Agenda packet — Laguna Beach City Council, October 14, 2025 (part 3 of 3)

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
P. Changes: Contractor shall make no changes in the work or perform any additional work without the County’s specific written approval.

Q. Change of Ownership/Name, Litigation Status, Conflict of Interest Status: Contractor agrees that if there is a change or transfer in ownership of Contractor’s business prior to completion of this Contract, and the County agrees to an assignment of the Contract, the new owners shall be required under the terms of sale or other instruments of transfer to assume Contractor’s duties and obligations contained in this Contract and complete them to the satisfaction of the County.

County reserves the right to immediately terminate the Contract in the event the County determines that the assignee is not qualified or is otherwise unacceptable to the County for the provision of services under the Contract.

In addition, Contractor has the duty to notify the County in writing of any change in the Contractor’s status with respect to name changes that do not require an assignment of the Contract. The Contractor is also obligated to notify the County in writing if the Contractor becomes a party to any litigation against the County, or a party to litigation that may reasonably affect the Contractor’s performance under the Contract, as well as any potential conflicts of interest between Contractor and County that may arise prior to or during the period of Contract performance. While Contractor will be required to provide this information without prompting from the County any time there is a change in Contractor’s name, conflict of interest or litigation status, Contractor must also provide an update to the County of its status in these areas whenever requested by the County.

Contractor shall exercise reasonable care and diligence to prevent any actions or conditions that could result in a conflict with County interests. In addition to the Contractor, this obligation shall apply to the Contractor’s employees, agents, and subcontractors associated with the provision of goods and services provided under this Contract. The Contractor’s efforts shall include, but not be limited to establishing rules and procedures preventing its employees, agents, and subcontractors from providing or offering gifts, entertainment, payments, loans or other considerations which could be deemed to influence or appear to influence County staff or elected officers in the performance of their duties.

Contractor shall notify County in writing within thirty (30) days of any policy cancellation and ten (10) days for non-payment of premium and provide a copy of the cancellation notice to County.

Failure to provide written notice of cancellation may constitute a material breach of the Contract, upon which the County may suspend or terminate this Contract.

The Commercial General Liability policy shall contain a severability of interests clause also known as a “separation of insureds” clause (standard in the ISO CG 0001 policy).

Insurance certificates should be forwarded to the agency/department address listed on the solicitation.

If the Contractor fails to provide the insurance certificates and endorsements within seven (7) days of notification by CEO/Purchasing or the agency/department purchasing division, award may be made to the next qualified vendor.

County expressly retains the right to require Contractor to increase or decrease insurance of any of the above insurance types throughout the term of this Contract. Any increase or decrease in insurance will be as deemed by County of Orange Risk Manager as appropriate to adequately protect County.

County shall notify Contractor in writing of changes in the insurance requirements. If Contractor does not deposit copies of acceptable Certificates of Insurance and endorsements with County incorporating such changes within thirty (30) days of receipt of such notice, this Contract may be in breach without further notice to Contractor, and County shall be entitled to all legal remedies.

The procuring of such required policy or policies of insurance shall not be construed to limit Contractor's liability hereunder nor to fulfill the indemnification provisions and requirements of this Contract, nor act in any way to reduce the policy coverage and limits available from the insurer. 30 30 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 8 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
R. Force Majeure: Contractor shall not be assessed with liquidated damages or unsatisfactory performance penalties during any delay beyond the time named for the performance of this Contract caused by any act of God, war, civil disorder, employment strike or other cause beyond its reasonable control, provided Contractor gives written notice of the cause of the delay to County within thirtysix (36) hours of the start of the delay and Contractor avails himself of any available remedies.

S. Confidentiality: Contractor shall ensure the confidentiality, protection and preservation of the County’s Confidential Information (defined below) and information of a confidential, sensitive, and/or proprietary nature, which may be disclosed or made available to Contractor for its performance of services under this Contract, all related subordinate agreements, and its cyber security assessment and audit of the County’s network equipment, and associated software, information and documentation (collectively, the “Purpose”). a. “Confidential Information” means all non-public information, material, or documents, of any kind obtained from, or on behalf of, the County through any medium that is:
i. Designated in writing as “confidential” or “private” at the time of its disclosure; or ii. The County’s sensitive security information, technical data, programs, software (including configuration or source codes), technical information, screen shots, customer information, employee records, computer network, or architectural or engineering information; or
iii. Exploitable data, information protected by privacy law, or other information that is treated as confidential by the County, or is prohibited from being disclosed for any reason pursuant to law, statute, regulation, ordinance, or contract; or iv. Any County information security record the disclosure of which would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of the County; or
v. Information obtained by Contractor and relating to the County during the course of Contractor’s performance of the Contract, any related subordinate agreements, or the Purpose, that a reasonable person knows or reasonably should understand to be confidential, and is treated confidential by the disclosing party. b. Obligations of Confidence: Except as expressly permitted or further restricted by Section U(c) below, Contractor agrees as recipient of County’s Confidential Information that it will: (a) not disclose such Confidential Information to any third parties, and (b) exercise the same degree of care to protect such Confidential Information from any possession, use or disclosure not expressly permitted by this Contract, that Contractor generally uses to protect its own information of similar nature, but in any event no less than a reasonable standard of care. c. Limited Permitted Use and Disclosure: Contractor may possess, use, and disclose County’s Confidential Information only as follows:
i. Possession and Use: Contractor may possess, use and reproduce Confidential Information solely for the Purpose. The Purpose shall not include disclosure except as expressly permitted in Section U(c)(ii) and (iii) below. Contractor shall not use the Confidential Information for any other purpose. Contractor shall not disassemble, decompile or otherwise reverse engineer any samples, prototypes, software or other tangible objects provided by the County hereunder. If Contractor is provided with a copy of the County’s software/firmware or hardware products, Contractor may use and operate such products solely for its own internal testing and evaluation regarding the Purpose. Any information derived from testing and evaluating the County’s products will be deemed Confidential Information, and the sole property, of the County.
31 31 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 9 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
ii. Disclosure: Contractor may, with the express written consent of the County, disclose Confidential Information to its Affiliates (defined below) and employees on a strict "need to know" basis and solely for the Purpose and in the course of providing the services to County, provided that each such entity/person to whom such disclosure is made is notified of the confidential nature of the disclosure and is under an obligation to hold the Confidential Information in confidence under terms and conditions at least as restrictive as the terms and conditions of this Contract. “Affiliate” means Contractor’s parent or subsidiary company or a corporate affiliate that controls, is controlled by or under common control with Contractor.
iii. Legally Required Disclosure: Disclosure of any Confidential Information by Contractor shall not be precluded if such disclosure is required of Contractor pursuant to court or administrative order, but only to the extent required and provided that Contractor in each instance before making such disclosure first (i) promptly upon receipt of such order notifies County of such order in writing; and (ii) reasonably cooperates with County in making, if available under applicable law, a good faith effort to obtain a protective order or other appropriate determination against or limiting disclosure or use of the Confidential Information, at no cost to County. iv. Return or Secure Destruction of Confidential Information: Upon the earlier of: the expiration of this Contract or the request (at any time) of County, the recipient Party shall, at the County’s option and pursuant to the County’s written authorization, either:
(a) promptly securely destroy all copies of the Confidential Information obtained from the County or furnished to the Contractor, or Contractor’s approved Affiliates and employees, and confirm such destruction to the County in writing by executing the Certificate of Return or Destruction and Non-data Breach attached hereto as Attachment E, or (b) return to the County all Confidential Information obtained from the County or furnished to the Contractor, and Contractor’s approved Affiliates and employees, and confirm such return to the County in writing by executing the Certification of Return or Destruction and Non-data Breach attached hereto as Attachment E.
v. Exceptions to Confidentiality: Notwithstanding any other provisions of this Contract, each Party acknowledges that Confidential Information shall not include any information which:

1. is now or becomes part of the public domain through no fault or omission of the Contractor;

2. is already known by the Contractor prior to the disclosure without restriction on disclosure;

3. is lawfully received, without obligation of confidentiality, by the Contractor from others; or

4. is independently developed by or for the Contractor without use of or reference to the County’s Confidential Information.
d. Responsibility for Others: Contractor shall be fully responsible for the acts, omissions, breaches, violations of law, and unauthorized uses or disclosures of the County’s Confidential Information by its employees and duly approved Affiliates, agents, and subcontractors (all, as relevant and if any).
e. Survival of Confidentiality Obligations: Contractor’s confidentiality obligations in this Contract and the obligations of this Section U et seq. shall survive the termination or expiration of the 32 32 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 10 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
T. Compliance with Laws: Contractor represents and warrants that services to be provided under this Contract shall fully comply, at Contractor’s expense, with all standards, laws, statutes, restrictions, ordinances, requirements, and regulations (collectively “laws”), including, but not limited to those issued by County in its governmental capacity and all other laws applicable to the services at the time services are provided to and accepted by County. Contractor acknowledges that County is relying on Contractor to ensure such compliance, and pursuant to the requirements of paragraph “Z” below, Contractor agrees that it shall defend, indemnify and hold County and County Indemnities harmless from all liability, damages, costs, and expenses arising from or related to a violation of such laws.

U. Freight (F.O.B. Destination): Contractor assumes full responsibility for all transportation, transportation scheduling, packing, handling, insurance, and other services associated with delivery of all products deemed necessary under this Contract.

V. Severability: If any term, covenant, condition, or provision of this Contract is held by a court of competent jurisdiction to be invalid, void or unenforceable, the remainder of the provisions hereof shall remain in full force and effect and shall in no way be affected, impaired or invalidated thereby.

W. Attorney Fees: In any action or proceeding to enforce or interpret any provision of this Contract, or where any provision hereof is validly asserted as a defense, each Party shall bear its own attorney’s fees, costs and expenses.

X. Interpretation: This Contract has been negotiated at arm’s length and between persons sophisticated and knowledgeable in the matters dealt with in this Contract. In addition, each Party has been represented by experienced and knowledgeable independent legal counsel of their own choosing or has knowingly declined to seek such counsel despite being encouraged and given the opportunity to do so. Each Party further acknowledges that they have not been influenced to any extent whatsoever in executing this Contract by any other Party hereto or by any person representing them, or both. Accordingly, any rule or law (including California Civil Code Section 1654) or legal decision that would require interpretation of any ambiguities in this Contract against the Party that has drafted it is not applicable and is waived. The provisions of this Contract shall be interpreted in a reasonable manner to affect the purpose of the Parties and this Contract.

Y. Employee Eligibility Verification: The Contractor warrants that it fully complies with all Federal and State statutes and regulations regarding the employment of aliens and others and that all its employees performing work under this Contract meet the citizenship or alien status requirement set forth in Federal statutes and regulations. The Contractor shall obtain, from all employees, consultants and subcontractors performing work hereunder, all verification and other documentation of employment eligibility status required by Federal or State statutes and regulations including, but not limited to, the Immigration Reform and Control Act of 1986, 8 U.S.C. §1324 et seq., as they currently exist and as they may be hereafter amended. The Contractor shall retain all such documentation for all covered employee, consultants and subcontractors for the period prescribed by the law. The Contractor shall indemnify, defend with counsel approved in writing by County, and hold harmless, the County, its agents, officers, and employees from employer sanctions and any other liability which may be assessed against the Contractor or the County or both in connection with any alleged violation of any Federal or State statutes or regulations pertaining to the eligibility for employment of any persons performing work under this Contract.

Contract and all related subordinate contracts. Contractor shall keep the County’s Confidential Information confidential indefinitely.
f. Disclaimers and Retention of Rights: Nothing in this Contract shall operate to create or transfer an ownership or other interest in any Confidential Information, nor require the disclosure by County of any of its Confidential Information, nor restrict, inhibit or encumber County’s right or ability to dispose of, use, distribute, disclose or disseminate in any way its own Confidential Information.

County will retain all right, title, and interest in and to all Confidential Information. Contractor shall not acquire any patent, copyright, mask work or trademark rights under this Contract. 33 33 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 11 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
Z. Indemnification Provisions: Contractor agrees to indemnify, defend with counsel approved in writing by County, and hold County, its elected and appointed officials, officers, employees, agents and those special districts and agencies which County’s Board of Supervisors acts as the governing Board (“County Indemnitees”) harmless from any claims, demands or liability of any kind or nature, including but not limited to personal injury or property damage, arising from or related to the services, products or other performance provided by Contractor pursuant to this Contract. If judgment is entered against Contractor and County by a court of competent jurisdiction because of the concurrent active negligence of County or County Indemnitees, Contractor and County agree that liability will be apportioned as determined by the court. Neither Party shall request a jury apportionment.

AA. Audits/Inspections: Contractor agrees to permit the County’s Auditor-Controller or the AuditorController’s authorized representative (including auditors from a private auditing firm hired by the County) access during normal working hours to all books, accounts, records, reports, files, financial records, supporting documentation, including payroll and accounts payable/receivable records, and other papers or property of Contractor for the purpose of auditing or inspecting any aspect of performance under this Contract. The inspection and/or audit will be confined to those matters connected with the performance of the Contract including, but not limited to, the costs of administering the Contract. The County will provide reasonable notice of such an audit or inspection.

The County reserves the right to audit and verify the Contractor’s records before final payment is made.

Contractor agrees to maintain such records for possible audit for a minimum of three years after final payment, unless a longer period of records retention is stipulated under this Contract or by law. Contractor agrees to allow interviews of any employees or others who might reasonably have information related to such records. Further, Contractor agrees to include a similar right to the County to audit records and interview staff of any subcontractor related to performance of this Contract.

Should the Contractor cease to exist as a legal entity, the Contractor’s records pertaining to this Contract shall be forwarded to the surviving entity in a merger or acquisition or, in the event of liquidation, to the County’s project manager.

BB. Contingency of Funds: Contractor acknowledges that funding or portions of funding for this Contract may be contingent upon state budget approval; receipt of funds from, and/or obligation of funds by, the state of California to County; and inclusion of sufficient funding for the services hereunder in the budget approved by County’s Board of Supervisors for each fiscal year covered by this Contract. If such approval, funding or appropriations are not forthcoming, or are otherwise limited, County may immediately terminate or modify this Contract without penalty.

CC. Expenditure Limit: Contractor shall notify the County of Orange assigned Deputy Purchasing Agent in writing when the expenditures against the Contract reach 75 percent of the dollar limit on the Contract. County will not be responsible for any expenditure overruns and will not pay for work exceeding the dollar limit on the Contract unless a change order to cover those costs has been issued.

III. Additional Terms and Conditions:

1. Scope of Contract: This Contract, together with the Attachments and Exhibits attached hereto and included herein by reference, specifies the contractual terms and conditions by which Contractor shall provide County with Cybersecurity Assessment & Audit Services.

2. Term of Contract: This Contract shall be effective for three (3) years from January 1, 2023, through December 31, 2025. This Contract may be renewed, by mutual written agreement of both Parties, for one (1) additional two-year term. County does not have to give any reason should it 34 34 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 12 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

3. Precedence: The Contract documents will consist of this Contract, including its Attachments and Exhibits. In the event of a conflict or inconsistency between or among the Contract documents, the following order of precedence shall apply: (a) the provisions of the main body of this Contract (i.e., those provisions set forth in the recitals and articles, excluding its Attachments and Exhibits), (b) Attachment A; (c) Attachment B; (d) Attachment C; (e) Attachment D; (f) Attachment E; (g) Exhibit I.

4. Authorization Warranty: Contractor represents and warrants that the person or persons executing this Contract on behalf of and for Contractor is an authorized agent who has actual authority to bind Contractor to each and every term, condition and obligation of this Contract and that all requirements of Contractor have been fulfilled to provide such actual authority.

5. Breach: The failure of Contractor to comply with any of the provisions, covenants, requirements, or conditions of this Contract shall be a material breach of this Contract. In such event, County may, in addition to any other remedies available at law, in equity, or otherwise specified in this Contract, do any of the following:
a. Afford Contractor written notice of the breach and, if the breach is curable, ten (10) calendar days or such shorter time that may be specified in this Contract, within which Contractor is to cure the breach;
b. Discontinue payment to Contractor for and during the period in which Contractor is in breach; c. Offset against any monies billed by Contractor but yet unpaid by County those monies disallowed pursuant to the above; and
d. Terminate the Contract immediately pursuant to paragraph “K”.

Any reference to specific breaches being material breaches within this Contract will not be construed to mean that other breaches are not material.

6. County’s Project Manager: County shall appoint a Project Manager that shall: (a) act as the primary liaison between County and the Contractor’s Project Manager; (b) have overall responsibility for directing and coordinating County’s activities hereunder; and (c) be vested with the necessary authority to fulfill all of the responsibilities of the County’s Project Manager described in this Contract. County represents that the individual designated as the County’s Project Manager is, and shall ensure that any replacement holder of such position shall be, an experienced manager who is knowledgeable as to County, its respective businesses, business practices, functions, and related activities, and its respective systems, requirements, and needs.

7. Contractor’s Project Manager: Contractor shall appoint a Project Manager to direct Contractor’s efforts in fulfilling Contractor’s obligations under this Contract. The Contractor’s Project Manager shall at all times: (i) act as the primary liaison between Contractor and the County’s Project Manager; (ii) have overall responsibility for directing all of Contractor’s activities hereunder, including directing the performance of all Services from inception through completion; (iii) be vested with the necessary authority to fulfill all of the responsibilities of the Contractor’s Project Manager described in this Contract; and (iv) coordinate and conduct periodic program review sessions with County to discuss costs, Attachments, and any relevant technical aspects of Contractor’s performance under this Contract. Contractor represents that the individual designated as the Contractor’s Project Manager is, and promises that any replacement holder of such position shall be, an experienced manager who is knowledgeable as to County, its respective businesses, business practices, functions, and related activities, and its respective solution, requirements, and needs. County shall have the right to interview, as County deems necessary, and participate (by elect not to renew or extend this Contract. Any renewal may require approval of the County of Orange Board of Supervisors.
35 35 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 13 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

8. Contractor’s Power and Authority: Contractor represents and warrants that it has the full power and authority to grant the rights herein granted and will indemnify and defend and hold County and County Indemnitees harmless from and against any and all loss, cost, liability, and expense, including reasonable attorney fees, arising out of any breach of this representation and warranty.

Further, Contractor avers that it will not enter, and has not entered, into any arrangement with any third party which might abridge any rights of County under this Contract.

9. Conflict of Interest – (Contractor): Contractor shall exercise reasonable care and diligence to prevent any actions or conditions that result in a conflict with the best interests of County. This obligation shall apply to Contractor; Contractor’s employees, agents, relatives, sub-tier contractors, and third parties associated with accomplishing work and Services hereunder. Contractor’s efforts shall include, but are not limited to, establishing precautions to prevent its employees or agents from making, receiving, providing, or offering gifts, entertainment, payments, loans, or other considerations which could be deemed to appear to influence individuals to act contrary to the best interest of County.

10. Conditions Affecting Work: Contractor shall be responsible for taking all steps reasonably necessary to ascertain the nature and location of the work to be performed under this Contract and to reasonably know the general conditions which can affect the work or the cost thereof. Any unreasonable failure by Contractor to do so shall not relieve Contractor from responsibility for successfully performing the work without additional cost to County. County assumes no responsibility for any understanding or representations made by any of its officers or agents during or prior to the execution of this Contract concerning the nature, location(s), or general conditions of the Contract, unless such understanding or representations by County are expressly stated in the Contract and the Contract expressly provides that County assumes the responsibility.

11. Contractor’s Expense: Contractor will be responsible for all costs related to photocopying, telephone communications, fax communications, travel, parking, and any and all “out of pocket” expenses incurred by Contractor during the performance of the Services under this Contract, unless otherwise specified. Contractor shall be responsible for payment of all parking costs and expenses incurred at a County facility while performing work under this Contract, except to the extent the County facility has free parking available to the public and Contractor makes appropriate use of this free parking. However, County will at no point provide free parking to Contractor in the County Civic Center.

12. Defaults: The following constitute events of default:
a. Any material misrepresentation, whether negligent or willful and whether in the inducement or in the performance, made by Contractor to County.
b. Failure, as a result of insolvency, filing for bankruptcy or assignment for the benefit of creditor, to perform the Services in a manner reasonably satisfactory to County. providing input and recommendations) in the final selection of the Contractor’s Project Manager.

Without the prior written consent of the County’s Project Manager, which consent shall not be unreasonably withheld, Contractor shall not: (a) designate a replacement for the Contractor’s Project Manager; or (b) voluntarily replace or reassign the individual serving as the Contractor’s Project Manager during the first twelve (12) months after the date that such individual commences performing the duties of the Contractor’s Project Manager hereunder. The County’s Project Manager shall have the right to require the removal and replacement of the Contractor’s Project Manager from providing Services to County under this Contract. The County’s Project Manager shall notify Contractor in writing of such action. Contractor shall accomplish the removal within three (3) calendar days after written notice by the County’s Project Manager. County is not required to provide any reason, rationale or factual information in the event it elects to request the removal of the Contractor’s Project Manager from providing Services to County under this Contract. 36 36 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 14 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
c. Discontinuance of the Services for reasons within Contractor’s reasonable control. d. Contractor’s default under any other agreement it may presently have or may enter into with County during the life of this Contract. Contractor acknowledges and agrees that in the event of a default under this Contract, County may also declare a default under any other such contracts.
e. Contractor’s repeated or continued violations of County ordinances unrelated to performance under the Contract that in the reasonable opinion of County indicate a willful or reckless disregard for County laws and regulations.

13. Disputes: The Parties shall deal in good faith and attempt to resolve potential disputes informally.

If the dispute concerning a question of fact arising under the terms of this Contract is not disposed of in a reasonable period of time by the Contractor’s Project Manager and the County’s Project Manager, such matter shall be brought to the attention of the Deputy Purchasing Agent by way of the following process:

Contractor shall submit to the Deputy Purchasing Agent a written demand for a final decision regarding the disposition of any dispute between the Parties arising under, related to, or involving this Contract, unless County, on its own initiative, has already rendered such a final decision.

Contractor’s written demand shall be fully supported by factual information, and, if such demand involves a cost adjustment to the Contract, Contractor shall include with the demand a written statement signed by a senior official of Contractor indicating that the demand is made in good faith, that the supporting data are accurate and complete, and that the amount requested accurately reflects the contract adjustment for which Contractor believes County is liable.

Pending the final resolution of any dispute arising under, related to, or involving this Contract, Contractor will diligently proceed with the performance of this Contract, including the provision of Services, as specified in Attachment A, Scope of Work. Contractor’s failure to diligently proceed shall be considered a material breach of this Contract.

Any final decision of County shall be expressly identified as such, shall be in writing, and shall be signed by the Deputy Purchasing Agent. If County fails to render a decision within ninety (90) calendar days after receipt of Contractor’s demand, it shall be deemed a final decision adverse to Contractor’s contentions. County’s final decision shall be conclusive and binding regarding the dispute unless Contractor commences action in a court of competent jurisdiction to contest such decision within ninety (90) calendar days following the date of County’s final decision or one (1) year following the accrual of the cause of action, whichever is later.

Nothing in this paragraph shall be construed as affecting County’s right to terminate the Contract pursuant to Paragraph “K”, Termination.

14. Disputed Amounts: County may withhold payment of fees or any other charges otherwise due to Contractor under this Contract to the extent that County disputes such charges in good faith. In such case, County shall provide to Contractor a reasonably detailed written explanation of the basis for the dispute and shall continue to make payments of undisputed amounts as otherwise provided in this Contract. If any disputed amounts are later determined to have been improperly withheld (i.e., properly charged by Contractor), then County shall be obligated to pay the withheld amount in accordance with this Contract, until paid in full. If any paid amounts are later disputed by County and determined to have been improperly paid (i.e., improperly charged by Contractor), then Contractor shall promptly pay County, in cash, the improperly paid amount. The failure of County to withhold payment shall not waive any other rights County may have with respect to disputed amounts or overpayments. Except as otherwise provided herein, any dispute relating to amounts owed by a Party hereunder, shall be considered a disagreement. This right to withhold is in addition 37 37 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 15 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

15. Employee Qualification Verification: Subject to and in accordance with applicable law, Contractor, prior to assigning an individual as Contractor personnel and at Contractor’s sole expense, shall have appropriately verified the qualifications of such individual, including verifying employment history, conducting reference checks, verifying non-employer technical certifications or education completed or degrees awarded.

16. Gratuities: Contractor represents and warrants that no gratuities, in the form of entertainment, gifts, or otherwise, were offered or given by Contractor or any agent or representative of Contractor to any officer or employee of County with a view toward securing the Contract or securing favorable treatment with respect to any determinations concerning the performance of the Contract.

For breach or violation of this representation and warranty, County shall have the right to terminate the Contract, either in whole or in part, and any loss or damage sustained by County in procuring on the open market any goods or Services which Contractor agreed to supply shall be borne and paid for by Contractor. The rights and remedies of County provided in this paragraph shall not be exclusive and are in addition to any other rights and remedies provided by law or under the Contract.

17. No Third-Party Beneficiaries: This Contract is an agreement by and between the Parties and does not: (a) confer any rights upon any of the employees, agents, or contractors, of either Party or upon any other person or entity not a party hereto; or (b) preclude any actions or claims against, or rights of recovery from, any person or entity not a party hereto.

18. Non-Exclusivity: Nothing herein shall prevent County from providing for itself or obtaining from any third party, at any time during the term or thereafter, the Services, or any type of products or services in any way analogous, similar, or comparable to the Services, as applicable, or any other products or services. Nor shall anything in this Contract be construed or interpreted as limiting County’s right or ability during the term to increase or decrease its demand for Services hereunder.

19. Non-Solicitation of Employees: Except as otherwise expressly provided in this Contract, during the term and for the first twelve (12) months thereafter, neither Party shall, without the prior written consent of the other Party, directly or indirectly solicit, entice, encourage, or otherwise recruit any employee of such other Party whose duties and responsibilities include performing Services directly or indirectly connected with performance under this Contract to leave such other Party’s employ in order to accept employment or other engagement with the soliciting Party, its affiliates, or any other person. Notwithstanding the foregoing, the Parties acknowledge and agree that this Contract shall not prohibit solicitations by either Party through general advertising or other publications of general circulation. In no way is this paragraph intended, nor shall it be deemed, to restrict or limit any individual’s right to seek employment, but rather this paragraph is intended to, and shall, prevent each Party from actively recruiting the employees of the other Party (except as provided in this Contract), thereby depriving such other Party of vital resources in the securing, development, training, and deployment of whom it has expended considerable time and resources.

20. Notice of Claims: Contractor shall give County immediate notice in writing of any legal action or suit filed related in any way to this Contract or which may affect the performance of work under this Contract and prompt notice of any claim made against Contractor by any subcontractor which may result in litigation related in any way to this Contract or which may affect the performance of work under this Contract.
to, and not a limitation of, any other remedies available to County. Contractor may not fail to perform or suspend performance of any Services hereunder by reason of County’s good faith withholding of any payment or amount in accordance with this paragraph. Contractor’s failure to perform shall be considered a material breach of this Contract. 38 38 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 16 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

21. Right to Access and Use Services: Contractor grants County a non-transferable and non-exclusive right to use and access all Services and other functionalities or services, provided, furnished, or accessible under this Contract, including that described in Attachment A, Scope of Work. This shall include the right of County to, and access to, all System maintenance and warranty updates, upgrades, patches, fixes and support without Contractor requiring a separate maintenance or support agreement. Subject to the agreed limitation on the number of users, County may use the Services with any computer, computer system, server, or desktop workstation owned or utilized by County or other authorized users. User access to the Services shall be routinely provided by Contractor. The right to access and use Services, including any associated payment for such right, shall commence on the Go-Live date.

22. Set-Off: County may set-off against any and all amounts otherwise payable to Contractor pursuant to any of the provisions of this Contract: (i) any and all amounts claimed by County in good faith to be owed by Contractor to County pursuant to any of the provisions of this Contract; and (ii) any and all amounts claimed by County in good faith to be owed by Contractor pursuant to any other written agreement between the Parties. Within twenty (20) calendar days after any such set-off by County, County shall provide Contractor with a written accounting of such set-off and a written statement of the reasons therefore. If the amount set-off is insufficient to cover the excess costs, Contractor is liable for and must promptly remit to County the balance upon written demand. This right to set-off is in addition to, and not a limitation of, any other remedies available to County.

Contractor may not fail to perform or suspend performance of any Services hereunder by reason of County’s good faith set-off in accordance with this paragraph. Contractor’s failure to perform shall be considered a material breach of this Contract.

23. Stop Work: County may, at any time, by written stop work order to Contractor, require Contractor to stop all or any part of the work called for by this Contract for a period up to ninety (90) business days after the stop work order is delivered to Contractor and for any further period to which the Parties may agree. The stop work order shall be specifically identified as such and shall indicate it is issued under this paragraph. Upon receipt of the stop work order, Contractor shall immediately comply with its terms and take all reasonable steps to minimize the incurrence of costs allocable to the work covered by the stop work order during the period of work stoppage. Within a period of ninety (90) business days after a stop work order is delivered to Contractor or within any extension of that period to which the Parties shall have agreed, County shall either:
a. Cancel the stop work order; or
b. Terminate the Contract in whole or in part in writing as soon as feasible. County is not required to provide thirty (30) calendar day-notice of the termination of the Contract to Contractor if a stop work order has been issued by County.

County shall not be liable to Contractor for loss of profits because of a stop work order issued under this paragraph.

24. Orderly Termination: Upon receipt of a termination notice from County, Contractor shall stop work under this Contract on the date and to the extent specified in the termination notice.

Contractor shall complete performance of such part of the work as shall not have been terminated by the termination notice, if any. County shall pay Contractor all undisputed amounts due and payable hereunder, if any. Contractor shall pay County all amounts due and payable hereunder, such as performance credits and prepaid fees, if any. Upon termination or expiration of this Contract, each Party shall assist the other Party in transferring all assets, tangible and intangible, as may be necessary for the orderly, non-disruptive business continuation of each Party. Each Party shall promptly return to the other Party all papers, materials, and other properties of the other held by each for purposes of performance of this Contract and Contractor shall return all County data to County in the file format specified by County within thirty (30) calendar days. In addition, 39 39 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 17 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

25. Reports/Meetings: Contractor shall develop reports and any other relevant documents necessary to complete the Services and requirements as set forth in this Contract. The County’s Project Manager and the Contractor’s Project Manager shall meet on reasonable notice to discuss Contractor’s performance and progress under this Contract. If requested, the Contractor’s Project Manager and other project personnel shall attend all meetings. Contractor shall provide such information that is requested by County for the purpose of monitoring progress under this Contract.

26. News/Information Release: Contractor will not issue any news releases in connection with either the award of this Contract or any subsequent amendment of or effort under this Contract without first obtaining review and express prior written consent of said news releases from County through the County’s Project Manager.

27. Promotional/Advertisement: County owns all rights to the name, logos and symbols of County.

The use and/or reproduction of County’s name and/or logo for any purpose, including commercial advertisement, promotional purposes, announcements, displays or press releases, without County’s express prior written consent is expressly prohibited. No use or reproduction may state or imply that County endorses Contractor’s products or Services.

28. Publication: No copies of sketches, schedules, written documents, computer based data, photographs, maps or graphs, including graphic art work, resulting from performance or prepared in connection with this Contract, are to be released by Contractor and/or anyone acting under the supervision of Contractor to any person, partnership, company, corporation, or agency, without County’s express prior written consent, except as necessary for the performance of the Services under this Contract. All press releases, including but not limited to graphic display information to be published in newspapers and magazines, are to be administered only by County unless otherwise agreed to by both Parties.

29. Errors and Omissions: All reports, files, and other documents prepared and submitted by Contractor shall be complete and shall be carefully checked by the professional(s) identified by Contractor as Project Manager, prior to submission to County. Contractor agrees that County review is discretionary and Contractor shall not assume that County shall discover errors and/or omissions. If County discovers any errors or omissions prior to approving Contractor's reports, files, and other written documents, the reports, files, or other written documents shall be returned to Contractor for correction. Should County or others discover errors or omissions in the reports, files, or other written documents submitted by Contractor after County approval thereof, County approval of Contractor's reports, files, or other written documents shall not be used as a defense by Contractor in any action between County and Contractor, and the reports, files, or other written documents shall be returned to Contractor for correction.

30. Debarment: Contractor certifies that neither Contractor nor its principles are presently debarred, proposed for debarment, declared ineligible or voluntarily excluded from participation in the transaction by any Federal department or agency.

Contractor shall erase, destroy, and render unreadable all data in its entirety remaining in Contractor’s (including any subcontractor’s) possession, but only after the County data has been returned to County. County data must be rendered in a manner that prevents its physical reconstruction through the use of commonly available file restoration utilities. Certification in writing that these actions have been completed must be provided within thirty (30) calendar days of termination or expiration of this Contract or within seven (7) calendar days of a request of County, whichever shall come first. Notwithstanding the foregoing, the foregoing requirement to return, erase, destroy and render data unreadable, including County data, shall not apply to electronic copies of such data maintained in a non-production environment in accordance with Contractor’s standard procedures for electronic archiving. 40 40 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 18 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

31. Notices: Any and all notices, requests, demands, and other communications contemplated, called for, permitted, or required to be given hereunder shall be in writing, except through the course of the Parties’ project managers’ routine exchange of information and cooperation during the term of the Contract and except as otherwise provided herein. Any such communications shall be deemed duly given (1) upon actual delivery, if delivery is by hand; (2) upon delivery by United States mail, if delivery is by postage paid registered or certified return receipt requested mail; or (3) upon delivery via electronic mail with paper copy delivered by United States mail or hand to Party. Each such notice shall be sent to the respective Party at the address indicated below or to any other address as the respective Parties may designate from time to time upon notice in the manner aforesaid.

CONTRACTOR CONTACT
Tevora Business Solutions, Inc.

Attn: Cindy Curley
Street Address: 17875 Von Karmen Ave, Suite 100
Irvine CA, 92614
Phone: 858-361-7743
Email: [email protected]

COUNTY CONTACTS
OCIT/Contracts & Procurement Division
1055 N. Main St., 6th Floor
Santa Ana, CA 92701
Attn: Tim Shears, Deputy Purchasing Agent
Phone: (714) 567-7488
Email: [email protected]
OCIT/Project Manager
1055 N. Main St., 6th Floor
Santa Ana, CA 92701
Attn: Andrew Song
Phone: (714) 834-4081
Email: [email protected]

32. Equal Employment Opportunity: Contractor shall comply with Executive Order 11246, “Equal Employment Opportunity”, as amended by Executive order 11375 and as supplemented in Department of Labor regulations (41 CFR, Part 60), and applicable state of California regulations as may now exist or be amended in the future. Contractor shall not discriminate against any employee or applicant for employment on the basis of race, color, national origin, ancestry, religion, sex, marital status, political affiliation or physical or mental condition.

Contractor will not discriminate against any employee or applicant for employment because of a physical or mental handicap for any position for which the employee or applicant for employment is qualified. Contractor will provide equal opportunity to handicapped persons in employment or in advancement in employment or otherwise treat qualified handicapped individuals without discrimination based upon their physical or mental handicaps in all employment practices, including: employment, upgrading, promotions, transfers, recruitments, advertising, layoffs, terminations, rate of pay or other forms of compensation, and selection for training, including apprenticeship. Contractor will comply with the provisions of Sections 503 and 504 of the Rehabilitation Act of 1973, as amended, pertaining to prohibition of discrimination against qualified handicapped persons in all programs and/or activities as detailed in regulations signed by the Secretary of the Department of Health and Human Services effective June 3, 1977, and found in the Federal Register, Volume 42, No. 68 dated May 4, 1977, as may now exist or be amended in the future.

Further, Contractor will comply with applicable provisions of Title 1 of the Americans with Disabilities Act of 1990, as may now exist or be amended in the future. 41 41 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 19 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

33. Civil Rights: Contractor attests that Services provided shall be in accordance with the provisions of Title VI and Title VII of the Civil Rights Act of 1964, as amended; Section 504 of the Rehabilitation Act of 1973, as amended; the Age Discrimination Act of 1975, as amended; Title II of the Americans with Disabilities Act of 1990, and other applicable state and federal laws and regulations prohibiting discrimination on the basis of race, color, national origin, ethnic group identification, age, religion, marital status, sex or disability.

34. Lobbying: On best information and belief, Contractor certifies no federal appropriated funds have been paid or will be paid by, or on behalf of, Contractor to any person for influencing or attempting to influence an officer or employee of Congress; or an employee of a member of Congress in connection with the awarding of any federal contract, continuation, renewal, amendment, or modification of any federal contract, grant, loan, or cooperative agreement.

35. Ownership of Documents: County has permanent ownership of all directly connected and derivative materials produced under this Contract by Contractor. All documents, reports and other incidental or derivative work or materials furnished hereunder shall become and remains the sole property of County and may be used by County as it may require without additional cost to County. None of the documents, reports and other incidental or derivative work or furnished materials shall be used by Contractor without the express written consent of County.

Notwithstanding the foregoing or anything else to the contrary in this Contract, nothing in this Contract shall be deemed to convey to County or any third party any right, title or interest in or to materials in which Contractor or its suppliers, subcontractors and vendors have an existing intellectual property right (“Existing Materials”); provided, however, that Contractor hereby grants to County a non-exclusive, fully paid, perpetual, worldwide license to use such Existing Materials for County’s internal business purposes to the extent such Existing Materials are incorporated into a Deliverable. However, such Existing Materials may be subject to disclosure pursuant to Section 6250 et seq. of the California Public Records Act.

36. Materials Subject to Disclosure: This Contract including its Attachments may be subject to disclosure pursuant to court order or applicable law, including but not limited to Section 6250 et seq. of the California Public Records Act.

37. Third Party Software: Contractor has obtained all necessary licenses for County to use any third party software (including without limitation, all Open Source licenses) provided with Contractor’s Services. Contractor complies with and shall continue to comply with all third party licenses (including, without limitation, all Open Source licenses) associated with any third party software provided with Contractor’s Software and Services. To the extent any third party software are provided with Contractor’s Services, County’s use of the System as provided by Contractor and in accordance with this Contract or any additional agreements issued hereunder will not be in conflict with any third party license requirements and will satisfy all conditions on use, modification or distribution of any such third party software without the need for any additional, unanticipated action or license fees on County’s part. County does not and will not need to procure any rights or licenses to any patents or other third party intellectual property rights to use as intended in this Contract.

38. Data - Title to: All materials, documents, data or information obtained from the County data files or any County medium furnished to Contractor in the performance of this Contract will at all times remain the property of the County. Such data or information may not be used or copied for direct or indirect use by Contractor after completion or termination of this Contract without the express written consent of the County. All materials, documents, data or information, including copies, must be returned to the County at the end of this Contract. 42 42 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 20 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

39. Data Location: Except where Contractor obtains County’s express prior written consent, the physical location of Contractor’s data center where County data is stored shall be within the continental United States.

40. Trans-Border Data Flows: Contractor shall not transfer any County data across a country border.

Furthermore, Contractor shall perform all work and Services required under this Contract within the continental United States.

41. Discovery: Contractor shall promptly notify County upon receipt of any requests which in any way might reasonably require access to County data or County’s use of Contractor’s Services.

Contractor shall notify County by the fastest means available and also in writing, with additional notification provided to the County’s Project Manager or designee, unless prohibited by law from providing such notification. Contractor shall provide such notification within forty-eight (48) hours after Contractor receives the request. Contractor shall not respond to subpoenas, service of process, Public Records Act requests, and other legal requests directed at Contractor regarding this Contract without first notifying County, unless prohibited by law from providing such notification.

Contractor will provide its intended responses to County with adequate time for County to review, revise, and, if necessary, seek a protective order in a court of competent jurisdiction. Contractor shall not respond to legal requests directed at County unless authorized in writing to do so by County.

42. Counterparts: This Contract may be executed in multiple counterparts, each of which when executed and delivered shall be deemed an original, but all of which together shall constitute one and the same agreement. This Contract shall be deemed executed and binding upon the Parties when at least one counterpart bears the signature of each Party’s authorized signatory or signatories.

43. Cooperative Contract: This Contract is a cooperative contract and may be utilized by all County of Orange departments.

The provisions and pricing of this Contract will be extended to other governmental entities. Governmental entities wishing to use this Contract will be responsible for issuing their own purchase documents, providing for their own acceptance, and making any subsequent payments. Contractor shall be required to include in any subordinate contract entered into with another governmental entity pursuant to this Contract, a contract clause that will hold harmless the County of Orange from all claims, demands, actions or causes of actions of every kind resulting directly or indirectly, arising out of, or in any way connected with the use of this Contract. Failure to do so will be considered a material breach of this Contract and grounds for immediate Contract termination. Governmental entities are responsible for obtaining all certificates of insurance, endorsements and bonds required. The Parties agree that any other governmental entity utilizing this Contract shall not be deemed to be an agent or employee of County for any purpose whatsoever.

The Contractor is responsible for providing each governmental entity a copy of this Contract upon request. The County of Orange makes no guarantee of usage by other users of this Contract.

The Contractor shall be required to maintain a list of the County of Orange departments and governmental entities using this Contract. The list shall report dollar volumes spent annually and shall be provided on an annual basis to the County, at the County’s request.

Subordinate contracts must be executed prior to the expiration or earlier termination of this Contract and may survive the expiration of this Contract up to a maximum of one year.

44. Information Technology Confidentiality and Security Requirements:

All Contractors with access to County data and/or systems shall establish and maintain policies, procedures, and technical, physical, and administrative safeguards designed to (i) ensure the confidentiality, integrity, and availability of all County data and any other confidential 43 43 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 21 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
A. County of Orange Information Technology Security Standards: County of Orange security standards follows the latest National Institute of Standards and Technology (NIST) 800-53 framework to ensure the highest levels of operational resiliency and cybersecurity.

Contractor, Contractor personnel, Contractor’s subcontractors, any person performing work on behalf of Contractor, and all other agents and representatives of Contractor will, at all times, comply with and abide by all County of Orange Information Technology Security Standards (“Security Standards”), as existing or modified, that pertain to Contractor in connection with the Services performed by Contractor as set forth in the scope of work of this Contract. Any violations of such Security Standards shall, in addition to all other available rights and remedies available to County, be cause for immediate termination of this Contract. Such Security Standards include, but are not limited to, Attachment C - County of Orange Information Technology Security Standards and Attachment D - Business Associate Contract.

Contractor shall use industry best practices and methods with regard to confidentiality, integrity, availability, and the prevention, detection, response, and elimination of threat, by all appropriate means, of fraud, abuse, and other inappropriate or unauthorized access to County data and/or system(s) accessed in the performance of Services under this Contract.

B. The Contractor shall implement and maintain a written information security program that contains reasonable and appropriate security measures designed to safeguard the confidentiality, integrity, availability, and resiliency of County data and/or system(s). The Contractor shall review and update its information security program in accordance with contractual, legal, and regulatory requirements. Contractor shall provide to County a copy of the organization’s information security program and/or policies.

C. Information Access: Contractor shall use appropriate safeguards and security measures to ensure the confidentiality and security of all County data.

County may require all Contractor personnel, subcontractors, and affiliates approved by County to perform work under this Contract to execute a confidentiality and non-disclosure agreement concerning access protection and data security in the form provided by County.

County shall authorize, and Contractor shall issue, any necessary information-access mechanisms, including access IDs and passwords, and in no event shall Contractor permit any such mechanisms to be shared or used by other than the individual Contractor personnel, subcontractor, or affiliate to whom issued.

Contractor shall provide each Contractor personnel, subcontractors, or affiliates with only such level of access as is required for such individual to perform his or her assigned tasks and functions.
information that the Contractor receives, stores, maintains, processes, transmits, or otherwise accesses in connection with the provision of the contracted services, (ii) protect against any threats or hazards to the security or integrity of County data, systems, or other confidential information, (iii) protect against unauthorized access, use, or disclosure of personal or County confidential information, (iv) maintain reasonable procedures to prevent, detect, respond, and provide notification to the County regarding any internal or external security breaches, (v) ensure the return or appropriate disposal of personal information or other confidential information upon contract conclusion (or per retention standards set forth in the contract), and (vi) ensure that any subcontractor(s)/agent(s) that receives, stores, maintains, processes, transmits, or otherwise accesses County data and/or system(s) is in compliance with statements and the provisions of statements and services herein.
44 44 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 22 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
D. Data Security Requirements: Without limiting Contractor’s obligation of confidentiality as further described in this Contract, Contractor must establish, maintain, and enforce a data privacy program and an information and cyber security program, including safety, physical, and technical security and resiliency policies and procedures, that comply with the requirements set forth in this Contract and, to the extent such programs are consistent with and not less protective than the requirements set forth in this Contract and are at least equal to applicable best industry practices and standards (NIST 800-53).

Contractor also shall provide technical and organizational safeguards against accidental, unlawful, or unauthorized access or use, destruction, loss, alteration, disclosure, transfer, commingling, or processing of such information that ensure a level of security appropriate to the risks presented by the processing of County Data.

Contractor personnel and/or subcontractor personnel and affiliates approved by County to perform work under this Contract may use or disclose County personal and confidential information only as permitted in this Contract. Any other use or disclosure requires express approval in writing by the County of Orange. No Contractor personnel and/or subcontractor personnel or affiliate shall duplicate, disseminate, market, sell, or disclose County personal and confidential information except as allowed in this Contract. Contractor personnel and/or subcontractor personnel or affiliate who access, disclose, market, sell, or use County personal and confidential information in a manner or for a purpose not authorized by this Contract may be subject to civil and criminal sanctions contained in applicable federal and state statutes.

Contractor shall take all reasonable measures to secure and defend all locations, equipment, systems, and other materials and facilities employed in connection with the Services against hackers and others who may seek, without authorization, to disrupt, damage, modify, access, or otherwise use Contractor systems or the information found therein; and prevent County data from being commingled with or contaminated by the data of other customers or their users of the Services and unauthorized access to any of County data.

Throughout the Contract term, upon request from County but at least once each calendar year, Contractor shall provide County with an accurate, up-to-date list of those Contractor personnel and/or subcontractor personnel having access to County systems and/or County data, and the respective security level or clearance assigned to each such Contractor personnel and/or subcontractor personnel. County reserves the right to require the removal and replacement of Contractor personnel and/or subcontractor personnel at the County’s sole discretion. Removal and replacement shall be performed within 14 calendar days of notification by the County.

All County resources (including County systems), County data, County hardware, and County software used or accessed by Contractor: (a) shall be used and accessed by such Contractor and/or subcontractors personnel solely and exclusively in the performance of their assigned duties in connection with, and in furtherance of, the performance of Contractor’s obligations hereunder; and (b) shall not be used or accessed except as expressly permitted hereunder, or commercially exploited in any manner whatsoever, by Contractor or Contractor’s personnel and subcontractors, at any time.

Contractor acknowledges and agrees that any failure to comply with the provisions of this paragraph shall constitute a breach of this Contract and entitle County to deny or restrict the rights of such non-complying Contractor personnel and/or subcontractor personnel to access and use the County data and/or system(s), as County in its sole discretion shall deem appropriate.
45 45 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 23 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
E. Enhanced Security Measures: County may, in its discretion, designate certain areas, facilities, or solution systems as ones that require a higher level of security and access control. County shall notify Contractor in writing reasonably in advance of any such designation becoming effective. Any such notice shall set forth, in reasonable detail, the enhanced security or accesscontrol procedures, measures, or requirements that Contractor shall be required to implement and enforce, as well as the date on which such procedures and measures shall take effect.

Contractor shall and shall cause Contractor personnel and subcontractors to fully comply with and abide by all such enhanced security and access measures and procedures as of such date.

F. General Security Standards: Contractor will be solely responsible for the information technology infrastructure, including all computers, software, databases, electronic systems (including database management systems) and networks used by or for Contractor (“Contractor Systems”) to access County resources (including County systems), County data or otherwise in connection with the Services and shall prevent unauthorized access to County resources (including County systems) or County data through the Contractor Systems.

At all times during the contract term, Contractor shall maintain a level of security with regard to the Contractor Systems, that in all events is at least as secure as the levels of security that are common and prevalent in the industry and in accordance with industry best practices (NIST 800-53). Contractor shall maintain all appropriate administrative, physical, technical, and procedural safeguards to secure County data from data breach, protect County data and the Services from loss, corruption, unauthorized disclosure, and from hacks, and the introduction of viruses, disabling devices, malware, and other forms of malicious and inadvertent acts that can disrupt County’s access and use of County data and the Services.

G. Security Failures: Any failure by the Contractor to meet the requirements of this Contract with respect to the security of County data, including any related backup, disaster recovery, or other policies, practices or procedures, and any breach or violation by Contractor or its subcontractors or affiliates, or their employees or agents, of any of the foregoing, shall be deemed a material breach of this Contract and may result in termination and reimbursement to County of any fees prepaid by County prorated to the date of such termination. The remedy provided in this paragraph shall not be exclusive and is in addition to any other rights and remedies provided by law or under the Contract.

H. Security Breach Notification: In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, availability, confidentiality, and/or integrity of County data or the physical, technical, administrative, or organizational safeguards required under this Contract that relate to the security, availability, confidentiality, and/or integrity of County data, Contractor shall, at its own expense, (1) immediately (or within 24 hours of potential or suspected breach), notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence; (2) perform a root cause analysis of the actual, potential, or Contractor shall also continuously monitor its systems for potential areas where security could be breached. In no case shall the safeguards of Contractor’s data privacy and information and cyber security program be less stringent than the safeguards used by County. Without limiting any other audit rights of County, County shall have the right to review Contractor’s data privacy and information and cyber security program prior to commencement of Services and from time to time during the term of this Contract.

All data belongs to the County and shall be destroyed or returned at the end of the contract via digital wiping, degaussing, or physical shredding as directed by County. 46 46 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 24 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
Notification shall be sent to:

Rafael Linares
Chief Information Security Officer
1055 N. Main St., 6th Floor
Santa Ana, CA 92701
Phone: (714) 567-7611
[email protected]
Linda Le, CHPC, CHC, CHP
County Privacy Officer
1055 N. Main St., 6th Floor
Santa Ana, CA 92701
Phone: (714) 834-4082
[email protected]
I. Security Audits: Contractor shall maintain complete and accurate records relating to its system and Organization Controls (SOC) Type II audits or equivalent’s data protection practices, internal and external audits, and the security of any of County-hosted content, including any confidentiality, integrity, and availability operations (data hosting, backup, disaster recovery, external dependencies management, vulnerability testing, penetration testing, patching, or other related policies, practices, standards, or procedures).

Contractor shall inform County of any internal/external security audit or assessment performed on Contractor’s operations, information and cyber security program, disaster recovery plan, and prevention, detection, or response protocols that are related to hosted County content, within sixty (60) calendar days of such audit or assessment. Contractor will provide a copy of the audit report to County within thirty (30) days after Contractor’s receipt of request for such report(s).
suspected breach; (3) provide a remediation plan that is acceptable to County within 30 days of verified breach, to address the occurrence of the breach and prevent any further incidents; (4) conduct a forensic investigation to determine what systems, data, and information have been affected by such event; and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, forensics, investigative evidence, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County).

County shall make the final decision on notifying County officials, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required.

Contractor shall reimburse County for all notification and related costs incurred by County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications.

In the case of a breach, Contractor shall provide third-party credit and identity monitoring services to each of the affected individuals for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following the date of notification to such individuals.

Contractor shall indemnify, defend with counsel approved in writing by County, and hold County and County Indemnitees harmless from and against any and all claims, including reasonable attorney’s fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from County in connection with the occurrence.
47 47 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 25 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
J. Business Continuity and Disaster Recovery (BCDR):

For the purposes of this section, “Recovery Point Objectives” means the maximum age of files (data and system configurations) that must be recovered from backup storage for normal operations to resume if a computer, system, or network goes down as a result of a hardware, program, or communications failure (establishing the data backup schedule and strategy). “Recovery Time Objectives” means the maximum duration of time and a service level within which a business process must be restored after a disaster (or disruption) in order to avoid unacceptable consequences associated with a loss of functionality.

The Contractor shall maintain an comprehensive risk management program focused on managing risks to County operations and data, including mitigation of the likelihood and impact of an adverse event occurring that would negatively affect contracted services and operations of the County. Business continuity management will enable the Contractor to identify and minimize disruptive risks and restore and recover hosted County businesscritical services and/or data within the agreed terms following an adverse event or other major business disruptions. Recovery and timeframes may be impacted when events or disruptions are related to dependencies on third parties. The County and Contractor will agree on Recovery Point Objectives and Recovery Time Objectives (as needed)) and will periodically review these objectives. Any disruption to services of system will be communicated to the County within 4 hours, and every effort shall be undertaken to restore contracted services, data, operations, security, and functionality.

All data and/or systems and technology provided by the Contractor internally and through third-party vendors shall have resiliency and redundancy capabilities to achieve high availability and data recoverability. Contractor Systems shall be designed, where practical and possible, to ensure continuity of service(s) in the event of a disruption or outage [Remainder of this page intentionally left blank]
Contractor shall reasonably cooperate with all County security reviews and testing, including but not limited to penetration testing of any cloud-based solution provided by Contractor to County under this Contract. Contractor shall implement any required safeguards as identified by County or by any audit of Contractor’s data privacy and information/cyber security program.

In addition, County has the right to review Plans of Actions and Milestones (POA&M) for any outstanding items identified by the SOC 2 Type II report requiring remediation as it pertains to the confidentiality, integrity, and availability of County data. County reserves the right, at its sole discretion, to immediately terminate this Contract or a part thereof without limitation and without liability to County if County reasonably determines Contractor fails or has failed to meet its obligations under this section. 48 48 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 26 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

CONTRACT SIGNATURE PAGE
IN WITNESS WHEREOF, the Parties hereto have executed this Contract RCA-017-23010029 on the date set forth opposite their signature(s).

Contractor shall provide two signatures as follows:
1) The first signature must be either the Chairman of the Board, President, or any Vice President; 2) The second signature must be that of the Secretary, an Assistant Secretary, the Chief Financial Officer, or any Assistant Treasurer.

In the alternative, a single corporate signature is acceptable when accompanied by a corporate resolution or by-laws demonstrating the legal authority of the signature to bind the company.

Tevora Business Solutions, Inc.

Signature # 1
Print Name Title
Signature Date
Signature # 2
Print Name Title
Signature Date
County of Orange, a political subdivision of the State of California Deputy Purchasing Agent Authorized Signature:

Timothy Shears, DPA Deputy Purchasing Agent
Print Name Title
Signature Date
EVP of Sales
12/14/2022
12/14/2022
Nazy Fouladirad CFO
Steve Stumpfl
Dec 27, 2022
49 49 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 27 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

ATTACHMENT A

SCOPE OF WORK
I. Introduction
The County of Orange (County) is establishing this Regional Cooperative Agreement (RCA) for the provision of Cybersecurity Assessment and Audit Services on an as-needed basis. RCAs awarded by the County of Orange are intended to be used as cooperative agreements against which individual subordinate contracts may be executed by participating County agencies/departments and non-County public entities, during the term of the RCA. Subordinate contracts issued under the contemplated RCA shall incorporate all of the RCA terms, conditions, and pricing.

County agencies/departments and non-County public entities may utilize the RCA by contracting directly with the Contractor using a subordinate contract. All subordinate contracts executed against this RCA shall include a project specific, detailed Scope of Work and shall incorporate by reference the terms and conditions of the RCA.

II. Contractor’s Requirements
Cybersecurity Assessment Contractor Requirements:

Contractor shall:

1. Conduct requested cyber security assessments and cyber security gap analysis and prepare written reports of findings (infrastructure security assessments). The written report component of all infrastructure security assessments shall include specific recommended actions to accomplish short and long-term remediation of the County’s cyber security infrastructure, processes and procedures, and specifically identify steps necessary to bring any such infrastructure, processes and procedures into compliance with applicable state and federal regulations.

2. Comply with all applicable state and federal regulations as they now exist or may hereafter be modified, changed, or amended during the Term of this Contract, regarding data confidentiality, including, but not limited to, the information security requirements of the following:
a. Title 42, USC § 290dd–2
b. Title 42, CFR Part2
c. Title 42, CFR Part 96, § 96.132(e)
d. Title 42, USC §§ 1320d through 1320d-8
e. Title 42, CFR §§ 431.300 et. seq.
f. Title 45, CFR Parts 160, 162, and 164 – the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act (the Final Omnibus Rule)
g. Title 45, CFR §§ 205.50 et. seq
h. Welfare and Institutional code, § 14100.2, which is specific to Medi-Cal i. HSC §§ 11812 and 11845.5
j. HSC §§ 123110 through 123149.5 – Patient Access to Health Records k. Title 22, CCR § 51009, which is specific to Medi-Cal l. Civil Code §§ 56 through 56.37 – Confidentiality of Medical Information Act m. Civil Code §§ 1798.80 through 1798.82 – Customer Records (breach of security) 50 50 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 28 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
n. Civil Code § 1798.85 – Confidentiality of Social Security Number o. The American Recovery and Reinvestment Act of 2009 (ARRA) Electronic Health Records (EHR) Incentive Program – Meaningful Use
p. U.S. Department of Justice Federal Bureau of Investigation Criminal Justice Information Services (CJIS) Security Policy
q. Payment Card Industry (PCI) Data Security Standard (DSS) r. Department of Motor Vehicles (DMV) – Information Security Agreement (ISA) s. The Social Security Administration (SSA) (Computer Matching and Privacy Protection Act Agreement, Information Exchange Agreement and Electronic Information Exchange Security Requirements and Procedures for State and Local Agencies Exchanging Electronic Information) t. The Department of Homeland Security, United States Citizenship and Immigration Services (DHS-USCIS) Computing Matching Agreement
u. The Internal Revenue Service (IRS) Publication 1075 Tax Information Security Guidelines

3. The Parties understand and agree that the methodologies used for the performance and preparation of the IT Infrastructure Security Assessments shall include a combination of hardware and software tools, utilities, and will be performed in accordance with industry best practices. Therefore, the tests listed herein are a sub-set of all the activities expected in order to properly identify and resolve potential points of security failure in the following areas:
a. Architectural design,
b. Infrastructure,
c. Software application,
d. Authentication,
e. Maintenance process,
f. Process,
g. Procedures, or
h. Other factors that would impact solution security and/or “Fit-for-Use” of the intended business application.

All testing and data shall be encrypted based on a testing plan developed/approved by the County for each SAE.

III. Cybersecurity Assessment Services
A. HIPAA Audit Services

1. Conduct a thorough analysis of the current standing of County business practices in relation to the HIPAA Privacy Rule and the HIPAA Security Rule. This will include current County operations and policy status as compared to HIPAA Privacy and Security Rule standard (45 CFR §164.308, 164.310, 164.312, 164.314, 164.316) and specific remediation steps to correct potential violations. The Analysis will include all HIPAA connected offices and departments, related administrative policies and procedures, physical facility and office conditions, and information technologies in use by County.

2. Compare HIPAA Privacy and Security regulations with all California state security and confidentiality statutes and identify which state statutes are more restrictive than the federal law.

3. Conduct onsite visits of all involved agencies in order to evaluate physical structures to 51 51 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 29 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

4. Interview selected management and staff members regarding common privacy and security related practices within agencies and between agencies to include, but not be limited to, disposal, storage, and encryption practices or procedures.

5. Identify all information systems and communication networks that store, maintain, or transmit electronically-stored Protected Health Information (“ePHI”) and determine compliance with HIPAA Privacy and Security regulations or other state privacy and security statutes.

6. Evaluate the potential risks, including all associated potential financial costs (inclusive of, but not limited to, notifying the public of release of Protected Health Information (“PHI”) and other financial exposure), associated with how the different agencies collect, use, manage, house, disclose and dispose of information and evaluate options or changes to current practices in order to meet HIPAA Privacy and Security regulations or other state privacy and security statutes. Evaluate risks related to management, investigation and remediation of privacy and security breaches.

7. Analyze the current County physical and electronic PHI-handling and monitoring practices against the requirements of HIPAA Privacy and Security regulations and identify areas of noncompliance.

8. Review County procedures for release, disclosure and recording of health information for compliance with each of the following HIPAA Privacy and Security standards:
a. 164.308 Administrative Safeguards
b. 164.310 Physical Safeguards
c. 164.312 Technical Safeguards
d. 164.502(b) Standard: Minimum Use and Disclosure of PHI e. 164.530(a) Standard: Personnel Designations
f. 164.530(b) Standard: Training
g. 164.530(c) Standard: Safeguards
h. 164.530(d) Standard: Complaints to the Covered Entity i. 164.530(e) Standard: Sanctions
j. 164.530(f) Standard: Mitigation
k. 164.530(g) Standard: Refraining from Intimidating and Retaliatory Acts l. 164.530(h) Standard: Waiver Rights
m. 164.530(i) Standard: Policies and Procedures
n. 164.530(j) Standard: Documentation

9. Review the County HIPAA Breach incident reporting and response practices, procedures and policies for sufficiency.

10. Review a sampling of County Contracts, Master Agreements, Memoranda of Understanding, Service Agreements, and other organizational relationships for HIPAA Privacy and Security compliance.

11. Review County HIPAA Privacy and Security training modules currently used by the agencies to determine if there are gaps between training content and HIPAA Privacy and Security standards or state privacy and security statutes. Evaluate training module to determine appropriate changes to improve training efficacy. Identify training requirements for staff, management, and executive levels to include determination if some training should be procured externally for specific programs and services.

12. Review County Human Resource Services policies, procedures and practices for HIPAA Privacy and Security compliance, including the review of all HIPAA-related agreements for new hires (County employees, Contracted employees, temporary employees, volunteers, etc.), the sufficiency of the HIPAA Privacy and Security Officers’ job descriptions and job determine if building or space modifications are required to comply with HIPAA Privacy and Security regulations or other state privacy and security statutes. 52 52 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 30 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

13. Describe in detail the analysis process to be followed for each division/program including a work plan documenting tasks to be accomplished, timeframes and the responsible Party.

14. Commence requested HIPAA Audit within fifteen (15) calendar days of Contract award and complete the analysis within one hundred twenty (120) calendar days of Contract award.

Submit to County a comprehensive report detailing the findings of the audit, due within fifteen (15) calendar days of completing the field analysis (timeframe for completion to be negotiated).

15. Suggest specific short and long-term projects and remediation for each individual audited agency, including a tentative timeframe and budget, for the correction of identified discrepancies in HIPAA Privacy and Security compliance.

16. Provide written verification of all residence status and signed non-disclosure agreements for all staff to provide services under this Contract. Contractor’s staff shall be knowledgeable of all required software and scanning tools.

17. Not change the project staff during the duration of any engagement unless approved by the County in writing.

18. Supply all of its own hardware, software, media and materials required to complete a project under this Contract. Contractor shall provide evidence of ownership of any software used during the engagement and certify that any software installed has been removed prior to the close-out meeting with the County.

B. Payment Card Industry Data Security Standard (PCI DSS) The PCI DSS is payment card network (Visa, Mastercard, Discover, and American Express) and industry-mandated requirements for handling of credit card information, classification of merchants, and validation of merchant compliance. Merchants are responsible for the security of cardholder data. They must be careful not to store certain types of data on their systems or the systems of their third-party service providers. Merchants are also responsible for any damages or liability resulting from a data security breach or other non-compliance with the PCI DSS. The PCI DSS encompasses all merchants and third-party service providers that store, process, or transmit cardholder data.

Contractor shall:

1. Hold certifications to validate merchant compliance with PCI DSS (Qualified Security Assessor) and perform vulnerability scanning (Approved Scanning Vendor).

2. Provide services to ensure the security, confidentiality, and integrity of payment transactions and cardholder information.

3. Provide services to ensure the periodic review to identify new and emerging threats and vulnerabilities.

4. Provide services to take appropriate measures to remediate and remove emerging and existing threats and vulnerabilities.

5. Provide services to achieve compliance with the PCI DSS, including, but not limited to, network scans, penetration tests, self-assessment questionnaires, attestations of compliance, and compliance reports.

C. Policies & Procedures Review and Development
Contractor Shall:

1. Prepare Procedures for the County

2. Address how PII and PHI shall be controlled by setting forth what uses and disclosures are authorized or required including what rights patients have with respect to their health information.

3. Be structured to have countywide applicability, provided, however, that agency-specific assessments, employee disciplinary process and the protocol for addressing breach-related infractions.
53 53 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 31 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
policies and procedures shall be developed as deemed necessary.

4. Conduct a review of Cyber Security Awareness Training Contractor shall:

1. Review mandated Cyber Security Awareness training programs for all County staff and, if necessary, develop necessary enhancements and/or a training plan (timeframe for completion to be negotiated). The training plan shall include:
a. All federally mandated Privacy and Security and state privacy and security requirements, respectively.
b. A plan to validate the effectiveness of training programs. c. List, in order of importance, the topics to be included in the training programs.

2. Develop a training plan which includes all federally mandated Privacy and Security and state privacy and security requirements, respectively.

3. Develop a plan to validate the effectiveness of training programs.

4. List, in order of importance, the topics to be included in the training programs.

5. Describe what Contractor considers effective communication and training techniques to maximize the effectiveness of training programs.

6. Describe how the Contractor would incorporate agency specific information into this training D. On-Site Validation of Physical Security Controls:

1. Assessment: Federal and State regulations requires compliance with Safeguards to protect the confidentiality, integrity, and availability of Personal Identifiable Information (PII) and Protected Health Information (PHI). Contractor shall assess the state of County compliance with the following areas:
a. Administrative Safeguards
b. Physical Safeguards
c. Technical Safeguards
d. Organizational Requirements

2. Reporting: A compliance report shall be issued which includes an assessment of County’s compliance with the regulations, along with risk rated prioritization of recommendations for remediation of any identified compliance gaps.

E. Security Risk Analysis

1. Contractor shall perform a risk assessment of the PII and PHI held by the County. The assessment will include the following stages:
a. Asset Identification: Work with Contractor(s) personnel to identify each asset where PHI is either stored or transmitted.
b. Threat Identification: Facilitate a review with Contractor to identify the types of threats that may affect the identified assets.
c. Vulnerability Identification: Facilitate a review with Contractor to identify any known or likely vulnerabilities to the identified assets.
d. Inherent risk: Based on the above details, Contractor will facilitate a risk assessment of the inherent risk to PHI in the identified assets.
e. Controls identification: Identify any existing controls that may reduce the inherent risk for these assets.
f. Gaps identified: Based on the threats, vulnerabilities, and controls identified, and using 54 54 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 32 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
the assessors’ judgment, what are the current gaps?
g. Residual risk: Reevaluate the risk of to the asset based on the existing controls. h. Recommended remediation: Based on the residual risks, a list of recommended controls will be recommended for consideration.

2. Contactor shall deliver a risk assessment report that will include the results from each portion of the assessment, the final risk profile, and potential solutions.

F. Penetration Testing

1. Internal Penetration Test:

Taking a vulnerability assessment beyond a simple “check the box” approach, Contractor should use an attacker mindset to increase the effectiveness and findings of the internal assessment. In this case, the assessment is specifically targeting network. Infrastructure and segmentation, end-user workstations, and exfiltration techniques. Contractor must use a realistic perspective of the effectiveness of the defensive mechanisms currently in place at preventing and detecting an attacker. In general terms, exploitations techniques are listed below.
a. Internal network reconnaissance
b. System fingerprinting
c. Server and workstation configuration flaws
d. Privilege escalation
e. Vulnerability exploitation
f. Password policy requirements
g. Database vulnerability scanning
h. Firewall and ACL testing
i. Protocol poisoning
j. Egress testing
k. Website filtering
l. Insider threat analysis

2. External Penetration Testing
Included in the scope of this security assessment, is an external network penetration test.

Contractor(s) security methodology should include more than a simple IP range scan testing of a variety of vulnerabilities. Going beyond the surface, Contractor(s) security professionals should apply advanced attacker tactics and techniques targeting the external infrastructure including routers, servers, VPNs, firewalls, and any other external services. However, in contrast with the external penetration test, the external vulnerability assessment focuses more on vulnerability discovery and remediation than exploitation and impact identification. Attacks that may be included in the external penetration test are listed below. a. System Fingerprinting
b. Services Probing
c. Analysis and Identification of Attack Vectors (including social engineering) d. Exploit Testing
e. Authentication Attacks
55 55 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 33 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
f. Vulnerability Exploitation
g. Privilege Escalation
h. Exploitation of Configuration Flaws
The scope of the external network vulnerability assessment will include external IP addresses maintained by County. Prior to the assessment beginning, County will provide Contractor Security with the list of IP addresses to be included in the assessment.

3. Social Engineering
Social engineering penetration testing may consist of, but not limited to, common scams to test employees' adherence to the security policies and practices or various types of phishing attempts for the purpose of determining the organization's level of vulnerability to this type of exploit and the effectiveness of the organization’s cyber security awareness training.

4. Project Report
Upon completion of the penetration test, Contractor will provide a report to County within fourteen (14) days of completion. The report will contain documented and detailed findings as a result of performing the services contained and outlined.

G. One-time compromise testing
Similar to penetration testing, the goal of this service is to evaluate information technology infrastructure, systems and services as well as employee workspace for the presence of attacker activity. The purpose of this assessment is to identify or confirm security breaches that currently or may have existed for extended periods of time resulting in the theft of valuable intellectual property, personally identifiable information, protected health information, payment card information, or other sensitive information.

H. Cyber Incident Response Remediation
Incident response is an organized approach to addressing and managing the aftermath of a security breach or attack (also known as an incident). The goal is to handle the situation in a way that limits damage and reduces recovery time and costs to the organization.

I. DHS Cyber Resilience Review (CRR)
Contractor shall provide services to perform and facilitate for the completion of the DHS CRR assessment. In addition, the County has a GRC platform where the completed assessment and final report should be submitted by the vendor.

The CRR is an interview-based assessment of an organization’s cybersecurity management program. It seeks to understand the cybersecurity management of services, and their associated assets, that are critical for an organization’s mission success. The CRR focuses on protection and sustainment practices within key areas that typically contribute to the overall cyber resilience of an organization. The CRR measures essential cybersecurity capabilities and behaviors to provide meaningful indicators of an organization’s operational resilience during normal operations and during times of operational stress.

The CRR is derived from the CERT Resilience Management Model (CERT-RMM), a process improvement model developed by Carnegie Mellon University’s Software Engineering Institute for managing operational resilience. The CRR is based on the premise that an organization deploys its assets (people, information, technology, and facilities) to support specific critical services or products. Based on this principle, the CRR evaluates the maturity of your organization’s capacities and capabilities in performing, planning, managing, measuring and defining cybersecurity capabilities across 10 domains.
https://www.cisa.gov/uscert/resources/assessments
56 56 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 34 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
IV. Deliverables
A. IT infrastructure Security Assessment Engagements (SAE) These engagements shall include the following components as described below:

1. Host Review – Contractor shall scan, automatically and manually, for any and all potential vulnerabilities in the host-based components of the specific IT infrastructure. Targeted systems may include, but are not limited to, servers, workstations, routers and firewalls. The Contractor shall look for missing patches, misconfigurations, un-patched or enabled services, inappropriate user accounts and other related problems on the target hosts. The Contractor shall provide recommendations for remediation of all vulnerabilities discovered. Both vulnerabilities and recommendations shall be provided to the County electronically, in an Excel 2016 or later file format.

2. Network Architecture – Contractor shall look for vulnerabilities at various layers of the target environment and test for flaws in the targeted environment including, but not limited to, network connectivity (including wireless) and router and firewall designs to control network access between the target servers and the rest of the County IT infrastructure. The Contractor will determine if the architecture and implementation protections are appropriate for the specified servers and at the right network layer, to secure the servers from potential types of attacks from other parts of the network and/or the Internet.

3. Enterprise Architecture Review – Contractor shall review (via documentation, interviews and testing) the system’s appropriateness for the specific purpose identified by the County and provide a security architectural assessment documenting key assumptions and impacts, including, but not limited to, security model, host access, system controls, authentication, administration, maintenance, business resiliency and continuity.

Enterprise Architecture Review activities shall include, but not be limited to, the following automatic and manual tasks:
a. Architectural review of the infrastructure for best practices and security weakness. b. Network topology review and device scanning for identification and mapping. c. Host review of all hardware/software configurations settings, patches, versions, etc. d. Host scan for all known applications, services, code engine and database vulnerabilities. e. Identify all known sever and application administration flaws. f. Review intended data flows between web, applications, databases and other systems. g. Test County’s infrastructure for: Social Engineering weaknesses, wireless capabilities, etc. h. Review settings for account authentication, authorization and audit controls. i. Identify areas where regulatory compliance might not exist or be at risk. j. Identify opportunities to write to the host file system or execute uploaded files. k. Identify inappropriate files, debugging information, developer accounts, etc. l. Review if fraudulent transactions across architectural separation can be performed. m. Review Operational Procedures documentation for the specific tested solution. n. Review for IT Solution weakness or non-best practices for this intended purpose. o. Certification of the specific tested solution as “Secure Fit-for-Use.” B. Software Application Security Assessments
57 57 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 35 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
These engagements shall involve the four (4) service areas identified below:

1. Application Architecture Review – Contractor shall review the software to assess security weaknesses that occur as a result of the design, use of coding techniques, use of tiers for different service layers, web services, thick client modules, etc.

2. Database Security Review – Contractor shall review the database usage and design as part of this assessment. The data classification for the data fields is a key part of assessing the security of the database, as well as, authentication, authorization, access controls and a nonexhaustive list of characteristics listed in the Compensation, Pricing and Payment schedule in Attachment B – Compensation, Pricing and Payment.

3. Web Application Penetration Test – Contractor shall attempt to breach the web site and web pages contained within the County’s web application solution. The County will also provide at least two sets of credentials, which the Contractor shall use to try to escalate their rights/access to the web site. As part of this test, the Contractor shall document all potential weaknesses discovered.

4. Application Code Review – Contractor shall complete detailed application design discussions with actual developers and/or support engineers responsible for; coding, technical support, network and databases in order to build a threat model that exposes the vulnerabilities of the application. This model shall be analyzed and recommendations shall be provided to allow remediation. Since the Contractor is a security expert, they shall also provide a statement as to the fit-for-use of this application for the County’s business application or solution.

C. Policies and Procedures Review and Development

1. Policies & Procedures Review

2. Physical Security Review

3. Training

4. Social Engineering Assessment

5. Organizational Cultural Review
V. Reporting Requirements
All reporting requirements shall be handled as Confidential Information and provided over secured medium ONLY to the County’s Designated Representative.

A. Daily Progress Updates:
• Contractor shall provide written daily progress updates of the engagement to the County’s Designated Representative.
• Immediately report to County’s Designated Representative any issues detected that require urgent attention and mediation.
• Report shall indicate “there was no activity today” if applicable. • Report to include details for preliminary findings, potential and or identified issues (security, schedule, risk, etc.) and recommendations for remediation. • Contractor shall arrange a meeting with the County’s Designated Representative to review any critical findings which might impact the assessment and/or remediation schedule.

B. Findings and Recommendations
• For each SAE and upon request, Contractor shall provide the County’s Designated Representative a daily, weekly, or periodic report of Findings and Recommendations. 58 58 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 36 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
• Contractor shall report findings and recommendations in accordance with compliance laws and regulations listed above.
• Contractor shall destroy the report(s) at the direction of the County’s Designated Representative.
• Contractor shall not distribute the report(s) to any other persons other than the Contractor’s Representative. General support staff of the Parties is not to receive the report nor the findings of the report even if the general staff was involved in some portion of the SAE. • Prepare and deliver on request an executive level summary of findings and recommendations.

C. Activity Log
• For each SAE or the execution of a subordinate contract executed by participating County departments, Contractor shall provide an activity log at the beginning of each engagement. • Contractor shall provide certification of remediation performed by the County. Certification shall be provided the following week after the County performs any required remediation.

D. Close-Out
• Contractor shall provide working draft Close-Out reports during and at the end of each engagement or at other times as requested by the County’s Designated Representative. • The Close-Out reports shall consist of the following:
i. Executive overview highlighting the scope, approach, and final Security Certification statement;
ii. Technical summary highlighting the risk rating for major findings and remediation by area; iii. Detailed technical section which includes the business or technical risk for each vulnerability finding with remediation and how to eliminate or reduce the risk; and iv. Electronic spreadsheet of findings with columns for risk, ranking, type, impacted systems, risk (H-M-L), recommended action, actual resolution.
v. Grading report and/or standing with compliance to the laws and regulations listed above.

End of Attachment A
59 59 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 37 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

ATTACHMENT B

COMPENSATION, PRICING AND PAYMENT
A. Compensation: Contractor agrees to provide services at the fixed rates and prices, and agrees to accept the specified compensation as set forth in this Contract as full remuneration for (a) providing all Services and furnishing all staffing and materials required under this Contract, (b) any reasonably unforeseen difficulties which may arise or be encountered in the performance of the Services until acceptance, (c) risks connected with the Services, and (d) performance by Contractor of all its duties and obligations required herein as they now exist or may hereafter be amended.

Except for the payment of its fees, neither Contractor nor Contractor’s agents, employees, or subcontractors, are entitled to any damages from County, nor is any Party entitled to be reimbursed by County, for damages, charges, or other losses or expenses incurred by Contractor by reason of delays or hindrances in the performance of the Services, whether or not caused by County.

B. Pricing: Contractor shall bill County for goods provided and services rendered according to the rates listed in Section F, “Pricing” below.

C. Price Increase/Decreases: No price increases will be permitted during the first period of the Contract. The County requires documented proof of cost increases on Contracts prior to any price adjustment. A minimum of 30-days advance notice in writing is required to secure such adjustment. No retroactive price adjustments will be considered.

All price decreases will automatically be extended to the County. The County may enforce, negotiate, or cancel escalating price Contracts or take any other action it deems appropriate, as it sees fit. The net dollar amount of profit will remain firm during the period of the Contract. Adjustments increasing the Contractor’s profit will not be allowed.

D. Payments and Invoicing:

Contractor shall reference Contract number on invoice. Payment will be in arrears and net forty-five (45) days after receipt of an invoice in a format acceptable to County and verified and approved by County and subject to routine processing requirements. The responsibility for providing an acceptable invoice rests with Contractor.

Billing shall cover services and/or goods not previously invoiced. Contractor shall reimburse County for any monies paid to Contractor for goods or services not provided or when goods or services do not meet Contract requirements.

Payments made by County shall not preclude the right of County from thereafter disputing any items or services involved or billed under this Contract and shall not be construed as acceptance of any part of the goods or services.

Contractor will provide an invoice on Contractor’s letterhead for services rendered. Each invoice will have a number and will include the following information:

1. Contractor’s remittance address 5. Service Description

2. Name of County agency department 6. Contractor’s Federal Taxpayer Identification Number

3. County Subordinate Contract number 7. Total Invoice Amount

4. Service date(s)
E. Payment (Electronic Funds Transfer): County offers Contractor the option of receiving payment directly to its bank account via an Electronic Fund Transfer (EFT) process in lieu of a check payment. Payment made via EFT shall also receive an Electronic Remittance Advice with the payment details via e-mail. An e-mail address shall need to be provided to County via an EFT Authorization Form. Contractor may request a form from the agency/department representative listed in the Contract. 60 60 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 38 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
F. Pricing:

DESCRIPTION
1 HIPAA Risk Assessment
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

1.1 Small

1.5 Weeks $20,250.00 $20,958.00
Number of systems and network devices: 1 to 50
Number of personnel to interview: 1 to 5
Number of business associates that have access to
ePhi: 1 to 5

1.2 Medium
2 Weeks $27,000.00 $27,945.00
Number of systems and network devices: 51-100
Number of personnel to interview: 5-10
Number of business associates that have access to
ePhi: 5-10

1.3 Large
3 Weeks $40,500.00 $41,917.00
Number of systems and network devices: 101-200
Number of personnel to interview: 11-30
Number of business associates that have access to
ePhi: 11-20
2 PCI Gap Analysis
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

2.1 Small
1 Week $13,500.00 $13,972.00
Locations: Up to 2
DR Facilities: Up to 2
Employees to Interview: Up to 15
Number of Servers: Up to 1,000
Number of Workstations: Up to 500
Number of services included in-scope: Up to 2
61 61 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 39 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

2.2 Medium

1.5 Weeks $20,250.00 $20,958.00
Locations: Up to 3
DR Facilities: Up to 2
Employees to Interview: Up to 20
Number of Servers: Up to 2,000
Number of Workstations: Up to 1,000
Number of services included in-scope: Up to 3

2.3 Large
2-3 Weeks $30,750.00 $31,826.00
Locations: Up to 5
DR Facilities: Up to 2
Employees to Interview: Up to 25
Number of Servers: Up to 3,000
Number of Workstations: Up to 1,500
Number of services included in-scope: Up to 4
3 Level One PCI Assessment
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

3.1 Small
2 Weeks $27,000.00 $27,945.00
Locations: Up to 2
DR Facilities: Up to 2
Employees to Interview: Up to 15
Number of Servers: Up to 1,000
Number of Workstations: Up to 500
Number of services included in-scope: Up to 2

3.2 Medium
3 Weeks $40,500.00 $41,917.00
Locations: Up to 3
DR Facilities: Up to 2
Employees to Interview: Up to 20
Number of Servers: Up to 2,000
Number of Workstations: Up to 1,000
Number of services included in-scope: Up to 3
62 62 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 40 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

3.3 Large
4-4.5 Weeks $54,000.00 $55,890.00
Locations: Up to 5
DR Facilities: Up to 2
Employees to Interview: Up to 25
Number of Servers: Up to 3,000
Number of Workstations: Up to 1,500
Number of services included in-scope: Up to 4
4 PCI Policy and Procedure Creation
Service Level (customized policies) Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

4.1 Small
1 Week $13,500.00 $13,972.00
1-5 policies

4.2 Medium
2 Weeks $27,000.00 $27,945.00
6-10 policies

4.3 Large 3 Weeks $40,500.00 $41,917.00 11 to 15 policies 5 PCI Policy and Procedure Templates
Service Level (template policies) Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

5.1 Small
2 Days $5,400.00 $5,589.00
1-10 policies

5.2 Medium
4 Days $10,800.00 $11,178.00
11-15 policies

5.3 Large 6 Days $16,200.00 $16,767.00 16 to 20 policies 6 DHS Cyber Resilience Procedure Review
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

6.1 Normal
2-3 Weeks $33,750.00 $34,931.00 Includes interviews with county department personnel only

6.2 Add-On
2-3 Days $5,400.00 $5,589.00 Include one third party in interview process 7 Policy and Procedure Review and Development Services
Service Level (customized policies for any
requirements) Timeline CostYears 1 - 3
Cost
Years 4 - 5

7.1 Small
2 Weeks $27,000.00 $27,945.00
1 to 10 policies

7.2 Medium
3 Weeks $40,500.00 $41,917.00
11 to 15 policies
63 63 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 41 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

7.3 Large

3.5-4 Weeks $47,250.00 $48,903.00 16 to 20 policies
8 On-Site Validation of Physical Security Controls
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

8.1 Normal
2-3 Days $5,400.00 $5,589.00
One department, one location

8.2 Add-On Additional location 1 Day $2,700.00 $2,794.00 9 Security Risk Analysis Services
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

9.1 Small

1.5 Weeks $20,250.00 $20,958.00
Number of workstations: Up to 250
Number of systems and network devices: Up to 100
Number of personnel to interview: Up to 15 Number of
core applications in scope: Up to 2

9.2 Medium
3 Weeks $40,500.00 $41,917.00
Number of workstations: 251-1000
Number of systems and network devices: Up to 400
Number of personnel to interview: Up to 20
Number of core applications in scope: Up to 3

9.3 Large
4-5 Weeks $60,750.00 $60,876.00
Number of workstations: over 1000
Number of systems and network devices: Up to 5,000
Number of personnel to interview: Up to 30
Number of core applications in scope: Up to 8
10 Vulnerability Assessment
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

10.1 Small

1.5 Weeks $20,250.00 $20,958.00
Number of devices: 1-1000

10.2 Medium

2.5 Weeks $33,750.00 $34,931.00 Number of devices: 1001-2000

10.3 Large 3.5 Weeks $47,250.00 $48,903.00 Number of devices: 2,001-5,000

10.4 Add-On Remediation Validation 1 Day $2,700.00 $2,794.00 11 External Penetration Testing
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

11.1 Small
1 Week $13,500.00 $13,972.00
1-50 devices

11.2 Medium
2 Weeks $27,000.00 $27,945.00
51-150 devices

11.3 Large 3 Weeks $40,500.00 $41,917.00
151-500 devices
64 64 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 42 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
11 External Penetration Testing
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

11.4 Add-On Remediation Validation 1 Day $2,700.00 $2,794.00 12 Social Engineering Penetration Test
Service Level (phone or email testing) Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

12.1 Phone Testing Small 1-5 targets 3 Days $8,100.00 $8,359.00

12.2 Phone Testing Medium 6-12 targets 1 Week $13,500.00 $13,972.00

12.3 Phone Testing Large 13-50 targets 2 Weeks $27,000.00 $27,945.00

12.4 Email Testing Small 1-25 targets 3 Days $8,100.00 $8,359.00

12.5 Email Testing Medium 26-100 targets 1 Week $13,500.00 $13,972.00

12.6 Email Testing Large 101-1000 targets 1.5 Weeks $20,250.00 $20,958.00 13 One Time Compromise Testing Services
Service Level Estimated
Timeline*
Per Hour
Years 1 - 3
Per Hour
Years 4 - 5

13.1 Small
40 Hours $350.00 $362.00
1-2 devices

13.2 Medium
80 Hours $350.00 $362.00
3-10 devices

13.3 Large
120 Hours $350.00 $360.00
11-25 devices
14 Incident Response Readiness Assessment
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

14.1 Small

2.5 Weeks $33,750.00 $34,931.00 Readiness Assessment Report

14.2 Medium

3.5 Weeks $47,250.00 $48,903.00 Readiness Assessment Report Incident Response Plan

14.3 Large
Readiness Assessment Report Incident Response Plan 4.5 Weeks $60,750.00 $62,876.00 Five (5) Runbooks
15 Incident Response Support Hours
Service Level Per Hour
Years 1 - 3
Per Hour
Years 4 - 5

15.1 With Completed Readiness Assessment $400.00 $414.00

15.2 Without Completed Readiness Assessment $450.00 $465.00 16 Network Security Assessment
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

16.1 Small
1 Weeks $13,500.00 $13,972.00
1-50 devices

16.2 Medium
2 Weeks $27,000.00 $27,945.00
51-200 devices
65 65 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 43 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

16.3 Large 3 Weeks $40,500.00 $41,917.00
201-1000 devices
17 Software Application Security Assessment
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

17.1 Low Complexity 1-5 active pages 1 Week $13,500.00 $13,972.00

17.2 Medium Complexity 6-20 active pages 1.5 Weeks $20,250.00 $20,958.00

17.3 High Complexity 21-50 active pages 2.5 Weeks $33,750.00 $34,931.00

17.4 Add-On Remediation Validation 1 Day $2,700.00 $2,794.00 18 ADDITIONAL CONSULTING (NOT INCLUDED IN ABOVE ACTIVITIES) Additional Consulting Per Hour
Years 1 - 3
Per Hour
Years 4 - 5

18.1 Basic Security Tester $220.00 $227.00

18.2 Web Penetration Expert $225.00 $232.00

18.3 Senior Security Specialist $325.00 $336.00
End of Attachment B
66 66 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 44 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

ATTACHMENT C
County of Orange Information Technology Security Standards (See separate Attachment)
67 67 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 45 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

ATTACHMENT D
Business Associate Contract
(See Separate Attachment)
68 68 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 46 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

ATTACHMENT E

CERTIFICATION OF RETURN OR DESTRUCTION AND NON-DATA BREACH Upon the earlier of the closing of this project engagement, as a result of completion and/or other means, or the request (at any time) of County, Contractor shall (1) thoroughly complete the tables herein with information sufficient to allow the County to account for its documents, materials, and information and ensure their secure return or destruction; (2) at the County’s option and pursuant to the County’s written authorization: (a) return all copies of documents, materials, and information obtained from, or on behalf of, the County; and/or (b) securely destroy all documents, materials, and information obtained from, or on behalf of, the County; and (3) sign the certification below.

In the event Contractor returns documents, materials, and information to the County, the Contractor shall thoroughly complete the following table (including additional lines as needed):

Vendor Project What was supplied to the Vendor
and Date
What was returned to the County
and Date
In the event the County authorizes certain documents, materials, and information not to be returned to the County and authorized their destruction, Contractor shall securely destroy the residual data in accordance with secure destruction NIST Special Publication 800-88 Revision 1 (or the most current version) or a documented manner acceptable to the County Chief Security Officer and thoroughly complete the following table (including additional lines as needed):

Vendor Project Unique Certificate
Number
What was securely
destroyed?
When was it securely
destroyed?
The undersigned hereby certifies that Contractor has returned or securely destroyed all copies of documents and materials provided to it by, or on behalf of, the County of Orange, as described on the attached Receipt Acknowledgements, other than those documents and materials listed in Attachment A to this certification. The undersigned further certifies that there have been no known or suspected data breaches pertaining to the documents and materials described on the attached Receipt Acknowledgments while they were in the possession, custody or control of Tevora Business Solutions, Inc. and its approved Affiliates, if any.

Tevora Business Solutions, Inc.

Name:
_____________________________________
Title:
_____________________________________
Signature:
_____________________________________
Date:
_____________________________________
69 69 of 402
County of Orange – OCIT
Tevora Business Solutions, Inc.

Page 47 of 47 ends

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

EXHIBIT I
Staffing Plan
Key Personnel Staff to perform Contract duties
Name Title Phone Email
Steve Stumpfl Executive Vice President 949-398-0121 [email protected] Cindy Curley Account Director 858-361-7743 [email protected] Clayton Riness Principal Consultant 949-398-0129 [email protected] Christina Whiting Principal Consultant 949-398-0132 [email protected] Matt Mosley Managing Director, Incident
Response 971-266-0132 [email protected]
Jeremiah Sahlberg
Managing Director, Federal,
Third-Party Risk, Enterprise
Risk, Healthcare
703-298-8375 [email protected]
Ben Dimick Director, Security Consulting
Services
714-222-6543 [email protected]
Chris Callas Senior Manager, Cloud
Services 929-456-7703 [email protected]
Kevin Dick Manager, Threat Services 858-922-4047 [email protected] Anir Desai Manager, Information
Security and Compliance
562-274-3818 [email protected]
Bill Nguyen Manager, Information
Security and Compliance
714-326-4927 [email protected]
Jason Lee Associate Manager,
Healthcare
213-820-5499 [email protected]
Justin Graham Associate Manager,
Healthcare
512-665-4829 [email protected]
Brandon Richardson Associate Manager 858-248-0240 [email protected] 70 70 of 402

STAFF REPORT
Meeting Date:

October 14, 2025

CONSENT
18 SUBJECT: FALL AND WINTER COMMUNITY EVENT APPROVALS AND REQUESTS RECOMMENDATION: It is recommended that the City Council:

1. Approve the Laguna Art Museum’s exclusive use of the Laguna Beach High School Community Pool to host a rehearsal on Saturday, October 18 from 3 p.m. to 4 p.m. and the public performance on Saturday, November 8 from 2 p.m. to 4 p.m., subject to an agreement in a form approved by the City Attorney, and excluding lifeguard services, waiver of fees for the exclusive use of the pool and the commercial filming permit application;

2. Approve Ability Awareness’s request to host World Kindness Day at the Main Beach Cobblestones area on Saturday, November 15, 2025, from 10 a.m. to 5 p.m., waive the associated application fees for reserving the area, and authorize the Transit and Community Services Department to bag three parking meters on El Paseo in support of the event;

3. Authorize the Acting Director of Transit and Community Services to file an application for a Temporary Use Permit for Hospitality Night activities on Friday, December 5, 2025, December 4, 2026, and December 3, 2027, including the use of amplified sound, the temporary closures of certain Downtown Laguna Beach streets and Lot 2, and restricted parking on Forest Avenue;

4. Authorize an amendment to Resolution 13.001 to include the additional street closures of Temple Terrace and Catalina Street between Oak and Brooks Street each Halloween;

5. Authorize the City Manager to modify the dates of the events as necessary; and

6. Find the actions categorically exempt from State CEQA Guidelines Section 15301 based on the facts in this staff report.

SUMMARY OF THE MATTER
This report recommends that the City Council approve the use of City and School District facilities for four community events planned for Fall and Winter 2025: the Laguna Art Museum’s Art + Nature performance, the World Kindness Day event hosted by Ability Awareness, the City’s co-sponsored Hospitality Night, and street closures for Halloween by the Laguna Beach Police Department. The recommended actions include authorizing facility use, fee waivers, event coordination, and temporary street and parking adjustments, as well as approving a Temporary Use Permit for Hospitality Night for three consecutive years.

There are minimal fiscal impacts, with most costs already absorbed in departmental budgets. The proposed events support the City’s community engagement and public enrichment goals, and the actions are categorically exempt from the California Environmental Quality Act (CEQA) under Section 15301 (Existing Facilities).

DISCUSSION
The City and Laguna Beach Unified School District (LBUSD) have a Joint Use Agreement for the Community Pool. Based on such agreement, the City operates and oversees the pool for seventy (70%) of the time. Laguna Art Museum has approached the City for use of the Pool for an artistic swimming performance by the Meraquas of Irvine. More specifically, Laguna Art Museum is seeking to host a 1 of 411

FALL AND WINTER COMMUNITY EVENT APPROVALS AND REQUESTS
October 14, 2025

Page 2 of 4 ends

rehearsal on Saturday, October 18 from 3 p.m. to 4 p.m. and the public performance on Saturday, November 8 from 2 p.m. to 4 p.m. The requested use will occur outside of normal operating hours of the pool to limit impacts to the public’s use of the pool for lap swimming and to accommodate pre-existing activities scheduled on November 8. LBUSD has been made aware of and approved the requested use.

The City does not have an established policy or fee schedule for use of the pool outside normal operating hours, and estimates $75 per hour for lifeguard staff costs. Laguna Art Museum is asking for a waiver of both the pool use fees and lifeguard fees. City staff recommends that the City Council waive the pool use fees but charge for the lifeguard fees because lifeguards would not ordinarily be present and the cost is not budgeted.

Laguna Art Museum has also made the Transit and Community Services Department aware of its intent to file an application for a commercial filming permit pursuant to Chapter 5.66 (Commercial Motion Picture Film, Video Tape and Still Photography Production). Such applications are considered by the City Manager and are subject to certain conditions if granted. Laguna Art Museum is seeking a waiver of the application fees for such permit. City staff recommends that the City Council waive the application fees for the commercial filming permit.

World Kindness Day
In 2018, the City of Laguna Beach adopted Resolution 18.051 to support World Kindness and calendared World Kindness Day annually on or around November 13. (Attachment 2.) This year, Ability Awareness is proposing to host an event on the cobblestone area Saturday, November 15, 2025, from 10 a.m. to 5 p.m.

In accordance with the provisions of Laguna Beach Municipal Code Section 18.28.010, the hard surface cobblestone area located in the southerly portion of Main Beach Park are available not more than five days per month on a first-come, first-served basis by reservation through the City for the conduct of constitutionally protected expressive activities involving the use of structures. “Constitutionally protected expressive activities involving the use of structures" means “conduct and activities that encompasses, entails or includes the erection and use of stages, tables, barricades, utility poles, booths, tents or other temporary structures in addition to the tables, benches, permanent structures, equipment and facilities provided by the city, and the sole or principal purpose of which is the expression, dissemination, or communication by verbal, visual, literary or auditory means of opinion, views or ideas.” No single structure in excess of six hundred square feet in area or in excess of eight feet in height shall be allowed. (LBMC Section

18.28.015(c).)
Ability Awareness is proposing to set up for an event on the Cobblestones with temporary structures and requests City staff print kindness awards signed by the Mayor. Ability Awareness requests a waiver of both the application fees to reserve the area for the proposed event and bag three parking meters on El Paseo in support of the event.

Hospitality Night
Each year, the City and the Laguna Beach Chamber of Commerce propose to co-sponsor Hospitality Night which generally occurs one night in December. The main festivities generally take place at the Pepper Tree parking lot (Lot 2) at 322 Forest Avenue, where Santa visits, tree lighting occurs, and the public enjoys 2 of 411

FALL AND WINTER COMMUNITY EVENT APPROVALS AND REQUESTS
October 14, 2025

Page 3 of 4 ends

family-friendly crafts. Additionally, the Chamber of Commerce generally provides main stage band entertainment at the end of the Promenade on Forest, coordinates with all the downtown businesses, and works with other Laguna Beach Chamber members and non-profits on booth set-ups on Forest and Glenneyre Avenue to provide organization information and sell holiday-related items. To accommodate Hospitality Night, Downtown streets are generally closed to vehicular traffic prior to and during the event, including the intersections of Park at Glenneyre Street, Beach Street, Ocean Avenue, Lot 2 (Pepper Tree lot), Second Street, Mermaid Street, and Forest Avenue, so that pedestrians can walk safely through the downtown area and support local businesses.

The Transit and Community Services Department recommends that the City Council authorize the Transit and Community Services Department to file a Temporary Use Permit application for the Hospital Night on the following dates over the course of the next three years: December 5, 2025, December 4, 2026, and December 3, 2027. We conferred with Santa’s scheduler and these were the only available dates in 2025, 2026, and 2027 during which he could leave the North Pole. We were fortunate to have booked him early via a “save the date(s)“ postcard.

Halloween Street Closures
City Council Resolution 13.001 authorizes the temporary closure of Oak Street and Brooks Street between Temple Terrace and Catalina Street on Halloween.(Attachment 3.) Due to the popularity of the event and increased attendance, the Police Department is requesting that the resolution be formally amended to include the closure of Temple Terrace and Catalina Street between Oak and Brooks Street each Halloween.

This change will enhance public safety, improve traffic control, and provide a safer environment for families and children walking in the area. This creates a safe walking loop between Oak and Brooks Streets and allows attendees to circulate without crossing through active vehicle traffic.

FINANCIAL ANALYSIS
Laguna Art Museum and World Kindness Day requests are indirect costs. The costs associated with annual Hospitality Night are incorporated into the budget and no additional allocations are requested.

ENVIRONMENTAL ANALYSIS
The recommended actions are exempt under the California Environmental Quality Act under CEQA Guidelines Section 15301 because it consists of the operation, repair, maintenance, permitting, leasing, licensing, or minor alteration of existing public or private structures, facilities, mechanical equipment, or topographical features, involving negligible or no expansion of existing or former use. Here, the recommended actions meet the exemption because they contemplate authorizing activities on public facilities, which are generally used for such activities.

ATTACHMENTS

1. Proposed Hospitality Night Street Closure Plan (Pg. 5)

2. World Kindness Day Resolution (Pgs. 6-7)

3. Halloween Street Closure Resolution (Pgs. 8-9)
3 of 411

FALL AND WINTER COMMUNITY EVENT APPROVALS AND REQUESTS
October 14, 2025

Page 4 of 4 ends

Submitted By: Alexis Braun Approved: .David A Kiff
Alexis Braun, Acting Director of
Transit and Community Services
Dave Kiff, City Manager
Report Prepared By: Coordinated With:

Alexis Braun, Acting Director of Transit and
Community Services
Tierney Doran, Recreation Supervisor
Andrea Tirnauer, Senior Recreation Coordinator
Jeff Calvert, Chief of Police
Jane Abzug, Assistant City Attorney
4 of 411
Hospitality Night
December 5, 2025
Street Closures
Forest Avenue Closed
3:00pm – 9:00pm
Glenneyre Closed
(from Park to Forest)
3:00pm – 9:00pm
Upper Ocean Avenue
(from Forest to Beach)
No Parking all day
Closed 3:00pm – 9:00pm
Promenade Closed
for duration of event
Lot 2 (Peppertree Lot )
Closed All Day Beach Street Closed
(from Ocean to Forest)
3:00pm – 9:00pm
Mermaid Closed
3:00pm – 9:00pm
(No right turn from 3rd St)
2nd Street Closed
3:00pm – 9:00pm
Lot 5 (Mermaid Lot)
3:00pm – 9:00pm
Lot 15 (Bus Depot)
Closed 2:00 – 9:00pm
Attachment 1
4 5 of 411
Attachment 2
5 6 of 411
6 7 of 411
RESOLUTION NO. 13.001

A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF LAGUNA

BEACH, CALIFORNIA, APPROVING THE TEMPORARY CLOSURE OF

OAK STREET AND BROOKS STREET FROM TEMPLE TERRACE TO

CATALINA STREET EACH HALLOWEEN
WHEREAS, the City Council of the City of Laguna Beach is aware that the portion of 8 Oak Street and Brooks Street between Temple Terrace and Catalina Street has become a 9 popular community event for Halloween activities; and 10 WHEREAS, it is estimated that more than 800 people attended the event during 11 Halloween of 2012; and
12 WHEREAS, the City Council believes that it is reasonable and justified to temporarily 13 14 close Oak Street and Brooks Street from Temple Terrace to Catalina Street on Halloween each 15 year for the health, safety and general welfare of persons using the street during such Halloween 16 activities;
17 NOW, THEREFORE, THE CITY COUNCIL OF THE CITY OF LAGUNA BEACH 18 does RESOLVE that the portion of Oak Street and Brook Street between Temple Terrace and 19 Catalina Street shall be and is approved for temporary closure each year on Halloween. 20 21
THE CITY COUNCIL does FURTHER RESOLVE that the City Manager shall be and 22 is authorized to utilize such City resources as are necessary for the temporary closure, including 23 but not limited to placement and removal of barricades and assistance with traffic control. 24 25
26 27
28 1
2 3
4 5
6 7
Attachment 3
8 8 of 411
k--A-7- rrE 6
rrE CHEL, City Clerk
e City of Laguna Beach, CA
9 10
11 12
13 14
15 16
17 18
19 20
21 ADOPTED this 15th day of January, 2013.
5 STATE OF CALIFORNIA )
COUNTY OF CALIFORNIA) ) ss.

I, LISETTE CHEL, City Clerk of the City of Laguna Beach, California, do hereby certify that the foregoing Resolution No. 13.001 was duly adopted at a Regular Meeting of the City Council of said City held on January 15, 2013, by the following vote:

AYES: COUNCILMEMBER(S): Whalen, Iseman, Dicterow, Pearson, Boyd NOES COUNCILMEMBER(S): None ABSENT COUNCILMEMBER(S): None
ABSTAIN COUNCILMEMBER(S): None
22 23
24 25
26 27
28 1
2 3
4 9
-2-
9 of 411

STAFF REPORT
Meeting Date:

October 14, 2025

BUSINESS
19 SUBJECT: SUMMER 2025 OPERATIONAL WRAP-UP AND RECOMMENDATIONS FOR 2026
RECOMMENDATION: It is recommended that the City Council:

1. Receive and file the Summer 2025 Wrap-Up Report and Recommendations for 2026;

2. Provide direction to Mayor pro Tem Orgill and Council Member Kempf and to staff on whether to further evaluate or return with proposals related to the potential Municipal Code amendments, operational changes, or programmatic suggestions outlined in the report;

3. Provide additional guidance regarding preparation for Summer 2026; and

4. Find that this action is not subject to the California Environmental Quality Act pursuant to Section 15378(b)(5) of the CEQA Guidelines.

SUMMARY OF THE MATTER
In the months after a busy, visitor-heavy summer in 2024, the City heard a lot from residents and businesses about some of the adverse impacts of tourism, including excessive violations of our municipal code, impacts to ocean resources, trash, parking problems, traffic and much more. In advance of Summer 2025, the City Council formed an Ad Hoc Committee on Stewardship (“stewardship” being a different concept in destination information that tries to educate visitors as to the sensitivity of an area’s cultural, historic, and environmental resources). Mayor pro Tem Orgill and Council Member Kempf serve as the Ad Hoc Committee members.

The Committee and City staff worked on efforts for Summer 2025 that included:

1. More targeted enforcement of Municipal Code violations (such as parking violations, smoking on the beach, trash left on the beach, blocking public safety members’ views of the beach, alcohol on the beach, loud vehicle exhaust, and more) by the PD team, including sworn officers, Parking Control officers, Animal Control officers, and Park Rangers.

2. Adding to the Park Ranger corps – two positions were added in FY 25-26.

3. Adding trash cans to beaches and beach entries.

4. Staying nimble and adjusting the pacing of trash pickup at Main Beach, Aliso Beach, the downtown, and at other beaches.

5. Placing portable restrooms in South Laguna.
1 of 13
SUMMER 2025 OPERATIONAL WRAP-UP AND RECOMMENDATIONS FOR 2026 October 14, 2025

Page 2 of 8 ends

6. A pilot project that installed temporary signage – in this case, at Woods Cove – to improve awareness of commonly-violated code provisions.

How did we do? This staff report attempts to answer that. The report also outlines potential Municipal Code amendments, operational adjustments, and stewardship strategies for future Council consideration.

While no immediate fiscal impact is associated with receiving this report, future actions stemming from its recommendations may require separate City Council review and budget allocation.

Any future recommendations may result in funding needs, which would be brought forward separately.

This action is not subject to CEQA, as it constitutes an informational update and general administrative direction without any commitment to a physical project (CEQA Guidelines Section 15378(b)(5)).

DISCUSSION
Following community concerns in Summer 2024 about the impacts of increased tourism on public safety, environmental resources, and code compliance, the City Council formed an Ad Hoc Committee on Stewardship. This committee worked closely with City staff to implement targeted initiatives during Summer 2025. Below is a department-by-department summary of those efforts and their outcomes.

A. Public Works & Utilities
The Public Works Department expanded its maintenance operations in response to anticipated high summer demand. Enhancements were implemented across trash collection, restroom servicing, pressure washing, and beach grooming. These changes helped maintain cleanliness and responsiveness in high-traffic public spaces. The table below outlines these service enhancements compared to off-season levels:

Table 1. Public Works Summer 2025 Enhancements
Service Area Summer Frequency Off-Season Frequency % Increase / Notes Main Beach Grooming 4–5 times per week 2 times per week 100–150% increase Day Porters (Downtown, Main,
Heisler) 2 per shift 1 per shift Doubled staffing per shift Trash/Recycling Bins (South
Laguna) 232 bins 143 bins +62% more bins
Trash Collection Frequency 3 times per day Once daily Tripled frequency Sidewalk Pressure Washing
(Downtown) 4 times per week Twice per week Doubled frequency Looking Ahead to 2026: Although demand for maintenance services remains consistently high during the summer season, the City Council could consider increasing contracted day porter staffing at high-use areas to further enhance service levels. Currently, downtown Laguna Beach, Main Beach, and Heisler Park are served by two day porters per shift. To better meet demand, the City Council may wish to consider increasing this to four per shift, assigning one dedicated day porter each to downtown and Main Beach, and two porters to serve Heisler Park. Additional day porters could also be deployed at Aliso Beach Park and along the South Laguna beaches, including West Street, Table Rock, Thousand Steps, and Totuava, to support trash collection, restroom maintenance, and overall site cleanliness during peak visitation periods. 2 of 13
SUMMER 2025 OPERATIONAL WRAP-UP AND RECOMMENDATIONS FOR 2026 October 14, 2025

Page 3 of 8 ends

Also, staff is evaluating types of trash receptacles to better prevent spillover, seagull nuisance issues, and to provide better source separation to meet recycling and diversion goals.

B. Police Department
The Police Department significantly increased its enforcement presence in Summer 2025, responding to a broad range of municipal code violations. The following table summarizes year-over-year trends since 2023:

Table 2. Police Department Summer Activity Comparison (2023–2025) Category 2023 2024 2025 % Change (2024 to 25)
All Calls for Service 13,795 15,820 17,781 +12.4%
Citations 1,859 2,354 3,329 +41.4%
Parking Citations 8,159 7,197 8,526 +18.5%
Felony Arrests 72 78 65 -16.7%
Misdemeanor Arrests 269 299 269 -10%
Reports 906 1,031 1,169 +13.4%
While Summer 2025 remained operationally demanding, officers and support personnel reported a generally calmer environment compared to Summer 2024. Several contributing factors were noted anecdotally, including cooler coastal weather patterns, clearer signage, and increased coordination across enforcement teams. Despite a rise in calls for service and citations, fewer confrontational or disorderly incidents were reported, suggesting that enhanced presence and public awareness may have had a “deterrent” effect.

Looking Ahead to 2026: The City Council could consider whether to sustain or adjust enforcement staffing levels based on anticipated crowd sizes and ongoing compliance trends. Additional focus areas for 2026 may include:
• Continuing to reduce repeat violations through signage, visibility, and social media education. • Evaluating potential deployment of mobile response units or foot patrols in high-volume areas. • Strengthening interdepartmental coordination between Police, Marine Safety, and Park Rangers.

It may be important to consider improving supervision and promotional avenues in the Park Ranger Program (without adding new staff). Converting two ranger positions to senior ranger positions, along with designating the two senior positions and two non-senior positions as Homeless Liaison Rangers, might make sense as we focus on homelessness services in a post Grants Pass environment.

Our experience has shown that our feedback-based approach successfully maintains a strong enforcement presence while balancing community expectations and resource availability.

C. Marine Safety
3 of 13
SUMMER 2025 OPERATIONAL WRAP-UP AND RECOMMENDATIONS FOR 2026 October 14, 2025

Page 4 of 8 ends

The Marine Safety Department reported an increase in rescues during Summer 2025 compared to previous years, while other key statistics declined. This trend suggests increased visitor activity in the water, offset by successful preventative outreach and safety education efforts. The table below presents a year-over-year comparison of key operational metrics:

Table 3. Marine Safety Activity – Memorial Day to Labor Day (2023–2025)* Category 2023 2024 2025 % Change (2024-25)
Rescues 6,613 9,618 10,329 +7.4%
Medical Aids 5,991 6,741 5,617 -16.7%
Ordinance Advisement 157,957 150,569 118,096 -21.6%
Preventative Actions 349,876 432,518 390,133 -9.8%
*The City assumed operations in South Laguna on March 1, 2023.

In addition to its core lifeguard and rescue functions, the Marine Safety Department expanded its public education and outreach efforts in Summer 2025. While the City offers tidepool and ocean safety talks at Main Beach, participation by non-local schools is often limited by transportation logistics. To broaden access, staff launched an inland outreach initiative targeting nearby school districts.

Marine Safety personnel visited schools in Aliso Viejo, Laguna Hills, Mission Viejo, and San Juan Capistrano, engaging over 1,000 students in presentations focused on:
• Recognizing ocean hazards and rip currents;
• Practicing safe behavior in and around the ocean;
• Understanding how to protect sensitive marine environments.

This initiative helped increase awareness among student visitors and likely contributed to declines in ordinance advisements and medical aid calls. Enhanced education, coupled with consistent staffing and proactive enforcement, supported a safer beach environment for both residents and visitors.

Looking Ahead to 2026: Marine Safety will continue to prioritize community education and operational readiness. Key goals for the upcoming season include:
• Expanding the Junior Lifeguard Program, with a particular focus on adding sessions in South Laguna to accommodate increased beach activity in those areas • Sustaining and growing pre-season school outreach, including in-person presentations and digital materials to reach a broader student audience;
• Increasing the number of trained Wave Watch rescue vessel operators, to enable consistent summer deployment of this program, weather permitting;
• Enhancing coastal observation infrastructure by identifying new locations for cameras in highuse or high-risk areas, enabling real-time monitoring to improve incident response and resource allocation.
4 of 13
SUMMER 2025 OPERATIONAL WRAP-UP AND RECOMMENDATIONS FOR 2026 October 14, 2025

Page 5 of 8 ends

These efforts will help foster a culture of safety, environmental stewardship, and preparedness throughout the summer season.

D. City Manager / Public Information
In addition to working with the Ad Hoc Committee on Stewardship, we put out more targeted information via advertisements and social media, providing information about beach behavior, parking, and our municipal code. Using Google Ads’ social media programming, we targeted the Orange County region Monday through Thursday with stewardship ads and “don’t do this” ads. Friday through Sunday, the same ads were geofenced to anyone using social media while here in town.

We also prepared and distributed six key videos about beach issues in advance of Summer. Subjects included stewardship generally, beach safety, tidepool protection, our obligations under the Coastal Act, and more.

Looking Ahead to 2026. We’ll likely continue to refine the messages and delivery of our paid social media work. We hope to work in close collaboration in messaging with Visit Laguna Beach’s updated stewardship effort.

E. Community Services and Transit
The City continued its long-standing efforts to reduce vehicle congestion by promoting the use of public transit during the peak summer season. The Laguna Beach trolley program, first introduced in 2002 and expanded to year-round service in 2015, marked its 10th full year of continuous operation in 2025. This summer, the system recorded over 282,000 boardings on its primary routes, while an additional 34,263 riders used the Summer Breeze park-and-ride service from Irvine. The ridership trends for the past several years are summarized in the table below.

Table 4. Trolley Program Ridership by Route (2019-2025) Year Canyon Coastal Summer Breeze Total
2019 142,753 276,432 10,846 430,031
2021 104,651 209,874 8,825 323,350
2022 115,461 244,721 17,248 377,430
2023 116,781 208,880 18,509 344,170
2024 118,586 186,584 23,486 328,656
2025* 118,532 163,931 34,263 316,726
*Boardings recorded through August 31, 2025.

Looking Ahead to 2026:

To further reduce traffic congestion and improve visitor access, the City Council could consider strategies to increase trolley ridership and streamline service delivery. While overall boardings saw a modest decline in 2025, the 46% increase in Summer Breeze ridership suggests growing public interest in convenient parkand-ride options. For Summer 2026, staff may evaluate potential adjustments to route frequency, service hours, or promotional efforts to boost use of underutilized routes, or eliminate underutilized routes.

Continued collaboration with regional partners, including OCTA and the City of Irvine, could also enhance 5 of 13
SUMMER 2025 OPERATIONAL WRAP-UP AND RECOMMENDATIONS FOR 2026 October 14, 2025

Page 6 of 8 ends

outreach and rider incentives. Additionally, data collection improvements, such as mobile ridership tracking or real-time service updates, will help refine transit planning and responsiveness.

F. POSSIBLE MUNI CODE AND OTHER CHANGES FOR 2026
• Parking Enforcement. Parking spaces and parking enforcement seem to be a recurrent concern, and rightfully so. As a reminder, our parking enforcement officers both issue tickets and address critical other needs, such as accident reports and investigations, cars that are blocking residents’ driveways, or that have exceeded the 72-hour time limit. Other cities that have city charters are able to have private sector parking enforcement (where the contracted staff only issues tickets), but Laguna Beach, as a general law city, is likely required to have a city employee be the person who places a ticket on a windshield.

In the spirit of effectiveness and cost savings, asking the voters to consider becoming a Charter City in November 2026 may make some sense here.
• Parking Rates/Paid Parking Locations. Assuming all goes well, the City will be implementing new parking rates for 2026, including assuming success in issuing a Coastal Development Permit (CDP) to do so. A similar CDP is likely to include requiring payment to park at more locations in South Laguna, consistent with a conversation with the community and Council in August/September of 2025.
• Signage. The pilot custom signage program for Woods Cove should be expanded to other key beach areas.
• Those #$%@# Fake Rose Petals. They’re clearly litter – but maybe folks are not aware that they are litter and don’t decompose. They’re (often) not picked up, and leave multiple pieces of plastic in or adjacent to the ocean ecosystem. While any permitted wedding ceremony agrees to not have loose petals of any kind for their ceremony as part of the application process, enforcement is challenging – and several ceremonies (engagements, photo shoots) don’t always go through the permitting process. Should we further ban fake rose petals? Educate more about how harmful they can be? Both?
• Canopies. As beaches get busier, and sometimes as sandy space is limited, Council may wish to consider changing our somewhat outdated code involving canopies. The current code says that no canopies can be larger than 6’ by 6’ by 6’ – yet most visitors don’t know this, and many canopy vendors sell mostly 10’ by 10’ by 10’.

It is tough on Park Patrol to tell a friendly beachgoing family that their canopy is too large (though a 10’ by 10’ by 10’ can be walked in and lowered to become a 6’ by 6’ by 6’). Remember that the main purpose of this regulation is to allow Marine Safety and other officials to have clear views of the water for swimmer and wader safety.
6 of 13
SUMMER 2025 OPERATIONAL WRAP-UP AND RECOMMENDATIONS FOR 2026 October 14, 2025

Page 7 of 8 ends

The council may wish to consider whether the canopy size limitation should be change to reflect the market – but also that canopies larger in size only be allowed on certain beaches such as Main Beach where generally dry sand is more available. At other beaches, shade structures could be limited to umbrellas.
• Hours. Council may wish to discuss different options for some of our more secluded coves where beachgoer safety can be compromised by isolation and darkness. This would have to be in consultation with the California Coastal Commission to ensure that wet sand beach access is not constrained. A working tool to assist in this might be drones to be able to determine if someone is not where they should be after certain hours.
• Volunteers. Other ideas include having volunteer community members at the top of busy beach steps to advise beachgoers as to limitations on drinking, smoking, or shade structures and the location of restrooms. While this has been suggested to us from community members, we certainly don't want to put a community volunteer in an unsafe situation should tempers escalate. • Stewardship. As noted, we expect the new team at Visit Laguna Beach to be on board with more changes to stewardship marketing – with plans to be discussed soon. These could involve cultural, heritage, and environmental activities and messaging to complement the City’s work.

Summary Outlook for Summer 2026
As Laguna Beach continues to experience high levels of summer visitors, maintaining service quality, public safety, and environmental stewardship remains a top priority. This report outlines a range of preliminary ideas for Summer 2026, including potential increases in staffing, targeted outreach, expanded public education, improved observation infrastructure, and refined transit operations. Staff welcomes Council input on which initiatives to explore further, with the goal of balancing community expectations, visitor experience, and operational feasibility in the upcoming budget and planning cycles.

FINANCIAL ANALYSIS
There is no direct fiscal impact associated with receiving and filing this report. The actions described herein, including enhanced summer operations, public education efforts, enforcement activity, and transit services, were funded through previously approved departmental budgets for FY 2024–25 and FY 2025–26. Should the City Council wish to pursue any of the potential code amendments, staffing changes, or capital investments discussed for Summer 2026, separate staff reports and fiscal analyses will be brought forward for consideration at a future date.

ENVIRONMENTAL ANALYSIS
The proposed action is not a project under the California Environmental Quality Act (CEQA) pursuant to CEQA Guidelines Section 15378(b)(5), as it involves an administrative activity of government that does not result in a direct or indirect physical change in the environment.

ATTACHMENTS
None
7 of 13
SUMMER 2025 OPERATIONAL WRAP-UP AND RECOMMENDATIONS FOR 2026 October 14, 2025

Page 8 of 8 ends

Submitted By: . Approved: .David A Kiff
Dave Kiff, City Manager Dave Kiff, City Manager
Report Prepared By: Coordinated With:

Mark Orgill, Mayor pro Tem
Sue Kempf, Council Member
Dave Kiff, City Manager
Mark McAvoy, Director of Public Works & Utilities
Jeff Calvert, Police Chief
Alexis Braun, Acting Director of Transit and
Community Services
Kai Bond, Marine Safety Chief
Megan Garibaldi, City Attorney
8 of 13
9 of 13
10 of 13
11 of 13
1 McKay, Ann Marie CC
Subject: October 14 City Council Agenda Item #19 Summer 2025 Operational Wrap-up From: [email protected] <[email protected]>
Sent: Monday, October 13, 2025 3:12 PM
To: City Council <[email protected]>
Cc: McKay, Ann Marie CC <[email protected]>; Kiff, Dave CM <[email protected]>; Thomas, John <[email protected]>
Subject: October 14 City Council Agenda Item #19 Summer 2025 Operational Wrap-up Thank you for the efforts to address negative impacts caused by tourism.

And, all-in-all, it is a good report with many highly supportable recommendations for going forward.

Here are a few additional comments, suggestions, and questions:

1. Restrooms (Page 1 of 8) : Portable restrooms in South Laguna – MY COMMENT: What was done this year? And what is the status of efforts to create permanent restrooms in South Laguna?

2. Beach Hours: (Page 7 of 8) Hours - Regarding. “Council may wish to discuss different options for some of our more secluded coves where beachgoer safety can be compromised by isolation and darkness.”
MY COMMENT: The language in the December 17, 1986, Resolution of the Board of Supervisors of Orange County, referencing DEIR 461 that enabled public access to Tablerock Beach included this language:
“MITIGATION MEASURES INCLUDED IN BOTH EIR 461 AND PREVOUS NEGATIVE DECLARATION 21. Because the access is proximate to residences, it shall be designated for day use only, that is, from 8:00 a.m. to sunset. Signage shall be posted at the access indicating beach hours, and a gate, to be locked and unlocked daily by Operations and Maintenance personnel, installed to enforce those hours.”
MY COMMENT: Should Tablerock beach be closed at sunset as the Supervisors specified? Isn’t that what was approved.

3. Beach Maintenance (Page 2 of 8) Regarding - “Currently, downtown Laguna Beach, Main Beach, and Heisler Park are served by two day porters per shift. To better meet demand, the City Council may wish to consider increasing this to four per shift, assigning one dedicated day porter each to downtown and Main Beach, and two porters to serve Heisler Park. Additional day porters could also be deployed at Aliso Beach Park and along the South Laguna beaches, including West Street, Table Rock, Thousand Steps, and Totuava, to support trash collection, restroom maintenance, and overall site cleanliness during peak visitation periods.”
MY COMMENT: Considering the revenue the city received for taking over South Laguna beaches and considering South Laguna beaches comprise about 3 miles of the total 7 miles of Laguna beaches, there should be wide support for the staff report suggestion of additional day porters being deployed to the South Laguna beaches.

4. Park Rangers: (Page 1 of 8 and 3 of 8): City is considering changes in the Park Ranger program.

MY COMMENT: Some people have observed that Beach Patrol officers were far more evident on the sand than the Park Rangers are. Currently, Park Rangers have duties beyond patrolling the beaches which leave them less time on the sand which is where the vast majority of incidents are encountered. 1) Should the city reconsider the change from Beach Patrol of Park Rangers? Or 2) at least, like Chief Farinella did, log the amount of time these officers are actually on the sand – referred to as “Sand 12 of 13
2 Time” - and make sure there is at least a minimum amount of time spent on the sand by the Park Rangers?”

5. Tidepools: (Page 4 of 8)
MY COMMENT: While the report mentions tidepool education at Main Beach, should South Laguna tidepools receive the same level of effort as others in the city?

6. Fake Rose Petals and Weddings (Page 6 of 8):

MY COMMENT: I don’t have a suggestion on this, but simply as an observation, there are weddings almost daily on South Laguna beaches and I have no idea of whether they go through the permitting process.

7. Trolley and Summer Breeze Ridership: (Page 5 of 8): Just a question: What is the cost per boarding of the Trolley and Summer Breeze programs? Some of these programs may be more cost-effective than others.
13 of 13

Laguna Beach City CouncilOctober 14, 2025

Laguna Beach City Council
October 14, 2025