR, EQUAL PERCENTAGE RAMP UP
Partner Rate of
Increase FY 29 FY 30 FY 31 FY 32 FY 33 Total Target
Plant Targets* 73% $3,844,000 $6,650,000 $11,505,000 $19,904,000 $34,434,000 $34,430,000 Palo Alto 73% $1,414,000 $2,446,000 $4,232,000 $7,321,000 $12,665,000 $12,662,000 Mountain View* 73% $1,545,000 $2,673,000 $4,624,000 $8,000,000 $13,840,000 $13,838,000 Los Altos 73% $335,000 $580,000 $1,003,000 $1,735,000 $3,002,000 $3,001,000 Los Altos Hills 73% $67,000 $116,000 $201,000 $348,000 $602,000 $599,000 Stanford 73% $223,000 $386,000 $668,000 $1,156,000 $2,000,000 $2,000,000 EPASD 73% $260,000 $450,000 $779,000 $1,348,000 $2,332,000 $2,333,000 *Includes AWPS Debt Reserve Requirement which only MV contributes to 193
9 RECOMMENDED 2029 – 2033 PARTNER RESERVE CONTRIBUTIONS:
5-YR, EQUAL PERCENTAGE RAMP UP
Partner Rate of
Increase FY 29 FY 30 FY 31 FY 32 FY 33 Total Target
Forecasted Plant
Budget for Ref.* - $48,533,000 $64,081,000 $65,081,000 $66,780,000 $68,495,000 - Plant Targets** 73% $3,844,000 $2,806,000 $4,855,000 $8,399,000 $14,526,000 $34,430,000 Palo Alto 73% $1,414,000 $1,032,000 $1,786,000 $3,089,000 $5,341,000 $12,662,000 Mountain View* 73% $1,545,000 $1,128,000 $1,951,000 $3,376,000 $5,838,000 $13,838,000 Los Altos 73% $335,000 $245,000 $423,000 $732,000 $1,266,000 $3,001,000 Los Altos Hills 73% $67,000 $49,000 $85,000 $147,000 $251,000 $599,000 Stanford 73% $223,000 $163,000 $282,000 $488,000 $844,000 $2,000,000 EPASD 73% $260,000 $190,000 $329,000 $569,000 $985,000 $2,333,000 *Based on March 2026 Update to the FY27 Forecast
**Includes AWPS Debt Reserve Requirement which only MV contributes to 194
10 WHY DO A RESERVES STUDY?
Current Status
• Dated reserve policy that’s not
necessarily relevant to the Plant
• Not necessarily tailored to WWTP
(partners instead of ratepayers)
• Not actively managed/tracked
Future Status
• Long Range Facility Plan-Update will
identify updated/expanded capital
improvement program
• Long-term solution as Line of Credit is
an interim solution
Parallel Efforts
• The City, with BakerTilly, is accessing
its current reserve policies and making
recommended changes.
• Raftelis is reviewing their work, and
aligning RWQCP policies where
appropriate/relevant
195
11 PARTNER BENEFITS OF SUSTAINABLE RESERVES
Reduced volume of staff reports
and partner amendments.

Smoothed-out impacts of market
forces on annual expenses.

Reduced (eliminated) general fund
loans and associated interest.

Strong bank balances helps sustain
credit worthiness for future financing
196
12 RESERVES STUDY SCOPE
Purpose
• Maintain financial stability for Operations and Capital • Fund cash flow and emergencies
Raftelis Scope
• Survey of regional utilities agencies to identify practices on reserve targets
• Assessing targets, funding levels, and debt policy alignment • Schedule
› Preliminary recommendations: Summer 2026
› Implementation: FY2029 with new cost allocation updates Coordination
• Align with BakerTilly recommendations
• Provide Partner updates and respond to feedback
197
13 RESERVE POLICY STUDY - TIMELINE 2025
June: Addressing JISR budget
shortfall, Partners identified
reserves to reduce future volatility
September: Proposed a plan to
assess reserves
October: Contracted with Raftelis to
perform a Reserve Study
November: Surveyed other
wastewater treatment facilities
2026February: Presented initial findings
to S&C
March: Presented initial findings to
Partners; aligned with
management’s responses on Baker
Tilly report
June: Status update to S&C.

Continued alignment with Baker Tilly
Report
September:

Partners Meeting specifically
focused on reserves including
implementation plan and partner
specific amounts
October: Present findings to the
Finance Committee
November: Capture preferred
approach in FY 2028 forecast, with
Year-1 costs starting in FY 2029
2027
-2028Spring/Summer 2027:
- Return to Finance Committee with
final recommendations
- CPA Council approval of RWQCP
reserve policy
- Update Partners Agreements to
incorporate reserve
July 2028: Ramp-up for reserves
begin with FY2029 Q1 billings
198
14 • O&M Reserves:

Operations Outlay: Cover working capital for operations and maintenance expenses + any unexpected increases in operating costs during year Other Outlay: Funds needed for non-debt funded capital expenses, typically need the total capital expenditure for the year upfront (i.e., working capital for Minor CIP) • Capital Reserves: Cover unexpected increases, contingencies, and emergencies
• Debt Reserves: Funds required by debt covenants (also referred to as Notes and Loans Reserves)
• Rate Stabilization Reserves: Cover changes in use patterns and associated rate revenues and unexpected increased costs

WORKING DEFINITIONS OF RESERVE TYPES
199
15 SURVEY: THE PEER GROUP
• San Jose / Santa Clara (Regional Facility): Includes Milpitas, Cupertino SD, Burbank SD, West Valley SD (Campbell, Los Gatos, Monte Sereno, Saratoga) • Silicon Valley Clean Water (JPA): Redwood City, San Carlos, Belmont, Most of Menlo Park (aka West Bay Sanitary District)
• San Mateo / Foster City (Shared Plant): Includes Hillsborough, Crystal Springs CSD, some portions of San Mateo County
• Oro Loma / Castro Valley (Shared Plant)
• South SF / San Bruno (Shared Plant): Includes portions of Daly City and Colma, some additional very small partners
• Sunnyvale (Sole Ownership): Includes parts of Cupertino and San Jose • Hayward (Sole Ownership)
200
16 BACKGROUND: PARTNER BILLING SCHEDULE
FY
Q1 Q2 Q3 Q4
FY
Q1 Q2 Q3 Q4
Mountain View,
Palo Alto,
Los Altos, and
East Palo Alto SD
Los Altos Hills*,
Stanford
Billed on
Forecast,
Based on
Prior Year’s
Flows and
Loads
Billed on
Forecast,
Based on
Prior Year’s
Flows and
Loads
+ Prior Year
True Up
Billed on
Forecast,
Based on
Prior Year’s
Flows and
Loads
Billed on
Forecast,
Based on
Prior Year’s
Flows and
Loads
Billed on
Forecast,
Based on
Prior Year’s
Flows and
Loads
Billed on
Forecast,
Based on
Prior Year’s
Flows and
Loads
Billed on
Forecast,
Based on
Prior Year’s
Flows and
Loads
Billed on
Forecast,
Based on
Prior Year’s
Flows and
Loads
+ Prior Year
True Up
Billed on
Prior Year’s
Actuals
Based on the
Flows and
Loads from
the same
period
Billed on
Prior Year’s
Actuals
Based on the
Flows and
Loads from
the same
period
* By agreement, Los Altos Hills flows are determined by calculation, not by metered measurement like other partners 201
17 BACKGROUND: PARTNER BILLING SCHEDULE
FY
Q1 Q2 Q3 Q4
FY
Q1 Q2 Q3 Q4
Mountain View,
Palo Alto,
Los Altos, and
East Palo Alto SD
Los Altos Hills*,
Stanford
Billed on
Forecast,
Based on
Prior Year’s
Flows and
Loads
Billed on
Forecast,
Based on
Prior Year’s
Flows and
Loads
+ Prior Year
True Up
Billed on
Forecast,
Based on
Prior Year’s
Flows and
Loads
Billed on
Forecast,
Based on
Prior Year’s
Flows and
Loads
Billed on
Forecast,
Based on
Prior Year’s
Flows and
Loads
Billed on
Forecast,
Based on
Prior Year’s
Flows and
Loads
Billed on
Forecast,
Based on
Prior Year’s
Flows and
Loads
Billed on
Forecast,
Based on
Prior Year’s
Flows and
Loads
+ Prior Year
True Up
Billed on
Prior Year’s
Actuals
Based on the
Flows and
Loads from
the same
period
Billed on
Prior Year’s
Actuals
Based on the
Flows and
Loads from
the same
period
* By agreement, Los Altos Hills flows are determined by calculation, not by metered measurement like other partners Key Findings:

1. The Fund routinely pays for costs ahead of
billings (i.e., partially bills in arrears)

2. The Fund doesn’t capture any cost increases
over forecast for a couple of months, and
potentially longer
202
18 ANALYSIS: RESERVE ALTERNATIVES EVALUATED
Reserve Types
O&M
Capital
Debt
Rate Stabilization
Ramp-Up
Duration
5-Years
10-Years
15-Years
Ramp-Up
Increase Types
Fixed Amount
Fixed Rate
203
19 ANALYSIS: RESERVE ALTERNATIVES EVALUATED
Reserve Types
O&M
Capital
Debt
Rate Stabilization
Ramp-Up
Duration
5-Years
10-Years
15-Years
Ramp-Up
Increase Types
Fixed Amount
Fixed Rate
15 years was quickly
dropped; timeline clearly
doesn’t meet need and
mitigate risk on a
reasonable timeline
204
20 • O&M Reserves: Mitigate the risk and expense
based on the current billing practices
• Capital Reserves: Need to be able to respond to
unforeseen issues and emergencies
• Debt Reserves: Need to be able to meet loan
commitments
• Rate Stabilization:
– Not applicable; RWQCP doesn’t charge rates
– Could be appropriate when there is a surplus ahead of anticipated increased spending, which isn’t the foreseeable situation

RESERVE TYPES REASONING
Reserve
Types
O&M
Capital
Debt
Rate Stabilization
205
21 O&M Reserves:

Operations Outlay: 20% of Annual Operating Costs ($9.0M by FY33) Other Outlay: 100% of Minor CIP Annual Authorization ($5.2M by FY33) Capital Reserves:

For the ramp, 10% of Average annual 5-yr Capital Plan ($3.3M by FY33) Future policy will determine target between 10% and 20%.

Debt Reserves:

Match debt convenance requirements ($16.9M by FY33, primarily by City charter and covenant; typically one year’s debt payment)
Rate Stabilization Reserves:

Eliminate, RWQCP Partners establish sewer rates within their jurisdictions. ($0M)

RESERVE TYPES CALCULATIONS
Estimated Reserves When Fully Funded based on FY33 = $34.4M* *Based on Current CIP
206
22 RAMP-UP PROJECTIONS, 5- AND 10-YEAR CURVES, PT. 1
0 10
20 30
40 50
60 2028 2030 2032 2034 2036 2038 2040 2042
Millions of Dollars
Fiscal Year
5-Year Fixed Rate 10-Year Fixed Rate Annual Reserve Target Debt Reserve 5-Year Fixed Amount 10-Year Fixed Amount Reserve Target
Based on
Current CIP
Potential Reserve
Target Based on
LRFPU
Potential Reserve
Target Based on
LRFPU – Debt Only
Planning to adopt LRFPU CIP late FY2027 or FY2028
207
23 RAMP-UP PROJECTIONS, 5- AND 10-YEAR CURVES, PT. 2
0 10
20 30
40 50
60 2028 2030 2032 2034 2036 2038 2040 2042
Millions of Dollars
Fiscal Year
Reserve Ramp Curves
Fixed Rate vs Fixed Amount
5-Year Fixed Rate 10-Year Fixed Rate Annual Reserve Target Debt Reserve 5-Year Fixed Amount 10-Year Fixed Amount Reserve Target
Based on
Current CIP
Solid Lines
Represent a
Fixed Rate
Dashed Lines
Represent a
Fixed Amount
Planning to adopt LRFPU CIP late FY2027 or FY2028
208
24 RAMP-UP DURATION AND TYPE OF INCREASES
❑ 5-yr Ramp-up Duration
– Allow Plant to meet it’s estimated Debt Reserve requirements (by FY2034) – Be best positioned to adapt to LRFPU includes an updated 10-year CIP schedule • Debt and Capital reserves targets to increase in the 5- to 10-year timeframe • Reserve target adjustments in outyears can be gradual ❑ Fixed Rate/Percentage Ramp Increase
– Best positions the fund to meet the anticipated increased CIP 209
25 FIXED RATE VS FIXED AMOUNT RAMP UP
0 10
20 30
40 50
60 2028 2030 2032 2034 2036 2038 2040 2042
Millions of Dollars
Fiscal Year
Reserve Ramp Curves
Fixed Rate vs Fixed Amount
5-Year Fixed Rate 10-Year Fixed Rate Annual Reserve Target Debt Reserve 5-Year Fixed Amount 10-Year Fixed Amount Planning to adopt LRFPU CIP late FY2027 or FY2028
210
26 FIXED RATE VS FIXED AMOUNT RAMP UP
0 10
20 30
40 50
60 2028 2030 2032 2034 2036 2038 2040 2042
Millions of Dollars
Fiscal Year
5-Year Fixed Rate 10-Year Fixed Rate Annual Reserve Target Debt Reserve 5-Year Fixed Amount 10-Year Fixed Amount Fixed Rate (Solid Lines)
Best Position the RWQCP
to Adapt to the
Anticipated CIP (LRFPU)
Ramp-up
Increase
Types
Fixed
Amount
Fixed
Rate
Planning to adopt LRFPU CIP late FY2027 or FY2028
211
27 RAMP-UP DURATION
Ramp-Up
Duration
5-Years
10-Years
15-Years
0 10
20 30
40 50
60 2028 2030 2032 2034 2036 2038 2040 2042
Millions of Dollars
Fiscal Year
5-Year Fixed Rate 10-Year Fixed Rate Annual Reserve Target Debt Reserve 5-Year Fixed Amount 10-Year Fixed Amount 10-Yr Duration Ramp-up
Takes Too Long to Build
Minimum Debt Reserves
and Mitigate RWQCP Risk
Planning to adopt LRFPU CIP late FY2027 or FY2028
212
28 STAFF RESERVE RECOMMENDATIONS SUMMARY
Reserve
Types
O&M
Capital
Debt
Rate Stabilization
Ramp-Up
Duration
5-Years
10-Years
15-Years
Increase
Types
Fixed Amount
Fixed Rate
213
29 $6,649,228
$11,503,664
$19,901,688
$34,430,000
$3,844,000
$2,805,228
$4,854,436
$8,398,024
$14,528,312
$-
$5,000,000
$10,000,000
$15,000,000
$20,000,000
$25,000,000
$30,000,000
$35,000,000
$40,000,000
FY 29 FY 30 FY 31 FY 32 FY 33
O&M Balance (47%) Capital Balance (9%) Debt Balance (44%) O&M Contribution (47%) Capital Contribution (9%) Debt Contribution (44%) RAMP UP IMPLEMENTATION, 5-YEAR FIXED RATE - TOTAL
Reserve Types
• O&M: $14.2M
• Capital: $3.3M
• Debt: $16.9M
214
30 $2.67
$4.62
$8.00
$13.84
$1.55
$1.13
$1.95
$3.38
$5.84
$0.00
$2.00
$4.00
$6.00
$8.00
$10.00
$12.00
$14.00
$16.00
FY 29 FY 30 FY 31 FY 32 FY 33
Millions of Dollars
O&M Balance (47%) Capital Balance (9%) Debt Balance (44%) O&M Contribution (47%) Capital Contribution (9%) Debt Contribution (44%)

MOUNTAIN VIEW PARTNER SPECIFIC VALUE LINKS
Fixed Share = 37.89%
Includes AWPS Debt Payment
(30-Year Total $13,419,716).
• Additional AWPS
Payment $447,324 each
year from FY30 onward.
215
31 $0.58
$1.00
$1.74
$3.00
$0.34
$0.25
$0.42
$0.73
$1.27
$0.00
$0.50
$1.00
$1.50
$2.00
$2.50
$3.00
$3.50
FY 29 FY 30 FY 31 FY 32 FY 33
Millions of Dollars
O&M Balance (47%) Capital Balance (9%) Debt Balance (44%) O&M Contribution (47%) Capital Contribution (9%) Debt Contribution (44%)

LOS ALTOS PARTNER SPECIFIC VALUE LINKS
Fixed Share = 9.47%
216
32 LOS ALTOS HILLS PARTNER SPECIFIC VALUE LINKS
$0.12
$0.20
$0.35
$0.60
$0.07
$0.05
$0.09
$0.15
$0.25
$0.00
$0.10
$0.20
$0.30
$0.40
$0.50
$0.60
$0.70
FY 29 FY 30 FY 31 FY 32 FY 33
Millions of Dollars
O&M Balance (47%) Capital Balance (9%) Debt Balance (44%) O&M Contribution (47%) Capital Contribution (9%) Debt Contribution (44%) Fixed Share = 1.58%
217
33 $0.39
$0.67
$1.16
$2.00
$0.22
$0.16
$0.28
$0.49
$0.84
$0.00
$0.50
$1.00
$1.50
$2.00
$2.50
FY 29 FY 30 FY 31 FY 32 FY 33
Millions of Dollars
O&M Balance (47%) Capital Balance (9%) Debt Balance (44%) O&M Contribution (47%) Capital Contribution (9%) Debt Contribution (44%)

STANFORD PARTNER SPECIFIC VALUE LINKS
Fixed Share = 5.26%
218
34 $0.45
$0.78
$1.35
$2.33
$0.26
$0.19
$0.33
$0.57
$0.98
$0.00
$0.50
$1.00
$1.50
$2.00
$2.50
$3.00
FY 29 FY 30 FY 31 FY 32 FY 33
Millions of Dollars
O&M Balance (47%) Capital Balance (9%) Debt Balance (44%) O&M Contribution (47%) Capital Contribution (9%) Debt Contribution (44%)

EAST PALO ALTO PARTNER SPECIFIC VALUE LINKS
Fixed Share = 7.64%
219
35 PALO ALTO PARTNER SPECIFIC VALUE LINKS
Fixed Share = 38.16%
$2.45
$4.23
$7.32
$12.67
$1.41
$1.03
$1.79
$3.09
$5.34
$0.00
$2.00
$4.00
$6.00
$8.00
$10.00
$12.00
$14.00
FY 29 FY 30 FY 31 FY 32 FY 33
Millions of Dollars
O&M Balance (47%) Capital Balance (9%) Debt Balance (44%) O&M Contribution (47%) Capital Contribution (9%) Debt Contribution (44%) 220
36 NEXT STEPS
• October 6, 2026: Present findings to the Finance Committee • November 2026: Capture preferred approach in FY 2028 forecast, with Year1 costs starting in FY 2029 • Early 2027: Palo Alto City Council approves updated Reserve Policy for Wastewater Treatment Fund
• Spring/Summer 2027: Update Partners Agreements to incorporate reserve • July 2028: Ramp-up for reserves begin with FY2029 Q1 billings 221
37 Line of Credit
222
38 RFP Was Issued
Feb 13
Proposals
Mar 6
Selection
Mar 9-13
Council Action
Preparations
May
LOC Council
Action
August 10
Initial Draw
August
Partner
Agreements
38 LINE OF CREDIT (LOC) - SCHEDULE
Partner amendments needed
Next Steps
• August 10 Palo Alto Council Action
• Internal process controls for LOC usage
• Partner Amendments
– Drafts sent; need to negotiate/address comments
– Mountain View and Los Altos target Sept 22nd
– EPASD target October 6th
– Stanford ?
– Palo Alto council target date October 19th Provide Partners Update (Early September)
LOC “Projects” and Usage
• Headworks Design
• Gravity Thickener
• 1900 Embarcadero Property Acquisition [Palo Alto
only]
• Outfall Project Design
• Ventilation Improvement
• Minor Capital Projects (Other)
• Emergency Draw
223
39 FY2027 – ADDITIONAL CAPITAL (CASH OR LOC) FOR INITIAL

PROJECT (NEEDS PARTNER AGREEMENT)
Existing Capital Debt
Service
Projects Estimated
Cost in million
MV Cash
Contribution Remaining Palo Alto Los Altos EPASD Los Altos Hills Stanford

37.89% 62.11% 38.16% 9.47% 7.64% 1.58% 5.26%
Headworks Design $18,000,000 $6,820,200 $11,179,800 $6,868,800 $1,704,600 $1,375,200 $284,400 $946,800 Outfall Design $1,000,000 $378,900 $621,100 $381,600 $94,700 $76,400 $15,800 $52,600 Gravity Sludge Thickening
Rehabilitation $10,000,000 $3,789,000 $6,211,000 $3,816,000 $947,000 $764,000 $158,000 $526,000 Sludge Dewatering and
Loadout Ventilation
Improvements
$1,000,000 $378,900 $621,100 $381,600 $94,700 $76,400 $15,800 $52,600 Digital O&M Manual, P&IDs
and Plant GIS System $1,000,000 $378,900 $621,100 $381,600 $94,700 $76,400 $15,800 $52,600 Total $31,000,000 $11,745,900 $19,254,100 $11,829,600 $2,935,700 $2,368,400 $489,800 $1,630,600 Notes:
- New Partner Amendments/Agreements needed before LOC can be used. 224
40 TIME CHECK AND BIO BREAK
225
41 1900 Embarcadero Update
226
42 WORKSPACE PLANNING: SPACE FOR STAFF IS HIGHLY CONSTRAINED Byxbee
Park
Airport
Wetlands
227
43 RWQCP Expansion and Enhancements
• Construction & Capital Project Support
– Contractor staging area and overflow
parking
– Construction management offices (replacing
temporary on-site trailers).
– Expansion of RWQCP footprint and removal
of property fence to improve site integration.
• Workforce Safety
– Removes the liability of staff and visitors
visiting RWQP site during construction.
• Operational & Workforce Improvements
– New employee locker rooms and upgraded
facilities
– Relocation of other Public Works ESD staff
to consolidate operations near RWQCP.
– Utilization of All Hands Meeting Space in
1900 Embarcadero Way saves a $6 million
capital improvement project to renovate the
Admin Building.
• Allows for separation of treatment processes usage
in the Admin Building from future workspace usage.
• Community & Public Interface
– Dedicated public-facing space for RWQCP
meetings, tours, and bid walks.
– Space for programming with Palo Alto
Unified School District.
– Community Meeting Room
• Potential Collocation with Other City
Groups
– Utilities, Zero Waste, Airport, CSD Baylands
HOW 1900 EMBARCADERO COULD BE UTILIZED
228
44 1900 EMBARCADERO UPDATE • Costs will continue to be treated as RWQCP operating expenses and fall
within the existing cost allocation
framework—no agreement amendments
needed.
• Funding will come from a combination of
the Palo Alto’s Line of Credit and
Wastewater Treatment fund balance,
later rolled into utility revenue bonds.
• Financial impact to partners projected at
an annual average of $1.76M over 35
years; current leasing cost
(~$0.40M/year) will be eliminated.
229
45 Long Range Facility Plan Update
• Status Update
• 10-Year Capital Improvement Projects
The Long Range Facility Plan
Update (LRFPU) builds on the
previous LRFP (2012) to
anticipate the RWQCP needs
over the next 50 years. The
LRFPU includes:
• Current and projected
treatment requirements,
• Workspace plan,
• Biosolids facility plan
update; and
• Updated CIP program. There will be a separate
meeting for Partners to go
over the LRFPU in detail.
230
46 LRFPU 2026-27 TIMELINE
Develop Capital Improvement
Plan (including Project
Estimates, Sequencing, and
Schedules)
February 2026
Biosolids Facility
Plan Update –
Public Meeting
June 2026
Parks and Recreation
Commission –
Measure E Findings
Spring 2026
Project
Identification
August 7, 2026
Climate Action &
Sustainability Committee
– LRFPU Update
Prepare Draft
Report
Begin Preparation for
Partner Presentation
Materials
Fall 2026
BSFPU and Measure E
Recommendation to Council
2027
Final LRFPU to Council
Public Meetings Plan Development
Carollo Amendment to support add’l
analyses and Partner presentations
231
47 APPROACH FOR IDENTIFYING CIP PROJECTS
Project Drivers
Capacity Condition
Assessment Regulatory Policy City Needs
Next 5
years
Near
Term
Projects
5 – 15
years
MidTerm
Projects
15+
years
Long
Term
Projects
Implementation Timeline
We are looking at the 10-year CIP for forecasting purposes. 232
48 LRFPU: 10-YEAR CIP IDENTIFICATION
Major Capital
•New Effluent Outfall Discharge System
•New Headworks Facility
•New Tertiary Filtration Facility
•Effluent Discharge UV Dinsinfection
Upgrades
Liquids
Treatment
•Gravity Thickener Rehabilitation
•New Thickening Facility
Solids
Management
•Recycled Water Storage & Distribution
Evaluation
•New Recycled Water Disinfection System
Recycled
Water
•Operations Building Rehabilitation
•Plant Water System Improvements
•New GIS System Development
Plantwide
Infrastructure
Project Drivers
Capacity Condition
Assessment Regulatory Policy City Needs
233
49 50-YEAR CIP AT A GLANCE (BY PROGRAM AREA)
Liquids Treatment
FY25
New Headworks
Facility (H-01)
New Tertiary
Filtration Facility
(TT-03)
FY30 FY35 FY40 FY45 FY50 FY75
New Effluent
Outfall Discharge
System (O-01)
Effluent Discharge UV
Disinfection Upgrades
(TT-05)
STU Phase 2 (ST11)
Program Areas
STU Phase 1
Solids Management
Gravity Thickener Rehab
(T-01)
New Thickening Facility (T04)Potential New Mesophilic
Anaerobic Digestion (B-01)
Potential New Thermal
Drying (B-02)
Potential New
Pyrolysis (B-03)
AWPS Phase 1 Recycled Water
AWPS Phase 2
(RW-09)
New RW Disinfection
System (RW-07)
RW Storage & Distribution
Evaluation (RW-04)
Operations Building
Rehab (WP-03) Plantwide Infrastructure
Yard Piping Improvements (YP04)
Plant Water System
Improvements (WS-02) LRFP-U (PP-03)
New GIS System
Development (YP-01)
Climate Adaptation
Potential New Hybrid Horizontal Levee
& Flood Wall (SLR-02)
Asset Level Protection
(SLR-01)
Roadmap shows select milestone projects that shape the long-term CIP.

Icons identify when major facilities and improvements are expected to be. online.
10-Year CIP
234
50 Annual Budget Forecast Preparation
235
51 Task Start End
May Dry Weather Partner Wastewater Sampling Analyses 5/3 7/24 Flowmeter Data Collection and Analysis 7/1 7/20
Minor CIP Prioritization 7/15 9/10
Major CIP Debt Assumptions 8/19 9/17
Flow and Load Share Calculations 7/27 8/21
End of Year Calculations as Part of City's Annual Comprehensive Financial Reporting 8/24 12/1
City Budget Activities 7/1 12/1
Partner’s Meeting Presentation Development 9/21 11/6
Quarter Two True-Up Billing 10/1 11/15
Development of Partner Specific Forecasts based
on FY25 Actuals 10/8 10/29
Annual November Partner's Meeting (Thursday before Thanksgiving) 11/19 11/19 Overall timeline 5/3 12/1
• Reflects change to
dry-season sampling

ANNUAL RWQCP BUDGET FORECAST PREPARATION SCHEDULE
Applies to
Mountain
View, Palo
Alto, Los
Altos, and
East Palo
Alto SD
236
52 FLOW AND LOAD SHARE CALCULATIONS

MV PA LA EPASD SU LAH TOTAL
Previously
Forecasted Flow
and Load
Share Split for FY
26 (Based on FY 24
Actual Flows and
Load Data)

39.31% 36.66% 10.14% 5.56% 6.35% 1.98% 100%
Final Calculated
Flow and Load
Share for FY 26

42.26% 35.36% 8.40% 5.39% 6.41% 1.98% 100%
237
53 SUMMARY OF ANTICIPATED FORECAST/BUDGET ITEMS
FY 26 True-up
(2nd Qrtr Bill)
Summer 2026 Fall 2026 Winter 2026/27 Spring 2027 Summer 2027 FY 28 Forecast and
Partners Mtng**
November 19, 2026
LOC
Implementation/Use
Draft Amendment
Language for:
• Reserve Fund Policy
• Amended
Flow/Load Share
Calculation
• 3-yr rolling
average
• 1/3 flow, 1/3
COD, 1/3
NH3
** 10-year forecast will include anticipated reserve policy, with ramp up funds starting in FY 29 LOC to CPA Council for
approval
Partners review/accept
LOC amendment
language
Provide updated on
status of 1900 Emb.

Sept Partners Mtng
Long Range Facility Plan Update
Communications/Presentations
238
54 Capital Program Updates
• Ongoing Project Overview
239
55 STU PROJECT (BLOWER ROOM BEFORE / AFTER)
240
56 STU PROJECT (NEW RAS PUMP STATION & LC-11)
241
57 STU PROJECT (CURRENT PROGRESS, AERATION BASIN #2)
242
58 12-KV LOOP PHASES 2 THRU 7
• Installation of new electrical
service entrance cabinet from
CPAU (cabinet is elevated to
account for SLR)
• Installation of five (5) new
switchboxes
• All equipment is installed • Coordinating with Operations for 12-KV cable pulls / terminations to
integrate new equipment into the
12-KV Loop
• Scheduled for August / Sept.
243
59 12-KV LOOP PHASES 2 THRU 7
NEW CPAU #2 CABINET & 1 OF 5 NEW

SWITCHBOXES
244
60 12-KV LOOP SUPPORT AGREEMENT (PENDING)
❑ RWQCP electricians not qualified to perform switching or service on 12-KV equipment ❑ Agreement provides for emergency and afterhours response ❑ Equipment Isolation: safety, de-energization, switching operations, troubleshooting ❑ Peer Reviews: analyses, designs, procedures, calculations, and reports RWQCP / CPAU-E working towards agreement for CPAU-E emergency support 245
61 12-KV LOOP & STU PROJECTS SHUTDOWNS IN 2026
❑ 33 Mechanical / process shutdowns (piping tie-ins / equipment integration) ❑ 4 of Electrical shutdowns (3 on STU / 1 on 12-kV Loop) ❑ 1 full RWQCP shutdown (backing up the sewer)
• Shutdowns required for mechanical, process, electrical, and full RWQCP shutdowns to support construction to integrate new equipment, processes into the existing, operating RWQCP • Many times this work must be done at minimal flow to minimize the disruption to the RWQCP to reduce Plant risk and to reduce contractor costs
• Full RWQCP Shutdowns typically begin at midnight to 2 am and can only last until about 8 am before flows increase and contractors need to vacate work areas as the RWQCP is returned to service
246
62 AWPS PROJECT (ODOR CONTROL UNIT)
• Provides odor control for NPP
• Required to replace NPP in-ground
biofilter odor control unit
• Biofilter demolition required to
allow construction of the AWPS
• Commissioned and put into service
in Jan / Feb 2026
247
63 AWPS PROJECT (CURRENT PROGRESS)
• Installation of interconnecting
piping for MF Feed line and RO
Permeate line
• Underground conduits and process
piping being installed under slab
• Electrical ductbanks to encase
conduits are on-going
• Working towards slab pours for the
AWPS main process area and
Permeate Tank in Sept / Oct
248
64 OUTFALL PIPELINE PROJECT NEXT STEPS
• Gain FAA concurrence for pipelines easements appraisals for FMV (annual rental fees) • Draft / approve MOUs between PAO and PWE, RWQCP, and EPA • Amend designer contract for redesign and revised SOW
249
65 PROGRAM SCHEDULE UPDATE
Completed Program Projects >$3M:
✓ Sludge Dewatering and Loadout Facility
✓ Primary Sedimentation Tank Rehabilitation
✓ Joint Intercepting Sewer Rehabilitation
250
66 End of Slides
We appreciate your participation and feedback!
251
INFORMATIONAL REPORT 11.1

EAST PALO ALTO

CITY COUNCIL

STAFF REPORT
DATE: October 20, 2026
TO: Honorable Mayor and Members of the City Council
VIA: Melvin E. Gaines, City Manager
BY: Yajaira Morales, Housing Project Manager
Karen Camacho, Housing and Economic Development Manager SUBJECT: Measure JJ Anti-Displacement Program Utilization Report Recommendation
Receive special presentations from WeHOPE, Community Legal Services of East Palo Alto (CLSEPA) and Legal Aid Society of San Mateo County (Legal Aid SMC), Samaritan House, and East Palo Alto Community Alliance and Neighborhood Development Organization (EPACANDO) on the use of Measure JJ anti-displacement funds, launched in 2026.

Alignment with City Council Strategic Plan
This recommendation is primarily aligned with:

Priority: Comprehensive Housing
Background
Measure JJ passed in November 2024 with the following allowable uses: 1) at least 30% for tenant rental assistance; 2) up to 20% for the City’s administrative and overhead costs to manage the programs; and 3) the remaining revenue may, at the City Council’s discretion, be used for affordable homeownership, affordable housing preservation, tenant support, and antidisplacement and homelessness prevention. Measure JJ also requires City Council to periodically review housing policy, housing programs, and related issues to determine how and to what extent the City should establish and fund such programs.

In October 2025, the City Council allocated $1,110,530 in Measure JJ funds toward rental assistance and foreclosure prevention services in East Palo Alto, based on the projected annual revenue of $1.7 million, based on the City’s business license administrator’s projection. The actual revenue generated is calculated in April of each year, after revenue is collected between 252
INFORMATIONAL REPORT 11.1
January to March; the FY 25-26 revenue was approximately $1.75 million based on unaudited data.

The 2023-2031 Housing Element (adopted by the City Council on March 19, 2024) is a required element of the Vista 2035 General Plan, and accomplishment of its goals and programs is monitored and enforced by the California Department of Housing and Community Development (HCD). The 2024-2028 Affordable Housing Strategy (adopted February 6, 2024) is a five-year City Council-adopted plan that supports and implements parallel policies and programs to those in the Housing Element, including several anti-displacement policies and programs that are funded by Measure JJ, such as foreclosure prevention (Policy 4.9), rental assistance (Policies

4.11 and 4.12), legal anti-eviction services (Policy 5.7), and landlord/tenant mediation services (Policy 5.8).

The purpose of this staff report is to provide an update on the utilization of the program thus far.

During the special presentations, Council will hear from services providers about their accomplishments so far. A more detailed report is expected to be provided in Quarter 4 of 2027.

Analysis
Measure JJ is currently funding rental assistance, anti-eviction legal services, and foreclosure prevention. At the October 21, 2025, City Council meeting, Council appropriated funding in each program such that when summed with other program costs, it would result in forty-five percent (45%) of Measure JJ revenues going toward direct rental assistance subsidies (to the extent there is sufficient funding, as determined by the Finance Director) for each program awarded.

Table 1 provides an overview of the funding allocations, goal and to-date number of households assisted, and the percent of funds used thus far.

Rental Assistance
Through Measure JJ, the City funds Community Legal Services of East Palo Alto (CLSEPA), Samaritan House, and WeHOPE up to $701,500 annually across all three organizations (for three years) for direct rental and financial assistance for East Palo Alto residents. These contracts may be extended for an additional two-year term if funds remain unexpended by the end of the three-year contract term.

Providers are expected to conduct targeted outreach, reduce barriers to access (such as language and cultural needs), respond promptly to service requests, and collaborate with community partners to expand impact.

Legal Services
Through Measure JJ, the City also funds CLSEPA and its subcontractor, Legal Aid Society of San Mateo County (Legal Aid SMC), up to $407,500 annually to provide legal services such as landlord/tenant mediation, eviction defense, and unlawful detainer assistance. Of this annual amount, $115,000 is allocated for direct rental assistance, $239,348 for legal services, and 253
INFORMATIONAL REPORT 11.1
$53,152 for administrative activities. The faster expenditure of Measure JJ funding for legal services may suggest that a significant share of residents require legal assistance once a case has advanced to court. This raises an important question for evaluating Measure JJ: whether future resources should be targeted more heavily toward interventions before an unlawful detainer (a legal action initiated by a landlord to remove a tenant who has remained in a property without the legal right to do so) is filed, or whether the current level of unlawful detainer funding reflects the point at which residents are experiencing the greatest need for assistance.

Foreclosure Prevention
Through Measure JJ, the City further funds East Palo Alto Community Alliance and Neighborhood Development Organization (EPACANDO) via a one-time allocation of up to $148,500 for a pilot program providing foreclosure prevention services to one household already working with EPACANDO. The contract is expected to be extended for one additional one-year term, through October 2027, to allow the finalization of the program and utilization of all funds.

Staff will return to Council with a deeper analysis on the foreclosure prevention lessons learned as part of the Strategic Priority Ch-4 to research the feasibility of a financial empowerment and foreclosure prevention program, upon conclusion of the pilot program with EPACANDO. 254
DRA = Direct Rental Assistance; DFA = Direct Financial Assistance; Legal = Legal Assistance; OPC = Other Program Costs; Admin = Nonprofit Administration Cost (e.g. 15%) *Based on proposals submitted by the selected organizations and approved by City Council Table 1. Measure JJ Contracts Overview and Use of Funds through September 2026 Measure JJFunded
Organization
Service Area Contract
Term
Contract
Start Date
Annual
Funding by Category
(Year 1)
Cost Per
Household
Goal #
Assisted in
Year 1*
Total
Assisted
Funding
Used to
Date
CLSEPA Direct Rental and Financial
Assistance 3 Years 1/12/26 $170,000 DRA Up to $8,000 34 4 7% $25,500 Admin Subtotal $195,500 12% $13,470
WeHOPE Direct Rental and Financial
Assistance 3 Years 1/12/26
$218,000 DRA Up to $5,000
$2,000 OPC 145 2 1%
$33,000 Admin
Subtotal $253,000 1% $3,703
Samaritan House Direct Rental and Financial
Assistance 3 Years 6/1/26 $220,000 DRA Up to $2,200 100 Not yet available 0% $33,000 Admin Subtotal $253,000 0% $0
CLSEPA & Legal
Aid SMC
Legal Services and Direct
Rental Assistance 3 Years 1/12/26
$239,348 Legal 30 21 66%
$115,000 DRA Up to $5,000 23 3 13%
$53,152 Admin - - 4%
Subtotal $407,500 45% 43%
EPACANDO Foreclosure Prevention 1 Year Pilot 10/21/26
$100,000 DFA $100,000
1 1
100%
$35,000 OPC 46%
$13,500 Admin 86%
Subtotal $148,500 100% 100% $127,798
Total $1,257,500 - 333 31 (9%) $319,546
255
INFORMATIONAL REPORT 11.1
Next Steps
Staff will bring to Council a detailed report once all participating organizations have completed two years of service, which will be in Quarter 4 of 2027. The report will provide an update on the services delivered and the data collected during the first two years. At the three-year mark, Council will have the opportunity to review the outcomes and determine when the next Request for Proposals for anti-displacement services should be issued.

Fiscal Impact
There is no fiscal impact.

Public Notice
The public was provided notice by making the agenda and report available on the City’s website and on a bulletin board located at City Hall: 2415 University Avenue, East Palo Alto.

Government Code § 84308
Applicability of Levine Act: No, as the proposed action doesn’t entail an entitlement.

Analysis of Levine Act Compliance: Not applicable.

Attachments
None.
256
POLICY AND ACTION ITEM 13.1

EAST PALO ALTO

CITY COUNCIL

STAFF REPORT
DATE: October 20, 2026
TO: Honorable Mayor and Members of the City Council
VIA: Melvin E. Gaines, City Manager
BY: James Colin, City Clerk
SUBJECT: Commission Appointments
Recommendation
Interview applicants for the following open seats on the Rent Stabilization Board (2), and appoint applicants for the seats for the board using the selection process recommended by staff.

Alignment with City Council Strategic Plan
This recommendation is primarily aligned with:

Priority No. 1: Promote Housing, Economic and Workforce Development Priority No. 3: Promote Health & Public Safety
Priority No. 4: Ensure Our Financial and Organizational Health Government Code § 84308
Applicability of Levine Act: No
Analysis of Levine Act Compliance: Not applicable
Background
The City Council of the City of East Palo Alto is seeking candidates to make appointments for the following seats:
257
POLICY AND ACTION ITEM 13.1
Rent Stabilization Board appointments for the following terms:

Regular Seat No. 3: From May 31,2024, through May 31, 2027 Alternate Seat No. 8: From May 31,2025, through May 31, 2028 The application period has been held open from July 8 through September 25, 2026; however, these positions remain open until filled. The City accepted applications electronically via the SurveyMonkey platform and offered to assist anyone who needed help submitting the application.

The City conducted outreach, including in-person efforts and through its social media outlets to ensure a comprehensive approach to the outreach process. Social media outlets included various newsletters disseminated to over 4,000 residents, Facebook ads, and the City website.

Selection Process
In order to ensure an efficient and transparent Brown Act-compliant selection process, the procedure for review is as follows:

1. City Council will review the applications attached to the October 6, 2026, agenda.

2. City Council will be provided a voting form at the beginning of the agenda item from the City Clerk.

3. City Council will conduct interviews.

4. City Council will make its selections by ballot vote.

Attachments

1. Rent Stabilization Board Applications (redacted)
258
Q1
Name
Jose Sanchez
Q2
Home Address
1675 Woodland Ave
Q3
City
East Palo Alto
Q4
E-mail Address
[email protected]
Q5
Phone Number
650-391-5979
Q6
Are you available to attend regular Board meetings
scheduled for the second Wednesday of every month at
7:00 pm?
Yes
#2

CCOOMMPPLLEETTEE
Collector: Web Link 1 (Web Link)
Started: Wednesday, September 02, 2026 7:48:11 PM
Last Modified: Wednesday, September 02, 2026 7:59:22 PM Time Spent: 00:11:11
IP Address: 50.207.0.170

Page 1 ends

East Palo Alto City CouncilOctober 20, 2026

East Palo Alto City Council
October 20, 2026