El Cerrito City Council
July 18, 2023

Mayor Councilmembers
Lisa Motoyama Paul Fadelli
Mayor Pro Tem Gabriel Quinto
Tessa Rudnick AGENDA Carolyn Wysinger

TUESDAY, JULY 18, 2023
REGULAR CITY COUNCIL MEETING (6:00 PM)
City Council Chambers - 10890 San Pablo Ave, El Cerrito Additional In-Person Location:

HOLIDAY INN EXPRESS & SUITES, 2102 South C St., Tacoma, WA 98402 Ask at front desk for room number for remote meeting location
Join Via Zoom:
https://us06web.zoom.us/j/81274051504?pwd=Z1g4OGVxQXJWNExhTldxMFNONHhCZz09 Meeting ID: 812 7405 1504 Password: 374534 Dial in: 1-408-638-0968 View:

1. Cable T.V. Broadcast on KCRT Channel 28

2. Livestream Online at www.el-cerrito.org/CouncilMeetingMaterials Accommodations: In compliance with the Americans with Disabilities Act, if you need special assistance to participate in this meeting, please contact the City Clerk at 510- 215-4305. Notification 48 hours prior to the meeting will enable the City to make reasonable accommodations. Closed Captions available via zoom.

Conduct: This meeting shall be conducted pursuant to the El Cerrito City Council Rules of Order and Procedure, including adjourning by 11:00 PM unless extended to a specific time determined by a majority of the Council.

Public Comments:

1. In-person by submitting a request to speak to the City Clerk.

2. Via Zoom using the “Raise Hand” icon to request to speak.

3. By Phone at 1-408-638-0968, dial *9 to "raise your hand".

4. By Email to [email protected] identified in the subject line as Public Comments – Agenda Item #.

Written comments received by 2:00 p.m. the day of the meeting will be provided to the City Council and posted online in advance of the meeting. Comments received after the deadline will be provided to the City Council and will be posted after the meeting. 6:00 PM ROLL CALL – CONVENE REGULAR CITY COUNCIL MEETING

1. CONSIDER AND TAKE ACTION ON ANY REQUEST FROM A

COUNCILMEMBER TO PARTICIPATE IN THE MEETING REMOTELY DUE TO EMERGENCY CIRCUMSTANCES PURSUANT TO AB 2449
Agenda Packet Page 1 of 209
Mayor Councilmembers
Lisa Motoyama Paul Fadelli
Mayor Pro Tem Gabriel Quinto
Tessa Rudnick AGENDA Carolyn Wysinger

2. PLEDGE OF ALLEGIANCE TO THE FLAG OR OBSERVATION OF A

MOMENT OF SILENCE

3. TELECONFERENCE AND PUBLIC COMMENT INSTRUCTIONS

4. COUNCIL/STAFF COMMUNICATIONS
Reports of closed session, commission appointments and informational reports on matters of general interest which are announced by the City Council and staff.

5. ORAL COMMUNICATIONS FROM THE PUBLIC
Remarks are typically limited to 3 minutes per person. The Mayor may reduce the time limit per speaker depending upon the number of speakers and may limit the total time for public comment to facilitate the completion of business on the agenda. Comments regarding non-agenda, presentation and consent calendar items will be heard first.

Comments related to items appearing on the Public Hearing or Policy Matter portions of the Agenda will be heard prior to the City Council taking action on each item.

6. PRESENTATIONS
A. Summer 2023 I-80 Pavement Rehabilitation Project
Action Proposed: Receive and file a presentation from Caltrans District 4 on a paving project on both directions of I-80 starting at the end of July through September.

Contact: Andrew Baskerville, Contra Costa County Construction Manager, and Bart Ney, Public Affairs & Strategic Communications, Caltrans Bay Area

7. ADOPTION OF THE CONSENT CALENDAR
All items on the consent calendar shall be acted upon in one motion, unless a member of the City Council or staff request separate consideration.

A. Crime Prevention Committee Appointment of Brett Guest Action Proposed: Approve a Crime Prevention Committee
recommendation to appoint Brett Guest to the Crime Prevention Committee, effective July 18, 2023.

Contact: Sergeant Aaron Leone, El Cerrito Police Department B. Approve Three-Year Agreement between the City of El Cerrito and Chavan and Associates, LLP to Perform Required Independent Agenda Packet Page 2 of 209
Mayor Councilmembers
Lisa Motoyama Paul Fadelli
Mayor Pro Tem Gabriel Quinto
Tessa Rudnick AGENDA Carolyn Wysinger

Audit Services for Fiscal Years 2022-23, 2023-24 and 2024-25 Action Proposed: Adopt a resolution authorizing the City Manager to execute a three-year professional services agreement in an amount not to exceed $202,500 with Chavan and Associates, LLP, Certified Public Accountants to perform required independent audit services for Fiscal Years 2022-23, 2023-24 and 2024-25, with the option to extend the contract for an additional two (2) one-year terms.

Contact: Alexandra Orologas, Assistant City Manager, City Management C. Agreement between the City of El Cerrito and West Coast Vending and Food Service, Inc. to Provide Food Services to the El Cerrito Police Department
Action Proposed: Adopt a resolution authorizing the City Manager to enter into an agreement with West Coast Vending and Food Services, Inc. to provide vending services, including the purchase of materials, supplies, and/or equipment to the City of El Cerrito for an amount not to exceed $75,000 annually from July 1, 2023 through June 30, 2025.

Contact: Paul Keith, Chief of Police, El Cerrito Police Department D. Agreement with Motorola Solutions to Upgrade El Cerrito Police Department Radios with Encryption Software
Action Proposed: Authorize the City Manager to enter into an agreement with Motorola Solutions, Inc. for the provision of encryption software upgrades to El Cerrito Police Department radios for a cost not to exceed $135,000.

Contact: Paul Keith, Chief of Police, El Cerrito Police Department E. Consulting Services Agreement between the City of El Cerrito and Kittelson & Associates, Inc. to Provide Transportation Planning and Engineering Services for the Local Road Safety Plan
Action Proposed: Adopt a resolution authorizing the City Manager to execute a consulting services agreement for an amount not to exceed $87,000 with Kittelson & Associates, Inc. (Kittelson) to provide transportation planning and engineering services to initiate, develop, and complete a Local Road Safety Plan (LRSP).

Contact: Yvetteh Ortiz, Public Works Director/City Engineer, Public Works Department; Jarrett Mullen, Sustainable Transportation Program Manager, Community Development Department
Agenda Packet Page 3 of 209
Mayor Councilmembers
Lisa Motoyama Paul Fadelli
Mayor Pro Tem Gabriel Quinto
Tessa Rudnick AGENDA Carolyn Wysinger

F. Amendment to Agreement with Cox Automotive Mobility Fleet Services for Fleet Maintenance Services
Action Proposed: Adopt a resolution to authorize the City Manager to amend the agreement with Cox Automotive Mobility Fleet Services for Fleet Maintenance Services by $15,000 for a total amount not to exceed amount of $203,100 for Fiscal Year 2022-23.

Contact: Christina Leard, Management Analyst III; Susan Kattchee, Interim Operations & Environmental Services Division Manager; Yvetteh Ortiz, Public Works Director/City Engineer, Public Works Department G. Agreement with SSP Data to provide DarkTrace Detect and Response Security Monitoring Services
Action Proposed: Adopt a resolution to authorize the City Manager to execute the pricing agreement with SSP Data for DarkTrace Holding Limited’s cybersecurity services in an amount not-to-exceed $380,000 over a four-year period.

Contact: Eric Ng, Acting IT Manager, Information Technology Department

8. PUBLIC HEARINGS
A. Fire Hazard Abatement
Exempt from CEQA review pursuant to Sections 15304 and 15308, Notice published 7/8/2023
Action Proposed: 1) Adopt a resolution declaring weeds, rubbish, litter, or other flammable material on certain real property identified in the resolution constitutes a public nuisance; and 2) Conduct a public hearing and upon conclusion, adopt a resolution overriding objections by property owners and ordering the City Manager or their designee to abate certain public nuisances pursuant to El Cerrito Municipal Code Chapter 16.26.

Contact: Traviss Crumpacker, Fire Prevention Officer; Chase Beckman, Fire Marshal, Fire Department

9. POLICY MATTERS

10. CITY COUNCIL LOCAL & REGIONAL LIAISON ASSIGNMENTS
Mayor and City Council communications regarding local and regional liaison Agenda Packet Page 4 of 209
Mayor Councilmembers
Lisa Motoyama Paul Fadelli
Mayor Pro Tem Gabriel Quinto
Tessa Rudnick AGENDA Carolyn Wysinger

assignments, committee reports, and any required reporting under AB 1234 for meetings (as defined by the Brown Act) attended at the public's expense.

11. ADJOURN REGULAR CITY COUNCIL MEETING
The next regularly scheduled City Council meeting is Tuesday, August 15, 2023 at 6:00 p.m.

The City of El Cerrito serves, leads and supports our diverse community by providing exemplary and innovative services, public places and infrastructure, ensuring public safety and creating an economically and environmentally sustainable future.

Agenda Packet Page 5 of 209
I-80 Pavement Rehabilitation Project
Contra Costa County, Project 3J070
1 Agenda Item No. 6
Agenda Packet Page 6 of 209
Project
Location
This project is in Contra Costa County on Interstate 80 (I‐80) from the State Route 4 separation (Post Mile 10.1) in Hercules, to the Carquinez Bridge (Post Mile 13.5), in Crockett.

Agenda Packet Page 7 of 209
Project Need
The existing pavement exhibits signs of distress, resulting in poor ride quality and the potential for pavement failure. 3 Agenda Packet Page 8 of 209
Project
PurposeTo extend the service life of the pavement and enhance highway safety. 4 Agenda Packet Page 9 of 209
Project
Scope
 26 lane‐miles of pavement resurfacing and restoration for the mainline freeway and ramps within the project limits
 Electrical, Drainage, signing work Upgrading curb ramps at ramp termini to be ADA compliant Construction Capital Cost is $50m State Highway Operations & Protection Program (SHOPP) & SB1 funding
5 Agenda Packet Page 10 of 209
Scheduled
Closures
I‐80 Weekend Closures Eastbound (56 hours each weekend)  July 21, Friday (9:00pm) – July 24, Monday (5:00am) August 4, Friday (9:00pm) – August 7, Monday (5:00am) August 18, Friday (9:00pm) – August 21, Monday (5:00am)  Westbound (104 hours) – Labor Day Weekend
 August 31, Thursday (9:00pm) – September 5, Tuesday (5am) Agenda Packet Page 11 of 209
Need for
Full Closure
Removal of existing paving and installation of Continuously Reinforced Concrete Pavement (CRCP) is a labor and equipment intensive operation.Safety of Caltrans and Contractor staff.Safety of travelling public.Performing weeks of overnight work in each weekend.

STEP 1: Demolition STEP 2: Base preparation
STEP 3: Reinforcing steel STEP 4: Concrete placement
Agenda Packet Page 12 of 209
Benefits of
CRCP
4 weekend closures vs. Over 120 nights of closuresProject should finish in late 2023 instead of late 2024.Improved ride quality now ‐ CRCP has no joints.Improved ride quality later – less likely to crack / settle / rock in future due to reinforcing steel.

Agenda Packet Page 13 of 209
Traffic
Management Plan
• Regional Changeable Message Sign
(CMS) Deployment
• Detours• Outreach Effort
9 Agenda Packet Page 14 of 209
Major Regional
Detours for EB 80
Eastbound I‐80 Closed at SR4Oakland / SF Area traffic diverted to EB SR24 to NB I‐680 or EB SR4 to I‐5San Jose / Hayward Area traffic diverted to EB 580 to I‐5 10 Agenda Packet Page 15 of 209
Regional
Detours forEB 80 Closure
11 Agenda Packet Page 16 of 209
Major
Regional Detours for WB 80
Westbound I‐80 Closed at I‐780Vacaville / Fairfield Area traffic diverted to SB I‐680 from I‐80 in Cordelia Tahoe/Sacramento Area traffic diverted to SB I‐5 to WB SR4 or WBI‐580 12 Agenda Packet Page 17 of 209
Regional
Detours for WB 80 Closure
13 Westbound I‐80 Closure
Agenda Packet Page 18 of 209
Regional
CMS Deployment
14 Agenda Packet Page 19 of 209
Regional
CMS Deployment
Eastbound I‐80 Closure
15 Agenda Packet Page 20 of 209
Westbound I‐80 Closure
16 Regional CMS Deployment
Agenda Packet Page 21 of 209
Outreach
Effort
• Caltrans will notify public via:
• City Council Meetings• Radio/TV Station News• Paid Media Advertisements• Caltrans Website• Social Media (Caltrans & Cities)• Press Release/Traffic Advisories Agenda Packet Page 22 of 209
Outreach Effort:

Webpage and Project Hotline
For Additional project information:Caltrans CC 80 Pave Project Website www.CC80pave.com
CC I-80 Pave Project Hotline Number:(510) 286-0319
Agenda Packet Page 23 of 209
Outreach
Effort
• Contacts:

Vince JacalaCaltrans Public Affairs Branch [email protected](510) 286‐5206Bart NeyCaltrans Public Affairs Office [email protected](510) 715‐7212Pedro QuintanaCaltrans Public Affairs Branch [email protected](510) 867‐6028 Agenda Packet Page 24 of 209
Questions & Comments
20 Agenda Packet Page 25 of 209

AGENDA BILL
Agenda Item No. 7.A.

Date: July 18, 2023
To: El Cerrito City Council
From: Sergeant Aaron Leone, El Cerrito Police Department Subject: Crime Prevention Committee Appointment of Brett Guest

ACTION PROPOSED
Approve a Crime Prevention Committee recommendation to appoint Brett Guest to the Crime Prevention Committee, effective July 18, 2023.

BACKGROUND/ANALYSIS
Brett Guest has submitted an application to join the Crime Prevention Committee (CPC). Mr. Guest has regularly attended the monthly CPC Meetings and has attended more than three meetings this year. The Crime Prevention Committee voted unanimously during the regularly scheduled meeting on May 1st, 2023, to recommend the City Council appoint Brett Guest as a member of the committee. Since then, he has completed and successfully passed the background investigation.

Brett Guest has explained that his family has lived in El Cerrito since the 1930s. He and his family are rooted in the community and he has no plans on leaving. In 2017, he prevented a violent crime in El Cerrito and was recognized by the El Cerrito City Council for his actions. Mr. Guest is interested in making El Cerrito a safer place.

If the City Council approves this recommendation, the number of Committee members will be 4 out of a possible membership total of 15, as established by Resolution 2001- 105.

STRATEGIC PLAN CONSIDERATIONS
This item is in alignment with Strategic Goal E: Ensure the Public's Health and Safety.

ENVIRONMENTAL CONSIDERATIONS
This item is in alignment with Strategic Goal E: Ensure the Public's Health and Safety.

FINANCIAL CONSIDERATIONS
This section is not applicable to this agenda item.

LEGAL CONSIDERATIONS
This section is not applicable to this agenda item.

Reviewed by:

Agenda Packet Page 26 of 209
Agenda Item No. 7.A.

Karen Pinkos, City Manager
Attachments:

Application(s) on File with the City Clerk
Agenda Packet Page 27 of 209

AGENDA BILL
Agenda Item No. 7.B.

Date: July 18, 2023
To: El Cerrito City Council
From: Alexandra Orologas, Assistant City Manager, City Management Subject: Approve Three-Year Agreement between the City of El Cerrito and Chavan and Associates, LLP to Perform Required Independent Audit Services for Fiscal Years 2022-23, 2023-24 and 2024-25

ACTION PROPOSED
Adopt a resolution authorizing the City Manager to execute a three-year professional services agreement in an amount not to exceed $202,500 with Chavan and Associates, LLP, Certified Public Accountants to perform required independent audit services for Fiscal Years 2022-23, 2023-24 and 2024-25, with the option to extend the contract for an additional two (2) one-year terms.

BACKGROUND/ANALYSIS
The City is required to obtain independent audit services to:
• Provide stakeholders with an auditor's opinion on whether the financial statements of an entity are presented fairly, free from material misstatements, and complied in all material respects.
• Comply with Office of Management and Budget Circular A-133 (Uniform Guidance) requirement for all non-federal government agencies spending more than $750,000 of federal awards in a fiscal year to obtain an annual audit from an independent certified public accountant.
• Assure required supplemental documents to the basic financial statements, as indicated by the Generally Accepted Accounting Principles (GAAP) and Governmental Accounting Standards Board (GASB), are included and subjected to methods of measurement and comparison for consistency. • Align with Government Finance Officers Association (GFOA) best practice recommendations that an annual audit of an agency’s financial statements be conducted by an external auditor.
• Align with the City Of El Cerrito’s Comprehensive Financial Policies, Section

5.1.1. "Annual Audit", which requires an annual audit performed by an independent public accounting firm.

Additionally, these audits must be conducted in conformance with Generally Accepted Auditing Standards (GAAS) and the Government Auditing Standards/Generally Accepted Government Auditing Standards (GAGAS) by a licensed independent public accounting firm. Consequently, auditors complete a risk assessment at the beginning of the planning phase of each audit and create a list of items for testing.

Agenda Packet Page 28 of 209
Agenda Item No. 7.B.

The City of El Cerrito’s Comprehensive Financial Policies Section 5.1.2 states that the independent audit firm will be selected through a competitive bidding process at least once every five years. The contract may be for an initial period of three years, with two additional one-year options. In alignment with this requirement, in June 2017 the City entered into a three-year contract with Badawi & Associates for independent audit services and extended the contract for two additional one-year terms through June 30, 2021, and/or completion of Fiscal Year (FY) 2020-21 audits, for a total of five years. In 2022, due to a significant staffing transition which delayed the ability to issue a formal request for proposals (RFP), the City conducted an information solicitation of audit firms and in August 2022 entered into a one-year contract with Chavan and Associates to audit FY 2021-22. The informal process was deemed necessary to ensure that the City was in compliance with regulatory auditing requirements for FY 2021-22.

On April 14, 2023, the City issued an RFP (Attachment 3) for professional auditing services for three years with the option to extend the contract for an additional two oneyear terms. In turn, five certified public accounting firms submitted responses by the May 5, 2023 deadline. The five proposals received are summarized below in alphabetical order, with proposed baseline costs (not including other report/filing options):

Firm FY 2022-23
Audit
FY 2023-24
Audit
FY 2024-25
Audit
FY 2025-26
Audit
FY 2026-27
Audit
Badawi &
Associates
$54,080 $55,445 $57,085 $58,660 $60,390
Chavan &
Associates
$55,000 $55,000 $55,000 $58,000 $58,000
Eide Bailly $87,560 $91,441 $98,299 $105,672 $113,598
Mun CPAs $78,300 $77,800 $79,800 $81,900 $84,000
The Pun
Group
$70,000 $72,000 $74,263 $76,491 $78,786
The proposals were reviewed by a subcommittee of the Financial Advisory Board (FAB) and the City's contract accountant. Interviews were then conducted by staff and the City's financial consultant on all five firms. After extensive review of the submittals and interviews, staff is recommending that the City engage the services of Chavan and Associates (Attachment 2) to provide the required independent audit services for a three-year period, with an option for an additional two one-year terms. Chavan and Associates, based in San Jose, California, provides a full range of auditing and compilation services, GASB implementation consulting, IRS tax resolution, and financial management accounting services. Chavan and Associates has:
• Confirmed their capacity and willingness to realign audit schedules to assure the City of El Cerrito will complete audits, with the utmost confidence in the quality Agenda Packet Page 29 of 209
Agenda Item No. 7.B.
and thoroughness of the audit services, in adherence with regulatory requirements and within completion deadlines;
• Significant experience in auditing small-to-mid-sized government entities; • Assembled an audit team with expertise and qualities to perform all required audits;
• Peer Review Reports in accordance with the American Institute of Certified Accountants (AICPA) and referrals from Bay Area municipalities; and, • Personalized approach to service delivery and practical approach to fieldwork.

Given that Chavan and Associates successfully completed the City's FY 2021-22 Audit, the Firm's inherited knowledge of the City's financials will be beneficial to begin work on the FY 2022-23 Audit immediately.

City staff recommends that the City Council approve a three-year contract with Chavan and Associates for financial audit services for the FYs 2022-23, 2023-24 and 2024-25 in an amount not to exceed $202,500 (which includes the baseline costs plus expected additional reporting and filing options), and authorize the City Manager to execute the contract.

STRATEGIC PLAN CONSIDERATIONS
Adhering to audit requirements is aligned with the City’s Strategic Plan fulfills Goal B:

Achieve long-term sustainability, which includes ensuring policies, procedures, and systems represent best practices in financial management.

ENVIRONMENTAL CONSIDERATIONS
This section is not applicable to this agenda item.

FINANCIAL CONSIDERATIONS
The cost associated with the professional services agreement to perform required independent audit services for the Fiscal Year ending June 30, 2023 (FY 2022-23), in an amount not to exceed $67,500 is included in the FY 2023-24 Adopted Budget. Costs for the audits for FY 2023-24 and 2024-25 will be included as part of the baseline budget for FYs 2024-25 and 2025-26.

LEGAL CONSIDERATIONS
The City Attorney has reviewed the proposed action and legal considerations have been addressed.

Reviewed by:

Agenda Packet Page 30 of 209
Agenda Item No. 7.B.

Karen Pinkos, City Manager
Attachments:

1. Resolution

2. Proposed Contract + RFP Submittal

3. Request for Proposals for Professional Auditing Services - City of El Cerrito Agenda Packet Page 31 of 209
Agenda Item No. 7.B.

RESOLUTION 2023-XX

RESOLUTION OF THE CITY COUNCIL OF THE CITY OF EL CERRITO AUTHORIZING

THE CITY MANAGER TO EXECUTE A PROFESSIONAL SERVICES AGREEMENT WITH

CHAVAN AND ASSOCIATES, LLP, CERTIFIED PUBLIC ACCOUNTANTS IN AN AMOUNT NOT TO EXCEED $202,500 FOR AUDITING AND FINANCIAL SERVICES WHEREAS, the City of El Cerrito seeks to secure professional services with the required certifications and knowledge and experience to perform auditing and financial services on behalf of the City; and
WHEREAS, the City is required to obtain independent audit services to conduct independent annual audits by a licensed independent public accounting firm in compliance with Office of Management and Budget Circular A-133 requirements for non-federal government agencies, State of California Code 53891, and the City’s Comprehensive Financial Policies and ensure the required supplemental documents to the basic financial statements as indicated by Generally Accepted Accounting Principles and Governmental Accounting Standards Board; and
WHEREAS, the City of El Cerrito’s Comprehensive Financial Policies, Section 5.1.1, states the independent audit firm will be selected through a competitive bidding process at least once every five years; and
WHEREAS, in August 2022, the City entered into a one-year contract with Chavan and Associates to audit FY 2021-22 after an informal solicitation of audit firms due to staff transition; and
WHEREAS, in April 2023, the City issued a Request for Proposals for professional auditing services and evaluated all five proposals received; and WHEREAS, the City has determined that Chavan and Associates is the best qualified among the firms interviewed to perform the City’s Audit; and WHEREAS, the City Council appropriated adequate funds for these annual audit services in the City’s FY 2023-24 Budget and will be included as part of the baseline budget for FYs 2024-25 and 2025-26.

NOW THEREFORE, BE IT RESOLVED by the City Council of the City of El Cerrito that it hereby Authorizes the City Manager to execute a three-year agreement with the option to extend for an additional two (2) one-year terms between the City of El Cerrito and Chavan and Associates, LLP, Certified Public Accountants in an amount not to exceed $202,500, to perform required independent audit services for FYs 2022-23, 2023-24 and 2024-25.

BE IT FURTHER RESOLVED that this resolution shall become effective immediately upon passage and adoption.

I CERTIFY that at a regular meeting on July 18, 2023, the City Council of the City Agenda Packet Page 32 of 209
Agenda Item No. 7.B.
of El Cerrito passed this Resolution by the following vote:

AYES: COUNCILMEMBERS:

NOES: COUNCILMEMBERS:

ABSTAIN: COUNCILMEMBERS:

ABSENT: COUNCILMEMBERS:

IN WITNESS of this action, I sign this document and affix the corporate seal of the City of El Cerrito on .

Alexandra Orologas, Deputy City Clerk
APPROVED:

Lisa Motoyama, Mayor
Agenda Packet Page 33 of 209

CONSULTING SERVICES AGREEMENT BETWEEN

THE CITY OF EL CERRITO
AND

CHAVAN AND ASSOCIATES, LLP
THIS AGREEMENT for consulting services is made by and between the City Of El Cerrito (“City”) and Chavan and Associates, LLP (“Contractor”) (together sometimes referred to as the “Parties”) as of June 27, 2023 (the “Effective Date”).

Section 1. SERVICES. Subject to the terms and conditions set forth in this Agreement, Contractor shall provide to City the services described in the Scope of Work attached as Exhibit A at the time and place and in the manner specified therein. In the event of a conflict in or inconsistency between the terms of this Agreement and Exhibit A, the Agreement shall prevail.

1.1 Term of Services. The term of this Agreement shall begin on the Effective Date and shall end on June 30, 2026, the date of completion specified in Exhibit A, and Contractor shall complete the work described in Exhibit A on or before that date, unless the term of the Agreement is otherwise terminated or extended, as provided for in Section 8. The time provided to Contractor to complete the services required by this Agreement shall not affect the City’s right to terminate the Agreement, as referenced in Section 8. The City may extend the contract for two (2) additional one-year terms.

1.2 Standard of Performance. Contractor shall perform all services required pursuant to this Agreement in the manner and according to the standards observed by a competent practitioner of the profession in which Contractor is engaged.

1.3 Assignment of Personnel. Contractor shall assign only competent personnel to perform services pursuant to this Agreement. In the event that City, in its sole discretion, at any time during the term of this Agreement, desires the reassignment of any such persons, Contractor shall, immediately upon receiving notice from City of such desire of City, reassign such person or persons.

1.4 Time. Contractor shall devote such time to the performance of services pursuant to this Agreement as may be reasonably necessary to meet the standard of performance provided in Section 1.1 above and to satisfy Contractor’s obligations hereunder.

Section 2. COMPENSATION. City hereby agrees to pay Contractor a sum not to exceed $202,500, notwithstanding any contrary indications that may be contained in Contractor’s proposal, for services to be performed and reimbursable costs incurred under this Agreement.

Agenda Packet Page 34 of 209
In the event of a conflict between this Agreement and Contractor’s proposal, attached as Exhibit A, regarding the amount of compensation, the Agreement shall prevail. City shall pay Contractor for services rendered pursuant to this Agreement at the time and in the manner set forth herein. The payments specified below shall be the only payments from City to Contractor for services rendered pursuant to this Agreement. Contractor shall submit all invoices to City in the manner specified herein. Except as specifically authorized by City in writing, Contractor shall not bill City for duplicate services performed by more than one person.

Contractor and City acknowledge and agree that compensation paid by City to Contractor under this Agreement is based upon Contractor’s estimated costs of providing the services required hereunder, including salaries and benefits of employees and subcontractors of Contractor.

Consequently, the parties further agree that compensation hereunder is intended to include the costs of contributions to any pensions and/or annuities to which Contractor and its employees, agents, and subcontractors may be eligible. City therefore has no responsibility for such contributions beyond compensation required under this Agreement.

2.1 Invoices. Contractor shall submit invoices, not more often than once a month during the term of this Agreement, based on the cost for services performed and reimbursable costs incurred prior to the invoice date. Invoices shall contain the following information:
 Serial identifications of progress bills; i.e., Progress Bill No. 1 for the first invoice, etc.;
 The beginning and ending dates of the billing period;  A Task Summary containing the original contract amount for the service category specified in Attachment A, the amount of prior billings for the service category, the total due this period, the balance available under the Agreement, and the percentage of completion;
 At City’s option, for each work item in each service category, a copy of the applicable time entries or time sheets shall be submitted showing the name of the person doing the work, the hours spent by each person, a brief description of the work, and each reimbursable expense;  The total number of hours of work performed under the Agreement by Contractor and each employee, agent, and subcontractor of Contractor performing services hereunder;
 The Contractor’s signature;
 Contractor shall give separate notice to the City when the total number of hours worked by Contractor and any individual employee, agent, or subcontractor of Contractor reaches or exceeds 800 hours within a 12- month period under this Agreement and any other agreement between Contractor and City. Such notice shall include an estimate of the time necessary to complete work described in Exhibit A and the estimate of time necessary to complete work under any other agreement between Contractor and City, if applicable.

Agenda Packet Page 35 of 209

2.2 Monthly Payment. City shall make monthly payments, based on invoices received, for services satisfactorily performed, and for authorized reimbursable costs incurred. City shall have 30 days from the receipt of an invoice that complies with all of the requirements above to pay Contractor.

2.3 Final Payment. City shall pay the last 10% of the total sum due pursuant to this Agreement within 60 days after completion of the services and submittal to City of a final invoice, if all services required have been satisfactorily performed.

2.4 Total Payment. City shall pay for the services to be rendered by Contractor pursuant to this Agreement. City shall not pay any additional sum for any expense or cost whatsoever incurred by Contractor in rendering services pursuant to this Agreement. City shall make no payment for any extra, further, or additional service pursuant to this Agreement.

In no event shall Contractor submit any invoice for an amount in excess of the maximum amount of compensation provided above either for a task, service category, or for the entire Agreement, unless the Agreement is modified prior to the submission of such an invoice by a properly executed change order or amendment.

2.5 Hourly Fees. Fees for work performed by Contractor on an hourly basis shall not exceed the amounts shown on the compensation schedule attached hereto as Exhibit B.

2.6 Reimbursable Expenses. Reimbursable expenses are specified in Exhibit A, and shall not exceed $6,000. Expenses not listed are not chargeable to City.

Reimbursable expenses are included in the total amount of compensation provided under this Agreement that shall not be exceeded.

2.7 Payment of Taxes. Contractor is solely responsible for the payment of employment taxes incurred under this Agreement and any similar federal or state taxes.

2.8 Payment upon Termination. In the event that the City or Contractor terminates this Agreement pursuant to Section 8, the City shall compensate the Contractor for all outstanding costs and reimbursable expenses incurred for work satisfactorily completed as of the date of written notice of termination.

Contractor shall maintain adequate logs and timesheets to verify costs incurred to that date.

Agenda Packet Page 36 of 209

2.9 Authorization to Perform Services. The Contractor is not authorized to perform any services or incur any costs whatsoever under the terms of this Agreement until receipt of authorization from the Contract Administrator.

Section 3. FACILITIES AND EQUIPMENT. Except as set forth herein, Contractor shall, at its sole cost and expense, provide all facilities and equipment that may be necessary to perform the services required by this Agreement. City shall make available to Contractor only the facilities and equipment listed in this section, and only under the terms and conditions set forth herein.

City shall furnish physical facilities such as desks, filing cabinets, and conference space, as may be reasonably necessary for Contractor’s use while consulting with City employees and reviewing records and the information in possession of the City. The location, quantity, and time of furnishing those facilities shall be in the sole discretion of City. In no event shall City be obligated to furnish any facility that may involve incurring any direct expense, including but not limited to computer, long-distance telephone or other communication charges, vehicles, and reproduction facilities.

Section 4. INSURANCE REQUIREMENTS. Before beginning any work under this Agreement, Contractor, at its own cost and expense, unless otherwise specified below, shall procure the types and amounts of insurance listed below against claims for injuries to persons or damages to property that may arise from or in connection with the performance of the work hereunder by the Contractor and its agents, representatives, employees, and subcontractors. Consistent with the following provisions, Contractor shall provide proof satisfactory to City of such insurance that meets the requirements of this section and under forms of insurance satisfactory in all respects, and that such insurance is in effect prior to beginning work to the City.

Contractor shall maintain the insurance policies required by this section throughout the term of this Agreement. The cost of such insurance shall be included in the Contractor's bid. Contractor shall not allow any subcontractor to commence work on any subcontract until Contractor has obtained all insurance required herein for the subcontractor(s) and provided evidence that such insurance is in effect to City. Verification of the required insurance shall be submitted and made part of this Agreement prior to execution. Contractor shall maintain all required insurance listed herein for the duration of this Agreement.

4.1 Workers’ Compensation. Contractor shall, at its sole cost and expense, maintain Statutory Workers’ Compensation Insurance and Employer’s Liability Insurance for any and all persons employed directly or indirectly by Contractor. The Statutory Workers’ Compensation Insurance and Employer’s Liability Insurance shall be provided with limits of not less than $1,000,000 per accident. In the alternative, Contractor may rely on a self-insurance program to meet those requirements, but only if the program of self-insurance complies fully with the provisions of the California Labor Code. Determination of whether a selfinsurance program meets the standards of the Labor Code shall be solely in the discretion of the Contract Administrator. The insurer, if insurance is provided, or Agenda Packet Page 37 of 209
the Contractor, if a program of self-insurance is provided, shall waive all rights of subrogation against the City and its officers, officials, employees, and volunteers for loss arising from work performed under this Agreement.

4.2 Commercial General and Automobile Liability Insurance.

4.2.1 General requirements. Contractor, at its own cost and expense, shall maintain commercial general and automobile liability insurance for the term of this Agreement in an amount not less than $1,000,000 per occurrence, combined single limit coverage for risks associated with the work contemplated by this Agreement. If a Commercial General Liability Insurance or an Automobile Liability form or other form with a general aggregate limit is used, either the general aggregate limit shall apply separately to the work to be performed under this Agreement or the general aggregate limit shall be at least twice the required occurrence limit. Such coverage shall include but shall not be limited to, protection against claims arising from bodily and personal injury, including death resulting therefrom, and damage to property resulting from activities contemplated under this Agreement, including the use of owned and non-owned automobiles.

4.2.2 Minimum scope of coverage. Commercial general coverage shall be at least as broad as Insurance Services Office Commercial General Liability occurrence form CG 0001 (most recent edition) covering comprehensive General Liability on an “occurrence” basis. Automobile coverage shall be at least as broad as Insurance Services Office Automobile Liability form CA 0001, Code 1 (any auto). No endorsement shall be attached limiting the coverage.

4.2.3 Additional requirements. Each of the following shall be included in the insurance coverage or added as a certified endorsement to the policy:
a. The Insurance shall cover on an occurrence or an accident basis, and not on a claims-made basis.
b. City, its officers, officials, employees, and volunteers are to be covered as additional insureds as respects: liability arising out of work or operations performed by or on behalf of the Contractor; or automobiles owned, leased, hired, or borrowed by the Contractor.
c. For any claims related to this Agreement or the work hereunder, the Contractor’s insurance covered shall be primary insurance as respects the City, its officers, officials, employees, and volunteers.

Agenda Packet Page 38 of 209
Any insurance or self-insurance maintained by the City, its officers, officials, employees, or volunteers shall be excess of the Contractor’s insurance and shall not contribute with it. d. Each insurance policy required by this clause shall be endorsed to state that coverage shall not be canceled by either party, except after 30 days’ prior written notice has been provided to the City.

4.3 Professional Liability Insurance.

4.3.1 General requirements. Contractor, at its own cost and expense, shall maintain for the period covered by this Agreement professional liability insurance for licensed professionals performing work pursuant to this Agreement in an amount not less than $1,000,000 covering the licensed professionals’ errors and omissions. Any deductible or self-insured retention shall not exceed $150,000 per claim.

4.3.2 Claims-made limitations. The following provisions shall apply if the professional liability coverage is written on a claims-made form:
a. The retroactive date of the policy must be shown and must be before the date of the Agreement.
b. Insurance must be maintained and evidence of insurance must be provided for at least five years after completion of the Agreement or the work, so long as commercially available at reasonable rates. c. If coverage is canceled or not renewed and it is not replaced with another claims-made policy form with a retroactive date that precedes the date of this Agreement, Contractor shall purchase an extended period coverage for a minimum of five years after completion of work under this Agreement.
d. A copy of the claim reporting requirements must be submitted to the City for review prior to the commencement of any work under this Agreement.

4.3.3 Additional Requirements. A certified endorsement to include contractual liability shall be included in the policy

4.4 All Policies Requirements.

4.4.1 Acceptability of insurers. All insurance required by this section is to be placed with insurers with a Bests' rating of no less than A:VII.

Agenda Packet Page 39 of 209

4.4.2 Verification of coverage. Prior to beginning any work under this Agreement, Contractor shall furnish City with complete copies of all policies delivered to Contractor by the insurer, including complete copies of all endorsements attached to those policies. All copies of policies and certified endorsements shall show the signature of a person authorized by that insurer to bind coverage on its behalf. If the City does not receive the required insurance documents prior to the Contractor beginning work, it shall not waive the Contractor’s obligation to provide them. The City reserves the right to require complete copies of all required insurance policies at any time.

4.4.3 Deductibles and Self-Insured Retentions. Contractor shall disclose to and obtain the written approval of City for the self-insured retentions and deductibles before beginning any of the services or work called for by any term of this Agreement. At the option of the City, either: the insurer shall reduce or eliminate such deductibles or self-insured retentions as respects the City, its officers, employees, and volunteers; or the Contractor shall provide a financial guarantee satisfactory to the City guaranteeing payment of losses and related investigations, claim administration and defense expenses.

4.4.4 Wasting Policies. No policy required by this Section 4 shall include a “wasting” policy limit (i.e. limit that is eroded by the cost of defense).

4.4.5 Waiver of Subrogation. Contractor hereby agrees to waive subrogation which any insurer or contractor may require from vendor by virtue of the payment of any loss. Contractor agrees to obtain any endorsements that may be necessary to affect this waiver of subrogation.

The Workers’ Compensation policy shall be endorsed with a waiver of subrogation in favor of the entity for all work performed by the Contractor, its employees, agents, and subcontractors.

4.4.6 Subcontractors. Contractor shall include all subcontractors as insureds under its policies or shall furnish separate certificates and certified endorsements for each subcontractor. All coverages for subcontractors shall be subject to all of the requirements stated herein.

4.5 Remedies. In addition to any other remedies City may have if Contractor fails to provide or maintain any insurance policies or policy endorsements to the extent and within the time herein required, City may, at its sole option exercise any of the following remedies, which are alternatives to other remedies City may have and are not the exclusive remedy for Contractor’s breach:

Agenda Packet Page 40 of 209
 Obtain such insurance and deduct and retain the amount of the premiums for such insurance from any sums due under the Agreement;  Order Contractor to stop work under this Agreement or withhold any payment that becomes due to Contractor hereunder, or both stop work and withhold any payment, until Contractor demonstrates compliance with the requirements hereof; and/or
 Terminate this Agreement.

Section 5. INDEMNIFICATION AND CONTRACTOR’S RESPONSIBILITIES. Contractor shall, to the fullest extent allowed by law, with respect to all Services performed in connection with this Agreement, defend with counsel acceptable to City, indemnify, and hold City, its officers, employees, agents, and volunteers, harmless from and against any and all claims that arise out of, pertain to, or relate to the negligence, recklessness, or willful misconduct of the Contractor (“Claims”). Contractor will bear all losses, costs, damages, expense and liability of every kind, nature and description that arise out of, pertain to, or relate to such Claims, whether directly or indirectly (“Liability”). Such obligations to defend, hold harmless and indemnify the City shall not apply to the extent that such Liabilities are caused by the sole negligence, active negligence, or willful misconduct of the City.

With respect to third party claims against the Contractor, the Contractor waives any and all rights of any type of express or implied indemnity against the Indemnitees.

Notwithstanding the forgoing, to the extent this Agreement is a “construction contract” as defined by California Civil Code section 2783, as may be amended from time to time, such duties of Contractor to indemnify shall not apply when to do so would be prohibited by California Civil Code Section 2782.

Section 6. STATUS OF CONTRACTOR.

6.1 Independent Contractor. At all times during the term of this Agreement, Contractor shall be an independent contractor and shall not be an employee of City. City shall have the right to control Contractor only insofar as the results of Contractor's services rendered pursuant to this Agreement and assignment of personnel pursuant to Subparagraph 1.3; however, otherwise City shall not have the right to control the means by which Contractor accomplishes services rendered pursuant to this Agreement. Notwithstanding any other City, state, or federal policy, rule, regulation, law, or ordinance to the contrary, Contractor and any of its employees, agents, and subcontractors providing services under this Agreement shall not qualify for or become entitled to, and hereby agree to waive any and all claims to, any compensation, benefit, or any incident of employment by City, including but not limited to eligibility to enroll in the California Public Agenda Packet Page 41 of 209
Employees Retirement System (PERS) as an employee of City and entitlement to any contribution to be paid by City for employer contributions and/or employee contributions for PERS benefits.

6.2 Contractor Not an Agent. Except as City may specify in writing, Contractor shall have no authority, express or implied, to act on behalf of City in any capacity whatsoever as an agent. Contractor shall have no authority, express or implied, pursuant to this Agreement to bind City to any obligation whatsoever.

Section 7. LEGAL REQUIREMENTS.

7.1 Governing Law. The laws of the State of California shall govern this Agreement.

7.2 Compliance with Applicable Laws. Contractor and any subcontractors shall comply with all laws and regulations applicable to the performance of the work hereunder, including but not limited to, the California Building Code, the Americans with Disabilities Act, and any copyright, patent or trademark law.

Contractor’s Failure to comply with any law(s) or regulation(s) applicable to the performance of the work hereunder shall constitute a breach of contract.

7.3 Other Governmental Regulations. To the extent that this Agreement may be funded by fiscal assistance from another governmental entity, Contractor and any subcontractors shall comply with all applicable rules and regulations to which City is bound by the terms of such fiscal assistance program.

7.4 Licenses and Permits. Contractor represents and warrants to City that Contractor and its employees, agents, and any subcontractors have all licenses, permits, qualifications, and approvals of whatsoever nature that are legally required to practice their respective professions. Contractor represents and warrants to City that Contractor and its employees, agents, any subcontractors shall, at their sole cost and expense, keep in effect at all times during the term of this Agreement any licenses, permits, and approvals that are legally required to practice their respective professions. In addition to the foregoing, Contractor and any subcontractors shall obtain and maintain during the term of this Agreement valid Business Licenses from City.

7.5 Nondiscrimination and Equal Opportunity. Contractor shall not discriminate, on the basis of a person’s race, religion, color, national origin, age, physical or mental handicap or disability, medical condition, marital status, sex, or sexual orientation, against any employee, applicant for employment, subcontractor, bidder for a subcontract, or participant in, recipient of, or applicant for any services or programs provided by Contractor under this Agreement. Contractor shall comply with all applicable federal, state, and local laws, policies, rules, and requirements related to equal opportunity and nondiscrimination in Agenda Packet Page 42 of 209
employment, contracting, and the provision of any services that are the subject of this Agreement, including but not limited to the satisfaction of any positive obligations required of Contractor thereby.

Contractor shall include the provisions of this Subsection in any subcontract approved by the Contract Administrator or this Agreement.

Section 8. TERMINATION AND MODIFICATION.

8.1 Termination. City may cancel this Agreement at any time and without cause upon written notification to Contractor.

Contractor may cancel this Agreement upon 60 days’ written notice to City and shall include in such notice the reasons for cancellation.

In the event of termination, Contractor shall be entitled to compensation for services performed to the effective date of termination; City, however, may condition payment of such compensation upon Contractor delivering to City any or all documents, photographs, computer software, video and audio tapes, and other materials provided to Contractor or prepared by or for Contractor or the City in connection with this Agreement.

8.2 Extension. City may, in its sole and exclusive discretion, extend the end date of this Agreement beyond that provided for in Subsection 1.1. Any such extension shall require a written amendment to this Agreement, as provided for herein.

Contractor understands and agrees that, if City grants such an extension, City shall have no obligation to provide Contractor with compensation beyond the maximum amount provided for in this Agreement. Similarly, unless authorized by the Contract Administrator, City shall have no obligation to reimburse Contractor for any otherwise reimbursable expenses incurred during the extension period.

8.3 Amendments. The parties may amend this Agreement only by a writing signed by all the parties.

8.4 Assignment and Subcontracting. City and Contractor recognize and agree that this Agreement contemplates personal performance by Contractor and is based upon a determination of Contractor’s unique personal competence, experience, and specialized personal knowledge. Moreover, a substantial inducement to City for entering into this Agreement was and is the professional reputation and competence of Contractor. Contractor may not assign this Agreement or any interest therein without the prior written approval of the Contract Administrator. Contractor shall not subcontract any portion of the performance contemplated and provided for herein, other than to the subcontractors noted in the proposal, without prior written approval of the Contract Administrator.

Agenda Packet Page 43 of 209

8.5 Survival. All obligations arising prior to the termination of this Agreement and all provisions of this Agreement allocating liability between City and Contractor shall survive the termination of this Agreement.

8.6 Options upon Breach by Contractor. If Contractor materially breaches any of the terms of this Agreement, City’s remedies shall include, but not be limited to, the following:

8.6.1 Immediately terminate the Agreement;

8.6.2 Retain the plans, specifications, drawings, reports, design documents, and any other work product prepared by Contractor pursuant to this Agreement;

8.6.3 Retain a different Contractor to complete the work described in Exhibit A not finished by Contractor; or

8.6.4 Charge Contractor the difference between the cost to complete the work described in Exhibit A that is unfinished at the time of breach and the amount that City would have paid Contractor pursuant to Section 2 if Contractor had completed the work.

Section 9. KEEPING AND STATUS OF RECORDS.

9.1 Records Created as Part of Contractor’s Performance. All reports, data, maps, models, charts, studies, surveys, photographs, memoranda, plans, studies, specifications, records, files, or any other documents or materials, in electronic or any other form, that Contractor prepares or obtains pursuant to this Agreement and that relate to the matters covered hereunder shall be the property of the City. Contractor hereby agrees to deliver those documents to the City upon termination of the Agreement. It is understood and agreed that the documents and other materials, including but not limited to those described above, prepared pursuant to this Agreement are prepared specifically for the City and are not necessarily suitable for any future or other use. City and Contractor agree that, until final approval by City, all data, plans, specifications, reports and other documents are confidential and will not be released to third parties without prior written consent of both parties.

9.2 Contractor’s Books and Records. Contractor shall maintain any and all ledgers, books of account, invoices, vouchers, canceled checks, and other records or documents evidencing or relating to charges for services or expenditures and disbursements charged to the City under this Agreement for a minimum of 3 Agenda Packet Page 44 of 209
years, or for any longer period required by law, from the date of final payment to the Contractor to this Agreement.

9.3 Inspection and Audit of Records. Any records or documents that Section 9.2 of this Agreement requires Contractor to maintain shall be made available for inspection, audit, and/or copying at any time during regular business hours, upon oral or written request of the City. Under California Government Code Section 8546.7, if the amount of public funds expended under this Agreement exceeds $10,000.00, the Agreement shall be subject to the examination and audit of the State Auditor, at the request of City or as part of any audit of the City, for a period of 3 years after final payment under the Agreement.

Section 10 MISCELLANEOUS PROVISIONS.

10.1 Attorneys’ Fees. If a party to this Agreement brings any action, including an action for declaratory relief, to enforce or interpret the provision of this Agreement, the prevailing party shall be entitled to reasonable attorneys’ fees in addition to any other relief to which that party may be entitled. The court may set such fees in the same action or in a separate action brought for that purpose.

10.2 Venue. In the event that either party brings any action against the other under this Agreement, the parties agree that trial of such action shall be vested exclusively in the state courts of California in the County of Contra Costa or in the United States District Court for the Northern District of California.

10.3 Severability. If a court of competent jurisdiction finds or rules that any provision of this Agreement is invalid, void, or unenforceable, the provisions of this Agreement not so adjudged shall remain in full force and effect. The invalidity in whole or in part of any provision of this Agreement shall not void or affect the validity of any other provision of this Agreement.

10.4 No Implied Waiver of Breach. The waiver of any breach of a specific provision of this Agreement does not constitute a waiver of any other breach of that term or any other term of this Agreement.

10.5 Successors and Assigns. The provisions of this Agreement shall inure to the benefit of and shall apply to and bind the successors and assigns of the parties.

10.6 Use of Recycled Products. Contractor shall prepare and submit all reports, written studies and other printed material on recycled paper to the extent it is available at equal or less cost than virgin paper.

10.7 Conflict of Interest. Contractor may serve other clients, but none whose activities within the corporate limits of City or whose business, regardless of Agenda Packet Page 45 of 209
location, would place Contractor in a “conflict of interest,” as that term is defined in the Political Reform Act, codified at California Government Code Section 81000 et seq.

Contractor shall not employ any City official in the work performed pursuant to this Agreement. No officer or employee of City shall have any financial interest in this Agreement that would violate California Government Code Sections 1090 et seq.

Contractor hereby warrants that it is not now, nor has it been in the previous 12 months, an employee, agent, appointee, or official of the City. If Contractor was an employee, agent, appointee, or official of the City in the previous twelve months, Contractor warrants that it did not participate in any manner in the forming of this Agreement. Contractor understands that, if this Agreement is made in violation of Government Code §1090 et seq., the entire Agreement is void and Contractor will not be entitled to any compensation for services performed pursuant to this Agreement, including reimbursement of expenses, and Contractor will be required to reimburse the City for any sums paid to the Contractor. Contractor understands that, in addition to the foregoing, it may be subject to criminal prosecution for a violation of Government Code § 1090 and, if applicable, will be disqualified from holding public office in the State of California.

10.8 Solicitation. Contractor agrees not to solicit business at any meeting, focus group, or interview related to this Agreement, either orally or through any written materials.

10.9 Contract Administration. This Agreement shall be administered by Alexandra Orologas, Assistant City Manager ("Contract Administrator"). All correspondence shall be directed to or through the Contract Administrator or his or her designee.

10.10 Notices. Any written notice to Contractor shall be sent to:

Chavan and Associates, LLP
Attn: Sheldon Chavan, CPA, Managing Partner
15105 Concord Circle, Suite 130
Morgan Hill, CA 95037
Any written notice to City shall be sent to:

City of El Cerrito
Attn: Alexandra Orologas, Assistant City Manager
10890 San Pablo Ave.

El Cerrito, CA 94530
Agenda Packet Page 46 of 209

10.11 Integration. This Agreement, including the engagement letter and detailed scope of work attached hereto and incorporated herein as Exhibits A represents the entire and integrated agreement between City and Contractor and supersedes all prior negotiations, representations, or agreements, either written or oral.

Exhibit A Engagement Letter/Scope of Work/Payment Schedule

10.12 Counterparts. This Agreement may be executed in multiple counterparts, each of which shall be an original and all of which together shall constitute one agreement.

The Parties have executed this Agreement as of the Effective Date.

CITY OF EL CERRITO CONTRACTOR
____________________________ ______________________________ Karen Pinkos, City Manager Sheldon Chavan, CPA, Managing Partner Chavan and Associates, LLP
Attest:
____________________________
Alexandra Orologas, Deputy City Clerk
Approved as to Form:
____________________________
Sky Woodruff, City Attorney

EXHIBIT A
Agenda Packet Page 47 of 209
Page | 1 15105 Concord Circle, Suite 130, Morgan Hill, CA 95037 Tel: 408-217-8749 • E-Fax: 408-872-4159
[email protected] • www.cnallp.com
June 27, 2023
City of El Cerrito
10890 San Pablo Avenue
El Cerrito, CA 94530
We are pleased to confirm our understanding of the services we are to provide for the City of El Cerrito (the “City”) for the fiscal years ending June 30, 2023, 2024 and 2025, with two option years. We will audit the financial statements of the governmental activities, the business-type activities, each major fund, and the aggregate remaining fund information of the City and the related notes to the financial statements, which collectively comprise the City’s basic financial statements.

In addition, we will audit the City’s compliance over major federal award programs each fiscal year. We are pleased to confirm our acceptance and our understanding of this audit engagement by means of this letter. Our audits will be conducted with the objectives of our expressing an opinion on each opinion unit and an opinion on compliance regarding the City’s major federal award programs.

The objectives of our audit of the financial statements are to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and to issue an auditor’s report that includes our opinion. Reasonable assurance is a high level of assurance but is not absolute assurance and therefore is not a guarantee that an audit conducted in accordance with auditing standards generally accepted in the United States of America (GAAS), and the standards applicable to financial audits contained in Government Auditing Standards, issued by the Comptroller General of the United States of America (GAGAS), will always detect a material misstatement when it exists. Misstatements, including omissions, can arise from fraud or error and are considered material if there is a substantial likelihood that, individually or in the aggregate, they would influence the judgment made by a reasonable user based on the financial statements.

The objectives of our compliance audit are to obtain sufficient appropriate audit evidence to form an opinion and report at the level specified in the governmental audit requirement about whether the City complied in all material respects with the applicable compliance requirements and identify audit and reporting requirements specified in the governmental audit requirement that are supplementary to GAAS and Government Auditing Standards, if any, and perform procedures to address those requirements.

Accounting principles generally accepted in the United States of America, (U.S. GAAP), as promulgated by the Governmental Accounting Standards Board (GASB), require that the items noted below be presented to supplement the basic financial statements. Such information, although not a part of the basic financial statements, is required by the GASB, who considers it to be an essential part of financial reporting for placing the basic financial statements in an appropriate operational, economic, or historical context. As part of our engagement, we will Exhibit A:

Revised Engagement Letter (as
of June 27, 2023), Original
Engagement Letter, Scope of
Work & Payment Schedule
Agenda Packet Page 48 of 209
Page | 2 15105 Concord Circle, Suite 130, Morgan Hill, CA 95037 Tel: 408-217-8749 • E-Fax: 408-872-4159
[email protected] • www.cnallp.com
apply certain limited procedures to the required supplementary information (RSI) in accordance with auditing standards generally accepted in the United States of America, (U.S. GAAS). These limited procedures will consist primarily of inquiries of management regarding their methods of measurement and presentation and comparing the information for consistency with management’s responses to our inquiries. We will not express an opinion or provide any form of assurance on the RSI. The following RSI is required by U.S. GAAP and will be subjected to certain limited procedures but will not be audited:

1. Management’s discussion and analysis.

2. Major fund budget to actual schedules.

3. Pension schedules.

4. Other postemployment benefit schedules.

Supplementary Information Other than RSI
Supplementary information other than RSI will accompany the City’s basic financial statements.

We will subject the following supplementary information to the auditing procedures applied in our audit of the basic financial statements and perform certain additional procedures, including comparing and reconciling the supplementary information to the underlying accounting and other records used to prepare the financial statements or to the financial statements themselves, and additional procedures in accordance with U.S. GAAS.

We intend to provide an opinion on the following supplementary information in relation to the financial statements as a whole:

1. Nonmajor fund combining balance sheets and schedules of revenues, expenditures and changes in fund balances.

2. Nonmajor budgetary comparison schedules, as applicable.

3. Fiduciary fund statements, as applicable.

4. The schedule of expenditures of federal awards.

5. Other supplementary schedules required by state and federal guidelines and subjected to the auditing standards identified in this letter unless such schedules are specifically listed as unaudited.

Also, the document we submit to you will include the following other additional information that will not be subjected to the auditing procedures applied in our audit of the basic financial statements:

1. ACFR introductory section.

2. Statistical tables.

Agenda Packet Page 49 of 209
Page | 3 15105 Concord Circle, Ste. 130, Morgan Hill, CA 95037 Tel: 408-217-8749 • E-Fax: 408-872-4159
[email protected] • www.cnallp.com
Schedule of Expenditures of Federal Awards
We will subject the schedule of expenditures of federal awards to the auditing procedures applied in our audit of the basic financial statements and certain additional procedures, including comparing and reconciling the schedule to the underlying accounting and other records used to prepare the financial statements or to the financial statements themselves, and additional procedures in accordance with auditing standards generally accepted in the United States of America. We intend to provide an opinion on whether the schedule of expenditures of federal awards is presented fairly in all material respects in relation to the financial statements as a whole.

Data Collection Form
Prior to the completion of our engagement, we will complete the sections of the Data Collection Form that are our responsibility. The form will summarize our audit findings, amounts and conclusions. It is management’s responsibility to submit a reporting package including financial statements, schedule of expenditure of federal awards, summary schedule of prior audit findings and corrective action plan along with the Data Collection Form to the federal audit clearinghouse.

The financial reporting package must be text searchable, unencrypted, and unlocked. Otherwise, the reporting package will not be accepted by the federal audit clearinghouse. We will assist you in the electronic submission and certification. You may request from us copies of our report for you to include with the reporting package submitted to pass-through entities.

The Data Collection Form is required to be submitted within the earlier of 30 days after receipt of our auditors’ reports or nine months after the end of the audit period, unless specifically waived by a federal cognizant or oversight agency for audits. Data Collection Forms submitted untimely are one of the factors in assessing programs at a higher risk.

Audit of the Financial Statements
We will conduct our audit in accordance with U.S. GAAS, the standards applicable to financial audits contained in Government Auditing Standards, issued by the Comptroller General of the United States of America, and the audit requirements of Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance). As part of an audit of financial statements in accordance with GAAS, and in accordance with Government Auditing Standards, we exercise professional judgment and maintain professional skepticism throughout the audit. We also complete the following:
• Identify and assess the risks of material misstatement of the financial statements, whether due to fraud or error, design and perform audit procedures responsive to those risks, and obtain audit evidence that is sufficient and appropriate to provide a basis for our opinion. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting Agenda Packet Page 50 of 209
Page | 4 15105 Concord Circle, Ste. 130, Morgan Hill, CA 95037 Tel: 408-217-8749 • E-Fax: 408-872-4159
[email protected] • www.cnallp.com
from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control. • Obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the City’s internal control. However, we will communicate to you in writing concerning any significant deficiencies or material weaknesses in internal control relevant to the audit of the financial statements that we have identified during the audit.
• Evaluate the appropriateness of accounting policies used and the reasonableness of significant accounting estimates made by management, as well as evaluate the overall presentation of the financial statements, including the disclosures, and whether the financial statements represent the underlying transactions and events in a manner that achieves fair presentation.
• Conclude, based on the audit evidence obtained, whether there are conditions or events, considered in the aggregate, that raise substantial doubt about the City’s ability to continue as a going concern for a reasonable period of time.

Because of the inherent limitations of an audit, together with the inherent limitations of internal control, an unavoidable risk that some material misstatements or noncompliance (whether caused by errors, fraudulent financial reporting, misappropriation of assets, detected abuse, or violations of laws or governmental regulations) may not be detected exists, even though the audit is properly planned and performed in accordance with U.S. GAAS and Government Auditing Standards of the Comptroller General of the United States of America. Please note that the determination of abuse is subjective and Government Auditing Standards does not require auditors to detect abuse.

Our responsibility as auditors is limited to the period(s) covered by our audit and does not extend to any other periods.

We will issue a written report upon completion of our audit of the City’s basic financial statements. Our report will be addressed to governing body of the City. We cannot provide assurance that unmodified opinions will be expressed. Circumstances may arise in which our report may differ from its expected form and content based on the results of our audit. Depending on the nature of these circumstances, it may be necessary for us to modify our opinions, add an emphasis-of-matter or other-matter paragraph(s) to our auditor’s report, or if necessary, withdraw from the engagement. If our opinions on the basic financial statements are other than unmodified, we will discuss the reasons with you in advance. If, for any reason, we are unable to complete the audit or are unable to form or have not formed opinions, we may decline to express opinions or to issue a report as a result of this engagement.

Agenda Packet Page 51 of 209
Page | 5 15105 Concord Circle, Ste. 130, Morgan Hill, CA 95037 Tel: 408-217-8749 • E-Fax: 408-872-4159
[email protected] • www.cnallp.com
In accordance with the requirements of Government Auditing Standards, we will also issue a written report describing the scope of our testing over internal control over financial reporting and over compliance with laws, regulations, and provisions of grants and contracts, including the results of that testing. However, providing an opinion on internal control and compliance over financial reporting will not be an objective of the audit and, therefore, no such opinion will be expressed.

Audit of Major Program Compliance
Our audit of the City’s major federal award program(s) compliance will be conducted in accordance with the requirements of the Single Audit Act, as amended; and the provisions of U.S. Office of Management and Budget’s (OMB) Uniform Guidance; and will include tests of accounting records, a determination of major programs in accordance with Uniform Guidance, and other procedures we consider necessary to enable us to express such an opinion on major federal award program compliance and to render the required reports. We cannot provide assurance that an unmodified opinion on compliance will be expressed. Circumstances may arise in which it is necessary for us to modify our opinion or withdraw from the engagement.

The Uniform Guidance requires that we also plan and perform the audit to obtain reasonable assurance about whether material noncompliance with applicable laws and regulations, the provisions of contracts and grant agreements applicable to major federal award programs, and the applicable compliance requirements occurred, whether due to fraud or error, and express an opinion on the City’s compliance based on the audit. Reasonable assurance is a high level of assurance but is not absolute assurance and therefore is not a guarantee that an audit conducted in accordance with GAAS, Government Auditing Standards, and the Uniform Guidance will always detect material noncompliance when it exists. The risk of not detecting material noncompliance resulting from fraud is higher than for that resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control.

Noncompliance with the compliance requirements is considered material if there is a substantial likelihood that, individually or in the aggregate, it would influence the judgment made by a reasonable user of the report on compliance about the City’s compliance with the requirements of the federal programs as a whole.

As part of a compliance audit in accordance with GAAS, and in accordance with Government Auditing Standards, we exercise professional judgment and maintain professional skepticism throughout the audit. We also identify and assess the risks of material noncompliance, whether due to fraud or error, and design and perform audit procedures responsive to those risks.

Our procedures will consist of determining major federal programs and, performing the applicable procedures described in the U.S. Office of Management and Budget OMB Compliance Supplement for the types of compliance requirements that could have a direct and material effect on each of the City’s major programs, and performing such other procedures as we consider necessary in the circumstances. The purpose of those procedures will be to express an opinion on Agenda Packet Page 52 of 209
Page | 6 15105 Concord Circle, Ste. 130, Morgan Hill, CA 95037 Tel: 408-217-8749 • E-Fax: 408-872-4159
[email protected] • www.cnallp.com
the City’s compliance with requirements applicable to each of its major programs in our report on compliance issued pursuant to the Uniform Guidance.

Also, as required by the Uniform Guidance, we will obtain an understanding of the City’s internal control over compliance relevant to the audit in order to design and perform tests of controls to evaluate the effectiveness of the design and operation of controls that we consider relevant to preventing or detecting material noncompliance with compliance requirements applicable to each of the City’s major federal award programs. Our tests will be less in scope than would be necessary to render an opinion on these controls and, accordingly, no opinion will be expressed in our report. However, we will communicate to you, regarding, among other matters, the planned scope and timing of the audit and any significant deficiencies and material weaknesses in internal control over compliance that we have identified during the audit.

We will issue a report on compliance that will include an opinion or disclaimer of opinion regarding the City’s major federal award programs, and a report on internal controls over compliance that will report any significant deficiencies and material weaknesses identified; however, such report will not express an opinion on internal control.

Management’s Responsibilities
Our audit will be conducted on the basis that management acknowledge and understand that they have responsibility:

1. For the preparation and fair presentation of the financial statements in accordance with accounting principles generally accepted in the United States of America;

2. For the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of financial statements that are free from material misstatement, whether due to fraud or error;

3. For identifying, in its accounts, all federal awards received and expended during the period and the federal programs under which they were received;

4. For maintaining records that adequately identify the source and application of funds for federally funded activities;

5. For preparing the schedule of expenditures of federal awards (including notes and noncash assistance received) in accordance with the Uniform Guidance;

6. For designing, implementing, and maintaining effective internal control over federal awards that provides reasonable assurance that the entity is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards;

7. For identifying and ensuring that the entity complies with federal laws, statutes, regulations, rules, provisions of contracts or grant agreements, and the terms and conditions of federal award programs, and implementing systems designed to achieve compliance with applicable federal statutes, regulations, and the terms and conditions of federal award programs;

8. For disclosing accurately, currently, and completely the financial results of each federal award in accordance with the requirements of the award; Agenda Packet Page 53 of 209
Page | 7 15105 Concord Circle, Ste. 130, Morgan Hill, CA 95037 Tel: 408-217-8749 • E-Fax: 408-872-4159
[email protected] • www.cnallp.com

9. For identifying and providing report copies of previous audits, attestation engagements, or other studies that directly relate to the objectives of the audit, including whether related recommendations have been implemented;

10. For taking prompt action when instances of noncompliance are identified;

11. For addressing the findings and recommendations of auditors, for establishing and maintaining a process to track the status of such findings and recommendations and taking corrective action on reported audit findings from prior periods and preparing a summary schedule of prior audit findings;

12. For following up and taking corrective action on current year audit findings and preparing a corrective action plan for such findings;

13. For submitting the reporting package and data collection form to the appropriate parties;

14. For making the auditor aware of any significant contractor relationships where the contractor is responsible for program compliance;

15. To provide us with:
a. Access to all information of which management is aware that is relevant to the preparation and fair presentation of the financial statements including the disclosures, and relevant to federal award programs, such as records, documentation, and other matters; b. Additional information that we may request from management for the purpose of the audit;
c. Unrestricted access to persons within the entity from whom we determine it necessary to obtain audit evidence;
d. A written acknowledgement of all the documents that management expects to issue that will be included in the annual report and the planned timing and method of issuance of that annual report; and
e. A final version of the annual report (including all the documents that, together, comprise the annual report) in a timely manner prior to the date of the auditor’s report.

16. For adjusting the financial statements to correct material misstatements and confirming to us in the management representation letter that the effects of any uncorrected misstatements aggregated by us during the current engagement and pertaining to the current year period(s) under audit are immaterial, both individually and in the aggregate, to the financial statements as a whole;

17. For acceptance of nonattest services, including identifying the proper party to oversee nonattest work;

18. For maintaining adequate records, selecting and applying accounting principles, and safeguarding assets;

19. For informing us of any known or suspected fraud affecting the entity involving management, employees with significant role in internal control and others where fraud could have a material effect on compliance;

20. For the accuracy and completeness of all information provided;

21. For taking reasonable measures to safeguard protected personally identifiable and other sensitive information; and

22. For confirming your understanding of your responsibilities as defined in this letter to us in your management representation letter.

Agenda Packet Page 54 of 209
Page | 8 15105 Concord Circle, Ste. 130, Morgan Hill, CA 95037 Tel: 408-217-8749 • E-Fax: 408-872-4159
[email protected] • www.cnallp.com
With regard to the supplementary information and schedule of expenditures of federal awards (SEFA) referred to above, you acknowledge and understand your responsibility (a) for the preparation of the supplementary information and SEFA in accordance with the applicable criteria, (b) to provide us with the appropriate written representations regarding the supplementary information and SEFA, (c) to include our report on the supplementary information and the SEFA in any document that contains the supplementary information and that indicates that we have reported on such supplementary information and the SEFA, and (d) to present the supplementary information and the SEFA with the audited financial statements, or if the supplementary information and the SEFA will not be presented with the audited financial statements, to make the audited financial statements readily available to the intended users of the supplementary information and the SEFA no later than the date of issuance by you of the supplementary information and the SEFA and our reports thereon.

As part of our audit process, we will request from management, written confirmation concerning representations made to us in connection with the audit.

We understand that your employees will prepare all confirmations we request and will locate any documents or invoices selected by us for testing.

If you intend to publish or otherwise reproduce the financial statements and make reference to our firm, you agree to provide us with printers’ proofs or masters for our review and approval before printing. You also agree to provide us with a copy of the final reproduced material for our approval before it is distributed.

Nonattest Services
With respect to any nonattest services we perform, we will not assume management responsibilities on behalf of the City. However, we will provide advice and recommendations to assist City management in performing its responsibilities. At the end of the year, we agree to perform the following:
 Prepare the audited financial statements (ACFR), related note disclosures, required supplementary information, supplementary information (as noted above), the schedule of expenditures of federal awards, and the data collection form. These items will be prepared from information prepared and provided by the City during our audit, such as the City’s trial balance.
 Propose adjusting or correcting journal entries to be reviewed and approved by City management.

City management is responsible for (a) making all management decisions and performing all management functions; (b) assigning a competent individual to oversee the services; (c) evaluating the adequacy of the services performed; (d) evaluating and accepting responsibility for the results of the services performed; and (e) establishing and maintaining internal controls, including monitoring ongoing activities.

Agenda Packet Page 55 of 209
Page | 9 15105 Concord Circle, Ste. 130, Morgan Hill, CA 95037 Tel: 408-217-8749 • E-Fax: 408-872-4159
[email protected] • www.cnallp.com
Our responsibilities and limitations of the nonattest services are as follows:
 We will perform the services in accordance with applicable professional standards, including GAAS, GAGAS, GASB and U.S. GAAP.
 The nonattest services are limited to the services previously outlined above. Our firm, in its sole professional judgment, reserves the right to refuse to do any procedure or take any action that could be construed as making management decisions or assuming management responsibilities, including determining account coding and approving journal entries. Our firm will advise the City with regard to certain positions taken in the preparation of the audited financial statements, but City must make all decisions with regard to those matters.

Government Auditing Standards require that we document an assessment of the skills, knowledge, and experience of management, should we participate in any form of preparation of the basic financial statements and related schedules or disclosures as these actions are deemed a non-audit service.

Audit Administration and Fees
The following is a summary of the estimated audit timeline:

Segment Estimated Phase
Entrance Conference July 29, 2023 I
Audit Planning C&A's Office July 29, 2023 I
List of Items Required by Client July 29, 2023 I
Interim Testing August 28, 2023 I
Interim Exit Conference and Completion September 8, 2023 I Preparation and Mailing of Confirmation Letters to 3rd Parties September 8, 2023 II Year-end Field Work Planning Meeting September 8, 2023 II Year-end Field Work and Compliance Testing October 16, 2023 II Exit Conference November 3, 2023 II
Progress List of Management Point and Recommendations November 3, 2023 II Final List of Management Point and Recommendations November 17, 2023 II/III Audit Adjustments November 17, 2023 II/III
Draft Reports, Financials, Management Letters December 10, 2023 III Final Reports, Financials, Management Letters January 5, 2024 III Council, Commission & Public Presentations As Needed III Agenda Packet Page 56 of 209
Page | 10 15105 Concord Circle, Ste. 130, Morgan Hill, CA 95037 Tel: 408-217-8749 • E-Fax: 408-872-4159
[email protected] • www.cnallp.com
Our all-inclusive maximum fee for these services will be as follows:

Services Hours 2023 2024 2025 2026 2027
City Audit, ACFR and Management Letters 392 $ 42,000 $ 42,000 $ 42,000 $ 43,500 $ 43,500 Single Audit 40 5,000 5,000 5,000 5,000 5,000
City's Pension Plan Audit 8 1,000 1,000 1,000 1,000 1,000 Public Financing Authority Audit 12 1,500 1,500 1,500 3,000 3,000 2008 Sales Tax Revenue Bonds AUP 16 2,000 2,000 2,000 2,000 2,000 Transportation Development Act 16 2,000 2,000 2,000 2,000 2,000 GANN Appropriation Limit 12 1,500 1,500 1,500 1,500 1,500 Conversion Entries N/A Included Included Included Included Included Beginning Balance Procedures N/A Included Included Included Included Included GASB implementation and guidance N/A Included Included Included Included Included Present Reports to Council and Committees N/A Included Included Included Included Included Meals, Lodging and Transportation N/A Included Included Included Included Included Subtotal Base Audit 496 55,000 55,000 55,000 58,000 58,000 AFTR (SCO) City 20 4,000 4,000 4,000 4,000 4,000
AFTR (SCO) Pension Fund 10 2,000 2,000 2,000 2,000 2,000 AFTR (SCO) PFA 10 2,000 2,000 2,000 2,000 2,000
Annual Streets Report City 12 2,500 2,500 2,500 2,500 2,500 Housing Auth. Rept./Filing 10 2,000 2,000 2,000 2,000 2,000 Total All-Inclusive Maximum Price 558 $ 67,500 $ 67,500 $ 67,500 $ 70,500 $ 70,500 Optional
Our fees include out-of-pocket costs (such as report reproduction, word processing, postage, travel, copies, telephone, etc.).

Our standard hourly rates vary according to the degree of responsibility involved and the experience level of the personnel assigned to your audit as follows:

Engagement Partner $200 per hour
Associate Partner/Reviewer $200 per hour
Senior Auditor $100 per hour
Staff Auditor $85 per hour
Administrative $85 per hour
Our invoices for these fees will be rendered each month as work progresses and are payable on presentation. In accordance with our firm policies, work may be suspended if your account becomes thirty days or more overdue and may not be resumed until your account is paid in full. If we elect to terminate our services for nonpayment, our engagement will be deemed to have been completed upon written notification of termination, even if we have not completed our report.

You will be obligated to compensate us for all time expended and to reimburse us for all out-ofpocket costs through the date of termination. The above fee is based on anticipated cooperation from your personnel and the assumption that unexpected circumstances will not be encountered during the audit. If cooperation is not provided as anticipated and at a level that hinders the Agenda Packet Page 57 of 209
Page | 11 15105 Concord Circle, Ste. 130, Morgan Hill, CA 95037 Tel: 408-217-8749 • E-Fax: 408-872-4159
[email protected] • www.cnallp.com
progress of the services to be provided, we retain the right to terminate the contract for cause with thirty (30) days’ notice. During that time, the City will have the opportunity to provide the cooperation required to complete the audit and C&A may rescind the cancellation.

If the services to be performed by C&A are not performed in an acceptable manner to the City, the City may cancel this contract for cause by providing notice to C&A, giving at least thirty (30) days’ notice of the proposed cancellation and the reasons for same. During that time period, C&A may seek to bring the performance of services to a level that is acceptable to the City, and the City may rescind the cancellation if such action is in the City’s best interest. Notwithstanding the above provisions, the City may, upon the expiration of thirty (30) days written notice to C&A, terminate the agreement at will. Payment for services or goods received prior to termination shall be made by the City provided those goods or services were provided in a manner acceptable to the City. Payment for those goods and services shall not be unreasonably withheld.

Sheldon Chavan, CPA, is the engagement partner for the audit services specified in this letter.

His responsibilities include supervising Chavan & Associates LLP’s services performed as part of this engagement and signing or authorizing another qualified firm representative to sign the audit report.

Other Matters
During the course of the engagement, we may communicate with you or your personnel via fax or e-mail, and you should be aware that communication in those mediums contains a risk of misdirected or intercepted communications.

Regarding the electronic dissemination of audited financial statements, including financial statements published electronically on your Internet website, you understand that electronic sites are a means to distribute information and, therefore, we are not required to read the information contained in these sites or to consider the consistency of other information in the electronic site with the original document.

Professional standards prohibit us from being the sole host and/or the sole storage for your financial and non-financial data. As such, it is your responsibility to maintain your original data and records and we cannot be responsible to maintain such original information. By signing this engagement letter, you affirm that you have all the data and records required to make your books and records complete.

The audit documentation for this engagement is the property of Chavan & Associates LLP and constitutes confidential information. However, we may be requested to make certain audit documentation available to state and federal agencies and the U.S. Government Accountability Office pursuant to authority given to it by law or regulation, or to peer reviewers. If requested, access to such audit documentation will be provided under the supervision of Chavan & Associates LLP’s personnel. Furthermore, upon request, we may provide copies of selected audit documentation to these agencies and regulators. The regulators and agencies may intend, or Agenda Packet Page 58 of 209
Page | 12 15105 Concord Circle, Ste. 130, Morgan Hill, CA 95037 Tel: 408-217-8749 • E-Fax: 408-872-4159
[email protected] • www.cnallp.com
decide, to distribute the copies of information contained therein to others, including other governmental agencies. We agree to retain our audit documentation or work papers for a period of at least seven years from the date of our report.

We will be available during the year to consult with you on financial management and accounting matters of a routine nature. You agree to inform us of facts that may affect the financial statements of which you may become aware during the period from the date of the auditor’s report to the date the financial statements are issued.

During the course of the audit, we may observe opportunities for economy in, or improved controls over, your operations. We will bring such matters to the attention of the appropriate level of management, either orally or in writing. At the conclusion of our audit engagement, we will communicate to management and the Board the following significant items from the audit:
 Our view about the qualitative aspects of the City’s significant accounting practices;  Significant difficulties, if any, encountered during the audit;  Uncorrected misstatements, other than those we believe are trivial, if any;  Disagreements with management, if any;
 Other findings or issues, if any, arising from the audit that are, in our professional judgment, significant and relevant to those charged with governance regarding their oversight of the financial reporting process;
 Material, corrected misstatements that were brought to the attention of management as a result of our audit procedures;
 Representations we requested from management;
 Management’s consultations with other accountants, if any; and  Significant issues, if any, arising from the audit that were discussed, or the subject of correspondence, with management.

In accordance with the requirements of Government Auditing Standards, we have provided a copy of our latest external peer review report with our proposal.

If the foregoing is in accordance with your understanding, please indicate your agreement by signing this letter and emailing it to us at [email protected] or following the DocuSign link. If you have any questions, please let us know. We appreciate the opportunity to be your financial statement auditors and look forward to working with you and your staff.

Very truly yours,
Sheldon Chavan, CPA, Managing Partner
Chavan & Associates, LLP
Agenda Packet Page 59 of 209
Page | 13 15105 Concord Circle, Ste. 130, Morgan Hill, CA 95037 Tel: 408-217-8749 • E-Fax: 408-872-4159
[email protected] • www.cnallp.com
RESPONSE:

This letter correctly sets forth the understanding of the City of El Cerrito.

Signature:

Title:

Date:

Agenda Packet Page 60 of 209
Agenda Packet Page 61 of 209
Agenda Packet Page 62 of 209
Agenda Packet Page 63 of 209
Agenda Packet Page 64 of 209
Agenda Packet Page 65 of 209
Agenda Packet Page 66 of 209
Agenda Packet Page 67 of 209
Agenda Packet Page 68 of 209
Agenda Packet Page 69 of 209
Agenda Packet Page 70 of 209
Agenda Packet Page 71 of 209
Agenda Packet Page 72 of 209
Agenda Packet Page 73 of 209
Agenda Packet Page 74 of 209
Agenda Packet Page 75 of 209
Agenda Packet Page 76 of 209
Agenda Packet Page 77 of 209
Agenda Packet Page 78 of 209
Agenda Packet Page 79 of 209
Agenda Packet Page 80 of 209
Agenda Packet Page 81 of 209
Agenda Packet Page 82 of 209
Agenda Packet Page 83 of 209
Agenda Packet Page 84 of 209
Agenda Packet Page 85 of 209
Agenda Packet Page 86 of 209
Agenda Packet Page 87 of 209
Agenda Packet Page 88 of 209
Agenda Packet Page 89 of 209
Agenda Packet Page 90 of 209
Agenda Packet Page 91 of 209
Agenda Packet Page 92 of 209
Agenda Packet Page 93 of 209
Agenda Packet Page 94 of 209
Agenda Packet Page 95 of 209
Agenda Packet Page 96 of 209
Agenda Packet Page 97 of 209
Agenda Packet Page 98 of 209
Agenda Packet Page 99 of 209
Agenda Packet Page 100 of 209
Agenda Packet Page 101 of 209
Agenda Packet Page 102 of 209
Agenda Packet Page 103 of 209
Agenda Packet Page 104 of 209
Agenda Packet Page 105 of 209
Agenda Packet Page 106 of 209
Agenda Packet Page 107 of 209
Agenda Packet Page 108 of 209
Agenda Packet Page 109 of 209

REQUEST FOR PROPOSALS
FOR

PROFESSIONAL AUDITING SERVICES
Issue Date: April 14, 2023
Proposal Due Date: May 5, 2023 5:00 P.M. (PST)

FINANCE DEPARTMENT

CITY OF EL CERRITO
10890 SAN PABLO AVENUE
EL CERRITO, CA 94530
Agenda Packet Page 110 of 209

RFP for Professional Auditing Services
City of El Cerrito

TABLE OF CONTENTS
I. GENERAL DESCRIPTION ................................................................................................3 II. CONTACT PERSON ........................................................................................................3 III. GENERAL INFORMATION FOR RESPONDING TO THE AUDIT RFP .................................3 IV. MINIMUM CONTENT OF RESPONSES .......................................................................... 4 V. TENTATIVE SCHEDULE FOR SELECTION PROCESS ........................................................ 6 VI. ACCEPTANCE OR REJECTION AND NEGOTIATION OF PROPOSALS .............................. 6 VII. REQUIRED SCOPE OF AUDITOR SERVICES ................................................................... 7 VIII. CITY BACKGROUND INFORMATION .............................................................................10 IX. NOT-TO-EXCEED PRICE FOR PROPOSED SERVICES SCHEDULE .................................... 11 X. ATTACHMENT A: PROFESSIONAL SERVICES AGREEMENT ........................................... 12 Agenda Packet Page 111 of 209

RFP for Professional Auditing Services
City of El Cerrito

1. GENERAL DESCRIPTION
The City of El Cerrito is seeking proposals for the preparation of both financial and compliance audit reports covering the City and its related operations from qualified firms of certified public accountants. A complete description of services to be provided is described later in this document. The contract will be for a period of three years with an option to renew for two (2) additional one-year terms. The first reporting period to be audited is fiscal year July 1, 2022 through June 30, 2023. This RFP consists of a Minimum Content of Responses, Required Scope of Auditor Services, City Background Information, and a request for a Not-to-Exceed Price for Proposed Services. Responding firms shall be solely responsible for any expenses incurred in preparing proposals in response to this request.

2. CONTACT PERSON
All questions regarding this RFP should be submitted by email to:

Sandra Dalida
Finance Director/City Treasurer
[email protected]
A response will be provided within three (3) business days, and the response will be posted on the City’s website. The deadline for submission of questions is 5:00 p.m. on Friday, May 5, 2023.

NOTE: The Annual Comprehensive Financial Reports from prior years are available on the City website at https://www.el-cerrito.org/Archive.aspx?AMID=76

3. GENERAL INFORMATION FOR RESPONDING TO THE AUDIT RFP
Email proposal must be submitted by 5:00 p.m. on Friday, May 5, 2023, to:
[email protected]
Attention: Sandra Dalida, Finance Director/City Treasurer A. The response should address at a minimum the information requested in the subsequent section entitled “Minimum Content of Responses.” The response proposal format should follow the same sequence as the Minimum Content of Responses section and should be based on the attached Required Auditor Scope of Work. Responses should be presented in a clear and concise format and may include relevant attachments or exhibits.

B. The firm receiving the contract for audit services shall procure and maintain, for the duration of the contract, insurance as required in the City’s standard professional services agreement (see Attachment A).

Agenda Packet Page 112 of 209

RFP for Professional Auditing Services
City of El Cerrito
C. The firm selected must have a valid City of El Cerrito business license while conducting any work under this contract for each year of the contract term. Additional information regarding the City’s business license program may be obtained by calling (510) 215-4314.

D. Submission of a proposal indicates acceptance by the firm of the conditions contained in this request for proposals and in the attached template standard professional services agreement, unless clearly and specifically noted in the proposal submitted and confirmed in the agreement between the City and the firm selected.

E. City representatives will review the proposals and may interview finalists. The City will consider a variety of factors in recommending the selected firm to the City Council, including evaluating the proposals for compliance with the requirements of the RFP. The following are several criteria to be used; the relative importance of each is not determined by the order shown:

1. Understanding of the engagement and the City’s needs.

2. Experience of the firm and the proposed individuals to be assigned to the audit; specifically with experience in performing audits of cities, which are similar in scope.

3. Resources available for the timely completion of the audit and scheduling of the work.

4. References from similar engagements.

5. Cost of Services (at a not-to-exceed contract amount per fiscal year).

During the evaluation process, the City reserves the right to request additional information or clarification from firms submitting proposals, or to allow corrections of errors or omissions.

4. MINIMUM CONTENT OF RESPONSES
All firms are requested to provide the following information in their response:

A. Title page showing the firm’s name, contact person, and the name, address, email, and telephone number of the contact person.

B. Signed letter of transmittal stating that the firm submitting the proposal:

1. is properly licensed to practice in California (including all of the assigned professional staff to perform the engagement);

2. agrees to perform all of the work outlined in the City’s RFP within the time periods established by the City;

3. understands that the firm’s proposal is a comprehensive and irrevocable offer, valid through July 31, 2023; and
Agenda Packet Page 113 of 209

RFP for Professional Auditing Services
City of El Cerrito

4. must contain a certification that the person signing the proposal is entitled to represent the firm, empowered to submit the proposal, and authorized to sign a contract with the City.

C. Provide a copy of the Firm’s most recent external quality review; include any findings discovered as part of that review and actions taken to correct those findings. The firm also must disclose information on the circumstances and status of any disciplinary action taken or pending against the firm during the pending or settled litigation within the past three (3) years.

D. A description of the size of the firm’s governmental staff and the firm’s experience with cities of a similar nature and scope. Emphasis should be placed on assignments undertaken within the past three years and on engagements undertaken by the personnel proposed to be assigned to this agreement.

E. Identify all personnel who will be assigned to work on this project and the firm’s office in which they are each located. Include brief summaries of their background (including if they hold a current CPA license) and experience in auditing cities, as well as their assigned responsibilities under the proposal.

F. Provide an affirmative statement that the firm understands that the engagement partners, managers and specialists may be changed only with the express prior written permission of the City. Other audit personnel may be changed at the discretion of the firm submitting the proposal, provided that replacements have substantially the same or better qualifications or experience.

G. The proposal should set forth an audit approach and methodology to be used to perform the services. This may include a discussion of: (1) approach to selection of sample size; (2) use of specialized software; (3) analytical procedures; (4) approach to internal control structure; (5) approach to determining laws / regulations subject to audit test work; (6) identification of any anticipated problems, or special assistance required from City Staff; and (7) the format of the report.

H. Provide an indication of the time required for the completion of each major phase of the project. Any assumptions regarding turnaround time for City Staff review should be clearly noted. Also provide a schedule as to when the firm will commit to completing work described in this proposal. Please note that auditor is responsible for identifying required review times for the City input and must account for printing and distribution within any timelines identified in the Required Scope of Auditor Services.

The selected audit firm will be expected to schedule interim fieldwork in July 2023 and the final phase of fieldwork during the month of October with all reports delivered by December 10th. In the past, both the interim audit phase and final field work phase have Agenda Packet Page 114 of 209

RFP for Professional Auditing Services
City of El Cerrito
taken approximately three weeks for each phase to be completed and has included any proposed audit adjustments from fieldwork. Draft copies of all audit reports should be delivered to staff during mid-November, well in advance of the Government Finance Officers Association’s (GFOA) submittal deadline.

I. Provide a listing of all cities for which the firm has performed audits during the last three years.

J. Provide three references for your most representative projects including the following:

1. Name of Public Agency

2. Name and Title of contact person

3. Telephone number and email address of contact person

4. Size of General Fund Budget for the year most recently audited

5. Size of Public Agency’s Finance Department Staff

6. Brief description of the scope of the audit performed K. Provide fee information on the Not-to-Exceed Price for Proposed Services Schedule for the completion of the projects described in the Required Scope of Auditor Services section.

The total maximum price shall contain all direct and indirect costs, including all out-ofpocket expenses. Costs and total hours required should be specified for each fiscal year.

The City will not be responsible for expenses incurred in preparing and submitting the proposal. Such costs shall not be included in the proposal. Include an hourly fee quotation for all positions to be assigned. Identify an estimate of any reimbursable or non-direct costs, which would be applicable to the completion of the work. Identify proposed method of adjustment, if any, in the cost of services through subsequent years of the engagement.

5. TENTATIVE SCHEDULE FOR SELECTION PROCESS
Submittal Deadline: May 5, 2023 at 5:00 p.m.

Submittal Screening: May 8, 2023 through May 17, 2023
Notification of Firms Selected for interviews: May 18, 2023 through May 19, 2023 Finalist Interviews: May 22, 2023 through May 26, 2023
Notice to Successful Firm: June 1, 2023
Recommendation to City Council with Agreement: June23, 2023 This schedule and its components are subject to change.

ACCEPTANCE OR REJECTION AND NEGOTIATION OF PROPOSALS
The City reserves the right, for any reason whatsoever, to reject any or all proposals, to waive any irregularities in the request for proposal, and to accept or reject any item or combination of items, with no penalty to the City of El Cerrito. The City reserves the right to make the selection based on its sole discretion. It is the City’s intent to select the firm that presents the proposal that, in opinion of the City, is the most advantageous to the City, based on considerations outlined above. By requesting proposals, the City is in no way obligated to Agenda Packet Page 115 of 209

RFP for Professional Auditing Services
City of El Cerrito
award a contract or to pay expenses of the proposing firms in connection with the preparation or submission of a proposal.

6. REQUIRED SCOPE OF AUDITOR SERVICES
A. The City of El Cerrito is requesting proposals from qualified certified public accounting firms to audit its financial statements for a three-year period beginning with the fiscal year ending June 30, 2023, with the option for the City to extend the contract for two (2) additional one-year terms. At the end of each term, the City reserves the right to terminate services as stated in the executed contract.

The City of El Cerrito desires the auditor to express an opinion on the fair presentation of its basic financial statements in conformity with generally accepted accounting principles.

The audit shall include an examination of all funds of the City of El Cerrito by certified public accountants duly authorized to practice as such by the State of California. The auditor shall also be responsible for performing certain limited procedures involving required supplementary information required by the Government Accounting Standards Board, as mandated by generally accepted auditing standards.

Auditor shall review and verify all Trial Balances by Fund and all of the accounting detail necessary to perform the audit including performing beginning balance procedures and conversion entries. An initial draft of the Annual Comprehensive Financial Report (ACFR) will be prepared by the auditor and given to the City for review. Final report preparation and necessary editing shall be the responsibility of the auditor. Reproduction of reports is discussed in Section D below. Auditor shall submit for management review a draft of all other audit reports. Auditor shall incorporate, as part of the basic proposal, meeting time with City staff for the purpose of discussing the audits or management letter and its conclusions. Also, the Auditors shall participate in the presentation of Reports to Council and Committees.

B. Basic Reports to be issued following completion of the audit of the fiscal year’s financial statements shall include the following:

1. Annual Comprehensive Financial Report (ACFR)
The City desires the auditor to express an opinion on the fair presentation of its basic financial statements. The auditor is not required to express an opinion on the combining and individual nonmajor fund financial statements and schedules.

However, the auditor is to provide an “in-relation-to” report based on the auditing procedures applied during the audit of the basic financial statements.

Certain limited procedures should be applied during the audit of the basic financial statements. Certain limited procedures should be applied to management’s discussion and analysis and budgetary comparison information, but an expression Agenda Packet Page 116 of 209

RFP for Professional Auditing Services
City of El Cerrito
of an opinion is not required. The auditor is not required to express an opinion on the introductory and statistical sections.

2. Management and SAS 114 Letters, which includes findings, statements, observations, opinion, comments, or recommendations, related to:
a. Systems of internal control based upon the auditor’s understanding of the control structure and assessment of control risk.
b. Compliance with applicable laws and regulations.
c. Accounting systems, functions, procedures, and processes, especially with regard to cost effectiveness.

3. Single Audit Report
The City receives federal funds which come under the provision of the Single Audit Act. The auditor will review the City’s Schedule of Expenditures of Federal Awards for accuracy and completeness, prepare and submit the Single Audit Report through the State designated portal, and notify the City of schedule and deadline for the City to complete and certify through the State designated portal.

4. Pension Plan Report

5. Public Financing Authority Report

6. 2008 Sales Tax Revenue Bonds, AUP

7. Transportation Development Act

8. Gann Appropriations Limit
Establish agreed upon procedures for calculating the City’s Gann Appropriation Limit based on State specified criteria.

C. Supplemental Reports, other Audits and Studies at the City’s option may be requested in writing through supplemental audit agreement. Prior to beginning work the scope of the study and associated costs shall be approved by the City and may include:

1. Cities Financial Transactions Report (CFTR)

2. Housing Authority Report and Electronic Filing

3. Management Letters and Findings

4. Audits related to special grant funds, based on audit threshold for the specific program.

D. Report Production and Filing
The Audit Firm will provide one (1) pdf file; five (5) bound copies of all audit reports, studies, and supplemental reports; and file and submit approved reports through designate regulatory online portals as specified by the City Agenda Packet Page 117 of 209

RFP for Professional Auditing Services
City of El Cerrito
E. Standards to be followed to meet the requirements of this request for proposals includes performing audits in accordance with all applicable and generally accepted auditing standards including, but not limited to standards set forth for financial audits by the:

1. Government Accounting Standards Board (GASB)

2. General Accounting Office’s (GAO) Government Auditing Standards

3. U.S. Office of Management (OMB) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards.

F. Special Considerations

1. The City of El Cerrito has historically submitted the Annual Comprehensive Financial Report (ACFR) to the Government Finance Officers Association (GFOA) for review related to the “Certificate of Achievement for Excellence in Financial Reporting.” The City anticipates that it will continue to send its ACFR to GFOA for review. The format of ACFR reports shall allow the City to meet the requirements of the GFOA program.

This also requires that the auditor ensure that the audit report and financial statements are completed in time for submission to GFOA. The auditor shall also assist with developing responses to any comments or deficiencies noted by GFOA.

2. The Schedule of Expenditures of Federal Awards (SEFA) and related auditor’s report, as well as the reports on the internal controls and compliance, will be issued separately and not to be included in the ACFR.

G. Working Paper Retention and Access to Working Papers All working papers and reports must be retained, at the auditor’s expense, for a minimum of five (5) years following completion of the audit, unless the firm is notified in writing by the City of El Cerrito to extend the retention period.

The auditor will be required to make working papers available, upon request, to the following parties or their designees:

1. City of El Cerrito

2. parties designated by the federal or state governments or by the City of El Cerrito as part of an audit quality review process

3. Auditors of entities of which the City of El Cerrito is a sub-recipient of grant funds

4. State of California, Office of the State

5. Successor auditors and allow successor auditors to review working papers relating to matters of accounting significance.

H. Assistance to be provided by City: 1. City Staff will prepare the final closing of the books.

The City will provide the auditors with a Trial Balance by Fund and the accounting detail necessary to perform the audit. 2. City Staff will generate the necessary confirmation letters prepared by the auditor. 3. City Staff will be available during the audit to assist the auditor by providing information, documentation, and explanations. All requests will first be directed to the Financial Services Manager. 4. City will provide the auditor with Agenda Packet Page 118 of 209

RFP for Professional Auditing Services
City of El Cerrito
reasonable workspace. Auditor will also be provided reasonable access to a telephone line, photocopier, and fax machine.

7. CITY BACKGROUND INFORMATION
The City of El Cerrito was incorporated as a General Law City on August 23, 1917 and became a Charter City in November 2018. El Cerrito has a population of approximately 25,508 and covers an area of 3.9 square miles. El Cerrito is located in west Contra Costa County and along the eastern shore of San Francisco Bay. Interstate Highway 80 passes near the western boundary and crest of Berkeley Hills and Wildcat Canyon Regional Park define the eastern boundary.

The City is organized as a Council-Manager form of local municipal government, and its City Charter was adopted by the voters in November 2018. The City Council consists of five members elected at large for four years, overlapping terms. The Council selects the Mayor for a one-year term from among its members. The Council Members also serve as the governing body of the El Cerrito Employees’ Pension Board and the El Cerrito Public Financing Authority.

The City Manager is appointed by the City Council and is responsible for administration of municipal affairs. All municipal departments operate under the supervision of the City Manager. The City Council also appoints the City Attorney to advise City staff and represent the City in litigation. The City provides police and fire services, recreation services, streets and roads, recycling, economic development, public improvements, building, planning and zoning, and general administrative services. Library services are provided by the County of Contra Costa, and the City contracts with East Bay Sanitary for garbage service through a franchise agreement. Comcast, AT&T, and a host of smaller companies provide telecommunication services. Water is provided by East Bay Municipal Utility District, and sewer services are provided by Stege Sanitary District. PG&E provides gas and electricity services, and in addition the City is a member of MCE, a public, not for-profit electricity provider that gives all PG&E electric customers the choice of having 60% to 100% of their electricity supplied from clean, renewable sources.

The mission of the Finance Department is to support the financial and fiscal sustainability of the City, its agencies and corporations; ensure the safekeeping, management, and accounting of the City’s financial assets; and assure activities are performed, recorded and presented in compliance with professional and ethical standards. Other important responsibilities include administering investments, debt management, pensions, payroll, accounts payable and receivable. The City contributes to the California Public Employees’ Retirement System (PERS), a multiple employer public employee retirement system that acts as a common investment and administrative agent for participating public entities within the State of California, and Public Agency Retirement Services (PARS) for designated employee classifications.

Agenda Packet Page 119 of 209

RFP for Professional Auditing Services
City of El Cerrito

8. NOT-TO-EXCEED PRICE FOR PROPOSED SERVICES SCHEDULE
In accordance with the Request for Proposals for Professional Auditing Services issued by City of El Cerrito, the firm referenced below hereby submits the following cost proposal:

Report Type To Issue
Fiscal Year Ending June 30
2023 2024 2025 2026 2027
Annual City Audit, Reports, Annual
Comprehensive Financial Report and
Opinions
Single Audit
City’s Pension Plan
Public Financing Authority
2008 Sales Tax Revenue Bonds, AUP
Transportation Development Act
GANN Appropriation Limit
Beginning Balance Procedures
Conversion Entries
Present Reports to Council and Committees

TOTAL NOT TO EXCEED AMOUNT
Additional Audits and Reports at City’s
Option:

Cities Financial Transaction Report
Housing Authority Report & Electronic
Filing
Management Letters and Findings
In addition, please include below an hourly fee quotation and hours proposed for all positions to be assigned to the audit:

Category Hours Hourly Rate
Partners
Managers
Supervisory Staff
Professional Staff
Clerical/Support Staff
Other
Agenda Packet Page 120 of 209

I hereby certify that the undersigned is authorized to represent the firm stated above, and empowered to submit this proposal, and if selected authorized to sign a contract with the City, for the services identified in the Request for Proposals.

Firm Name: ___________________________________________________ Signature: ___________________________________________________ Printed Name:___________________________________________________ Title: ___________________________________________________ Date: ___________________________________________________

9. ATTACHMENT A - CITY PROFESSIONAL SERVICES AGREEMENT
It is recognized that the formal basis of any agreement between the City and the service provider is a contract rather than a proposal. In submitting proposals, Proposers must indicate that they are prepared to complete the City’s standard Professional Services Agreement, a template of which is presented on the following pages. Please note that the City’s standard template agreement is currently under internal review and subject to change prior to entering into an agreement.

The selected Proposer will be expected to accept these terms and conditions unless they otherwise note any exception in their response.

If the interested firm desires to take exception to the agreement and/or insurance requirements, the interested firm shall clearly identify proposed changes to the agreement and furnish the reason for these changes.

Agenda Packet Page 121 of 209

AGENDA BILL
Agenda Item No. 7.C.

Date: July 18, 2023
To: El Cerrito City Council
From: Paul Keith, Chief of Police, El Cerrito Police Department Subject: Agreement between the City of El Cerrito and West Coast Vending and Food Service, Inc. to Provide Food Services to the El Cerrito Police Department

ACTION PROPOSED
Adopt a resolution authorizing the City Manager to enter into an agreement with West Coast Vending and Food Services, Inc. to provide vending services, including the purchase of materials, supplies, and/or equipment to the City of El Cerrito for an amount not to exceed $75,000 annually from July 1, 2023 through June 30, 2025.

BACKGROUND
In May 2022, Police Department staff began exploring various ideas to increase staff retention and morale. One solution proposed was to provide free vending of food and drinks. In August 2022, staff began a pilot program, providing free vending services to Police Department employees. Since implementation, this service has been very well received.

ANALYSIS
The free vending service has had a positive impact on Department morale and employee retention. The Police Department staff attrition rate has significantly slowed, and since the start of the pilot program, there have been no new voluntary resignations other than service retirements.

In addition to raising morale, providing the snack and drink service also has a practical application. The Police Department operates around the clock and due to the level of calls for service, at times, it is not practical for officers to take a meal break. The snacks and drinks allow officers to get sustenance at the station while continuing their work.

Additionally, the service provides hospitality for meetings, hosted training events, and provides refreshment for people brought to the Police Department for interviews and continuing investigations.

At the start of the pilot program, staff researched available vending companies in the area, finding only two that could potentially meet the Department’s needs. West Coast Vending was the only company that responded to inquiries. In Fiscal Year 2022-23, the City entered into a one-year contract with West Coast Vending for $45,000. This contract expires June 30, 2023.

Currently, the monthly service costs range from around $4,500 - $5,100. As Police Department staffing numbers increase, these costs are increasing, and staff Agenda Packet Page 122 of 209
Agenda Item No. 7.C.
recommend a new two-year contract for $75,000 to be paid from the Asset Forfeiture Fund.

STRATEGIC PLAN CONSIDERATIONS
This service supports Goal A of the City’s Strategic Plan: Deliver exemplary government services. This service aids the Department in its goal to recruit and maintain a talented and effective workforce.

ENVIRONMENTAL CONSIDERATIONS
This section is not applicable to this agenda item.

FINANCIAL CONSIDERATIONS
The funding for this agreement was included in the adopted Fiscal Year 2023-24 Budget and no new appropriations are necessary. The source of the funding is the Asset Forfeiture Fund. This is a special fund intended to be used to support policing activities.

LEGAL CONSIDERATIONS
This section is not applicable to this agenda item.

Reviewed by:

Karen Pinkos, City Manager
Attachments:

1. Resolution

2. Agreement
Agenda Packet Page 123 of 209
RESOLUTION 2023-XX

RESOLUTION OF THE CITY COUNCIL OF THE CITY OF EL CERRITO AUTHORIZING

THE CITY MANAGER TO ENTER INTO AN AGREEMENT WITH WEST COAST VENDING AND FOOD SERVICE, INC. TO PROVIDE VENDING SERVICES FOR AN AMOUNT NOT TO EXCEED $75,000.

WHEREAS, the City of El Cerrito Police Department has utilized West Coast Vending and Food Service, Inc., for food services during Fiscal Year 2022-23; and WHEREAS, West Coast Vending and Food Service, Inc. has provided excellent services to El Cerrito Police Staff; and
WHEREAS, vending services have been a benefit to employee retention, health, and satisfaction, and provide refreshments for a variety of activities that are beneficial to the Police Department.

NOW THEREFORE, BE IT RESOLVED by the City Council of the City of El Cerrito that it hereby authorizes the City Manager to enter into an agreement with West Coast Vending and Food Service, Inc. to provide vending services for an amount not to exceed $75,000.

I CERTIFY that at a regular meeting on July 18, 2023 the City Council of the City of El Cerrito passed this Resolution by the following vote:

AYES: COUNCILMEMBERS:

NOES: COUNCILMEMBERS:

ABSTAIN: COUNCILMEMBERS:

ABSENT: COUNCILMEMBERS:

IN WITNESS of this action, I sign this document and affix the corporate seal of the City of El Cerrito on .
________________________
Alexandra Orologas, Deputy City Clerk
APPROVED:
________________________
Lisa Motoyama, Mayor
Agenda Packet Page 124 of 209

PURCHASE AGREEMENT BETWEEN THE
CITY OF EL CERRITO AND WEST COAST VENDING & FOOD SERVICE, INC.

These terms and conditions govern the purchase of materials, supplies, and/or equipment, including any related installation and/or minor services and repairs described in this Purchase Agreement (“Purchase Agreement”) by West Coast Vending & Food Service, Inc. (“Vendor”) for the City of El Cerrito (“City”). Vendor and City are collectively referred to in this Purchase Agreement as “the Parties.” If the Vendor selects subcontractors to execute a portion the terms of this Purchase Agreement, that subcontractor is an agent of the Vendor, and is hereby included by reference as “the Vendor.”

1. Time of Performance. This Purchase Agreement shall commence effective July 1, 2023, and shall end June 30, 2024.

The services set forth in Exhibit A will be ongoing, through the expiration of this agreement. In the event that any of the terms of Exhibit A conflict with this Purchase Agreement, the terms of the Purchase Agreement shall prevail.

2. Description of Goods. Vendor shall perform everything required to be performed and shall provide and furnish to City with vending machine products and shall complete delivery F.O.B. to the City on a regular and ongoing basis from the date of this Purchase Agreement in strict accordance with the specifications as established by this Purchase Agreement and Exhibit(s), which specifications are incorporated herein and made part of this Purchase Agreement.

3. Description of Purchase. The City hereby agrees to pay Vendor for the Products and/or Services with a not to exceed amount. The total compensation for Products and/or Services performed under this Purchase Agreement is not to exceed seventy-five thousand dollars ($75,000).

The City shall pay Vendor invoices for Products and/or Services actually delivered in accordance with this Purchase Agreement. To be eligible for payment, Vendor invoices must itemize the Products and/or Services delivered and the corresponding prices in accordance with this Purchase Agreement. Payment of Vendor invoices does not constitute acceptance of Products and/or Services delivered. Prices of Products and/or Services delivered that are not in accordance with this Purchase Agreement are subject to adjustment. In no event will the prices of Products and/or Services delivered exceed that specified on this Purchase Agreement. Payments shall be subject to adjustment for defects in quality or failure of Vendor to meet terms and conditions herein and in Exhibit A. Such adjustments shall be equal to one hundred percent (100%) of City’s costs to correct such defects or Vendor’s failure to meet Purchase Agreement requirements.

4. Taxes. Vendor shall pay all applicable federal, state and local taxes, which may be chargeable against the delivery of the Products and/or Services listed herein.

5. General Warranties and Product Compliance. Vendor warrants that: (A) All Products and/or Services are as described on this Purchase Agreement conform to all descriptions and specifications contained in Exhibit A; (B) All Products and/or Services delivered are new and of good merchantable quality, free from material defects of workmanship and fit for the purpose for which sold or provided; (C) Vendor has good title to all Products delivered and all Products delivered are free from liens and other encumbrances; and (D) Vendor's delivery and installation of the Products and/or Services will be in strict conformity with all applicable local, state, and federal laws. For purposes of this warranty, any Products or components not meeting the foregoing quality shall be deemed defective. The foregoing warranty provisions shall also be applicable to equipment or materials provided by a third-party entity to Vendor via this Purchase Agreement.

Vendor also expressly warrants and guarantees, for one (1) year that the Products and/or Services furnished by it to City shall be free from breakage or defects of material and workmanship under normal use, service and maintenance from the date of acceptance of the City, and expressly agrees to repair or replace Products and/or Services or any part thereof which proves defective as a result of inferior or defective materials, equipment or workmanship. If within the period stated above, any repairs or replacements in connection with the Products and/or Services are, in the opinion of the City, rendered necessary as a result of the use of inferior or defective materials, equipment or workmanship, Vendor agrees on receipt of notice from City and without expense to the City, for freight, parts or labor, to properly repair, replace or correct any and all such defects therein. If Vendor, after such notice, fails to proceed promptly with the terms of this warranty and guarantee, the City may perform the work necessary to effectuate such corrections, repairs and replacements, and recover the cost thereof from Vendor.

6. Damage to City Facilities. Damage to City or public facilities or private property caused by the Vendor or by its subcontractors during delivery or installation shall be repaired and/or replaced in kind at no cost to the City.

7. Site Safety and Cleanup. The delivery and installation site shall be kept clean and free of hazards at all times during installation. After installation is completed at the site, Vendor shall clean the surrounding area to the condition prior to installation.

DocuSign Envelope ID: E4DFBC97-3847-46ED-91FE-1AF7C18BF33E Agenda Packet Page 125 of 209

8. Final Inspection and Work Acceptance. Finished installation work and/or equipment shall be subject to final inspection and acceptance or rejection by the City.

9. Indemnity. To the fullest extent permitted by law, Vendor shall indemnify, defend (with counsel acceptable to the City), and hold harmless the City and its elected and appointed officers, officials, employees, agents, contractors and consultants (collectively, the “City Indemnitees”) from and against any and all liability, loss, damage, claims, expenses and costs (including, without limitation, attorneys’ fees and costs of litigation) (collectively, “Liability”) of every nature arising out of or in connection with the delivery and installation of the Products and/or Services described on this Purchase Agreement or Vendor’s failure to comply with this Purchase Agreement, except such Liability caused by the gross negligence or willful misconduct of the City Indemnitees.

10. Insurance. Before beginning any installation, work and continuing throughout the term of this Purchase Agreement, Vendor, at its sole cost and expense, furnish the City with certificates of insurance evidencing that Contractor has obtained and maintains insurance in the following amounts:

A. Workers’ Compensation that satisfies the minimum statutory limits.

B. Commercial General Liability and Property Damage Insurance in an amount not less than ONE MILLION DOLLARS ($1,000,000) combined single limit per occurrence, TWO MILLION DOLLARS ($2,000,000) annual aggregate, for bodily injury, property damage, products, completed operations and contractual liability coverage. The policy shall also include coverage for liability arising out of the use and operation of any City-owned or City-furnished equipment used or operated by the Vendor, its personnel, agents, or subcontractors.

C. Comprehensive automobile insurance in an amount not less than ONE MILLION DOLLARS ($1,000,000) per occurrence for bodily injury and property damage including coverage for owned and non-owned vehicles.

All insurance policies shall be written on an occurrence basis and shall name the City Indemnitees as additional insureds with any City insurance shall be secondary and in excess to Vendor’s insurance. If the Vendor’s insurance policy includes a self-insured retention that must be paid by a named insured as a precondition of the insurer’s liability, or which has the effect of providing that payments of the self-insured retention by others, including additional insureds or insurers do not serve to satisfy the self-insured retention, such provisions must be modified by special endorsement so as to not apply to the additional insured coverage required by this agreement so as to not prevent any of the parties to this agreement from satisfying or paying the self-insured retention required to be paid as a precondition to the insurer’s liability. Additionally, the certificates of insurance must note whether the policy does or does not include any selfinsured retention and also must disclose the deductible.

The City Risk Manager, in writing, may approve a variation in the foregoing insurance requirements. A valid and executed approval by Risk Manager must accompany this Purchase Agreement for a variation to be binding.

11. Prevailing Wage. Where applicable, the wages to be paid for a day's work to all classes of laborers, workmen, or mechanics on the work contemplated by this Purchase Agreement, shall be not less than the prevailing rate for a day’s work in the same trade or occupation in the locality within the state where the work hereby contemplates to be performed as determined by the Director of Industrial Relations pursuant to the Director’s authority under Labor Code Section 1770, et seq. Each laborer, worker or mechanic employed by Vendor or by any subcontractor shall receive the wages herein provided for. The Vendor shall pay two hundred dollars ($200), or whatever amount may be set by Labor Code Section 1775, as may be amended, per day penalty for each worker paid less than prevailing rate of per diem wages. The difference between the prevailing rate of per diem wages and the wage paid to each worker shall be paid by the Vendor to each worker.

An error on the part of an awarding body does not relieve the Vendor from responsibility for payment of the prevailing rate of per diem wages and penalties pursuant to Labor Code Sections 1770-1775. The City will not recognize any claim for additional compensation because of the payment by the Vendor for any wage rate in excess of prevailing wage rate set forth. The possibility of wage increases is one of the elements to be considered by the Vendor.

A. Posting of Schedule of Prevailing Wage Rates and Deductions. If the schedule of prevailing wage rates is not attached hereto pursuant to Labor Code Section 1773.2, the Vendor shall post at appropriate conspicuous points at the site of the project a schedule showing all determined prevailing wage rates for the various classes of laborers and mechanics to be engaged in work on the project under this contract and all deductions, if any, required by law to be made from unpaid wages actually earned by the laborers and mechanics so engaged.

DocuSign Envelope ID: E4DFBC97-3847-46ED-91FE-1AF7C18BF33E Agenda Packet Page 126 of 209

B. Payroll Records. Each Vendor and subcontractor shall keep an accurate payroll record, showing the name, address, social security number, work week, and the actual per diem wages paid to each journeyman, apprentice, worker, or other employee employed by the Vendor in connection with the public work. Such records shall be certified and submitted weekly as required by Labor Code Section 1776.

12. Payment of Employment Taxes; Tax Withholding. Vendor is solely responsible for the payment of employment taxes incurred under this Agreement and any similar federal or state taxes. To be exempt from tax withholding, Vendor must provide City with a valid California Franchise Tax Board form 590 (“Form 590”), as may be amended and such Form 590 shall be attached hereto and incorporated herein as Exhibit B. Unless Vendor provides City with a valid Form 590 or other valid, written evidence of an exemption or waiver from withholding, City may withhold California taxes from payments to Vendor as required by law. Vendor shall obtain, and maintain on file for three (3) years after the termination of this Agreement, Form 590s (or other written evidence of exemptions or waivers) from all subcontractors.

Vendor accepts sole responsibility for withholding taxes from any non-California resident subcontractor and shall submit written documentation of compliance with Vendor’s withholding duty to City upon request.

13. Termination. In addition to all other legal and equitable rights of the City, the City may terminate this Purchase Agreement upon written notice to the Vendor. If the City terminates this Purchase Agreement, the City will pay the Vendor for Products and/or Services accepted in accordance with this Purchase Agreement prior to the date of termination.

14. Prevailing Party. In the event that either party to this Purchase Agreement commences any legal action or proceeding (including but not limited to arbitration) to interpret the terms of this Purchase Agreement, the prevailing party in such a proceeding shall be entitled to recover its reasonable attorney’s fees associated with that legal action or proceeding.

15. Notice. All notices and other communications which are required or may be given under this Agreement shall be in writing and shall be deemed to have been duly given (i) when received if personally delivered; (ii) when received if transmitted by telecopy, if received during normal business hours on a business day (or if not, the next business day after delivery) provided that such facsimile is legible and that at the time such facsimile is sent the sending Party receives written confirmation of receipt; (iii) if sent for next day delivery to a domestic address by recognized overnight delivery service (e.g., Federal Express); and (iv) upon receipt, if sent by certified or registered mail, return receipt requested. In each case notice shall be sent to the respective Parties as follows:

Vendor: Bruce Bauer
West Coast Vending & Food Service, Inc.
2124 Livingston Street, Oakland, CA 94606
City: Paul Keith, Police Chief
El Cerrito Police Department
10900 San Pablo Ave., El Cerrito, CA 94530

16. Assignment, Governing Law. The Vendor may not assign any of Vendor's obligations under this Purchase Agreement without the City’s prior written approval. This Purchase Agreement is governed by California law. The jurisdiction for any litigation arising from this Purchase Agreement shall be in the state of California and shall be venued in the County of Contra Costa.

17. Severability. If any portion of this Purchase Agreement is held invalid, the Parties agree that such invalidity shall not affect the validity of the remaining portions of this Purchase Agreement.

18. Entire Agreement. This Agreement represents the entire and integrated agreement between the Parties. This Purchase Agreement may be modified or amended only by a subsequent written agreement signed by both Parties.

19. Execution in Counterpart. This Agreement may be executed in counterparts and/or by facsimile or other electronic means, and when each Party has signed and delivered at least one such counterpart, each counterpart shall be deemed an original, and, when taken together with other signed counterpart, shall constitute one Agreement, which shall be binding upon and effective as to all Parties.

DocuSign Envelope ID: E4DFBC97-3847-46ED-91FE-1AF7C18BF33E Agenda Packet Page 127 of 209

CITY OF EL CERRITO VENDOR
By:___________________________ By:___________________________ Paul Keith, Chief of Police Bruce Bauer, President
Approved as to Form:
__________________________
City Attorney
5194019.1
DocuSign Envelope ID: E4DFBC97-3847-46ED-91FE-1AF7C18BF33E Agenda Packet Page 128 of 209

AGENDA BILL
Agenda Item No. 7.D.

Date: July 18, 2023
To: El Cerrito City Council
From: Paul Keith, Chief of Police, El Cerrito Police Department Subject: Agreement with Motorola Solutions to Upgrade El Cerrito Police Department Radios with Encryption Software

ACTION PROPOSED
Authorize the City Manager to enter into an agreement with Motorola Solutions, Inc. for the provision of encryption software upgrades to El Cerrito Police Department radios for a cost not to exceed $135,000.

BACKGROUND
For more than two decades, the El Cerrito Police Department (ECPD) has contracted with the City of Richmond for police dispatch services. During that time, both agencies used unencrypted radio channels to communicate between units. In October 2020, the California Department of Justice (DOJ) issued policy guidance regarding how personal identifying information is broadcast on police radios. The DOJ requires all broadcasts of personal identifying information to be done over encrypted radio channels. At the time, nearly all police agencies in California used unencrypted channels. Because of this guidance, these departments are upgrading their radio systems to incorporate encryption into their operations.

The El Cerrito Police Department uses radios manufactured by Motorola Solutions, Inc. and operates these radios on the East Bay Regional Communications System (EBRCS). The City of Richmond continues to provide dispatch services for the El Cerrito Police and has communicated its intent to encrypt police channels to comply with the guidance from DOJ.

ANALYSIS
The process of encrypting ECPD radios involves two steps. The first step is installing encryption software, provided by Motorola Solutions, Inc. Because all ECPD police radios are made by Motorola Solutions Inc., they are the only possible vendor for this software. The second step in the installation process is reprogramming the radios to match the new programming at the Richmond Communications Center. Contra Costa County provides radio programming services.

The cost of the encryption software for each radio is $1,444, before tax. The ECPD intends to install encryption software on eighty-one (81) radios, which includes both portable and vehicle radios. Funding is included within the FY 2023-24 Adopted Budget in the Abandoned Vehicle Abatement Fund and the C.O.P.S. Grant Fund.

Agenda Packet Page 129 of 209
Agenda Item No. 7.D.

STRATEGIC PLAN CONSIDERATIONS
This upgrade project is in alignment with Strategic Goal E: Ensure the Public's Health and Safety. The purpose of police radio encryption is to protect the personal identifying information of community members.

ENVIRONMENTAL CONSIDERATIONS
This section is not applicable to this agenda item.

FINANCIAL CONSIDERATIONS
Funding for this encryption project was included in the FY 2023-24 Adopted Budget and no new appropriations are necessary. The cost for the upgrades to Community Service Officer equipment ($10,000) will be from the Abandoned Vehicle Abatement Fund and upgrades to all other equipment (up to $125,000) are from the C.O.P.S. Grant Fund.

LEGAL CONSIDERATIONS
The City Attorney has reviewed the proposed action and legal considerations have been addressed.

Reviewed by:

Karen Pinkos, City Manager
Attachments:

1. Resolution

2. DOJ_CLETS_Encryption_Notice

3. Motorola Encryption Quote
Agenda Packet Page 130 of 209
RESOLUTION 2023-XX

RESOLUTION OF THE CITY COUNCIL OF THE CITY OF EL CERRITO

AUTHORIZING THE CITY MANAGER TO ENTER INTO AN AGREEMENT WITH MOTOROLA SOLUTIONS, INC. FOR THE PROVISION OF ENCRYPTION

SOFTWARE UPGRADES TO EL CERRITO POLICE DEPARTMENT RADIOS FOR AN AMOUNT NOT TO EXCEED $135,000.

WHEREAS, the El Cerrito Police Department does not currently use encryption on police radio communication; and
WHEREAS, the California Department of Justice requires police agencies to encrypt communications containing personal identifying information; and WHEREAS, the Richmond Communications Center is the dispatch vendor for the El Cerrito Police Department and intends to encrypt radio communications; and WHEREAS, the El Cerrito Police Department must upgrade police radios to continue to protect personal identifying information and communicate with the Richmond Communications Center.

NOW THEREFORE, BE IT RESOLVED by the City Council of the City of El Cerrito that it hereby authorizes the City Manager to enter into an agreement with Motorola Solutions, Inc. to provide encryption software upgrades to El Cerrito Police Department radios for an amount not to exceed $135,000.

I CERTIFY that at a regular meeting on July 18, 2023, the City Council of the City of El Cerrito passed this Resolution by the following vote:

AYES: COUNCILMEMBERS:

NOES: COUNCILMEMBERS:

ABSTAIN: COUNCILMEMBERS:

ABSENT: COUNCILMEMBERS:

IN WITNESS of this action, I sign this document and affix the corporate seal of the City of El Cerrito on .
________________________
Alexandra Orologas, Deputy City Clerk
APPROVED:
________________________
Lisa Motoyama, Mayor
Agenda Packet Page 131 of 209
Xavier Becerra, Attorney General
California Department of Justice

CALIFORNIA JUSTICE

INFORMATION SERVICES DIVISION
Joe Dominic, Chief
Contact.for information:
20-09-CJIS
Confidentiality of lnformatic;m from the California Law 1--- Da1e-: ----' CLETS Administration Section EnforcementTelecommunicat1ons System (CLETS) [email protected] 10-12-2020 (916) 210-4240
TO: ALL CLETS SUBSCRIBING AGENCIES
Law enforcement and criminal justice agencies authorized by the California Department of Justice (CA DOJ) to access the CLETS must adhere to the requirements detailed in the CLETS Policies, Practices and Procedures (PPP) and in the Federal Bureau of Investigation (FBI) Criminal Justice Information Services (CJIS) Security Policy to ensure the confidentiality and integrity of the data therein. 1 More specifically, and as detailed further below, access to certain Criminal Justice Information (CJI) and Personally Identifiable Information (PII) must be limited to authorized personnel; and the transmission of such information must be encrypted. Although generally applicable, the information in this bulletin is particularly relevant to the radio transmission of protected data.

Allowable "access" to CJI and PII, derived from CLETS, is described in CLETS PPP section 1.6.4:

Only authorized law enforcement, criminal justice personnel or their lawfully authorized designees may use a CLETS terminal or have access to information derived from CLETS.

Any information from the CLETS is confidential and for official use only. Access is defined as the ability to hear or view any information provided through the CLETS.

The FBI and the CA DOJ establish policies and procedures related to the usage and protection of CJI that govern the usage of the CLETS. The policies define CJI, classify them as restricted or unrestricted, and limit the amount and types of information that can be broadcast over unencrypted radio channels in order to protect sensitive CJI and PII.

Generally, PII is information that can be used to distinguish or trace an individual's identity, such as an individual's first name, or first initial, and last name in combination with any one or more specific data elements (see FBI CJIS Security Policy section 4.3.). Data elements include Social Security number, passport number, military identification (ID) number and other unique ID numbers issued on a government document. The most common data elements encountered during field operations include a driver license number or ID number.

The transmission of sensitive CJI and PII must be encrypted pursuant to the FBI CJIS Security Policy sections 5.10 and 5.13; and access may only be provided to authorized individuals as defined under the CLETS PPP and the FBI CJIS Security Policy.
1 For reference, please refer to the CLETS PPP at https://oag.ca.gov/sites/default/files/clets-ppp%2012-2019.pdf and the FBI CJIS Security Policy at https://www.fbi.gov/file-repository/cjis_security_policy_v5-9_20200601.pdf/view. See also Government Code section 15150 et seq. and California Code of Regulations, title 11, section 703.

Agenda Packet Page 132 of 209
Information Bulletin
Confidentiality of CLETS Information

Compliance with these requirements can be achieved using any of the following:
• Encryption of radio traffic pursuant to FBI CJIS Security Policy sections 5.10.1.2, 5.10.1.2.1, and 5.13.1. This will provide the ability to securely broadcast all CJI (both restricted and unrestricted information) and all combinations of PII.
• Establish policy to restrict dissemination of specific information that would provide for the protection of restricted CJI database information and combinations of name. and other data elements that meet the defin'ition of PII. This will provide for the protection of CJI and PII while allowing for radio traffic with the information necessary to provide public safety.

If your agency is not currently in compliance with the requirements outlined herein, please submit an implementation plan to the CA DOJ, CLETS Administration Section, no later than December 31 , 2020. The plan must be on agency letterhead and signed by the Agency Head (e.g .. , She.riff, Chief); include a detailed description of how radio communications will be brought into compliance (e.g., encryption), or how the risks will be mitigated through policy if unable to implement the required technology; and must include the projected timeline as to when the issue will be resolved.

For questions about this bulletin, contact the CLETS Administration Section at [email protected] or (916) 210-4240.

Sincerely,
1·)~
JOE DOMINIC, Chief
California Justice Information Services Division
For XAVIER BECERRA
Attorney General
Agenda Packet Page 133 of 209
Billing Address:

EL CERRITO, CITY OF
7007 MOESER LN
EL CERRITO, CA 94530
US
Shipping Address:

EL CERRITO, CITY OF
7007 MOESER LN
EL CERRITO, CA 94530
US
Quote Date:07/06/2023
Expiration Date:09/04/2023
Quote Created By:

Dick Fasi
[email protected]
End Customer:

EL CERRITO, CITY OF
Contract: 22582 - CONTRA COSTA

COUNTY, CA
Payment Terms:30 NET
Line # Item Number Description Qty List Price Sale Price Ext. Sale Price FLASHport Series APX6500FLASHPORT
1 T7698A TDMA 1 $0.00 $0.00 $0.00
1a G298AV ENH: ASTRO 25 OTAR W/

MULTIKEY
31 $936.00 $748.80 $23,212.80
FLASHport Series APX6000FLASHPORT
2 T7665A TDMA 1 $0.00 $0.00 $0.00
2a Q498BA ENH: ASTRO 25 OTAR W/

MULTIKEY
50 $936.00 $748.80 $37,440.00
After Market Encryption
Upgrades
3 T7936A APX UCM UPGRADE CD 1 $57.50 $57.50 $57.50
3a CA00182AR ADD: AES ENCRYPTION

SOFTWARE
81 $696.00 $696.00 $56,376.00
Subtotal $117,086.30
Estimated Tax $12,001.00
Grand Total $129,087.30(USD)
Notes:

QUOTE-2224647
Any sales transaction following Motorola's quote is based on and subject to the terms and conditions of the valid and executed written contract between Customer and Motorola (the ""Underlying Agreement"") that authorizes Customer to purchase equipment and/or services or license software (collectively ""Products""). If no Underlying Agreement exists between Motorola and Customer, then Motorola's Standard Terms of Use and Motorola's Standard Terms and Conditions of Sales and Supply shall govern the purchase of the Products.

Motorola Solutions, Inc.: 500 West Monroe, United States - 60661 ~ #: 36-1115800 Agenda Packet Page 134 of 209

Purchase Order Checklist
Purchase Order Checklist
Marked as PO/ Contract/ Notice to Proceed on Company Letterhead (PO will not be processed without this)
PO Number/ Contract Number
PO Date
Vendor = Motorola Solutions, Inc.

Payment (Billing) Terms/ State Contract Number
Bill-To Name on PO must be equal to the Legal Bill-To Name Bill-To Address
Ship-To Address (If we are shipping to a MR location, it must be documented on PO) Ultimate Address (If the Ship-To address is the MR location then the Ultimate Destination address must be documented on PO )
PO Amount must be equal to or greater than Order Total
Non-Editable Format (Word/ Excel templates cannot be accepted) Bill To Contact Name & Phone # and EMAIL for customer accounts payable dept Ship To Contact Name & Phone #
Tax Exemption Status
Signatures (As required)
Agenda Packet Page 135 of 209

AGENDA BILL
Agenda Item No. 7.E.

Date: July 18, 2023
To: El Cerrito City Council
From: Yvetteh Ortiz, Public Works Director/City Engineer, Public Works Department; Jarrett Mullen, Sustainable Transportation Program Manager, Community Development Department
Subject: Consulting Services Agreement between the City of El Cerrito and Kittelson & Associates, Inc. to Provide Transportation Planning and Engineering Services for the Local Road Safety Plan

ACTION PROPOSED
Adopt a resolution authorizing the City Manager to execute a consulting services agreement for an amount not to exceed $87,000 with Kittelson & Associates, Inc. (Kittelson) to provide transportation planning and engineering services to initiate, develop, and complete a Local Road Safety Plan (LRSP).

BACKGROUND
Road safety is a growing focus of state and national concern. Nationwide, roadway fatalities have remained stubbornly high for the past decade. Approximately 40,000 people die on U.S. roads every year, or one fatality per 100 million miles traveled. The trend worsened during the pandemic. In 2021, nearly 43,000 people died on American roads, an approximately ten percent increase above 2020, and the highest number of deaths since 2007. During the same period, other wealthy nations successfully reduced per-capita crashes by prioritizing bicyclist and pedestrian safety through both road and vehicle design overhauls.

Seeking to emulate the successes of international programs, state and federal transportation agencies are requiring that local agencies adopt safety plans to remain eligible or competitive for transportation grants. Prior to the 2021 Bipartisan Infrastructure Law, grant-seeking agencies were required to complete Local Road Safety Plans (LRSP), but LRSP requirements were superseded by Comprehensive Safety Action Plans (CSAP) with adoption of the infrastructure law. The LRSP and CSAP requirements are closely related. Both center on crash pattern analysis and countermeasures, while the CSAP adds an equity focus.

The City’s LRSP scope of work, shown in Attachment 2, meets the latest state and federal guidelines and is summarized below:
• Crash data gathering, analysis, and identification of crash patterns • Equity analysis of crash effects on disadvantaged populations and underserved communities
• Community outreach and engagement
• Development of potential street design, policy, and program countermeasures in Agenda Packet Page 136 of 209
Agenda Item No. 7.E.
response to the identified crash patterns and community feedback • Preparation of a draft and final plan document
In February 2021, the City was awarded a grant of $72,000 in State funding to prepare an LRSP with a $15,000 local match from the City’s SB1 Local Streets and Roads Program. However, due to reduced staffing and staff vacancies in the Public Works Department, the development of the LRSP, including procurement of consulting services, was delayed.

During this time, federal grant opportunities and requirements changed significantly.

CSAP requirements superseded LRSP requirements, and the federal $5 billion 2022-26 Safe Streets and Roads for All (SS4A) grant program debuted, with locally-adopted CSAP’s as a core eligibility condition. While the Contra Costa Transportation Authority (CCTA) successfully led a multi-agency collaborative grant application to secure $29 million for five projects including El Cerrito’s Richmond Street Complete Streets Improvements, based on previously adopted safety plans that met SS4A eligibility criteria, it concurrently sought to build upon these plans and solicited proposals for a countywide CSAP to maximize funding opportunities for all member agencies under the SS4A program.

To advance both the LRSP and CSAP in an integrated and efficient manner, CCTA staff suggested that the City engage their countywide CSAP consultant, Kittlelson & Associates, who was selected by CCTA through a Request for Proposals (RFP) process that followed state and federal guidelines. The CCTA Board approved an agreement with Kittelson & Associates along with other on-call consultants, on September 21, 2022.

Engaging Kittelson & Associates for El Cerrito’s LRSP effort would improve coordination, reduce potential work duplication, and most importantly, add an equity focus, and maximize opportunities for the City to be ready for future SS4A grant cycles.

Under the City’s Administrative Policy III.1, the procurement process for professional services such as these would normally include an RFP and selection based upon demonstrated competence and professional qualifications. The Administrative Policy, Section D.4 allows the City to dispense with the formal procurement process in several circumstances, including when “necessary to serve the best interests of the City.” In light of the above-described circumstances, including the CCTA-led RFP process, City staff considers that forgoing a City-specific RFP process and moving forward with an agreement with Kittelson & Associates is appropriate in this case.

City staff considered other alternatives, including transferring the City grant funding to CCTA; and, cancelling the LRSP altogether and relying solely on CCTA’s countywide CSAP to maintain our grant eligibility. The former was disallowed by the State, and the latter would involve returning the $72,000 to the State and curtailing the amount of outreach, analysis, and interventions focused on El Cerrito’s needs.

Agenda Packet Page 137 of 209
Agenda Item No. 7.E.

The Public Works Department is recommending that the City engage the services of Kittelson & Associates, Inc. to develop a citywide LRSP. Kittelson & Associates, based in Portland, Oregon, but with Northern California offices in Oakland and Sacramento, provides a full range of transportation planning and engineering services. Kittelson & Associates, Inc. has:
• Confirmed their capacity and willingness to initiate, develop, and complete an LRSP in coordination with CCTA’s countywide CSAP and position the City for eligibility with the latest State and Federal transportation grant requirements. • Significant experience in developing context-sensitive LRSP’s and CSAP’s for government agencies across the US and in California.
• Assembled a team with expertise and qualities to perform all required tasks.

City staff recommends that the City Council authorize the City Manager to execute an agreement with Kittelson & Associates, Inc. for transportation planning and engineering services to initiate, develop, and complete a citywide LRSP, for an amount not to exceed $87,000.

STRATEGIC PLAN CONSIDERATIONS
Completing the Local Road Safety Plan is aligned with the following City’s Strategic Plan goals: ensure the public’s health and safety, foster environmental sustainability citywide, and achieve long-term financial sustainability.

ENVIRONMENTAL CONSIDERATIONS
The action to develop the LSRP is statutorily exempt from CEQA under Section 15262 (Feasibility and Planning Studies) because it involves development of a plan for possible future actions that have not yet been funded or approved.

FINANCIAL CONSIDERATIONS
The funding for the consulting services agreement to develop the Local Road Safety Plan (LRSP), in an amount not to exceed $87,000, is included in the Fiscal Year 2023- 24 Adopted Budget and Capital Improvement Program. This includes $72,000 in the Capital Improvement Fund, which will be reimbursed from the State grant, and $15,000 in the SB1 Local Streets and Roads Program Fund. No additional expenditure appropriation is requested.

LEGAL CONSIDERATIONS
The City Attorney has reviewed the proposed action and legal considerations have been addressed. Additionally, the consulting services agreement will conform to the City’s standard agreement as approved by the City Attorney.

Reviewed by:

Agenda Packet Page 138 of 209
Agenda Item No. 7.E.

Karen Pinkos, City Manager
Attachments:

1. Resolution

2. Kittelson & Associates, Inc. LRSP Scope & Fee
Agenda Packet Page 139 of 209
RESOLUTION 2023-XX

RESOLUTION OF THE CITY COUNCIL OF THE CITY OF EL CERRITO AUTHORIZING

THE CITY MANAGER TO EXECUTE A CONSULTING SERVICES AGREEMENT WITH KITTELSON & ASSOCIATES, INC. IN AN AMOUNT NOT TO EXCEED $87,000 FOR

TRANSPORTATION PLANNING AND ENGINEERING SERVICES FOR A LOCAL

ROAD SAFETY PLAN
WHEREAS, the City of El Cerrito seeks to secure consulting services with the required certifications, knowledge, and experience to perform transportation planning and engineering services on behalf of the City; and
WHEREAS, road safety is a growing focus of national concern. Approximately 40,000 people died on American roads annually over the last decade. In response, state and federal agencies are requiring that local agencies adopt safety plans to remain eligible or competitive for transportation grants; and
WHEREAS, in February 2021, the City was awarded a grant of $72,000 in State funding to prepare a Local Road Safety Plan (LRSP) with a $15,000 local match from the City’s SB1 Local Streets and Roads Program. However, due to reduced staffing and staff vacancies in the Public Works Department, the development of the LRSP, including procurement of consulting services, was delayed; and
WHEREAS, since February 2021, federal grant opportunities and requirements changed significantly. Comprehensive Safety Action Plan (CSAP) requirements superseded LRSP requirements, augmenting them and remaining closely related, and the federal $5 billion 2022-26 Safe Streets and Roads for All (SS4A) grant program debuted, with locally-adopted CSAP’s as a core eligibility criteria; and WHEREAS, the Contra Costa Transportation Authority (CCTA), through a Request for Proposal (RPF) process that followed state and federal guidelines, selected Kittelson & Associates to develop a countywide CSAP to maximize funding opportunities for member agencies under the SS4A program; and
WHEREAS, engaging Kittelson & Associates to develop the City’s LRSP would advance the LRSP and CSAP in an integrated manner, add an equity focus, and maximize opportunities for the City to be ready for future SS4A grant cycles; and WHEREAS, City Administrative Policy III.1, Section D.4, allows the City to forgo a formal RFP process in several circumstances, including when “necessary to serve the best interests of the City,” which City staff considers is appropriate in this case.

NOW THEREFORE, BE IT RESOLVED by the City Council of the City of El Cerrito that it hereby authorizes the City Manager to execute a consulting services agreement between the City of El Cerrito and Kittelson & Associates, Inc. in an amount not to exceed Agenda Packet Page 140 of 209
$87,000, to perform transportation planning and engineering services to initiate, develop, and complete a Local Road Safety Plan.

BE IT FURTHER RESOLVED that this resolution shall become effective immediately upon passage and adoption.

I CERTIFY that at a regular meeting on July 18, 2023 the City Council of the City of El Cerrito passed this Resolution by the following vote:

AYES: COUNCILMEMBERS:

NOES: COUNCILMEMBERS:

ABSTAIN: COUNCILMEMBERS:

ABSENT: COUNCILMEMBERS:

IN WITNESS of this action, I sign this document and affix the corporate seal of the City of El Cerrito on .
________________________
Alexandra Orologas, Deputy City Clerk
APPROVED:
________________________
Lisa Motoyama, Mayor
Agenda Packet Page 141 of 209
FILENAME: H:\29\29138 - EL CERRITO LRSP\ADMIN\P\04_WORKINGDOCS_QAQC\29138P - CITY OF EL CERRITO SCOPE OF WORK LRSP_20230620.DOCX June 20, 2023 Project #: 29138P
Jarrett Mullen
City of El Cerrito
10890 San Pablo Avenue
El Cerrito, CA 94530
RE: City of El Cerrito LRSP
Dear Jarrett:

Attached is a proposal for developing the City of El Cerrito’s Local Roadway Safety Plan (LRSP) to advance the city’s efforts to improve safety across all city roadways and formalize an ongoing safety management process. As part of the LRSP, we will develop an informed, holistic, and implementable safety plan that enables the city to move towards zero deaths and severe injuries on city roadways.

We propose to conduct the services (detailed in Part “A” herein) on a time and materials basis for $87,000 (detailed in Table 1). This proposal (scope of work, budget, and timeline) is effective for sixty days.

We bring the city a team that has extensive experience in conducting data-driven safety analysis; obtaining key partners and public input; identifying effective countermeasures; developing priority projects; and developing strategies for education, enforcement, and emergency response; prioritizing recommended countermeasures based on effectiveness; is deeply knowledgeable about roadway safety planning in California as well as El Cerrito’s needs for the Safety Plan.

Mychal Loomis will serve as the Project Manager and Matt Braughton will serve as the Project Principal providing senior review and quality assurance. Any questions of a technical or contractual nature can be directed to either of us.

Please review this proposal at your earliest convenience. If the attached Professional Services Agreement is satisfactory, please return a signed copy electronically. A fully executed copy will be returned for your records. Thank you for the opportunity to propose on this project. If you have any questions please call us at 916-822-5354.

Sincerely,
Kittelson & Associates, Inc.

Mychal Loomis, PE/TE/PTOE/RSP Matt Braughton
Associate Engineer Associate Planner
City of El Cerrito LRSP
29137P
2510 J Street, Suite 200
Sacramento, CA 95816
P 916.266.2190 F 916.266.2195
Agenda Packet Page 142 of 209
29136P
City of El Cerrito LRSP Page: 2 of 8
Kittelson & Associates, Inc.

PART A - SCOPE OF WORK
TASK 1 – PROJECT INITIATION AND MANAGEMENT
Purpose: Facilitate regular communication with the City of El Cerrito project manager and staff so that the LRSP development remains on schedule and meets the needs and interests of the City.

Task 1.1: Kick-off Meeting
Kittelson will prepare for and conduct a project kick-off meeting with City of El Cerrito project manager and staff. The meeting will confirm schedule, scope, goals, key interests, near-term data needs from the consultant, if any, and identify the working group roster.

Task 1.2: Bi-Weekly Coordination Meetings
Kittelson’s project manager will conduct 30-minute bi-weekly virtual conference calls with the City.

Based on the agenda and any topics for resolution, specific invites for local agency participation or other partners will be extended prior to the call. The focus of these calls will be to provide an update regarding ongoing work, identify any potential issues that require resolution, and provide a recurring opportunity for the City project manager to provide our team with feedback to be sure we are meeting or exceeding expectations.

Deliverables:
▪ Virtual kick-off meeting with City
▪ Project schedule
▪ Bi-weekly progress meetings with City
TASK 2 – SAFETY DATA ANALYSIS
Purpose: Kittelson will identify roadway characteristics and user behaviors associated with crash risk based on crash history. This will help in identifying priority locations based on risk factors.

Task 2.1: Assessment of Current Policies and Plans
Kittelson will request and obtain relevant City safety policies, programs, partners, and additional documentation to consider for the development of the LRSP. That information will be included in the LRSP as required.

Task 2.2: Analysis of Crash Patterns and Trends & High Priority Location Mapping Kittelson will obtain SWITRS and TIMS crash data for the latest five years of available data. Kittelson will work with the City to determine any additional crash data available and confirm the desired data period. A consolidated, uniform set of reported crashes will be mapped in a GIS-based platform.

Kittelson will also obtain available land use and roadway data to help identify any contributing factors related to crashes.

Agenda Packet Page 143 of 209
29136P
City of El Cerrito LRSP Page: 3 of 8
Kittelson & Associates, Inc.

Kittelson will conduct a network screening to identify high crash frequency and/or severity locations for both intersections and roadway segments. Kittelson will prepare a highly graphical weblink of analysis findings, which will include a list of high-crash locations, identified risk factors, and common contributing factors for the crashes. The weblink will include charts and exhibits illustrating key findings related to factors like personal attributes/human factors (e.g., driver impairment, behavior), vehicular and equipment factors (e.g., braking, occupant restraints), and roadway and environmental factors (e.g., speed limits, roadway geometric design).

Task 2.3: Equity Analysis
Kittelson will work with the city in identifying disadvantaged populations and underserved communities in the city to understand and improve the transportation safety performance in these areas. Kittelson will conduct two of the following four evaluation processes (at a high level) to identify the historically underrepresented communities in the city:

1. Demographic analysis

2. Metropolitan Transportation Commission’s (MTC) Equity Priority Communities

3. State of California Disadvantaged Communities

4. Transportation Disadvantaged Population Index
The results from this analysis will be helpful to select priority community groups within the city for focused engagement activities and to improve transportation safety performance.

Deliverables:
▪ Summary of current policies and procedures to be included in LRSP ▪ Consolidated crash database in GIS format
▪ Highly graphical weblink summarizing crash patterns, trends, and high crash locations ▪ List of priority community groups identified from the equity analysis TASK 3 – WORKING GROUP AND COMMUNITY ENGAGEMENT
Purpose: Establish a Working Group comprised of multidisciplinary agency partners and organizations and engage them throughout the process of developing the LRSP. Support City staff with preparing and presenting project-related materials for outreach and at public meetings.

Task 3.1: Working Group Meetings
Kittelson will work with City of El Cerrito project manager and staff to identify potential safety partners to serve as part of the Working group. We anticipate the roster for the working group to include multidisciplinary partners which may include neighboring jurisdictions, Safe Routes to School program, disabled community, traffic safety advocacy groups, California Highway Patrol (CHP), Caltrans, El Cerrito’ Police Department, and/or emergency services representatives. Ultimately, the invited participants of the group could become a regular steering committee to address roadway safety from a variety of perspectives for the City.

Agenda Packet Page 144 of 209
29136P
City of El Cerrito LRSP Page: 4 of 8
Kittelson & Associates, Inc.

Based on our prior experience with LRSPs and similar roadway safety plans, we propose two (2) Progress Meetings with the working group at the following critical points in the LRSP development to provide the greatest benefit for the plan:
▪ Progress Meeting #1: Introduction to the LRSP and safety management process, discussion of working group roles, discussion of crash analysis results, and priority locations. ▪ Progress Meeting #2: Review the Draft LRSP and priority projects, identify changes for the Final City of El Cerrito LRSP.

For each meeting, Kittelson will prepare an agenda, meeting materials, facilitate the discussion and activities, take meeting notes, and disseminate the notes to attendees following the meeting.

Task 3.2: Community Engagement Support
Kittelson will create a community engagement plan to document the approach for gaining public feedback. The strategy is anticipated to include a mix of virtual meetings specific to the project, attending existing board and committee meetings, and “popping-up” at community events.

Kittelson will assist City staff with preparing up to three (3) fact sheets that provide an overview of polices or legislation related to safety that have been recently adopted or could be proposed for the City. The fact sheets are intended to be graphic based intended for a general audience.

Kittelson will assist City staff with preparing two sets of materials for use at meetings to provide information related to the project. The first set of materials would be informational about the LRSP, crash data, and emphasis areas. The second set of materials would be about proposed countermeasures and priority locations. In addition, Kittelson will assist City staff with preparing and presenting materials, answering questions, and providing notes for up to four (4) public/community meetings. It is anticipated that three meetings would be pop-up events for the community where Kittelson and City staff will be presenting safety analysis results and priority locations, and the other would be for LRSP approval at City Council.

Deliverables:
▪ Three (3) policy overview fact sheets
▪ Attendance, facilitation, agendas, notes, and materials for up to two (2) working group virtual meetings
▪ Two sets of materials (PowerPoint, flyers) for use at public meetings ▪ Attendance at three (3) pop-up events
▪ One (1) presentation at the City Council
TASK 4. SELECTION OF EMPHASIS AREAS
Purpose: Establish the emphasis areas, safety goals, priorities, and objectives for the City. The emphasis areas will be informed by findings from prior tasks and input from the City and working group to ensure sufficient buy-in for future improvements.

Agenda Packet Page 145 of 209
29136P
City of El Cerrito LRSP Page: 5 of 8
Kittelson & Associates, Inc.

Task 4.1 Identify Emphasis Areas. Kittelson will identify emphasis areas using results from the safety analysis in Task 2. Each emphasis area will include goals and strategies that will support the LRSP vision.

Kittelson will also help identify safety partners that will be instrumental in supporting the goals of each emphasis area and the vision of the LRSP. Kittelson will prepare a memorandum that includes the emphasis areas and their goals and strategies and supporting safety partners.

Deliverables:
▪ Draft and final emphasis areas, goals, and strategies memorandum ▪ Memorandum comment matrix
TASK 5. COUNTERMEASURES AND POTENTIAL IMPROVEMENT

IDENTIFICATION
Purpose: Identify countermeasures to address emphasis areas and high priority locations.

Countermeasures will be informed by data and selected in cooperation with the City and working group with sensitivity to local context and a focus on systemic effectiveness.

Task 5.1 Identify Countermeasures. Kittelson will work with City of El Cerrito staff to identify strategies to help achieve their safety vision and address findings of Tasks 3 and 4. Engineering, systemic, and non-engineering countermeasures will be considered when identifying potential solutions. Kittelson will develop a memorandum that provides a countermeasures toolbox applicable to their safety crash trends. The toolbox will include:
 Engineering Countermeasures most relevant to the roadway safety vision and goals, high-priority locations, and crash risk factors using the latest version of the Caltrans Local Roadway Safety Manual, the FHWA’s Crash Modification (CMF) Clearinghouse website, HSIP set-aside categories, and other recent countermeasures used or encouraged by the City. The toolbox will provide guidance on applicable places to install countermeasures such as protected turns, median refuges, and bikeways.
 Non-Engineering Countermeasures including education, equitable enforcement, emergency services, and emerging technologies strategies that can be implemented to modify user behavior or reduce the likelihood of severe crash outcomes. Partnership with the working group, review of NHTSA’s Countermeasures that Work, and the Caltrans SHSP Implementation Plan will help identify feasible solutions that can be utilized to target behavior-related crash factors identified in Task 3.
 Policies that could be considered by the City to help achieve the roadway safety vision and goals. This includes a look at recent legislation changes, peer cities such as those committed to Vision Zero or involved in NACTO, and opportunities based on the findings of Task 2.1.

Kittelson will produce a draft memorandum and will revise based on a consolidated set of comments from City staff and additional partners identified by the City.

Task 5.2 Caltrans Coordination. Kittelson will work with City of El Cerrito and Caltrans staff to coordinate opportunities for improving safety along San Pablo Avenue (SR-123). Kittelson will review and Agenda Packet Page 146 of 209
29136P
City of El Cerrito LRSP Page: 6 of 8
Kittelson & Associates, Inc.
summarize lessons learned from up to four (4) state highway arterials with local agencies seeking safety and complete street improvements. In addition, we propose a series of four (4) meetings with El Cerrito and Caltrans to discuss opportunities to partner on future safety efforts:
▪ Meeting #1: Discussion of existing context, crash analysis results along SR-123 and potential priority locations. Also obtain information on any planned or recent projects on SR-123.

Discuss goals of the coordination effort.
▪ Meeting #2: Review of current processes and discussion of potential arrangements through a maintenance or cost-sharing agreement to partner on future safety projects. ▪ Meeting #3: Discussion of recommended project ideas and concepts to identify in the LRSP and opportunities for funding implementation.
▪ Meeting #4: Review project concepts, status of updating processes or implementing future strategies and projects, and document next steps.

For each meeting, Kittelson will prepare an agenda, meeting materials, facilitate the discussion and activities, take meeting notes, and disseminate the notes to attendees following the meeting.

Task 5.3 Identify Priority Locations and Project Concepts. Kittelson will identify up to five (5) priority locations based on results from Task 2, countermeasures in Task 4.1, and coordination with City staff.

Kittelson will summarize the priority locations and include comparative attributes with the City, which could include, for example:
▪ Location type (intersection, roadway, or all)
▪ Crash history (number of crashes, crash severity score, targeted crashes) ▪ Top reported crash types and primary crash factors
▪ Alignment with emphasis areas and risk factors
Kittelson will select up to two (2) of the priority locations to develop project concepts for. Project development will consist of countermeasures matched to locations based on crash history and systemic location characteristics, and contextual applications based on a field review of the locations. Selection of the locations will consider the most impactful locations and the most competitive for possible funding. For example, concepts that include complete street considerations, signal equipment inventory upgrades, and speed limit reductions in alignment with Assembly Bills 43 and 1983 may be prioritized to align with City priorities.

Deliverables:
▪ Countermeasures and Policy Toolbox
▪ Caltrans Coordination meeting materials
▪ Up to two (2) project concepts
Agenda Packet Page 147 of 209
29136P
City of El Cerrito LRSP Page: 7 of 8
Kittelson & Associates, Inc.

TASK 6 – DEVELOP LOCAL ROADWAY SAFETY PLAN
Purpose: Prepare an LRSP including goals, emphasis areas, high-priority locations, improvements, and strategies to implement roadway safety management process, and to improve roadway safety in the City of El Cerrito.

Kittelson will prepare a draft and final City of El Cerrito Local Roadway Safety Plan following the Local Roadway Safety Plan guidance and requirements. The LRSP will include:
▪ Executive Summary
▪ Previous efforts to address roadway safety
▪ Partners and process to develop the LRSP
▪ Vision and mission statement, goals, and objectives of the LRSP o Zero deaths and serious injuries commitment with target dates ▪ Current roadway safety performance including the high-injury network and recurring crash trends and patterns, crash data modeling and risk analysis results ▪ Emphasis areas
▪ A list of high-priority locations for future City evaluations, along with two (2) project concepts ▪ Engineering and non-engineering safety countermeasures and strategies for the priority projects
▪ Implementation plan for LRSP, which includes the funding sources, key partners’ continuous involvement, and suggested timeline for proposed projects o Incorporating the Safe System Approach
o Incorporating the role of the “E’s”
We will revise the draft based on comments compiled and provided by City staff, City Council, and partners. We will provide all textual work products in both PDF and Microsoft Word formats, as desired.

All relevant project data will be packaged and shared to the City for their future use.

Deliverables:
▪ Draft Local Roadway Safety Plan
▪ Final Local Roadway Safety Plan
Agenda Packet Page 148 of 209
29136P
City of El Cerrito LRSP Page: 8 of 8
Kittelson & Associates, Inc.

BUDGET INFORMATION
Table 1:

Project Task Description
Estimated
Amount

1. Project Initiation and Management $8,500

2. Safety Analysis $15,200

3. Community Engagement $23,800

4. Selection of Emphasis Areas $4,700

5. Countermeasures and Potential Improvements $15,300

6. Develop Local Roadway Safety Plan $19,500
Total $87,000
Note: Task budgets are estimates and Kittelson reserves the right to adjust task budgets based on the actual level of effort while remaining within the overall total budget.

Agenda Packet Page 149 of 209

AGENDA BILL
Agenda Item No. 7.F.

Date: July 18, 2023
To: El Cerrito City Council
From: Christina Leard, Management Analyst III; Susan Kattchee, Interim Operations & Environmental Services Division Manager; Yvetteh Ortiz, Public Works Director/City Engineer, Public Works Department Subject: Amendment to Agreement with Cox Automotive Mobility Fleet Services for Fleet Maintenance Services

ACTION PROPOSED
Adopt a resolution to authorize the City Manager to amend the agreement with Cox Automotive Mobility Fleet Services for Fleet Maintenance Services by $15,000 for a total amount not to exceed amount of $203,100 for Fiscal Year 2022-23.

BACKGROUND/ANALYSIS
In 2021, after a Request for Proposals (RFP) process, the City of El Cerrito City Council (Resolution No. 2021-33) approved an agreement with Mobile Fleetcare, Inc./Cox Automotive Mobility Fleet Services for an annual amount of $143,100 to provide fleet maintenance and repair services for the City’s recycling trucks and heavy equipment operated by the Public Works Department.

The most recent amendments, executed in June 2023, increased the not to exceed amount by $45,000 from $143,100 to $188,100 to allow the City to pay for additional fleet maintenance services required for City vehicles.

The recycling trucks are high-use trucks, on the road 260 days of the year, requiring consistent preventative maintenance and prompt emergency repairs. Because of the need for emergency and routine fleet maintenance that occurred at the end of the fiscal year, staff is bringing a third amendment to the agreement of $15,000 for a not-toexceed total of $203,100.

Pursuant to Resolution 2017-71A, contracts up to $45,000 may be authorized by the City Manager. The same Resolution stipulates that purchases made from a single vendor (either individually or collectively within one fiscal year) over $45,000 requires City Council approval. City staff is therefore recommending that the City Council authorize the City Manager to amend the current agreement with Cox Automotive Mobility Fleet Services in the amount of $15,000 for a total amount not to exceed $203,100 for FY 2022-23.

STRATEGIC PLAN CONSIDERATIONS
Engaging the fleet maintenance services of Cox Automotive Mobility Fleet Services is consistent with the El Cerrito Strategic Plan goal to deliver exemplary government services by ensuring the City’s fleet is well maintained with minimal downtime.

Agenda Packet Page 150 of 209
Agenda Item No. 7.F.

ENVIRONMENTAL CONSIDERATIONS
This proposed action will not result in a project as defined by the California Environmental Quality Act, (CEQA). No further environmental review is needed.

FINANCIAL CONSIDERATIONS
City staff is requesting approval to increase the agreement for fleet maintenance and repair services with Cox Automotive Mobility Fleet Services for a total amount not-toexceed $203,100. The not to exceed amount of $203,100 for FY 2022-23 under this agreement is available in the City’s Amended FY 2022-23 Public Works Department Budget.

LEGAL CONSIDERATIONS
The City Attorney has reviewed this action and found that legal considerations have been addressed.

Reviewed by:

Karen Pinkos, City Manager
Attachments:

1. Resolution

2. Third Amendment to Agreement
Agenda Packet Page 151 of 209
RESOLUTION NO. 2023-XX

RESOLUTION OF THE CITY COUNCIL OF THE CITY OF EL CERRITO AUTHORIZING

THE CITY MANAGER TO AMEND THE AGREEMENT BETWEEN THE CITY OF EL

CERRITO AND COX AUTOMOTIVE MOBILITY FLEET SERVICES FOR FLEET MAINTENANCE SERVICES FOR A TOTAL NOT TO EXCEED AMOUNT OF $203,100 WHEREAS, the Agreement with Cox Automotive Mobility Fleet Services to provide maintenance and repair services for Solid Waste/ Recycling vehicles and heavy equipment effective January 1, 2021, for a period of three years, with an option to annually extend three years thereafter, for an annual amount not to exceed $143,100 per fiscal year, contingent upon funding being appropriated by the City Council in annual City budgets; and
WHEREAS, the City has determined that it requires additional maintenance and repair services for its solid waste and recycling vehicles to maintain the vehicles in safe, road worthy and proper functioning manner to continue to provide recycling curbside recycling services to the residents and businesses of El Cerrito; and WHEREAS, Amendment #1 amended Section 2 (Compensation) to change the not to exceed amount from $143,100 to $168,100 for Cox Automotive Mobility Fleet Services to provide additional services in FY 2022-23; and WHEREAS, Amendment #2 amended Section 2 (Compensation) to change the not to exceed amount from $168,100 to $188,100 for Cox Automotive Mobility Fleet Services to provide additional services in FY 2022-23; and WHEREAS, Cox Automotive Mobility Fleet Services agrees to provide additional services for an additional annual cost of $15,000 in Fiscal Year (FY) 2022-23 annual compensation not to exceed $203,100 in FY 2022-23; and
WHEREAS, the City of El Cerrito Public Works Department has funds available in the adopted amended Fiscal Year 2022-23 budget to cover this additional expense, and NOW THEREFORE, BE IT RESOLVED by the City Council of the City of El Cerrito that it hereby authorizes the City Manager to execute an amendment to the agreement with Cox Automotive Mobility Fleet Services to increase the compensation by $15,000 for an amount not-to-exceed $203,100.

BE IT FURTHER RESOLVED that this resolution shall become effective immediately upon passage and adoption.

I CERTIFY that at a regular meeting on July 18, 2023 the City Council of the City of El Cerrito passed this Resolution by the following vote:

AYES: COUNCILMEMBERS:

NOES: COUNCILMEMBERS:

ABSTAIN: COUNCILMEMBERS:

ABSENT: COUNCILMEMBERS:

Agenda Packet Page 152 of 209
IN WITNESS of this action, I sign this document and affix the corporate seal of the City of El Cerrito on _____ .

Alexandra Orologas, Deputy City Clerk
APPROVED:

Lisa Motoyama, Mayor
Agenda Packet Page 153 of 209

THIRD AMENDMENT TO

GENERAL SERVICES AGREEMENT

BETWEEN THE CITY OF EL CERRITO AND

COX AUTOMOTIVE MOBILITY FLEET SERVICES
This Third Amendment (Amendment) is entered into and effective as of July 18, 2023, and amends that certain General Service Agreement (Agreement) dated January 1, 2021 by and between the City of El Cerrito (City) and between Cox Automotive Mobility Fleet Services (Contractor).

RECITALS
WHEREAS, the Agreement with Cox Automotive Mobility Fleet Services to provide maintenance and repair services for Solid Waste/ Recycling vehicles and heavy equipment effective January 1, 2021, for a period of three years, with an option to annually extend three years thereafter, for an annual amount not to exceed $143,100 per fiscal year, contingent upon funding being appropriated by the City Council in annual City budgets; and
WHEREAS, the City has determined that it requires additional maintenance and repair services for its solid waste and recycling vehicles to maintain the vehicles in safe, road worthy and proper functioning manner to continue to provide recycling curbside recycling services to the residents and businesses of El Cerrito; and WHEREAS, Amendment #1 dated 6/8/23 amended Section 2 (Compensation) to change the not to exceed amount from $143,100 to $168,100 for Cox Automotive Mobility Fleet Services to provide additional services in FY 2022-23; and WHEREAS, Amendment #2 dated 6/28/23 amended Section 2 (Compensation) to change the not to exceed amount from $168,100 to $188,100 for Cox Automotive Mobility Fleet Services to provide additional services in FY 2022-23; and WHEREAS, Cox Automotive Mobility Fleet Services agrees to provide additional services for an additional annual cost of $15,000 in Fiscal Year (FY) 2022-23 annual compensation not to exceed $203,100 in FY 2022-23; and
NOW THEREFORE, for and in consideration of the mutual covenants and agreements contained in the Agreement and in this Amendment, and other good and valuable consideration, the receipt and adequacy of which is hereby acknowledged, the City and Contractor hereby agree as follows:

Section 1. The above recitals are true and correct and incorporated in this Amendment by this reference.

Section 2. Section 2 (Compensation) is amended to change the not to exceed amount to $203,100 in FY 2022-23.

Agenda Packet Page 154 of 209
Section 3. Except as otherwise expressly set forth herein, all other terms and conditions of the Agreement remain unchanged and in full force and effect.

SIGNATURES
CITY:

CITY OF EL CERRITO
By: _______________________________
Karen Pinkos, City Manager
CONTRACTOR:

Cox Automotive Mobility Fleet Services
By: _____________________________

Agenda Packet Page 155 of 209

AGENDA BILL
Agenda Item No. 7.G.

Date: July 18, 2023
To: El Cerrito City Council
From: Eric Ng, Acting IT Manager, Information Technology Department Subject: Agreement with SSP Data to provide DarkTrace Detect and Response Security Monitoring Services

ACTION PROPOSED
Adopt a resolution to authorize the City Manager to execute the pricing agreement with SSP Data for DarkTrace Holding Limited’s cybersecurity services in an amount not-toexceed $380,000 over a four-year period.

BACKGROUND
The agreement with SSP Data for DarkTrace Holding Limited’s cybersecurity services would provide email, cloud, and network defense systems. This agreement would enhance the City's cyber-threat monitoring with active autonomous response which can intercept and neutralize cyber-attacks including insider threats, ransomware, and Internet of Things (IoT) attacks without the need for human intervention. Leveraging Artificial Intelligence (AI) and machine learning is necessary to keep pace with today’s advanced persistent threats. This will provide the City with additional cybersecurity and will work in tandem with the City's managed security service provider, Sophos Manage Detect and Response (Sophos MDR).

ANALYSIS
An immediate response is critical to combating the spread of ransomware. Some of the most significant ransomware attacks have targeted local governments, which resulted in critical data being encrypted and vital services being crippled. These recent attacks illustrate the vulnerabilities of interconnected infrastructure. Ransomware campaigns are designed to specifically identify and exploit the weaknesses of their targets and spread across networks in a matter of seconds. The speed and sophistication of the attacks give security teams almost no time to react before the damage is done.

DarkTrace Artificial Intelligence (Al) takes intelligent and informed actions to isolate an attack within seconds - all without disrupting the City's critical IT systems and public services. DarkTrace has a proprietary cybersecurity system called Antigena which is their cyber-AI which not only detects but also intelligently fights back against in-progress attacks in real time.

Based on staff’s extensive research of options to supplement the City’s existing cybersecurity systems, they have found that DarkTrace's Enterprise Immune System’s Al technology is particularly suited to meet the City’s need to detect and respond to cyber-threats in real time, while providing visibility to active threats to the City's network, cloud, and email infrastructure. The City does not have visibility into all areas of Agenda Packet Page 156 of 209
Agenda Item No. 7.G.
infrastructure, nor does the City have the capability to automatically respond to anomalous activity. DarkTrace meets the City's needs in this area.

Under the City’s Administrative Policy III.1, the procurement process would normally include an RFP and selection based upon demonstrated qualifications. However, under Section D.4 of Administrative Policy III.1 the City may dispense with the formal procurement process in several circumstances, including when “necessary to serve the best interests of the City.” Based on its research, staff believes that the DarkTrace platform will best serve the City’s immediate security needs at competitive pricing and recommends that the City Council dispense with a formal procurement process to ensure that the additional cybersecurity measures are implemented without delay.

Through discounts available as part of a multi-year agreement, the City was able to negotiate a price lower than would otherwise be available for the DarkTrace system.

Other cities, specifically Richmond and Pittsburg, California, both purchased DarkTrace using sole source justification, strongly suggesting that the City is unlikely to find a functionally equivalent alternative through a competitive procurement process.

STRATEGIC PLAN CONSIDERATIONS
Authorization of these actions help fulfill City of El Cerrito Strategic Plan Goal A: Deliver Exemplary Government Services; and, Goal E: Ensure the Public’s Health and Safety.

ENVIRONMENTAL CONSIDERATIONS
This section is not applicable to this agenda item.

FINANCIAL CONSIDERATIONS
There is sufficient budget for this item in the current FY 2023-24 Adopted Budget.

Appropriations sufficient to cover future year's costs will be included as part of the baseline budgets for FYs 2024-25, 2025-26 and 2026-27.

LEGAL CONSIDERATIONS
This section is not applicable to this agenda item.

Reviewed by:

Karen Pinkos, City Manager
Attachments:

1. Resolution

2. Price Quote

3. DarkTrace Technology
Agenda Packet Page 157 of 209
RESOLUTION NO 2023-xx

RESOLUTION OF THE CITY COUNCIL OF THE CITY OF EL CERRITO

AUTHORIZING THE CITY MANAGER TO EXECUTE AN AGREEMENT WITH SSP

DATA FOR SOFTWARE AS A SERVICE FOR THE DARKTRACE ARTIFICIAL

INTELLIGENCE POWERED SECURITY DETECTION AND RESPONSE SYSTEM IN AN AMOUNT NOT TO EXCEED $380,000.00 OVER A FOUR-YEAR PERIOD WHEREAS, the Interim Information Technology Manager has found it to be of significant benefit to purchase artificial intelligence driven network monitoring services to combat cyber threats to City of El Cerrito; and
WHEREAS, municipalities like City of Oakland and City of Hayward have suffered cyber-attacks; and
WHEREAS, existing cyber defenses are falling behind, and an artificial intelligence driven network will help improve the City defenses against attack; and WHEREAS, the AI technology of Darktrace’s Enterprise Immune System can supplement the City’s security stack to spot and stop threats that other tools miss, from zero-days and insiders, through to ransomware and subtle, stealthy attacks; and WHEREAS, greater savings are available by entering into a multi-year agreement; and
WHEREAS, Administrative Policy Section D.4 allows the City to dispense with a formal procurement process when “necessary to serve the best interests of the City,” which City staff considers is appropriate in this case. Based on its research, staff believes that the DarkTrace Detect and Response AI platform will best serve the City’s immediate security needs at competitive pricing and has recommended that the City Council dispense with a formal procurement process to ensure that the additional cybersecurity measures are implemented without delay.

NOW THEREFORE BE IT RESOLVED that the City Council of the City of El Cerrito that it hereby authorizes the City Manager to enter into an agreement with SSP Data for the DarkTrace Detect and Response AI powered security platform in an amount not to exceed $380,000.00 for a term of four years.

BE IT FURTHER RESOLVED that this resolution shall become effective immediately upon passage and adoption.

I CERTIFY that at a regular meeting on July 18, 2023 the City Council of the City of El Cerrito passed this Resolution by the following vote:

AYES: COUNCILMEMBERS:

NOES: COUNCILMEMBERS:

ABSTAIN: COUNCILMEMBERS:

ABSENT: COUNCILMEMBERS:

Agenda Packet Page 158 of 209
IN WITNESS of this action, I sign this document and affix the corporate seal of the City of El Cerrito on .
________________________
Alexandra Orologas, Deputy City Clerk
APPROVED:
________________________
Lisa Motoyama, Mayor
Agenda Packet Page 159 of 209
Quote # SSPQ12769
Quote Date: 7/10/2023
Prepared by: Jennifer Inouye
Prepared for: Eric Ng
Phone # (510) 215-4333
Sold To: City of El Cerrito Ship To: City of El Cerrito Eric Ng Eric Ng
10890 San Pablo Avenue
El Cerrito, CA 94530
United States
10890 San Pablo Avenue
El Cerrito, CA 94530
United States
Ln # Qty Description Part Number Unit Price Ext. Price
1 DarkTrace Detect and Respond - 4 Years
2 Year 1 - Darktrace Detect and Respond
Endpoint and Email
3 1 Darktrace DETECT/ RESPOND $41,129.75 $41,129.75
Endpoint and Email - Year 1
Endpoints 150 laptops Email / Hybrid Exchange 300 mailboxes Start date: 7/18/2023 End date: 7/17/2024 Invoiced annually starting commencement date

DE/EP RE/EP DE/HE
4 Year 2
5 1 Darktrace DETECT/ RESPOND $54,521.50 $54,521.50
Endpoint and Email - Year 2
Endpoints 150 laptops Email / Hybrid Exchange 300 mailboxes Start date: 7/18/2024 End date: 7/17/2025

DE/EP RE/EP DE/HE
6 1 Darktrace DETECT/RESPOND - Year 2 $43,250.00 $43,250.00 Apps/Microsoft 365 SaaS (M365) 160 Accounts Darktrace DETECT/RESPOND Network - 323 Accounts Start date: 7/1/2024 End date: 7/17/2025 Invoiced annually
DE/RE App/M365 DE/RE
N
7 Year 3
8 1 Darktrace DETECT/ RESPOND $54,521.50 $54,521.50
Endpoint and Email - Year 3
Endpoints 150 laptops Email / Hybrid Exchange 300 mailboxes Start date: 7/18/2025 End date: 7/17/2026

DE/EP RE/EP DE/HE
9 1 Darktrace DETECT/RESPOND - Year 3 $43,250.00 $43,250.00 Apps/Microsoft 365 SaaS (M365) 160 Accounts Darktrace DETECT/RESPOND Network - 323 Accounts Start date: 7/1/2025 End date: 7/17/2026 Invoiced annually
DE/RE App/M365 DE/RE
N
10 Year 4
11 1 Darktrace DETECT/ RESPOND $51,111.00 $51,111.00
Endpoint and Email - Year 4
Endpoints 150 laptops Email / Hybrid Exchange 300 mailboxes Start date: 7/18/2026 End date: 7/17/2027 1304 South 51st Street, Richmond CA 94804 http://www.ssp.com Voice / Fax - 510-215-3423 1 of 3
Agenda Packet Page 160 of 209
Ln # Qty Description Part Number Unit Price Ext. Price DE/EP RE/EP DE/HE 12 1 Darktrace DETECT/RESPOND - Year 4 $45,216.00 $45,216.00 Apps/Microsoft 365 SaaS (M365) 160 Accounts Darktrace DETECT/RESPOND Network - 323 Accounts Start date: 7/1/2026 End date: 7/17/2027 Invoiced annually
DE/RE App/M365 DE/RE
N
13 Deployment and Support
14 1 Installation Services $0.00 $0.00
15 1 Darktrace Deployment UsageFees/Appliance (Medium) $0.00 $0.00 Subscription period commencing on 7/18 /2023
Dep/Ap/M
16 1 Standard Support Services including: $0.00 $0.00
Darktrace Services/Proactive ThreatNotification Complimentary across all 4 years, valued at $22,395.50 per year as the agreed upon contingent on July purchase Start date: 7/18/2023 Sv/PTN
17 Darktrace Training
18 1 eLearning Training Sv/Tr(E) $0.00 $0.00
19 1 Public Online Training Sv/Tr(PO) $0.00 $0.00
20 1 Private Training (Remote) 2 Sessions $0.00 $0.00
End User's use of Darktrace DETECT/RESPOND
Apps/Microsoft 365 will be limited to a maximum of 160
Accounts. For such purposes, an "Account" is an enabled account with log-incredentials to the relevant application. Should the Account limit be exceeded, additional Fees shall be payable..

End User’s use of Darktrace DETECT/RESPOND - Endpoint is limited to the number of Laptops specifi ed above (Usage Metrics). For such purposes a Laptop is an End User ownedand administered computer (EndPoint Agents) running the latest Windows and MacOS operating
systems, in the Threat Visualiser even when they are
outside privatecustomer networks. Should the Laptop limit be exceeded, additional Fees shall be payable.

End User’s use of Darktrace/Email is limited to the number of Mailboxes specifi ed above (“Usage Metrics”). For such purposes, a "Mailbox" is an email account capable
ofsending or receiving email. Email Volume is limited to 5000 emails sent and received in a 24 hour period (“Email Volume”). Should the Mailbox limit or the Email Volume
beexceeded, additional Fees shall be payable.

The Appliance(s) are for use with respect to the End User's applicable bandwidth throughput, number of connected devices and connections per minute as set out in
theapplicable Product Data Sheet
(https://darktrace.com/resources/contract-data-sheets.zip) (the Appliance Specifications). Should the Appliance Specifications beexceeded, additional Fees shall be payable. The Software is limited to 323 (three hundred and twenty and three) Devices in use on the Customer network (the Device Limit).For the purposes of this calculation a Device is a unique Internet Protocol address (IP address), tied to a piece of equipment, apparatus, or instrument, virtual or physical;that is monitored, modelled and visible in the Threat Visualizer within a given 7 day time frame.
1304 South 51st Street, Richmond CA 94804 http://www.ssp.com Voice / Fax - 510-215-3423 2 of 3
Agenda Packet Page 161 of 209
Ln # Qty Description Part Number Unit Price Ext. Price Should the Device Limit be exceeded, additional Fees shall be payable.

Send licensing to Eric Ng at [email protected]
Sv/Tr(PvR)
SubTotal $332,999.75
Sales Tax $0.00
Shipping $0.00
Total $332,999.75
Budgetary quote for 4 year Terms and conditions
* Quote valid for 30 days - acceptance based on credit approval * Purchase Order must include: end user name, street address, email address and phone number for updates. * Prices quoted do not include applicable shipping
Customer Authorized Signature Date
Customer Name and Title PO Number
1304 South 51st Street, Richmond CA 94804 http://www.ssp.com Voice / Fax - 510-215-3423 3 of 3
Agenda Packet Page 162 of 209
Darktrace Holdings Limited
Maurice Wilkes Building
St Johns Innovation Park
Cowley Road
Cambridge CB4 0DS
United Kingdom
5 June 2023
City of El Cerrito
Attn: Eric Ng
10900 San Pablo Ave
El Cerrito, CA 94530
Dear Mr. Ng,
On behalf of Darktrace Holdings Limited (“Darktrace”), this letter confirms that Darktrace has created self-learning artificial intelligence systems for cyber defense, and by nature of functionality, the systems provide a cyber security solution that is completely unique compared to other vendors on the market today. Darktrace offers the broadest product set to support protecting an organization’s entire digital infrastructure. With our heavy investments in research and development, Darktrace continues to innovate in the field. Darktrace’s self-learning artificial intelligence is modelled on the human immune system and is used by over 7,700 organizations to protect against threats to cloud and email systems, endpoints, zero trust technologies, networks and industrial systems.

This letter outlines the unique capabilities of Darktrace’s Cyber AI Loop™. No other software vendor can currently offer all of these features, including:
 The ability of our software to employ multiple unsupervised, supervised, and deep learning techniques in a Bayesian framework, creating bespoke protection for an organization;  The potential for total coverage of an organization’s entire digital estate;  AI-driven investigation at machine speed and scale;
 Rapid, on-demand triage of high-fidelity incidents identified for “Enhanced Monitoring”; and  The ability to provide end-to-end security through an interconnected system of AI engines that feedback into a virtuous cycle.

Cyber AI Loop ™
The Darktrace Cyber AI Loop™ represents the world’s first always-on, end-to-end, interconnected set of cyber security solutions. It empowers defenders to reduce cyber risk at every stage of the attack lifecycle. Darktrace PREVENT™ allows organizations to anticipate attacks and reduce risk by hardening defenses, while Darktrace DETECT™ spots threats instantly and in real time. Darktrace RESPOND™ then takes targeted action to disarm cyber-attacks in seconds, and if an attack does get through, Darktrace HEAL™ will restore normal operations.

Each of these capabilities is powered by Self-Learning AI that understands its unique digital surroundings. Rather than being trained on attack data, it learns the bespoke details of your organization, so it can identify subtle patterns that indicate a vulnerability or an emerging threat. Each capability feeds back into the Loop as a whole, autonomously and continuously strengthening the entire system.

DocuSign Envelope ID: 3F319CBF-8034-4CF1-81E9-635B9282904B Agenda Packet Page 163 of 209
Darktrace DETECT™
See attacks instantly
Powered by a bespoke, continuously evolving understanding of you, Darktrace DETECT delivers instant visibility of threats – even those using novel malware strains or new techniques.

Darktrace DETECT learns what makes your organization unique, from the ground up and without any prior assumptions as to what constitutes a threat. This understanding allows it to detect subtle patterns that reveal deviations from the norm, making it possible for the security team to identify attacks in real time, not after the damage has been done.

It analyzes millions of data points for every digital asset to ask: Is this device behaving normally? For every connection and behavior, DETECT asks hundreds of questions to determine whether that activity constitutes a threat.

DETECT then generates simple outputs that human security teams can quickly and easily understand to get to the bottom of an incident.

Darktrace RESPOND™
Disarm within seconds
By making a series of micro-decisions at machine speed, Darktrace RESPOND disarms an attack in seconds. It uses Darktrace’s evolving and bespoke understanding of your organization to pinpoint signs of a potential attack, interrupt the malicious activity, while letting your normal business operations continue.

This is in contrast to automated response solutions, which rely on pre-defining threats, resulting in broad-brush actions that may involve quarantining a device, interrupting normal business, or not actioning on a threat.

Darktrace RESPOND targets only the malicious behavior, without interrupting regular business.

It takes action via integrations with your existing security controls, augmenting your existing security investments and enabling Autonomous Response across your entire digital environment, or via native mechanisms. These autonomous actions can be taken against zero-day attacks, compromised cloud credentials, advanced spoofing campaigns, and more.

Cyber AI Analyst™
Bringing the human into the loop
At every stage of the Cyber AI Loop, Cyber AI Analyst™ runs in the background, using Explainable AI to generate meaningful outputs that a human team can easily understand.

With PREVENT, Explainable AI plays a key role in allowing human operator to immediately understand why Darktrace has suggested certain mitigation actions, or why a certain attack path has been identified as critical. At the DETECT stage, AI Analyst automatically investigates every security event, autonomously triaging and reporting on the full scope of the security incident, dramatically reducing the time to meaning for security teams.

With RESPOND, AI Analyst helps human security teams immediately understand what action the AI took, if any, and why, helping teams build trust in the AI’s decision-making over time.

At every stage, Darktrace’s findings are mapped to the widely-used MITRE framework.

Protection Where You Need It
Darktrace is the only cyber security technology that protects the entire digital enterprise. By bringing its SelfLearning AI to your data, wherever it resides, Darktrace offers a unified approach to cyber defense across diverse and fractured digital environments.

DocuSign Envelope ID: 3F319CBF-8034-4CF1-81E9-635B9282904B Agenda Packet Page 164 of 209
Darktrace/Apps
Cloud applications are the locus of critical workforce activity, with more sensitive data now residing in the hands of third-party services and applications.

Darktrace/Apps detects and stops malicious activity in cloud applications, from compromised credentials to account misuse. By correlating on-prem and off the VPN activity with traffic across hybrid and multi-cloud environments in real time, Darktrace reveals seemingly benign actions to be malicious in the wider context of the enterprise – threats only uncoverable through a holistic approach. =
Darktrace/Email
Darktrace/Email
Spear phishing, impersonation attempts, and account takeovers remain fruitful ways for cyber-criminals to infiltrate businesses. As attackers increasingly leverage the latest news trends, freshly purchased domains, and hijacked user identities – tactics which evade legacy defenses – email security needs to evolve.

Darktrace/Email represents the world’s first self-defending inbox. Using Darktrace’s core AI to stop the most advanced email threats, it works by ‘understanding the human’ behind the email address, learning what employees do, who they interact with, how they write, and the substance of their typical conversations. Crucially, when analyzing each email, the AI does not ask simplistic, limiting questions such as ‘Is this bad?’– instead, it asks ‘Does this belong?’. Such a nuanced grasp of how each individual and the wider organization usually behaves allows Darktrace to detect subtle deviations and anomalous behavior, detecting attacks regardless of whether they have been seen before.

This enables Darktrace/Email to autonomously respond and stop even the subtlest attacks. The AI works in any email environment, scaling alongside your organization without requiring manual configuration or fine tuning. “When Darktrace/Email caught a spear phishing campaign that the leader in the Magic Quadrant missed, we were convinced. The trial was over.” CIO, Numeris Darktrace/Endpoint
Darktrace/Endpoint protects your dynamic employees, wherever they are in the world. It continuously learns the “patterns of life” for every user and device, stopping cyber-attacks at the device level, before they spread to the wider business. With Cyber AI Analyst, Darktrace investigates every threat surfaced by Darktrace DETECT in the background, connecting the dots between all events identified on the endpoint, in conjunction with events across email, apps, cloud and the corporate network. The net result is a single incident complete with every detail the security team needs to fully understand what happened. If necessary, Darktrace RESPOND can take bespoke, targeted action to contain ongoing attacks on endpoint devices, whilst allowing normal activity to continue. “Darktrace gives our team complete real-time coverage across our SaaS applications and cloud.”
CIO, City of Las Vegas
DocuSign Envelope ID: 3F319CBF-8034-4CF1-81E9-635B9282904B Agenda Packet Page 165 of 209
Darktrace/Network
Darktrace’s Self-Learning AI is designed to protect dynamic systems and workers across the organization – no matter where they operate or the nature of their applications. Unlike legacy on-prem defenses, Darktrace’s understanding of normal in the network is enriched by its visibility across IoT devices, cloud, SaaS, and email services. This knowledge enables the AI to surgically interrupt emerging threats in the network at machine speed, giving security teams time to catch up before critical data can be lost or encrypted. Such a fast and targeted response mitigates cyber risk and ensures that business as normal can continue unimpeded.

Darktrace Services
Proactive Threat Notification™
Darktrace’s Proactive Threat Notification™ service (PTN) leverages our Security Operations Centers (SOCs), located in Cambridge (UK), San Francisco, and Singapore to provide additional, around-the-clock coverage of significant incidents identified and flagged by your Darktrace deployment.

If you receive the PTN service, high-fidelity incidents, which may be strong indicators of an emerging attack, will be relayed directly into Darktrace’s SOCs for triage and assessment by our team of Cyber Analysts. For such incidents, Darktrace will notify you of unusual activity or deviations in behavior which may be indicative of an inprogress attack. Note that not all alerts are triaged, only incidents that are highly indicative of attack are marked with the Enhanced Monitoring tag and will be triaged by PTN analysts.

Should Darktrace find strong evidence of attack during the triage phase, your team will be contacted immediately and provided with the intelligence ascertained so that your information security team can take immediate action.

Darktrace would suggest any PTN alerts be treated as High Priority. You can also elect to receive automated telephone calls or SMS messages if a PTN email alert has been issued.

Please do not hesitate to contact us should you have any questions. We welcome the opportunity to provide the City of El Cerrito with the Darktrace Cyber AI Loop™.

Disclaimer: This Sole Source Letter is being provided at the request of the prospective customer referenced herein. Darktrace has not examined the regulations or rules that such prospective customer may be required to follow and disclaims all liability if the prospective customer requires additional documentation to satisfy its rules or regulations.

Sincerely yours,
Darktrace Holdings Limited
By:

Name:

Title:

DocuSign Envelope ID: 3F319CBF-8034-4CF1-81E9-635B9282904B Head of Commercial Legal
Jon Coy
Agenda Packet Page 166 of 209

AGENDA BILL
Agenda Item No. 8.A.

Date: July 18, 2023
To: El Cerrito City Council
From: Traviss Crumpacker, Fire Prevention Officer; Chase Beckman, Fire Marshal, Fire Department
Subject: Fire Hazard Abatement

ACTION PROPOSED
1) Adopt a resolution declaring weeds, rubbish, litter, or other flammable material on certain real property identified in the resolution constitutes a public nuisance; and 2) Conduct a public hearing and upon conclusion, adopt a resolution overriding objections by property owners and ordering the City Manager or their designee to abate certain public nuisances pursuant to El Cerrito Municipal Code Chapter 16.26.

BACKGROUND
Following the Oakland/Berkeley Hills Fire in October 1991, El Cerrito needed a comprehensive citywide program to reduce hill area fire hazards in the City. The "fire storm" in the Oakland/Berkeley Hills was in fact an urban conflagration, fueled by vegetation among homes and large acreage properties that was driven by seasonally strong dry winds from the east. The fire destroyed over 3,000 dwellings. At the time of the Oakland/Berkeley Hills Fire, El Cerrito faced similar fire hazard conditions in its hill area. The City Council was determined to reduce those fire hazards by all reasonable means.

El Cerrito's comprehensive fire hazard reduction program focused upon reducing fire hazards in four areas: (1) on City property, (2) on property owned by other agencies (3) large landowners and (4) on residential property. The City began a comprehensive planning process to reduce fire hazards on City property, other agencies’ properties and large landholders. These property owners were approached about reducing fire hazards on their properties. Prior efforts at fire hazard reduction on private residential property relied on voluntary compliance by the owners. The City Council concluded that stronger measures were necessary to enforce the laws regarding abatement of fire hazards on residential private property.

The Fire Hazard Abatement Program is designed to reduce fire hazards on a large number of private properties during the spring and early summer months. A process of advance notice and hearings for property owners is coupled with a public education program involving the promulgation of standards for vegetation management in residents’ yards and vacant lots.

This program seeks to remove weeds, rubbish, litter or other flammable material from private properties where such flammable material endangers the public safety by creating a public nuisance and a fire hazard. Most property owners voluntarily abate Agenda Packet Page 167 of 209
Agenda Item No. 8.A.
these hazards without Fire Department involvement. However, we anticipate that a small number of owners are content to have the City do the work and place the costs on their tax bill. For over 20 years, the City’s annual Fire Hazard Abatement Program has been very successful in reducing fire hazards throughout the hill neighborhoods of El Cerrito. Indeed, this program has become a model program which other fire jurisdictions have borrowed from.

ANALYSIS
Beginning in May of this year, the Fire Department conducted Citywide fire hazard inspections of all properties. The inspections began on May 15, 2023 and have continued due to re-growth and citizen complaints. As a result of the on-going inspections, a list of properties containing public nuisances was generated, which continues to be amended as additional properties are identified. Between June 2nd and 15th, the identified properties determined to be in violation of El Cerrito Municipal Code Chapter 16.26 were notified in writing of the hazards on their property and to abate those hazardous conditions. The El Cerrito Vegetation Management Standards Checklist was included with the notification (Attachments 4, 6, & 7). Additionally, these property owners were informed in the letter from the Fire Marshal (Attachment 4 and 5) of the time, date, and location of the upcoming City Council meeting where their properties would be declared a public nuisance and abatement would be ordered.

Property owners were directed to complete the necessary measures to bring their property into compliance prior to the second round of the re-inspection process which began in July and continued through the date of the July 18, 2023 meeting. Only those properties that were not voluntarily abated with the first notice are contained within the Master Abatement List, Exhibit A to the proposed Resolution (List of Properties.) This public hearing is the next step in the process to eliminate hazards on private properties that were identified as a public nuisance and have not voluntarily abated said violations. In order to achieve full compliance, the City Council is asked to declare the properties to be a public nuisance and direct the City Manager or their designee to abate such public nuisance conditions. Actual City-ordered abatement of fire hazards occurs only after all efforts at providing notice, information, and a public hearing have failed to induce voluntary compliance by the property owner.

The Fire Hazard Abatement process, under the direction of the Fire Department, should proceed according to El Cerrito Municipal Code Chapter 16.26, which specifies the following:

1. The Fire Department determines that hazards must be abated. Pursuant to these code sections, "hazards" are defined as weeds, rubbish, litter, or other flammable materials which create a fire hazard or are otherwise noxious or dangerous and which exist on specific parcels of property within the City.

2. The Fire Department shall post notice on each property or send notice /by mail that the El Cerrito Fire Department has determined the existence of a public nuisance which must be abated and that a hearing will be held to consider any Agenda Packet Page 168 of 209
Agenda Item No. 8.A.
objections prior to the City Council declaring the properties to be a public nuisance and ordering the City Manager or their designee to perform abatement.

3. At the July 18, 2023 City Council meeting, the City Council shall first adopt a resolution Declaring that Weeds, Rubbish, Litter, or Other Flammable Material on Certain Real Property Constitutes a Public Nuisance (Attachment 1 and 2).

4. At the same hearing, but after adoption of the first resolution, the City Council shall hear and consider all objections to declaration of public nuisances or the procedures proposed for abatement of the same. After the hearing, the Council shall adopt a resolution Overriding Objections by Property Owners and Ordering the City Manager or their Designee to Abate Certain Public Nuisances Pursuant to Chapter 16.26 (Attachment 3).

5. At the conclusion of the July 18, 2023 hearing, a second and final notice shall be sent to each property owner prior to abatement (Attachment 8). This notice will order the immediate abatement of nuisance conditions. This notice will clearly state that if nuisance conditions are ignored, the City shall cause abatement and costs for removal will be assessed against the property as a lien and special assessment. It will also indicate that if the conditions are voluntarily abated, the property shall be removed from the process.

6. If the nuisance is not abated between July 19, 2023 and August 6, 2023, prior to the arrival of the hazard abatement crew, the City of El Cerrito shall cause the weeds, rubbish, refuse, and other flammable material to be removed and shall keep an account of the cost of abatement for each parcel of land where such work is performed according to the City Council adopted Fire Department Master Fee Schedule.

7. At the September 19, 2023 City Council meeting the City Manager or their designee shall submit to the City Council for confirmation an itemized written report showing the cost of abatement work performed. A copy of this report shall be posted for at least ten (10) days prior to its submission to the City Council.

Each property owner upon whose property abatement work was performed shall be sent written notice by mail of a hearing by the City Council to consider the cost of abatement work performed on their property.

8. At the City Council Meeting on September 19, 2023, the City Council shall receive and consider the written staff report on abatement actions taken by the City and shall hear any objections from the property owners liable to be assessed for the abatement. The City Council may modify the staff report if deemed appropriate and then confirm the report by motion or resolution.

9. After City Council confirmation of the report, a certified copy of the report shall be filed with the Contra Costa County auditor who shall add the amount of the assessment to the next regular tax bill levied against the parcel.

STRATEGIC PLAN CONSIDERATIONS
This item is in alignment with Strategic Goal E: Ensure the Public's Health and Safety.

ENVIRONMENTAL CONSIDERATIONS
The Fire Hazard Abatement Program is exempt from California Environmental Quality Agenda Packet Page 169 of 209
Agenda Item No. 8.A.

Act (CEQA) pursuant to Sections 15304 and 15308 of the CEQA Guidelines. Therefore, no further CEQA review is required.

FINANCIAL CONSIDERATIONS
The abatement program will be administered by Fire Department staff with minimum costs expended for printing and mailing. Abatement work will be completed by City maintenance staff or private contract labor as appropriate. Program costs will be recovered through the special assessment and lien process.

LEGAL CONSIDERATIONS
The City Attorney has reviewed and approved the process.

Reviewed by:

Karen Pinkos, City Manager
Attachments:

1. Resolution (Declaring Public Nuisance)

2. Exhibit A to Resolution (List of Properties)

3. Resolution (Overriding Objections)

4. First Letter from Fire Marshal

5. Reminder Letter Updating Time of Hearing

6. Abatement Inspection Form

7. Vegetation Management Standards Checklist

8. Second Letter from Fire Marshal
Agenda Packet Page 170 of 209
Agenda Item No. 8.A.

Attachment 1
RESOLUTION NO. 2023 - XX

RESOLUTION OF THE CITY COUNCIL OF THE CITY OF EL CERRITO DECLARING THAT

WEEDS, RUBBISH, LITTER OR OTHER FLAMMABLE MATERIAL ON CERTAIN REAL

PROPERTY CONSTITUTES A PUBLIC NUISANCE
WHEREAS, El Cerrito Municipal Code Chapter 16.26 provides a method by which a local legislative body may abate on private property public nuisance conditions relating to weeds, rubbish, litter or other flammable material that creates a fire hazard, a menace to the public health or which is otherwise noxious or dangerous; and WHEREAS, the City of El Cerrito Fire Marshal has identified certain real property, by street name, lot and block number, on which the presence of weeds, rubbish, litter or other flammable material creates a fire hazard, a menace to the public health or which is otherwise noxious or dangerous as defined in Chapter 16.26 of the El Cerrito Municipal Code and therefore constitutes a public nuisance; and
WHEREAS, pursuant to El Cerrito Municipal Code Section 16.26.160 and Government Code Section 39560-39588, the City Council shall adopt this resolution declaring that certain real property within the City constitutes a public nuisance.

NOW, THEREFORE, BE IT RESOLVED by the City Council of the City of El Cerrito that the properties identified on Exhibit A, attached hereto, are declared to be public nuisances pursuant to El Cerrito Municipal Code Section 16.26.160.

BE IT FURTHER RESOLVED that on this same date of July 18, 2023 at 6:00 P.M. in the City of El Cerrito, the City Council shall hold a hearing at which owners of the real property identified in Exhibit A hereto may object to the designation of their properties as public nuisances and object to the abatement actions proposed by the City.

BE IT FURTHER RESOLVED that this resolution shall become effective immediately upon passage and adoption.

I CERTIFY that at a regular meeting on July 18, 2023 the El Cerrito City Council passed this resolution by the following vote:

AYES: COUNCILMEMBERS:

NOES: COUNCILMEMBERS:

ABSENT: COUNCILMEMBERS:

ABSTAIN: COUNCILMEMBERS:

IN WITNESS of this action, I sign this document and affix the corporate seal of of the City of El Cerrito on .
_________________________
Alexandrea Orologas, Deputy City Clerk
APPROVED:
_________________________
Lisa Motoyama, Mayor
Agenda Packet Page 171 of 209
Agenda Item No. 8.A.

Attachment 2

EXHIBIT A
As of 7/10/23
City of El Cerrito Fire Department
List of Real Property Constituting Public Nuisances
APN Street Address
505-262-043-1 812 Contra Costa Dr.
505-103-023-6 7755 Earl Court
573-102-002-9 853 Kensington Rd.
505-130-015-9 1550 Regency Court
505-222-009-1 906 Shevlin Dr.
505-230-036-4 8049 Terrace Dr.

Agenda Packet Page 172 of 209
AGENDA ITEM NO. 8.A.

ATTACHMENT 3
RESOLUTION NO. 2023 - XX

RESOLUTION OF THE CITY COUNCIL OF THE CITY OF EL CERRITO OVERRIDING

OBJECTIONS BY PROPERTY OWNERS AND ORDERING THE CITY MANAGER OR

DESIGNEE TO ABATE CERTAIN PUBLIC NUISANCES PURSUANT TO CHAPTER

16.26 WHEREAS, El Cerrito Municipal Code Chapter 16.26 provides a method by which a local legislative body may abate on private property public nuisance conditions relating to weeds, rubbish, litter or other flammable material that creates a fire hazard, a menace to the public health or which is otherwise noxious or dangerous; and WHEREAS, the City of El Cerrito Fire Marshal has identified certain real property, by street name, lot and block number, on which the presence of weeds, rubbish, litter or other flammable material creates a fire hazard, a menace to the public health or which is otherwise noxious or dangerous as defined in Chapter 16.26 of the El Cerrito Municipal Code and therefore constitutes a public nuisance; and WHEREAS, on July 18, 2023, pursuant to El Cerrito Municipal Code Section

16.26.160 and Government Code Sections 39560-39588, the City Council adopted Resolution 2023-XX declaring that certain real property within the City constitutes a public nuisance; and
WHEREAS, El Cerrito Municipal Code Chapter 16.26 provides that notice shall be sent to owners of the real property declared a nuisance pursuant to Resolution 2023- XX providing those owners with the following: description of the nuisance; explanation of how the nuisance must be abated; explanation that if the nuisance is not abated; the City shall abate the public nuisance and the cost of abatement shall be assessed against the property as a special assessment; and informing the owners that the City Council shall hold a hearing at a certain date, time, and place at which the owners may present objections to the designation of their properties as public nuisances or to the proposed abatement of the nuisance; and
WHEREAS, between June 2 and June 15, 2023, the City’s Fire Department sent written notice to those property owners describing the weeds, rubbish, refuse, or other flammable material that presented a fire hazard and public nuisance; explaining that the Fire Department had determined a public nuisance that must be removed; informing the owners that if they did not abate by July 9, 2023, the City Council would hold a hearing on July 18, 2023 at which the owners could present objections to the declaration of the nuisance or the proposed abatement measures and further explained the City could abate the nuisance and collect the costs as an assessment on the property; and
WHEREAS, after initial inspections prior to the July 9, 2023 deadline, an additional notice was sent to the 10 properties that were not in compliance to inform them of the correct time of the public hearing.

WHEREAS, on July 18, 2023, the City Council adopted Resolution 2023-XX confirming the nuisance declarations of the City Fire Department and declaring a public nuisance on certain real property pursuant to Chapter 16.26; and Agenda Packet Page 173 of 209
WHEREAS, El Cerrito Municipal Code Section 16.26.160 and Government Code Sections 39560-39588 provide that after adoption of a resolution declaring a public nuisance and notice to affected property owners of the Council's hearing of objections, the Council may overrule any objections and order the City Manager or their designee to abate the public nuisances.

NOW THEREFORE, BE IT RESOLVED by the City Council of the City of El Cerrito that it overrides any objections by owners of that certain real property on which public nuisances were declared in Exhibit A to Resolution 2023 - __ (adopted on the same date herewith).

BE IT FURTHER RESOLVED that the City Manager and their designee is hereby ordered to abate the public nuisances by having the weeds, rubbish, refuse, dirt, or other fire hazard or noxious or dangerous materials removed.

BE IT FURTHER RESOLVED that pursuant to El Cerrito Municipal Code Section 16.26.160 and Government Code Section 39574, the City Manager or their designee shall keep an account of the cost of abatement for each parcel of land on which work is performed. The City Manager or their designee shall then prepare an itemized written report to be presented to the City Council so that, after the notice and hearing during the City Council meeting of September 19, 2023 these abatement costs can be confirmed as a special assessment against those parcels.

BE IT FURTHER RESOLVED that this resolution shall become effective immediately upon passage and adoption.

I CERTIFY that at a regular meeting on July 18, 2023 the El Cerrito City Council passed this resolution by the following vote:

AYES: COUNCILMEMBERS:

NOES: COUNCILMEMBERS:

ABSENT: COUNCILMEMBERS:

ABSTAIN: COUNCILMEMBERS:

IN WITNESS of this action, I sign this document and affix the corporate seal of the City of El Cerrito on ______________.
_________________________
Alexandra Orologas, Deputy City Clerk
APPROVED:
______________________
Lisa Motoyama, Mayor
Agenda Packet Page 174 of 209

EL CERRITO-KENSINGTON FIRE DEPARTMENT
Fire Prevention Office
10900 San Pablo Avenue, El Cerrito, CA 94530
(510) 215-4457 FAX (510) 232-4917 [email protected] June 2, 2023
Parcel Number: «APN»
Property Address: «Parcel_Address» «Parcel_Street», El Cerrito, CA 94530 Property Owner: «Legal_Property_Owner»
Property Owner’s Address: «Mailing_Address», «Mailing_City», «Mailing_State» «Mailing_Zip» Dear El Cerrito Property Owner:

With the continued drought conditions the last three years, the community is facing its peak fire danger earlier than normal. To reduce the fire danger on private property and provide greater community safety, the Fire Department has been inspecting properties and checking for fire hazards. Recently your property listed above was found that it does not comply with the Vegetation Management Guidelines set forth in the City of El Cerrito Vegetation Management Standards. You are being notified now so that you may, if you have not already done so, take steps to remove those fire hazard conditions found on your property.

Enclosed is a copy of the Fire Hazard Reduction Inspection form specifying those areas that are not in compliance as well as the Fire Hazard Reduction Guidelines and Fire Hazard Reductions Checklist that can assist you in bringing your property into compliance. More information on the Vegetation Management Standards and Guidelines may be found on the City’s website at: www.el-cerrito.org under Vegetation Management Standards. Additional information is also available at www.readyforwildfire.org or www.cafiresafecouncil.org as well as many others.

If you have recently completed the work to meet these standards, no further action is required. If not, your property is required to be brought into compliance no later than July 9, 2023. There is no need to contact Fire Department upon completion as we will be re-inspecting all properties. When the Fire Department has cleared your property, you will be removed from our non-compliant list.

On July 18, 2023 at 7:00PM the El Cerrito City Council will hold a public hearing to declare those properties still not in compliance as a public nuisance. Your property is at risk of being declared a public nuisance and subject to further abatement actions. In accordance with the Government Code, you may appear before the Board at this public hearing to dispute this declaration.

If you have not done so already, please take immediate action to remove those fire hazard conditions and we thank you for your cooperation helping us make El Cerrito a more fire safe community.

Sincerely,
Chase Beckman Chase Beckman
Fire Chief / Fire Marshal
Agenda Item No. 8.A.

Attachment 4
Agenda Packet Page 175 of 209

EL CERRITO-KENSINGTON FIRE DEPARTMENT
Fire Prevention Office
10900 San Pablo Avenue, El Cerrito, CA 94530
(510) 215-4457 FAX (510) 232-4917 [email protected] July 5, 2023
Parcel Number: xxx
Property Address: xxxx El Cerrito, CA 94530
Property Owner: xxxx
Property Owner’s Address: xxxxx
Dear El Cerrito Property Owner:

During the month of June 2023, your property was found to be out of compliance with the Vegetation Management Guidelines set forth in the City of El Cerrito Vegetation Management Standards. A letter was sent to you between June 2nd and June 15th notifying you to take steps to remove those fire hazard conditions found on your property.

The El Cerrito City Council public hearing declaring properties that are still not in compliance as a public nuisance was incorrectly listed on the initial letter as taking place at 7:00 PM on July 18. The meeting will, in fact, take place at 6:00 PM in the City Council Chambers located at 10890 San Pablo Ave, El Cerrito on July 18. Meeting materials including a Zoom link for remote participation will be available here: https://www.el-cerrito.org/114/City-Council-Meetings. In accordance with the Government Code, you may appear before the Council at this public hearing to dispute this declaration.

If you have recently completed the work to meet these standards, no further action is required. If not, your property is required to be brought into compliance no later than July 9, 2023. There is no need to contact Fire Department upon completion as we will be re-inspecting all properties. When the Fire Department has cleared your property, you will be removed from our non-compliant list.

Please take immediate action to remove those fire hazard conditions and we thank you for your cooperation in helping us make El Cerrito a more fire safe community.

Sincerely,
Chase Beckman Chase Beckman
Fire Chief / Fire Marshal
Agenda Item No. 8.A.

Attachment 5
Agenda Packet Page 176 of 209

EL CERRITO FIRE DEPARTMENT

KENSINGTON FIRE PROTECTION DISTRICT
10900 San Pablo Avenue, El Cerrito, Ca. 94530 (510)215-4450 Fire Hazard Reduction Inspection
Owner/Tenant Site Address City State Zip Code
Legal Propety Owner Mailing Address City State Zip Code APN #
ZONE 1
Zero to 30 feet from buildings, structures, decks,etc. in all portions within El Cerrito and Kensington ___ 1. Remove all dead plants, grass and weeds.
___ 2. Remove dead or dying leaves and pine needles from your yard, roof and rain gutters. ___
___
___
___
___ 7. Remove or prune flammable plants and shrubs near windows. ___
___
___
ZONE 2
___ 1. Cut or mow weeds and grass to a maximum height of 6 inches. ___
___ 3. Vacant lots in Zone 2 shall be maintained to be 30 feet wide along the property line.

COMMENTS:

Inspected by Inspection # Date Time

8. Remove vegetation and items that could catch fire from around and under decks.

9. Create a minimum 6-foot separation between trees, shrubs or vegetation and combustible materials.

10. Vacant lots in Zone 1 shall be maintained to be 10 feet wide along the property line.

Thirty to 100 feet from buildings, structures, decks, etc. for all parcels within the Very High Fire Hazard Severity Zone. Zone 1 requirements shall be followed in addition to Zone 2 requirements.

2. All fire hazardous vegetation except for weeds and grass shall be cleared and maintained to a height no greater than 18 inches above the ground.

YOUR PROPERTY IS NOT IN COMPLIANCE WITH THE FIRE CODE.

YOU MUST COMPLETE THE FOLLOWING REQUIREMENTS:

6. Relocate wood piles to Zone 2 if applicable.

3. Trees shall be maintained so that no portion is closer than 10 feet from any chimney opening.

4. Trees, shrubs, bushes or other vegetation adjacent to or overhanging any structure shall be maintained free of dead limbs and other combustible matter.

5. On mature trees, limbs should be removed up to 10' above the ground. Smaller trees should be limbed to 1/3 of their height up to 6' above the ground, but in no case less than 18" from the ground.

AGENDA ITEM NO. 8.A.

ATTACHMENT 6
Agenda Packet Page 177 of 209
City of El Cerrito Fire Hazard Reduction Guidelines
Zone 1
Zone 1 extends 30 feet from buildings, structures, decks, etc.in all portions within the City of El Cerrito including the designated Very High Fire Hazard Severity (VHFHS) Zones. Vacant lots in Zone 1 shall be maintained to be 10 feet wide along the property line. • Remove all dead plants, grass and weeds (vegetation). • Remove dead or dry leaves and pine needles from your yard, roof and rain gutters. • Trees shall be maintained so that no portion is closer than 10 feet from any chimney opening. • Trees, shrubs, bushes or other vegetation adjacent to or overhanging any structure shall be maintained free of dead limbs and other combustible matter such as vines and loose papery bark. • On mature trees, limbs should be removed up to 10’ above the ground. Smaller trees should be limbed to 1/3rd of their height up to 6’ above the ground, but in no case less than 18 inches from the ground. • Relocate wood piles to Zone 2 if applicable.
• Remove or prune flammable plants and shrubs near windows. • Remove vegetation and items that could catch fire from around and under decks. • Create a minimum 6-foot separation between trees, shrubs or vegetation and combustible materials.

Zone 2
Zone 2 extends from 30 feet to 100 feet out from buildings, structures, decks, etc. in only those areas within the City of El Cerrito designated as the Very High Fire Hazard Severity (VHFHS) Zones. Vacant lots in Zone 2 shall be maintained to be 30 feet wide along the property line. NOTE: All Zone 1 requirements shall be followed in addition to the following Zone 2 requirements:
• Cut or mow weeds and grass shall be cleared to a maximum height of 6 inches. • All fire hazardous vegetation except for weeds and grass shall be cleared and maintained to a height no greater than 18 inches above the ground.

AGENDA ITEM NO. 8.A.

ATTACHMENT 7
Agenda Packet Page 178 of 209
Fire Hazard Reduction Checklist
Zone 1 Requirements
Definition: Zone 1 extends 30 feet from buildings, structures, decks, etc.in all portions within the City of El Cerrito including the designated Very High Fire Hazard Severity (VHFHS) Zones
Remove all dead plants, grass and weeds within 30 feet of buildings, structures, decks, etc.

Remove dead or dry leaves and pine needles from your yard, roof and rain gutters Trees shall be maintained so that no portion is closer than 10 feet from any chimney opening Trees, shrubs, bushes or other vegetation adjacent to or overhanging any structure shall be maintained free of dead limbs and other combustible matter such as vines and loose papery bark On mature trees, limbs should be removed up to 10’ above the ground. Smaller trees should be limbed to 1/3rd of their height up to 6’ above the ground, but in no case less than 18” from the ground Relocate wood piles to Zone 2 if applicable
Remove or prune flammable plants and shrubs near windows Remove vegetation and items that could catch fire from around and under decks Create a minimum 6-foot separation between trees, shrubs or vegetation and combustible materials
Vacant lots in Zone 1 shall be maintained to be 10 feet wide along the property line Zone 2 Requirements
Definition: Zone 2 extends from 30 feet to 100 feet out from buildings, structures, decks, etc. in only those areas within the City of El Cerrito designated as the Very High Fire Hazard Severity (VHFHS) Zones. NOTE: All Zone 1 requirements shall be followed in addition to the following Zone 2 requirements
Cut or mow weeds and grass shall be cleared to a maximum height of 6 inches All fire hazardous vegetation except for weeds and grass shall be cleared and maintained to a height no greater than 18 inches above the ground
Vacant lots in Zone 2 shall be maintained to be 30 feet wide along the property line To find out if your property is located within the Very High Fire Hazard Severity Zone, go to : https://egis.fire.ca.gov/FHSZ/ On the upper left hand side, click on the bottom icon for Address Search.

Agenda Packet Page 179 of 209

CITY OF EL CERRITO
10900 San Pablo Avenue  El Cerrito  CA  94530
(510) 215-4457  FAX (510) 232-4917  [email protected] July 19, 2023
Parcel Number: XXX
Property Address: XXXX ., El Cerrito, CA 94530
Property Owner:

Property Owner’s Address:

NOTICE TO DESTROY WEEDS AND REMOVE

RUBBISH, REFUSE AND OTHER FLAMMABLE MATERIAL
On July 18, 2023 the El Cerrito City Council declared that your property in the City of El Cerrito, designated above by address and parcel number, constitutes a public nuisance because of the presence of weeds, rubbish, litter or other flammable material which creates a fire hazard, a menace to the public health, or is otherwise noxious or dangerous.

A previous notice was sent to you informing you of the July 18, 2023 hearing and further informing you of your obligation to remove the weeds, rubbish, refuse and other flammable material from your property. If you do not immediately abate these nuisance conditions, the City will do so and the costs for removal of the weeds, rubbish, refuse and other flammable material will be assessed against your property as a lien and special assessment. These removal costs shall then be collected in the time and in the manner of ordinary municipal taxes.

You will not receive any further notices from the City prior to this removal. The City shall perform this removal either through its own staff or through private contract sometime between the dates of August 21, 2023 to September 1, 2023. It is impossible to predict what it will cost the City to remove these nuisance conditions from your property. The costs depend on the severity of those conditions. In past years these abatement costs have sometimes exceeded $8,000 per parcel for those parcels with severe nuisance conditions The City Council will conduct a public hearing on September 19, 2023 to confirm the cost of the abatement work performed on your property. The meeting will be held both via teleconference and in the El Cerrito City Council Chambers at 10890 San Pablo Avenue in El Cerrito at 6:00 p.m. Please refer to the agenda for meeting information at www.elcerrito.org/CouncilMeetingMaterials. During this public hearing you will be given the opportunity to voice objections regarding the report and the assessment of the abatement costs for your property. At this hearing you will also be given the opportunity to object, protest and/or present evidence to support your arguments.

If you have any questions, contact the El Cerrito Fire Department at 10900 San Pablo Avenue.

The phone number is (510) 215-4457.

Chase Beckman
Chase Beckman
Fire Marshal
Agenda Item No. 8.A.

Attachment 8
Agenda Packet Page 180 of 209
CITY HALL 10890 San Pablo Avenue, El Cerrito, CA 94530
Telephone (510) 215-4305 Fax (510) 215-4379 http://www.el-cerrito.org

SUPPLEMENTAL AGENDA MATERIALS
July 18, 2023
(Revised July 19, 2023)

REGULAR CITY COUNCIL MEETING

PUBLIC COMMENT INDEX

1. Public Comments received
Agenda Item 7G – Agreement between the City of El Cerrito and SSP Data to provide DarkTrace Detect and Response security monitoring service to the City of El Cerrito

1. Additional information
Agenda Packet Page 181 of 209
CITY HALL 10890 San Pablo Avenue, El Cerrito, CA 94530
Telephone (510) 215-4305 Fax (510) 215-4379 http://www.el-cerrito.org

SUPPLEMENTAL AGENDA MATERIALS

PUBLIC COMMENT INDEX

REGULAR CITY COUNCIL MEETING
July 18, 2023
The following Public Comments were received by 2:00:00 p.m. 7/18/2023, were provided directly to City Councilmembers in advance of the meeting, and were posted online as supplemental materials at www.el-cerrito.org/CouncilMeetingMaterials Public Comments – Items Not on the Agenda

1. Bridget Cooney on behalf of Committee on Aging

2. Cordell Hindler

3. Dianne Brenner

4. Buddy Akacic (received during meeting)

5. Mariela Moreno Morray (received during meeting)
Agenda Packet Page 182 of 209
From: Bridget Cooney
To: City Clerk
Cc: Bridget Cooney
Subject: Public Comment - City Council
Date: Tuesday, July 11, 2023 11:25:04 AM
Attachments: image001.png
Date: June 22, 2023
To: Mayor Lisa Motoyama
CC: City Clerk, Holly Charlety, Staff Liaison, Bridget Cooney, Council Liaison Paul Fadelli From: Chair Katherine Cesa, City of El Cerrito Committee on Aging Re: Recommendation to City Council
At the regular meeting of the Committee on Aging held on Wednesday, June 21, 2023, the Committee on Aging of El Cerrito, passed a motion for recommendation to City Council to share the results of the Committee on Aging Survey conducted between December 2022 and February 2023 and to encourage the City Council to show their commitment to supporting seniors living in El Cerrito.

The El Cerrito Committee on Aging (COA) conducted a survey of seniors living in El Cerrito from December 2022 to February 2023. Ninety-one seniors participated in the survey with the average age of survey participant being 74.5 years old. Of the 91 seniors surveyed, all but one responded that senior programs and services were essential for improved quality of life. 73% thought a dedicated Senior Center building was important. Of the seniors surveyed, 63% indicated that they were most interested in exercise, fitness, and enrichment classes while only 40% indicated that they were most interested in informational presentations, lunch, or transportation services.

The COA therefore recommends that the City Council support the Recreation Department in providing low-cost programs that provide opportunities for seniors to be physically active, socially engaged, and well-informed. The COA encourages the City Council to show a commitment to senior programming by limiting the displacement of daytime senior classes held at the Community Center during the summertime to offer youth summer camps.

Additionally, the COA asks that the City Council show support for the Recreation Department by encouraging the expansion of the senior lunch program from operating only two days per week to operating a minimum of 4 days per week whenever possible.

Furthermore, the Committee on Aging recommends that the City Council continue to explore options for identifying a location and funding for a Senior Center in El Cerrito where Seniors can “drop-in” for social engagement, exercise classes, or attend programs, with easy access and at a reasonable cost.

The Committee on Aging passed this recommendation by the following vote:

Ayes: 8 (Chair Cesa, Vice Chair Dr. Kwong, Member Akacic, Member James, Member Kehoe, Member Lipson, Member Wagner, Member Yow)
Nos: 0
Abstentions: 0

Absent: 2 (Member Epley, Member Marlia)
Bridget Cooney
Recreation Supervisor
El Cerrito Community Center
7007 Moeser Lane, El Cerrito
(510) 559
[email protected]
Agenda Packet Page 183 of 209
From: Cordell Hindler
To: City Clerk
Subject: Public Comments
Date: Thursday, July 13, 2023 3:19:20 PM
Hello Mayor Motoyama, Council Members and Staff,
I AM Submitting The Following Comments into the Record:

1. For a Future Agenda, The Council Should Invite Danny Wan To Provide a Presentation On the Port of Oakland 2, Also To Direct Staff to Provide an Update on The Class & Comp Study Sincerely
Cordell
Agenda Packet Page 184 of 209
Remarks to City Council, July 18, 2023
Thank you Mayor and City Council.

I’m Dianne Brenner, an El Cerrito homeowner. I would like to speak to you tonight about a topic I first brought to you over 3 years ago – undergrounding public u�li�es using the Rule 20(a) program that PG&E administers.

For those of you who may not be familiar, Rule 20(A) is a state-wide program whereby PG&E collects funds from each ratepayer on each bill specifically and only for the purpose of undergrounding public u�li�es in the jurisdic�on from which the funds were collected. So the funds collected from El Cerrito are only for use in El Cerrito. Unless you fail to act.

In order start a project to use these funds, the city of El Cerrito needs to ini�ate a request to PG&E. The last �me El Cerrito completed a project under this program was approximately 20 years ago. And for the last 20 years, we have con�nued to pay into this fund, growing the balance of available funds, without undertaking any projects.

Today, the balance available for undergrounding in El Cerrito is approximately $3 million. And this program is set to expire on December 31, 2033. Ten years from now.

Agenda Packet Page 185 of 209
That is enough �me for El Cerrito to ini�ate a project request and get the project completed, so that our $3 million is not wasted or diverted to some other priority of PG&E’s. We know that due to a lack of par�cipa�on in this program, PG&E has already asked you for permission to divert our funds to some other purpose of their choosing.

Please don’t let that happen.
$3 million can underground approximately 1 mile of u�li�es. That is actually quite significant, and done strategically, could make a huge difference in improving the safety of emergency evacua�on from the eastern side of town, where an earthquake or a wildfire from Wildcat Canyon will send thousands of people trying to evacuate via Arlington Blvd.

Please don’t let our $3 million, plus the revenue from the next 10 years, go to waste. Please ini�ate an undergrounding project and do it for an area that will enhance public safety and disaster evacua�on.

Thank you.

Agenda Packet Page 186 of 209
St John's Senior Center --D--- 6500 Gladys Ave., El Cerrito, 945lg~G0 '
Every Tuesday, 9AM-3PM J\JL l s io1.3
Free Activities for all Older Adul~~~grt0
To register: Call 510-231-1453 Ext "O"
Chair Exercises
Watercolor painting for all levels
Ukulele class for all levels
Canasta games and lessons
Domino games and lessons
Jewelry making and repairs
WESTCONTRACOSTA Ii~ \\ l l'"'-' )=.-J J ADULT

EDUCATION
Speakers on various topics
Technology assistance and workshops
Home cooked lunch, $5.00 donation, (vegetarian available) Coffee, tea, and snacks available for a $0.25 donation
Agenda Packet Page 187 of 209
East Bay Senior Stroll
Each Friday the East Bay Senior Stroll will meet
at St. John Community Center at
10:00 AM for a 2-Mile walk in the nearby area.

The walk will end at approximately 12:00 pm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6500 Gladys Ave, El Cerrito, CA
For more information please call
Buddy Akacic (925) 628 9325
Agenda Packet Page 188 of 209
7/18/23, 3:55 PM El Cerrito, CA Code of Ordinances
Chapter 10.30 - NOISE
Sections:

10.30.010 - Unnecessary noises.

No person shall make, or permit to be made upon any premises owned, occupied or controlled by him any unnecessary noises or sounds which are:

A Physically annoying to persons of ordinary sensitiveness; or B. So harsh or so prolonged or unnatural or unusual in their use, time or place as to occasion physical discomfort to the inhabitants of the neighborhood. (Ord. 92-4 Div. 2 (part), 1992.)
about:b!ank 1/1
Agenda Packet Page 189 of 209
From: Karen Pinkos
Sent: Tuesday, July 18, 2023 2:29 PM
To: Tessa Rudnick <[email protected]>
Cc: Eric Ng <[email protected]>; Woodruff, Sky <[email protected]>; Alexandra Orologas <[email protected]>
Subject: DarkTrace Agreement
Hi Tessa,
DarkTrace’s Master Agreement can be found at this link: https://darktrace.com/legal/masterservices-agreement. Eric inquired of the vendor your question regarding data and they provided a copy of one of the addendums to the agreement concerning data processing (attached) and they explained that “…the only learning taking place is to create a bespoke digital footprint for [our] org/systems as a means of protecting it, it’s not being used to inform the broader DarkTrace product.”
Since this agenda item will lock in the pricing, once we move to sign the agreement we can provide comments to ensure that your concerns are addressed. I will provide this link and the addendum as part of the supplemental information for the packet.

Let me know if you have any other questions. Thanks!
Karen
Karen Pinkos, ICMA-CM
City Manager
City of El Cerrito
10890 San Pablo Avenue
El Cerrito CA 94530
(510) 215
(she/her/hers)
@kepinkos
www.el-cerrito.org
@cityofelcerrito
Agenda Packet Page 190 of 209
DPA | 2023-06-01
Appendix 3 - Data Processing Addendum
This Data Processing Addendum is supplementary to and shall be construed in accordance with the Darktrace Master Services Agreement available at https://darktrace.com/legal/master-services-agreement (the “Agreement”).

1. Definitions
Unless otherwise defined in the Agreement, all capitalized terms in this Data Processing Addendum (“DPA”), shall have the following meanings:
"Authority" means for Personal Data originating in the:
a) EEA, the European Commission; and
b) UK, the Information Commissioner's Office;
"Customer Data" means the Personal Data that is shared by the Customer with Darktrace in performance of the Services; "Controller" has the meaning given to it in the GDPR Laws; “Darktrace Affiliates” means all persons and entities directly or indirectly controlling, controlled by or under common control with Darktrace, where control may be by management authority, equity interest or otherwise; "Data Protection Impact Assessment" has the meaning given to it in the GDPR Laws; "Data Protection Laws" means all data protection and privacy laws, including guidance issued by any applicable data protection authority, applicable to any Personal Data, as may be amended or replaced from time to time, including without limitation:
a) in the European Union, the General Data Protection Regulation 2016/679 (the "EU GDPR") and the Privacy and Electronic Communications Directive 2002/58/EC (as the same may be superseded by the Regulation on Privacy and Electronic Communications);
b) in the UK, the UK General Data Protection Regulation 2016/679, as implemented by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 and the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (the "UK GDPR"), the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003; and c) in the United States of America the California Consumer Privacy Act, as amended. "Data Subject" has the meaning given to it in the GDPR Laws; "Documented Instructions" has the meaning given to it in paragraph 3 of this DPA; “EEA” means the European Economic Area;
“EU Processor-to-Processor Clauses” means the standard contractual clauses between processors for data transfers to Third Countries, as approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as at Schedule 2, currently located within the Standard Contractual Clauses document found at https://darktrace.com/legal/master-services-agreement; “EU Controller-to-Processor Clauses” means the standard contractual clauses between controllers and processors for data transfers to Third Countries, as approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as at Schedule 3, currently located within the Standard Contractual Clauses document found at https://darktrace.com/legal/master-servicesagreement; "GDPR Laws" means the EU GDPR and the UK GDPR collectively; "Information Security Policy" means the information security policy contained in Schedule 1; “International Data Transfer Addendum” or “IDTA” means the International Data Transfer Addendum to the EU Processor-to-Processor Clauses and the EU Controller-to-Processor Clauses as approved by the Information Commissioner’s Office of the United Kingdom under section 119A(1) of the Data Protection Act 2018, as at Schedule 4, currently located within the Standard Contractual Clauses document found at https://darktrace.com/legal/master-services-agreement; "Personal Data" has the meaning given to it in the GDPR Laws; "Personal Data Breach" means any breach of security or other action or inaction leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data by Darktrace, its affiliates, sub-processors, or any other identified or unidentified third party;
"Processor" has the meaning given to it in the GDPR Laws; Agenda Packet Page 191 of 209
DPA | 2023-06-01
“Standard Contractual Clauses” means the EU Processor-to-Processor Clauses, EU Controller-to-Processor Clauses and the International Data Transfer Addendum;
"Third Country" means in respect of Personal Data originating in the (a) EEA, a country outside of the EEA not recognized by the European Commission as providing an adequate level of protection for Personal Data (as described in the EU GDPR); and (b) UK, a country outside the UK not recognized by the Information Commissioner's Office as providing an adequate level of protection for Personal Data (as described in the UK GDPR).

2. Data Processing

2.1 Scope and Roles
This DPA applies when Darktrace processes Customer Data under the Agreement. In this context, Customer is the Controller and Darktrace is the Processor. Each Party agrees that it will comply with all Data Protection Laws in exercising its rights and performing its obligations under this Agreement, as such laws apply to a Controller and Processor respectively.

2.2 Details of the Processing
(a) Subject matter: The subject matter of the data processing under this DPA is Customer Data. (b) Duration: Customer Data shall be processed under this DPA for the Term. (c) Nature and purpose: Darktrace will process Customer Data for the purpose of providing the Services to Customer.

In the event that Customer has purchased that part of the Offering referred to as Darktrace Email, the data protection provisions of the Darktrace Email Data Storage and Security Schedule (as available at https://darktrace.com/legal/master-services-agreement) shall apply and be incorporated into this DPA. (d) Categories of Data Subject: The categories of Data Subject, whose Personal Data may be processed by Darktrace as Customer Data include Customer's clients and prospects; Customer’s officers and directors; Customer’s employees, temporary workers, agents and volunteers; independent contractors engaged by the Customer; Customer’s suppliers and vendors; advisors, consultants and other professional experts engaged by the Customer; and any other categories of Personal Data that may be contained in the Customer Data. (e) Types of Personal Data: The types of Personal Data that Darktrace may process include: names; phone numbers; addresses; and any other types of Personal Data that may be contained in the Customer Data.

3. Instructions

3.1 The Parties agree that this DPA and the Agreement (including any instructions provided by Customer to Darktrace required for or related to the performance of the Services) constitute Customer's documented instructions regarding Darktrace's processing of Customer Data ("Documented Instructions").

3.2 Darktrace will only process Customer Data in accordance with Documented Instructions unless required to do so by applicable law, in which case Darktrace will, to the extent legally permissible, inform Customer of that legal requirement before processing. Darktrace shall promptly inform Customer if, in Darktrace's opinion, an instruction from Customer infringes the Data Protection Laws.

3.3 If Customer Documented Instructions require Darktrace to perform actions that go beyond its obligations under this DPA or the scope of work for the Services set out in the Agreement, Darktrace shall inform the Customer and require the Customer to provide different Documented Instructions, the carrying out of which will fall within the scope of the Services or within the scope of Darktrace’s obligations under this DPA.

4. Confidentiality

4.1 Darktrace will take reasonable steps to ensure the reliability of any persons authorized to process any Customer Data and shall ensure that all such persons have committed themselves to confidentiality.

5. Security

5.1 Considering the nature, scope, context and purposes of processing, Darktrace has implemented and will maintain for the Term, the administrative, physical, technical and organizational measures as set out in the Information Security Policy to protect any Customer Data accessed or processed by it against unauthorized or unlawful processing or accidental loss, destruction, damage or disclosure.

5.2 The Parties agree that for the purposes of processing Customer Data under this DPA and the Agreement, the measures contained within the Information Security Policy are appropriate, given the nature of the data to be processed and the harm that might result from such unauthorized or unlawful processing or accidental loss, destruction, disclosure, access or damage.

5.3 Darktrace has been certified as operating an Information Security Management System which complies with the requirements of in ISO 27001 (ISO/IEC 27001:2013) and ISO 27018 (ISO/IEC 27001:2019) and Darktrace will continue to maintain such certifications (or equivalent) for the duration of the Term.

Agenda Packet Page 192 of 209
DPA | 2023-06-01

6. Sub-Processing

6.1 Save as expressed in paragraph 6.2, Darktrace shall not without the prior written consent of Customer, engage any sub-processors for the processing of Customer Data under this Agreement.

6.2 Customer consents to and authorizes Cloud Provider and Darktrace's Affiliates to act as sub-processors for Darktrace in the provision of the Services and on terms materially equivalent to those contained in this DPA. Darktrace shall be fully liable for any breach by the sub- processors of any of the obligations contained in this DPA.

7. Cross-Border Transfers

7.1 Save as expressed in paragraph 7.1, if Customer Data originates in the EEA or the UK, Darktrace will not transfer such Customer Data to a Third Country, without the prior written consent of Customer and not without procuring provision of adequate safeguards (as defined by relevant Authority from time to time) in accordance with applicable Data Protection Laws.

7.2 Customer Data may be hosted by the Cloud Provider in the Hosted Location specified in the Product Order Form. Customer acknowledges and consents to the processing of Customer Data outside of the EEA and UK, solely and to the extent necessary for Darktrace to provide the Services and for which purposes the relevant Standard Contractual Clauses shall apply.

7.3 When Customer is acting as a controller and transfers Customer Data originating in the:
(a) EEA, to a Processor located in a Third Country, the EU Controller-to-Processor Clauses will apply; and (b) UK, to a Processor located in a Third Country, Information Commissioner’s Office of the United Kingdom’s International Data Transfer Addendum will apply.

7.4 When Darktrace, its affiliates, or any other identified or unidentified third party is acting as a Processor and transfers Customer Data originating in the:
(a) EEA, to a Processor located in a Third Country, the EU Processor-to-Processor Clauses will apply; and (b) UK, to a Processor located in a Third Country, the Information Commissioner’s Office of the United Kingdom’s International Data Transfer Addendum will apply.

7.5 The Parties agree that Darktrace, may at its sole discretion, update and or entirely replace paragraphs 7.3(b) and 7.4(b) of this DPA, which concern transfers of Customer Data originating from the UK to a Third Country, if the Information Commissioner's Office provides an alternative or replacement recognized compliance standard for such transfers in accordance with the UK GDPR, to that already stated in this DPA. Darktrace will provide notice of such change in writing to Customer.

8. Data Subject Requests and Assistance

8.1 Darktrace shall use reasonable efforts to promptly notify Customer if it receives:
(a) a request from a Data Subject to have access to that person’s Personal Data; (b) a complaint or request relating to Customer’s obligations under the Data Protection Laws; or (c) any other communication relating directly or indirectly to the processing of any Personal Data in connection with the Agreement.

8.2 Considering the nature of processing and the information available to the Darktrace, Darktrace will provide reasonable support to Customer in:
(a) complying with any legally mandated request for access to or correction of any Personal Data by a data subject under Chapter III of each of the GDPR Laws (and where such request is submitted to Darktrace, Darktrace will promptly notify Customer of it);
(b) responding to requests or demands made to Customer by any court or governmental authority responsible for enforcing the Data Protection Laws; and
(c) in its preparation of a Data Protection Impact Assessment.

9. Personal Data Breach

9.1 In the event that Darktrace suffers or becomes aware of a Personal Data Breach it will inform Customer without undue delay, on becoming aware of the same, and will take reasonable steps to mitigate the effects and to minimize any damages resulting from such breach.

Agenda Packet Page 193 of 209
DPA | 2023-06-01

9.2 In the event of a Personal Data Breach, Darktrace (to the extent reasonably possible), will provide the following information to Customer:
(a) a description of the nature of the incident, including where possible the categories and approximate number of data subjects concerned and the categories and approximate number of Personal Data records concerned; (b) the name and contact details of the relevant Processor’s data protection officer or another contact point where more information can be obtained;
(c) a description of the likely consequences of the incident; and (d) a description of the measures taken and / or proposed to be taken by the relevant Processor to address the incident including, where appropriate, measures to mitigate possible adverse effects.

10. Audit.

10.1 Darktrace agrees to maintain its ISO 27001 and ISO 27018 certifications for the duration of the Term. Darktrace will use an external auditor to verify that its security measures meet ISO 27001 and ISO 27018 standards in accordance with the ISO certification process. On Customer's written request, and subject to appropriate confidentiality obligations, Darktrace will make available to Customer:
(a) a copy of the current certificate in relation to the ISO 27001 and ISO 27018 certification; and (b) any information reasonably requested by Customer concerning Darktrace's processing of Customer Data under the Agreement and this DPA.

10.2 Other than in the context of investigating a Personal Data Breach involving Customer Data, Customer agrees to exercise any right it may have to conduct an audit or inspection under Data Protection Laws (or the Standard Contractual Clauses, if applicable) by requesting the information outlined in paragraph 10.1.

11. Data Return and Destruction

11.1 On termination of the Agreement, Darktrace shall delete or return to Customer all Customer Data in its and / or its subprocessors' possession or control, in accordance with Customer’s written instructions.

Agenda Packet Page 194 of 209
SCHEDULE 1: DARKTRACE INFORMATION SECURITY POLICY
Agenda Packet Page 195 of 209
[DTL1]
[DTL1]

INFORMATION SECURITY POLICY
Agenda Packet Page 196 of 209
Information Security Policy
Version 3.1 For External Use Page | 2 of 14
[DTL1]
[DTL1]
Table of Contents
INFORMATION SECURITY POLICY.............................................................................................................1 Table of Contents............................................................................................................................2

1. Document Control...................................................................................................................3

2. Purpose ...................................................................................................................................4

3. Scope .......................................................................................................................................4

4. ISMS.........................................................................................................................................4

5. Objectives................................................................................................................................4

6. Overview .................................................................................................................................5

7. Information Security Certifications .........................................................................................5

8. Access Control .........................................................................................................................5

9. SDLC.........................................................................................................................................7

10. Physical Security ..................................................................................................................7

11. Asset Management .............................................................................................................8

12. Information Classification....................................................................................................8

13. Operations Security.............................................................................................................9

14. Incident Management.......................................................................................................10

15. Data Protection and Security.............................................................................................10

16. Web Application Security ..................................................................................................11

17. Human Resources Security................................................................................................12

18. Business Continuity and Disaster Recovery Planning........................................................13

19. Cloud Security....................................................................................................................13

20. Supplier Management.......................................................................................................14

21. Risk Management..............................................................................................................14

22. Data Privacy.......................................................................................................................14

23. Dispensations....................................................................................................................14

24. Enforcement......................................................................................................................14 Agenda Packet Page 197 of 209
Information Security Policy
Version 3.1 For External Use Page | 3 of 14
[DTL1]
[DTL1]

1. Document Control
This is a controlled document produced by Darktrace. The control and release of this document is the responsibility of the Darktrace document owner. This includes any amendment that may be required. This document and all associated works are copyright © Darktrace 2022 unless otherwise stated. This document is not for distribution without the express written permission of the Darktrace document approver.

Issue Control
Document Reference Project Number
Issue 3.1 Date 20/02/2023
Classification DTL1 Author Security Compliance Lead
Document Title Information Security Policy
Approved by Deputy CISO
Released by Deputy CISO
Owner Details
Name
Office/Region Cambridge
Contact Number
E-mail Address [email protected]
Revision History
Issue Date Author Comments

3. 01/07/2022 Initial Draft

3.1 20/02/2023 Amendments to Section 19
Distribution List
Name Title Company Contact Info.

Agenda Packet Page 198 of 209
Information Security Policy
Version 3.1 For External Use Page | 4 of 14
[DTL1]
[DTL1]

2. Purpose
The purpose of this policy is to outline the approach to Information Security adopted by Darktrace.

This policy is intended to provide an overview of the Information Security Management System (ISMS) and the Security Procedures in place to ensure the Confidentiality, Integrity and Availability of Information in Darktrace.

3. Scope
This policy is applicable to all employees, including consultants, temporary staff, contractors, secondees and all other persons who may access or make use of the organisation’s information resources and systems.

This policy applies to all business activities, processes and functions within the Organisation.

4. ISMS
The Information Security Management System (ISMS) ensures the confidentiality, integrity and availability of all information at Darktrace Holdings Limited, and all its affiliates(“Darktrace”). This is achieved through policies procedures and controls within the ISMS.

To give the ISMS purpose and direction, measurable information security objectives have been agreed based upon a risk assessment and our overall business strategy.

5. Objectives
Darktrace’s ultimate security goal is to:

Protect Darktrace business and customer systems, managing risk across the operational estate, avoiding cyber disruption that would have an adverse impact to our customers, employees or shareholders.

Darktrace intends to achieve this goal with security objectives that are outlined in the OBJ1 Security Objectives document. Management gives complete approval and commitment to this policy to satisfy requirements related to information security, to comply with applicable PII protection legislation and to adhere to contractual terms within customer contracts.

Management are committed to the continual improvement of the information security management system.

Agenda Packet Page 199 of 209
Information Security Policy
Version 3.1 For External Use Page | 5 of 14
[DTL1]
[DTL1]

6. Overview
As a cyber security company, the security of Darktrace and its customer information is paramount. It is essential that all parties; Darktrace employees, customers, suppliers and partners play their part in maintaining the Confidentiality, Integrity and Availability of information by upholding strong information security standards.

7. Information Security Certifications
ISO/IEC 27001
ISO 27001 is one of the most well-known, significant, and globally respected information security certifications. In order to achieve and retain this certification, regular audits are required, alongside a formal recertification every three years. Our certificate can be provided upon request and holds the number IS 645114.

ISO/IEC 27018
ISO 27018 is a security standard part of the ISO 27000 family of standards. It was the first international standard about the privacy in cloud computing services which was promoted by the industry. The standard helps cloud service providers who process Personally Identifiable Information (PII) to assess risk and implement controls for protecting PII. In order to achieve and retain this certification, we are audited bi-annually by an independent third-party against the standard.

Cyber Essentials
Darktrace also maintains the UK’s Cyber Essentials certification. This is required as a baseline by all companies doing business with UK government entities. Our certificate can be provided upon request.

8. Access Control
Access to the organisation’s network is limited to prevent unauthorised activity and unintended consequences.

Network Segregation
Darktrace uses physical and logical segregation of networks. Most significantly, the core software development network is physically separate to all other internal networks. Guest wireless is physically separate to the corporate wireless network.

Remote Access
Darktrace operates a zero-trust networking solution for the majority of its end users. The zerotrust solution requires MFA and can route only to authorized applications.

Agenda Packet Page 200 of 209
Information Security Policy
Version 3.1 For External Use Page | 6 of 14
[DTL1]
[DTL1]
Unauthorized Access
Devices are restricted from joining internal networks without authorisation. Antigena Network automatically denies any unauthorised devices the try to join internal networks. Wi-Fi connection details will not be shared without authorisation from the Security Team.

Visitor Access
Guests, visitors and third parties must not use the company’s corporate Wi-Fi and must follow the visitor procedure. They may connect to one of the Guest wireless networks. Unknown contractors working on or near network or IT equipment must be escorted at all times. Known contractors may work unescorted except in the Server Room and must have their physical access limited appropriately to their work requirements.

Access Requests
In order to maintain an audit trail of system access, access requests are submitted to the IT Support Team via the helpdesk ticketing system. The requestor’s job function as described by the HR department and their Line Manager are reviewed to ensure that the requested access is relevant and acceptable.

Access Authorisation
The IT Group has overall governance of access control within the company. Department managers are responsible for determining the access levels required by their staff. The Change Control managers, along with support from the Security Team, will evaluate all requests and authorisations to determine what access is required.

Privileged Access
The use of privileged accounts (admin/root) will be limited, operating on need to know and least-privilege principles. Uniquely identifiable usernames will be used to enable all activity under an account to be traced back to a single individual. No default administrative passwords will be left unchanged. Hardware tokens are required for admin roles.

Access Review
The access to systems will be regularly reviewed, to ensure that users are still authorised to access each system. The Security Team will request that system administrators or provisioners review the accesses for which they are responsible. Responses to electronic access reviews will be returned to the Security Team and evidence noted. Privileged Access reviews are conducted, and results are centrally recorded.

Logging and Monitoring
User activity is logged and routinely monitored for the purposes of error detection and security.

Passwords
Passwords are required to access systems transmitting, processing or storing customer data.

Passwords are set in line with guidance from National Cyber Security Centre (NCSC) and the National Institute of Standards and Technology (NIST). In general, all accounts must have a unique password, with a minimum length of 10 characters.

Agenda Packet Page 201 of 209
Information Security Policy
Version 3.1 For External Use Page | 7 of 14
[DTL1]
[DTL1]

9. SDLC
All products/services developed by Darktrace are designed with the philosophy of security by design. Testing is carried out at all stages of development.

Open-Source Code Policy
All open-source usage, whether the open source is used internally, as part of the Company’s products, or as part of a web service, needs to be reviewed through the OSS approval process.

In order to help Darktrace achieve its OSS objectives, Darktrace has appointed the position of OSS Compliance Officer (OSSCO). The OSSCO will be the first line of support for the development community within the Company on questions around OSS.

Vulnerability Management
The Dev/Ops team will keep themselves informed of security notifications for any underlying libraries and platforms and will push out patches as part of the regular product updates. Python and NPM security tools are also used for automated auditing of security vulnerabilities.

Penetration Test Methodology
A full penetration test by a suitably competent specialist is conducted before each major version release or annually, whichever occurs first. Such a test will include vulnerability scanning and skilled manual attacks at all levels of the TCP/IP stack including the Web application and SSH server. Tests are conducted initially without a valid credential and then with a credential for the Web application.

Results and Remediation
Results are presented in descending order of severity using a recognised, industry standard scoring system such as CVSS. Findings of a severity of CRITICAL or HIGH (>= 7) will be fixed and the complete test will be repeated until no such findings remain before the version is released to customers. MEDIUM (>= 4) findings will be addressed by an automatic update deployed to customers within 30 days. LOW (< 4) findings will be addressed before the next major release.

10. Physical Security
Loading and Delivery
The main delivery route for build locations (Cambridge and Dublin) is managed by access control systems, and CCTV covers the building perimeter on the internal approach. This has visibility over all external and internal movements. Packages being moved internally are covered at all times by CCTV and not left unattended with the external door open. General deliveries for all locations are taken and screened by onsite security / building management. Under no circumstances are general delivery drivers allowed to enter the main building through the building’s delivery route.

Larger deliveries for non-build locations such as London, San Francisco, Singapore, Los Angeles, New York, Reston, Paris are managed on prior notice to the building management teams. These locations are all covered by access control and CCTV by the building management team in the respective location.

Agenda Packet Page 202 of 209
Information Security Policy
Version 3.1 For External Use Page | 8 of 14
[DTL1]
[DTL1]
Perimeter Security
CCTV and PIR systems cover all entrances, internal corridors and secure areas. The retention period of the associated data is approximately 30 days. All Office entrances are accessed through a shared building lobby with manned reception. Internal office access restrictions are set with the use of electronic HID cards with photographic identification. All locations containing Darktrace critical infrastructure, and restricted and secure areas, utilise access control systems operated and managed by the internal security team. Internal zone access is determined by role.

All locations with non-critical infrastructure, access control and CCTV systems are operated and monitored by building management teams.

Environmental Threats
Layered entry defences are used to protect from environmental threats. Headquarters and Data Centres are not located in a flood plain or on a flight path. Fire detection and suppression equipment, and leak detection systems are in place within these locations.

11. Asset Management
Inventory of Assets
A full asset inventory database is maintained by the IT/Security Team for all devices with network access. Device ownership is assigned to a specific user in the database with a continual review and update cycle. A separate asset database is kept for customer appliances.

Return of Assets
The asset database updates automatically as part of the staff exit process. An Exit Certification Form certifies the return of assets and re-confirms the relevant provisions.

12. Information Classification
Classification of Information
Darktrace utilises a classification system for internal information. Disclosure of information classified at the lowest level represents insignificant harm to the business, while disclosure of information classified at the highest level may seriously impact the business or an individual.

Information is stored, handled, transferred and disposed of in line with the classification level requirements. A list of information assets is kept with their assigned level of classification.

Labelling of Information
All unmarked documents and media are assumed to have the lowest classification. All documents with higher classifications are marked as such, either in the document header or footer. Where not possible to mark the document itself, the classification is present on the container or access route (e.g., as metadata, or a folder name).

Agenda Packet Page 203 of 209
Information Security Policy
Version 3.1 For External Use Page | 9 of 14
[DTL1]
[DTL1]

13. Operations Security
Operational Procedures
All changes are risk-assessed and recorded within the ticketing system. Significant changes require recorded approval by a restricted list of approvers. Capacity management, where limitations exist, is tracked. Only late stage testing occurs on a staging server in operational environments. Operational networks are logically segregated.

Protection from Nefarious Threats
Darktrace utilises its own proprietary leading AI security technology, Enterprise Immune System (EIS) and Antigena Email (AGE), to learn normal ‘patterns of life’ in our internal and production environments to discover unpredictable cyber-threats, while delivering complete visibility across our dynamic workforce — from cloud and collaboration tools and to endpoints. Darktrace’s world-class SOC provides 24/7 monitoring and mitigation. Network activity is continuously monitored by the Darktrace EIS with full Antigena module enablement. AGE is also in place to monitor exchange traffic. Enterprise-grade endpoint security solutions are deployed throughout the Darktrace fleet. Cloud environments are monitored through security modules for SaaS and Web proxy filtering is in place.

Only approved software may be installed. Normal users do not have local administrative permissions, roles that require escalated privileges are monitored and their use is limited for specific approved actions only.

Logging and Monitoring
Network traffic logs are collected and passed into a Darktrace appliance. Security alerts from anomalous network events are investigated in real time. Security events and incidents are recorded. Clock synchronisation is achieved via NTP to internal servers. Access to the log server, collection server, anti-virus server and the internal Darktrace appliances is highly restricted.

Darktrace appliance aids attribution, including remote VPN users and administrator activities.

Log data is protected against tampering.

Control of Operational Software
Only software on the company’s approved software list may be installed on laptops, workstations and phones. A formal change control procedure is in place. Access to administrative credentials is restricted and devices are built to a standard specification.

Development and Operations teams manage instances of customised or in-house software.

Internal Technical Vulnerability Management
Auto-updates are enabled wherever possible. Important updates for other devices are rolled out as soon as possible and general updates are applied at least monthly. Websites are protected by anti-DDoS hosts. Vulnerability scanning of internal and external infrastructure is performed on a monthly basis. Findings from the vulnerability scans with a CVSS severity of CRITICAL or HIGH (>= 7) will be fixed within 7 days. MEDIUM (>= 4) findings will be addressed by an automatic update within 30 days. LOW (< 4) findings will be addressed as part of the monthly patch cycle.

Agenda Packet Page 204 of 209
Information Security Policy
Version 3.1 For External Use Page | 10 of 14
[DTL1]
[DTL1]

14. Incident Management
Responsibilities and Procedures
Incidents are raised to the Security Team. Business impact of the incident is assessed and if customer data is at risk, customers are notified within 24 hours. Evidence is collected and stored securely by the Security Team and accessed only by investigators. All investigators are independent of the incident itself. A formal incident report is written to determine the root cause, this is then reviewed to determine corrective or preventative actions.

Learning from Security Incidents
An incident, event and non-conformity (IENC) log is kept and used in forum meetings with senior management to identify key issues and trends. This is also used to determine the content of future security awareness training.

15. Data Protection and Security
Data is encrypted both at rest and when transmitted over public networks. Only authorized, vetted personnel have access and there is a documented privacy policy for the protection of information transmitted, processed or maintained on behalf of the customer.

Acceptable File Encryption
All corporate devices use disk encryption using native methods (FileVault 2 for MacOS, Native for iOS, BitLocker for Windows, LUKS for Linux) or VeraCrypt. Email is encrypted using Darktrace certificates within an email client. PDF file version higher than or equal to 1.6 are encrypted with AES. Microsoft Office documents (Excel, PowerPoint, Word) are encrypted using native methods in Office 2013 and above. ZIP files are encrypted using AES-128 or AES-256 with file names hidden.

Acceptable Transmission Encryption
Data is transmitted with TLS1.2+ (HTTPS, SMTPS, POPS etc), SSHv2, IPSec/DTLS with AES-128- GCM or higher encryption. Weaker ciphers from the available suite are removed. SMBv3 is encrypted with AES-CCM encryption.

Appliance Encryption
Darktrace appliances are encrypted via LUKS with keys stored on TPM using a 256-bit AES cipher and sha256 for key derivation. All hard drives have full disk encryption, except the boot hard drive, which contains a small unencrypted boot partition for starting up the appliance.

Call-Home Functionality
The Darktrace appliance makes an encrypted outbound SSH connection to Darktrace HQ. This is fully under the control of the customer and can easily be disabled within the appliance’s interface. Both sides of the connection enforce the correct pre-configured keys, which are unique to each customer. The connection is encrypted using the AES-128 CTR cipher. Only connection attempts from the customer’s nominated IP ranges are permitted. The connection terminates in a Call Home host that is dedicated solely to the customer. All logins and activity are logged and monitored, and authentication is multi-factor. The call home host and all Agenda Packet Page 205 of 209
Information Security Policy
Version 3.1 For External Use Page | 11 of 14
[DTL1]
[DTL1]
connections to it are monitored 24/7 by the Enterprise Immune System, as well as other security controls.

Data Destruction
Secure disposal procedure for all hard copy documentation, confidential waste, and HDD data.

Destroyed to BS EN15713:2009 Standards. Customer cloud environments are decommissioned at end/termination of contract, encryption keys are deleted.

16. Web Application Security
Transport Layer Security (TLS)
All web interfaces that serve data of any sensitivity or require authentication are served over HTTPS using modern, secure cipher suites. At the time of writing, the server’s first preferred cipher suite is summarised as: TLS v1.2 protocol, AES with 128-bit key in GCM mode encryption, a pseudo-random function of TLS PRF (with SHA-256), authentication using ECDSA-256 with SHA-256 on P-256 curve, and a key exchange using ECDHE using P-256 curve.

In particular, the following cipher suites are disabled: SSL v2/v3, TLS v1.0, RC4, DES, MD5. The following should be disabled: CBC modes, SHA1, 3DES.

Certificates
All external-facing web applications use an external trusted certificate authority. Sites that were live before 1 May 2018 may use RSA keys of at least 2048 bits, signed with SHA-256 or better hashes. New sites, released on or after 1 May 2018 will use ECDSA certificates, with optional additional legacy support for RSA.

Testing and Remediation
External-facing sites are regularly tested by Qualys SSL Labs and must get an A- or better grade.

If the site fails to achieve the required grade, fixes are prioritised in order to obtain the required grade within 10 working days. Regular scanning is performed by ZAP and vulnerabilities scored according to CVSS. Remediation timescales for these findings are the same as those previously defined in the Product Testing section.

Authentication
Where required, new sites will avoid the need to create new credentials and should rely on existing identities or Single Sign-On (SSO) mechanisms. External-facing sites additionally require the use of one-time codes (TOTP 2FA) as provided by e.g., DUO mobile app.

Content
The web sites are designed to avoid the OWASP Top 10 vulnerabilities. In particular, input validation and escaping must be handled by a recognised feature of the chosen platform or a trusted library. No inline scripting is used in new sites in order to support the CSP header restrictions.

Agenda Packet Page 206 of 209
Information Security Policy
Version 3.1 For External Use Page | 12 of 14
[DTL1]
[DTL1]

17. Human Resources Security
Prior to Employment
At least two professional references are taken, academic and professional qualifications are confirmed and a passport check is completed to confirm identity. For all roles with access to key company or customer information, a criminal background check and an Experian Complete check are conducted, which includes a financial stability check.

Onboarding
Upon hiring, new staff are assigned equipment and accesses based on their role. Access to internal systems and resources is granted to new hires on start date by IT.

Role Changes
Role changes are subject to the change control process. When changing roles, HR will update the HR system which will inform the IT department of a role change. Accounts are role based and will be automatically provisioned/revoked by IT systems.

Leavers
The leavers process is documented in the Exit Process policy. Upon receipt of a resignation letter or termination of contract by the company, the HR team will update the HR system with the users exit date. Management/HR decide whether the employee will work their notice period or leave immediately. On exit date, IT will disable all relevant accounts they manage and arrange for removal of others via ACP1. All equipment is to be returned. Contracts contain provisions to withhold the value of the equipment from the final paycheck until returned.

Terms and Conditions of Employment
Employee contracts include strict non-disclosure agreements and enforce compliance with information security policies. The employee contract documents the employees ongoing obligation to non-disclosure and confidentiality post-termination.

Security Awareness and Training
An Acceptable Use & IT Security policy is issued in a welcome pack to all staff. A security presentation outlining risks to Darktrace and employee obligations is discussed at all new joiner inductions. Presentations on security are included at major internal gathering events. High priority security alerts are emailed to all staff. Interactive quarterly training sessions are hosted on the company Intranet, completion is mandatory for all staff and is tracked and enforced by the Security team.

Disciplinary Process
A Disciplinary and Capability procedure is formally documented in the Staff Handbook and included in the employee contract. A formal incident response process exists and has been communicated to all staff.

Agenda Packet Page 207 of 209
Information Security Policy
Version 3.1 For External Use Page | 13 of 14
[DTL1]
[DTL1]

18. Business Continuity and Disaster Recovery Planning
Business Continuity and Disaster Recovery Planning
A plan has been developed to provide continuity in the event of a long-term total effective loss of the network infrastructure, communications services, and/or working locations. The BC plan is updated and re-approved annually.

Service Recovery
Services supporting key business functions and staff teams have been identified. Each service has at least two members of staff assigned with the knowledge, skills and access required, as well as a documented recovery procedure developed in advance. Each service has a Recovery Time Objective (RTO) and Recovery Point Objective (RPO) set by senior management.

Business Continuity and Disaster Recovery Testing
The BC and DR plan is tested annually. Testing is routinely conducted throughout the year to maximise testing value and to identify remediation actions. Testing can include dry runs, tabletop exercises or full, live tests. Any remediations are identified, consolidated, logged and addressed in the subsequent tests.

Backup Policy
The Backup policy outlines the procedures and frequency of backup for critical information systems. Backups of critical information systems are performed Daily. Testing of backups is performed dependent on the information system which is outlined in the backup policy.

19. Cloud Security
Onboarding Cloud Services
Use of cloud computing services for Darktrace work purposes must be formally assessed by the security team. Cloud computing services providers are classed as a supplier and therefore must be reviewed, within the Vendor Risk Management Program, as per their assessed criticality and risk. The Security Team will certify that security, privacy and all other security requirements will be adequately addressed by the cloud computing service provider. Any risks or security control deficiencies identified should be addressed with the cloud service provider through the appointed Darktrace services/contract owner.

Cloud Based Deployments
Cloud based deployments of Darktrace products, such as AGE or Cloud-Masters, utilise hosted datacentres provided by Azure, Amazon AWS or Google Cloud Platform (GCP). Azure, Amazon AWS and GCP are a sub-processor of Darktrace. Customers can choose specific regions for Darktrace cloud services to be deployed in. This is covered in depth within our Master Hosted Terms.

Agenda Packet Page 208 of 209
Information Security Policy
Version 3.1 For External Use Page | 14 of 14
[DTL1]
[DTL1]

20. Supplier Management
Business owners negotiate and approve the services provided by suppliers. The Security team should be consulted for all new suppliers to assess the criticality level. The criticality level is based on the importance of the service as part of Darktrace’s business operations combined with the potential business impact of a breach, impacting Darktrace’s reputation, valuation and customers. New suppliers that may handle Darktrace data (e.g., Payroll providers) must meet the security criteria based upon their criticality level and should be flagged immediately to the Security team for inclusion in the approved supplier list. All suppliers identified as medium criticality and above should be identified and included within the vendor risk management platform.

Darktrace utilises the vendor risk management platform to actively manage information security risks to the business posed by suppliers. During the due diligence stage of vendor onboarding, once the criticality level has been identified, the Security team will utilise security questionnaires to ascertain the information security maturity of the supplier. Any significant risks are treated. Thereafter, the Security team will periodically review the risks posed, based on the assigned criticality of the supplier and assessed risk.

21. Risk Management
A Risk Management Program has been developed to manage information security risk throughout the business. The Risk management program is within the scope of Darktrace’s ISO 27001 certification. An individual is designated to oversee the risk management program. Risk assessments are performed on an annual basis. Risks are recorded within a risk register.

Darktrace’s risk assessment methodology and threshold are documented within Risk Management Policy. Darktrace subscribes to the ISO31000: 2009 Risk Process.

22. Data Privacy
A Data Privacy Program is implemented which ensures that employee, customers and third party personal data is secured in line with Personal Data regulations and laws in the countries, and regions, that Darktrace operates within. Darktrace is a Data Controller and Data Processor.

Darktrace is committed to complying with data protection legislation and good practice.

Darktrace has a designated Data Protection Officer contactable at [email protected]

23. Dispensations
In case of any dispensations or deviations from this document please contact the document owner.

Agenda Packet Page 209 of 209