Laguna Beach City Council
October 14, 2025

CONTRACT RCA-017-23010029
FOR

CYBERSECURITY ASSESSMENT & AUDIT SERVICES

BETWEEN

COUNTY OF ORANGE
AND
TEVORA BUSINESS SOLUTIONS, INC.

Attachment 2
24 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
CONTRACT RCA-017-23010029
FOR

CYBERSECURITY ASSESSMENT & AUDIT SERVICES

BETWEEN

COUNTY OF ORANGE
AND
TEVORA BUSINESS SOLUTIONS, INC.

This Contract for Cybersecurity Assessment & Audit Services (“Contract”), is made and entered into as of the date fully executed by and between the County of Orange (“County”), a political subdivision of the State of California, acting through Orange County Information Technology (“OCIT”) and Tevora Business Solutions, Inc. (“Contractor”), with a place of business at 17875 Von Karmen Ave, Suite 100, Irvine, CA 92614, with County and Contractor sometimes individually referred to as “Party”, or collectively referred to as “Parties”.

ATTACHMENTS
This Contract is comprised of this document and the following Attachments and Exhibit, which are incorporated by reference into this Contract:

Attachment A – Scope of Work
Attachment B – Compensation, Pricing and Payment
Attachment C – County of Orange Information Technology Security Standards Attachment D – Business Associate Contract
Attachment E – Certificate of Return or Destruction and Non-Data Breach Exhibit I – Staffing Plan

RECITALS
WHEREAS, Contractor responded to Request for Proposals (“RFP”) for Cybersecurity Assessment & Audit Services and represented that its services shall meet or exceed the requirements and specifications of the RFP; and
WHEREAS, Contractor agrees to provide services as further set forth in the Attachment A, Scope of Work; and
WHEREAS, County agrees to pay Contractor the fees as more specifically described in Attachment B, Compensation, Pricing and Payment; and
NOW, THEREFORE, the Parties mutually agree as follows:

ARTICLES
I. Definitions:

The following terms and acronyms shall have the meanings set forth below unless otherwise specified in the Scope of Work of this Contract.
a. “Business Day” or “Business Hours” means Monday through Friday 8:00 a.m. to 5:00 p.m. U.S.

Pacific Time, excluding California and federal public holidays in the United States. 25 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
b. “Cloud Software as a Service (SaaS)” means capability provided to County to use applications made available by Contractor running on a cloud infrastructure. The applications are accessible from various County devices through a thin County interface such as a web browser (e.g., webbased email). County does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings. c. “Deliverable(s)” means tangible and intangible information or material that must be provided by Contractor to County under the terms of this Contract, including any other items as set forth in Attachment A, Scope of Work.
d. “Service(s)” means the duties and tasks undertaken by Contractor to fulfill the requirements of this Contract, including but not limited to providing web browser access by authorized users to the System and to related services, such as Contractor hosted computer storage, customization/integration, databases, support, maintenance, training, documentation, Deliverables and other functionalities, as a SaaS solution.

II. General Terms and Conditions:

A. Governing Law and Venue: This Contract has been negotiated and executed in the state of California and shall be governed by and construed under the laws of the state of California. In the event of any legal action to enforce or interpret this Contract, the sole and exclusive venue shall be a court of competent jurisdiction located in Orange County, California, and the Parties hereto agree to and do hereby submit to the jurisdiction of such court, notwithstanding Code of Civil Procedure Section 394. Furthermore, the Parties specifically agree to waive any and all rights to request that an action be transferred for trial to another county.

B. Entire Contract: This Contract, when accepted by the Contractor either in writing or by the shipment of any article or other commencement of performance hereunder, contains the entire Contract between the Parties with respect to the matters herein, and there are no restrictions, promises, warranties or undertakings other than those set forth herein or referred to herein. No exceptions, alternatives, substitutes or revisions are valid or binding on County unless authorized by County in writing. Electronic acceptance of any additional terms, conditions or supplemental Contracts by any County employee or agent, including but not limited to installers of software, shall not be valid or binding on County unless accepted in writing by County’s Purchasing Agent or his designee, hereinafter “Purchasing Agent.”
C. Amendments: No alteration or variation of the terms of this Contract shall be valid unless made in writing and signed by the Parties; no oral understanding or agreement not incorporated herein shall be binding on either of the Parties; and no exceptions, alternatives, substitutes or revisions are valid or binding on County unless authorized by County in writing.

D. Taxes: Unless otherwise provided herein or by law, price quoted does not include California state sales or use tax. Out-of-state Contractors shall indicate California Board of Equalization permit number and sales permit number on invoices, if California sales tax is added and collectable. If no permit numbers are shown, sales tax will be deducted from payment. The Auditor-Controller will then pay use tax directly to the State of California in lieu of payment of sales tax to the Contractor.

E. Delivery: Time of delivery of Services is of the essence in this Contract. County reserves the right to refuse any services and to cancel all or any part of the descriptions or services that do not conform to the prescribed statement of work. Delivery shall not be deemed to be complete until all services have actually been received and accepted in writing by County.

F. Acceptance/Payment: Unless otherwise agreed to in writing by the County, 1) acceptance shall not be deemed complete unless in writing and until all the services have actually been received to the satisfaction of County, and 2) payment shall be made in arrears after satisfactory acceptance. 26 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
G. Warranty: Contractor expressly warrants that the Services covered by this Contract will be performed with reasonable skill and diligence, and that the Deliverables created by such services, as described in the Scope of Work attached hereto, will be fit for the particular purpose for which it is intended. Acceptance of this order shall constitute an agreement upon Contractor’s part to indemnify, defend and hold County and its indemnities as identified in paragraph “Z” below, and as more fully described in paragraph “Z”, harmless from liability, loss, damage and expense, including reasonable counsel fees, incurred or sustained by County by reason of the failure of the services to conform to such warranties, faulty work performance, negligent or unlawful acts, and non-compliance with any applicable state or federal codes, ordinances, orders, or statutes, including the Occupational Safety and Health Act (“OSHA”) and the California Industrial Safety Act. Such remedies shall be in addition to any other remedies provided by law.

H. Patent/Copyright Materials/Proprietary Infringement: Unless otherwise expressly provided in this Contract, Contractor shall be solely responsible for clearing the right to use any patented or copyrighted materials in the performance of this Contract. Contractor warrants that any software as modified through services provided hereunder will not infringe upon or violate any patent, proprietary right, or trade secret right of any third Party. Contractor agrees that, in accordance with the more specific requirement contained in paragraph “Z” below, it shall indemnify, defend and hold County and County Indemnities harmless from any and all such claims and be responsible for payment of all costs, damages, penalties and expenses related to or arising from such claim(s), including, but not limited to, attorney’s fees, costs and expenses.

I. Assignment or Subcontracting: The terms, covenants, and conditions contained herein shall apply to and bind the heirs, successors, executors, administrators and assigns of the Parties.

Furthermore, neither the performance of this Contract nor any portion thereof may be assigned or subcontracted by Contractor without the express written consent of County. Any attempt by Contractor to assign or subcontract the performance or any portion thereof of this Contract without the express written consent of County shall be invalid and shall constitute a breach of this Contract.

J. Non-Discrimination: In the performance of this Contract, Contractor agrees that it will comply with the requirements of Section 1735 of the California Labor Code and not engage nor permit any subcontractors to engage in discrimination in employment of persons because of the race, religious creed, color, national origin, ancestry, physical disability, mental disability, medical condition, marital status, or sex of such persons. Contractor acknowledges that a violation of this provision shall subject Contractor to all the penalties imposed for a violation of Section 1720 et seq. of the California Labor Code.

K. Termination: In addition to any other remedies or rights it may have by law, County has the right to terminate this Contract without penalty immediately with cause or after thirty (30) days’ written notice without cause, unless otherwise specified. Cause shall be defined as any breach of Contract, any misrepresentation or fraud on the part of the Contractor. Exercise by County of its right to terminate the Contract shall relieve County of all further obligations.

L. Consent to Breach Not Waiver: No term or provision of this Contract shall be deemed waived and no breach excused, unless such waiver or consent shall be in writing and signed by the Party claimed to have waived or consented. Any consent by any Party to, or waiver of, a breach by the other, whether express or implied, shall not constitute consent to, waiver of, or excuse for any other different or subsequent breach.

M. Independent Contractor: Contractor shall be considered an independent Contractor and neither Contractor, its employees nor anyone working under Contractor shall be considered an agent or an employee of County. Neither Contractor, its employees nor anyone working under Contractor shall qualify for workers’ compensation or other fringe benefits of any kind through County.

N. Performance: Contractor shall perform all work under this Contract, taking necessary steps and precautions to perform the work to County’s satisfaction. Contractor shall be responsible for the professional quality, technical assurance, timely completion and coordination of all documentation and other services furnished by the Contractor under this Contract. Contractor shall perform all 27 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
O. Insurance Provisions: Prior to the provision of services under this Contract, the Contractor agrees to purchase all required insurance at Contractor’s expense, including all endorsements required herein, necessary to satisfy the County that the insurance provisions of this Contract have been complied with. Contractor agrees to keep such insurance coverage, Certificates of Insurance, and endorsements on deposit with the County during the entire term of this Contract. In addition, all subcontractors performing work on behalf of Contractor pursuant to this Contract shall obtain insurance subject to the same terms and conditions as set forth herein for Contractor.

Contractor shall ensure that all subcontractors performing work on behalf of Contractor pursuant to this Contract shall be covered under Contractor’s insurance as an Additional Insured or maintain insurance subject to the same terms and conditions as set forth herein for Contractor. Contractor shall not allow subcontractors to work if subcontractors have less than the level of coverage required by County from Contractor under this Contract. It is the obligation of Contractor to provide notice of the insurance requirements to every subcontractor and to receive proof of insurance prior to allowing any subcontractor to begin work. Such proof of insurance must be maintained by Contractor through the entirety of this Contract for inspection by County representative(s) at any reasonable time.

All self-insured retentions (“SIRs”) and deductibles shall be clearly stated on the Certificate of Insurance. Any self-insured retention (SIR) in an amount in excess of Fifty Thousand Dollars ($50,000) shall specifically be approved by the County’s Risk Manager, or designee, upon review of Contractor’s current audited financial report. If Contractor’s SIR is approved, Contractor, in addition to, and without limitation of, any other indemnity provision(s) in this Contract, agrees to all of the following:

1. In addition to the duty to indemnify and hold the County harmless against any and all liability, claim, demand or suit resulting from Contractor’s, its agents, employee’s or subcontractor’s performance of this Contract, Contractor shall defend the County at its sole cost and expense with counsel approved by Board of Supervisors against same; and

2. Contractor’s duty to defend, as stated above, shall be absolute and irrespective of any duty to indemnify or hold harmless; and

3. The provisions of California Civil Code Section 2860 shall apply to any and all actions to which the duty to defend stated above applies, and the Contractor’s SIR provision shall be interpreted as though the Contractor was an insurer and the County was the insured.

If the Contractor fails to maintain insurance acceptable to the County for the full term of this Contract, the County may terminate this Contract.

Qualified Insurer
The policy or policies of insurance must be issued by an insurer with a minimum rating of A- (Secure A.M. Best's Rating) and VIII (Financial Size Category as determined by the most current edition of the Best's Key Rating Guide/Property-Casualty/United States or ambest.com). It is preferred, but not mandatory, that the insurer be licensed to do business in the state of California (California Admitted Carrier).

If the insurance carrier does not have an A.M. Best Rating of A-/VIII, the CEO/Office of Risk Management retains the right to approve or reject a carrier after a review of the company's performance and financial ratings.
work diligently, carefully, and in a good and workman-like manner; shall furnish all labor, supervision, machinery, equipment, materials, and supplies necessary therefore; shall at its sole expense obtain and maintain all permits and licenses required by public authorities, including those of County required in its governmental capacity, in connection with performance of the work; and, if permitted to sub contract, shall be fully responsible for all work performed by subcontractors. 28 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
Coverage Minimum Limits
Commercial General Liability $1,000,000 per occurrence
$2,000,000 aggregate
Automobile Liability including coverage for owned,
non-owned and hired vehicles
$1,000,000 per occurrence
Workers Compensation Statutory
Employers Liability Insurance $1,000,000 per occurrence Network Security & Privacy Liability $1,000,000 per claims made Technology Errors and Omissions $1,000,000 per claims made $1,000,000 aggregate
Required Coverage Forms
The Commercial General Liability coverage shall be written on Insurance Services Office (“ISO”) form CG 00 01, or a substitute form providing liability coverage at least as broad.

The Business Auto Liability coverage shall be written on ISO form CA 00 01, CA 00 05, CA 0012, CA 00 20, or a substitute form providing coverage at least as broad.

Required Endorsements
The Commercial General Liability policy shall contain the following endorsements, which shall accompany the Certificate of Insurance:

1. An Additional Insured endorsement using ISO form CG 20 26 04 13 or a form at least as broad naming the County of Orange its elected and appointed officials, officers, agents and employees as Additional Insureds, or provide blanket coverage, which will state AS REQUIRED BY WRITTEN CONTRACT.

2. A primary non-contributing endorsement using ISO form CG 20 01 04 13, or a form at least as broad evidencing that the Contractor’s insurance is primary and any insurance or self-insurance maintained by the County of Orange shall be excess and non-contributing.

The Network Security and Privacy Liability policy shall contain the following endorsements which shall accompany the Certificate of Insurance:

1. An Additional Insured endorsement naming the County of Orange, its elected and appointed officials, officers, agents and employees as Additional Insureds for its vicarious liability.

2. A primary and non-contributing endorsement evidencing that Contractor’s insurance is primary and any insurance or self-insurance maintained by the County of Orange shall be excess and non-contributing.

The Workers’ Compensation policy shall contain a waiver of subrogation endorsement waiving all rights of subrogation against the County of Orange, its elected and appointed officials, officers, agents and employees or provide blanket coverage, which will state AS REQUIRED BY WRITTEN CONTRACT.

All insurance policies required by this Contract shall waive all rights of subrogation against the County of Orange, its elected and appointed officials, officers, agents and employees when acting within the scope of their appointment or employment.

The policy or policies of insurance maintained by the Contractor shall provide the minimum limits and coverage as set forth below:
29 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
P. Changes: Contractor shall make no changes in the work or perform any additional work without the County’s specific written approval.

Q. Change of Ownership/Name, Litigation Status, Conflict of Interest Status: Contractor agrees that if there is a change or transfer in ownership of Contractor’s business prior to completion of this Contract, and the County agrees to an assignment of the Contract, the new owners shall be required under the terms of sale or other instruments of transfer to assume Contractor’s duties and obligations contained in this Contract and complete them to the satisfaction of the County.

County reserves the right to immediately terminate the Contract in the event the County determines that the assignee is not qualified or is otherwise unacceptable to the County for the provision of services under the Contract.

In addition, Contractor has the duty to notify the County in writing of any change in the Contractor’s status with respect to name changes that do not require an assignment of the Contract. The Contractor is also obligated to notify the County in writing if the Contractor becomes a party to any litigation against the County, or a party to litigation that may reasonably affect the Contractor’s performance under the Contract, as well as any potential conflicts of interest between Contractor and County that may arise prior to or during the period of Contract performance. While Contractor will be required to provide this information without prompting from the County any time there is a change in Contractor’s name, conflict of interest or litigation status, Contractor must also provide an update to the County of its status in these areas whenever requested by the County.

Contractor shall exercise reasonable care and diligence to prevent any actions or conditions that could result in a conflict with County interests. In addition to the Contractor, this obligation shall apply to the Contractor’s employees, agents, and subcontractors associated with the provision of goods and services provided under this Contract. The Contractor’s efforts shall include, but not be limited to establishing rules and procedures preventing its employees, agents, and subcontractors from providing or offering gifts, entertainment, payments, loans or other considerations which could be deemed to influence or appear to influence County staff or elected officers in the performance of their duties.

Contractor shall notify County in writing within thirty (30) days of any policy cancellation and ten (10) days for non-payment of premium and provide a copy of the cancellation notice to County.

Failure to provide written notice of cancellation may constitute a material breach of the Contract, upon which the County may suspend or terminate this Contract.

The Commercial General Liability policy shall contain a severability of interests clause also known as a “separation of insureds” clause (standard in the ISO CG 0001 policy).

Insurance certificates should be forwarded to the agency/department address listed on the solicitation.

If the Contractor fails to provide the insurance certificates and endorsements within seven (7) days of notification by CEO/Purchasing or the agency/department purchasing division, award may be made to the next qualified vendor.

County expressly retains the right to require Contractor to increase or decrease insurance of any of the above insurance types throughout the term of this Contract. Any increase or decrease in insurance will be as deemed by County of Orange Risk Manager as appropriate to adequately protect County.

County shall notify Contractor in writing of changes in the insurance requirements. If Contractor does not deposit copies of acceptable Certificates of Insurance and endorsements with County incorporating such changes within thirty (30) days of receipt of such notice, this Contract may be in breach without further notice to Contractor, and County shall be entitled to all legal remedies.

The procuring of such required policy or policies of insurance shall not be construed to limit Contractor's liability hereunder nor to fulfill the indemnification provisions and requirements of this Contract, nor act in any way to reduce the policy coverage and limits available from the insurer. 30 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
R. Force Majeure: Contractor shall not be assessed with liquidated damages or unsatisfactory performance penalties during any delay beyond the time named for the performance of this Contract caused by any act of God, war, civil disorder, employment strike or other cause beyond its reasonable control, provided Contractor gives written notice of the cause of the delay to County within thirtysix (36) hours of the start of the delay and Contractor avails himself of any available remedies.

S. Confidentiality: Contractor shall ensure the confidentiality, protection and preservation of the County’s Confidential Information (defined below) and information of a confidential, sensitive, and/or proprietary nature, which may be disclosed or made available to Contractor for its performance of services under this Contract, all related subordinate agreements, and its cyber security assessment and audit of the County’s network equipment, and associated software, information and documentation (collectively, the “Purpose”). a. “Confidential Information” means all non-public information, material, or documents, of any kind obtained from, or on behalf of, the County through any medium that is:
i. Designated in writing as “confidential” or “private” at the time of its disclosure; or ii. The County’s sensitive security information, technical data, programs, software (including configuration or source codes), technical information, screen shots, customer information, employee records, computer network, or architectural or engineering information; or
iii. Exploitable data, information protected by privacy law, or other information that is treated as confidential by the County, or is prohibited from being disclosed for any reason pursuant to law, statute, regulation, ordinance, or contract; or iv. Any County information security record the disclosure of which would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of the County; or
v. Information obtained by Contractor and relating to the County during the course of Contractor’s performance of the Contract, any related subordinate agreements, or the Purpose, that a reasonable person knows or reasonably should understand to be confidential, and is treated confidential by the disclosing party. b. Obligations of Confidence: Except as expressly permitted or further restricted by Section U(c) below, Contractor agrees as recipient of County’s Confidential Information that it will: (a) not disclose such Confidential Information to any third parties, and (b) exercise the same degree of care to protect such Confidential Information from any possession, use or disclosure not expressly permitted by this Contract, that Contractor generally uses to protect its own information of similar nature, but in any event no less than a reasonable standard of care. c. Limited Permitted Use and Disclosure: Contractor may possess, use, and disclose County’s Confidential Information only as follows:
i. Possession and Use: Contractor may possess, use and reproduce Confidential Information solely for the Purpose. The Purpose shall not include disclosure except as expressly permitted in Section U(c)(ii) and (iii) below. Contractor shall not use the Confidential Information for any other purpose. Contractor shall not disassemble, decompile or otherwise reverse engineer any samples, prototypes, software or other tangible objects provided by the County hereunder. If Contractor is provided with a copy of the County’s software/firmware or hardware products, Contractor may use and operate such products solely for its own internal testing and evaluation regarding the Purpose. Any information derived from testing and evaluating the County’s products will be deemed Confidential Information, and the sole property, of the County.
31 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
ii. Disclosure: Contractor may, with the express written consent of the County, disclose Confidential Information to its Affiliates (defined below) and employees on a strict "need to know" basis and solely for the Purpose and in the course of providing the services to County, provided that each such entity/person to whom such disclosure is made is notified of the confidential nature of the disclosure and is under an obligation to hold the Confidential Information in confidence under terms and conditions at least as restrictive as the terms and conditions of this Contract. “Affiliate” means Contractor’s parent or subsidiary company or a corporate affiliate that controls, is controlled by or under common control with Contractor.
iii. Legally Required Disclosure: Disclosure of any Confidential Information by Contractor shall not be precluded if such disclosure is required of Contractor pursuant to court or administrative order, but only to the extent required and provided that Contractor in each instance before making such disclosure first (i) promptly upon receipt of such order notifies County of such order in writing; and (ii) reasonably cooperates with County in making, if available under applicable law, a good faith effort to obtain a protective order or other appropriate determination against or limiting disclosure or use of the Confidential Information, at no cost to County. iv. Return or Secure Destruction of Confidential Information: Upon the earlier of: the expiration of this Contract or the request (at any time) of County, the recipient Party shall, at the County’s option and pursuant to the County’s written authorization, either:
(a) promptly securely destroy all copies of the Confidential Information obtained from the County or furnished to the Contractor, or Contractor’s approved Affiliates and employees, and confirm such destruction to the County in writing by executing the Certificate of Return or Destruction and Non-data Breach attached hereto as Attachment E, or (b) return to the County all Confidential Information obtained from the County or furnished to the Contractor, and Contractor’s approved Affiliates and employees, and confirm such return to the County in writing by executing the Certification of Return or Destruction and Non-data Breach attached hereto as Attachment E.
v. Exceptions to Confidentiality: Notwithstanding any other provisions of this Contract, each Party acknowledges that Confidential Information shall not include any information which:

1. is now or becomes part of the public domain through no fault or omission of the Contractor;

2. is already known by the Contractor prior to the disclosure without restriction on disclosure;

3. is lawfully received, without obligation of confidentiality, by the Contractor from others; or

4. is independently developed by or for the Contractor without use of or reference to the County’s Confidential Information.
d. Responsibility for Others: Contractor shall be fully responsible for the acts, omissions, breaches, violations of law, and unauthorized uses or disclosures of the County’s Confidential Information by its employees and duly approved Affiliates, agents, and subcontractors (all, as relevant and if any).
e. Survival of Confidentiality Obligations: Contractor’s confidentiality obligations in this Contract and the obligations of this Section U et seq. shall survive the termination or expiration of the 32 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
T. Compliance with Laws: Contractor represents and warrants that services to be provided under this Contract shall fully comply, at Contractor’s expense, with all standards, laws, statutes, restrictions, ordinances, requirements, and regulations (collectively “laws”), including, but not limited to those issued by County in its governmental capacity and all other laws applicable to the services at the time services are provided to and accepted by County. Contractor acknowledges that County is relying on Contractor to ensure such compliance, and pursuant to the requirements of paragraph “Z” below, Contractor agrees that it shall defend, indemnify and hold County and County Indemnities harmless from all liability, damages, costs, and expenses arising from or related to a violation of such laws.

U. Freight (F.O.B. Destination): Contractor assumes full responsibility for all transportation, transportation scheduling, packing, handling, insurance, and other services associated with delivery of all products deemed necessary under this Contract.

V. Severability: If any term, covenant, condition, or provision of this Contract is held by a court of competent jurisdiction to be invalid, void or unenforceable, the remainder of the provisions hereof shall remain in full force and effect and shall in no way be affected, impaired or invalidated thereby.

W. Attorney Fees: In any action or proceeding to enforce or interpret any provision of this Contract, or where any provision hereof is validly asserted as a defense, each Party shall bear its own attorney’s fees, costs and expenses.

X. Interpretation: This Contract has been negotiated at arm’s length and between persons sophisticated and knowledgeable in the matters dealt with in this Contract. In addition, each Party has been represented by experienced and knowledgeable independent legal counsel of their own choosing or has knowingly declined to seek such counsel despite being encouraged and given the opportunity to do so. Each Party further acknowledges that they have not been influenced to any extent whatsoever in executing this Contract by any other Party hereto or by any person representing them, or both. Accordingly, any rule or law (including California Civil Code Section 1654) or legal decision that would require interpretation of any ambiguities in this Contract against the Party that has drafted it is not applicable and is waived. The provisions of this Contract shall be interpreted in a reasonable manner to affect the purpose of the Parties and this Contract.

Y. Employee Eligibility Verification: The Contractor warrants that it fully complies with all Federal and State statutes and regulations regarding the employment of aliens and others and that all its employees performing work under this Contract meet the citizenship or alien status requirement set forth in Federal statutes and regulations. The Contractor shall obtain, from all employees, consultants and subcontractors performing work hereunder, all verification and other documentation of employment eligibility status required by Federal or State statutes and regulations including, but not limited to, the Immigration Reform and Control Act of 1986, 8 U.S.C. §1324 et seq., as they currently exist and as they may be hereafter amended. The Contractor shall retain all such documentation for all covered employee, consultants and subcontractors for the period prescribed by the law. The Contractor shall indemnify, defend with counsel approved in writing by County, and hold harmless, the County, its agents, officers, and employees from employer sanctions and any other liability which may be assessed against the Contractor or the County or both in connection with any alleged violation of any Federal or State statutes or regulations pertaining to the eligibility for employment of any persons performing work under this Contract.

Contract and all related subordinate contracts. Contractor shall keep the County’s Confidential Information confidential indefinitely.
f. Disclaimers and Retention of Rights: Nothing in this Contract shall operate to create or transfer an ownership or other interest in any Confidential Information, nor require the disclosure by County of any of its Confidential Information, nor restrict, inhibit or encumber County’s right or ability to dispose of, use, distribute, disclose or disseminate in any way its own Confidential Information.

County will retain all right, title, and interest in and to all Confidential Information. Contractor shall not acquire any patent, copyright, mask work or trademark rights under this Contract. 33 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
Z. Indemnification Provisions: Contractor agrees to indemnify, defend with counsel approved in writing by County, and hold County, its elected and appointed officials, officers, employees, agents and those special districts and agencies which County’s Board of Supervisors acts as the governing Board (“County Indemnitees”) harmless from any claims, demands or liability of any kind or nature, including but not limited to personal injury or property damage, arising from or related to the services, products or other performance provided by Contractor pursuant to this Contract. If judgment is entered against Contractor and County by a court of competent jurisdiction because of the concurrent active negligence of County or County Indemnitees, Contractor and County agree that liability will be apportioned as determined by the court. Neither Party shall request a jury apportionment.

AA. Audits/Inspections: Contractor agrees to permit the County’s Auditor-Controller or the AuditorController’s authorized representative (including auditors from a private auditing firm hired by the County) access during normal working hours to all books, accounts, records, reports, files, financial records, supporting documentation, including payroll and accounts payable/receivable records, and other papers or property of Contractor for the purpose of auditing or inspecting any aspect of performance under this Contract. The inspection and/or audit will be confined to those matters connected with the performance of the Contract including, but not limited to, the costs of administering the Contract. The County will provide reasonable notice of such an audit or inspection.

The County reserves the right to audit and verify the Contractor’s records before final payment is made.

Contractor agrees to maintain such records for possible audit for a minimum of three years after final payment, unless a longer period of records retention is stipulated under this Contract or by law. Contractor agrees to allow interviews of any employees or others who might reasonably have information related to such records. Further, Contractor agrees to include a similar right to the County to audit records and interview staff of any subcontractor related to performance of this Contract.

Should the Contractor cease to exist as a legal entity, the Contractor’s records pertaining to this Contract shall be forwarded to the surviving entity in a merger or acquisition or, in the event of liquidation, to the County’s project manager.

BB. Contingency of Funds: Contractor acknowledges that funding or portions of funding for this Contract may be contingent upon state budget approval; receipt of funds from, and/or obligation of funds by, the state of California to County; and inclusion of sufficient funding for the services hereunder in the budget approved by County’s Board of Supervisors for each fiscal year covered by this Contract. If such approval, funding or appropriations are not forthcoming, or are otherwise limited, County may immediately terminate or modify this Contract without penalty.

CC. Expenditure Limit: Contractor shall notify the County of Orange assigned Deputy Purchasing Agent in writing when the expenditures against the Contract reach 75 percent of the dollar limit on the Contract. County will not be responsible for any expenditure overruns and will not pay for work exceeding the dollar limit on the Contract unless a change order to cover those costs has been issued.

III. Additional Terms and Conditions:

1. Scope of Contract: This Contract, together with the Attachments and Exhibits attached hereto and included herein by reference, specifies the contractual terms and conditions by which Contractor shall provide County with Cybersecurity Assessment & Audit Services.

2. Term of Contract: This Contract shall be effective for three (3) years from January 1, 2023, through December 31, 2025. This Contract may be renewed, by mutual written agreement of both Parties, for one (1) additional two-year term. County does not have to give any reason should it 34 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

3. Precedence: The Contract documents will consist of this Contract, including its Attachments and Exhibits. In the event of a conflict or inconsistency between or among the Contract documents, the following order of precedence shall apply: (a) the provisions of the main body of this Contract (i.e., those provisions set forth in the recitals and articles, excluding its Attachments and Exhibits), (b) Attachment A; (c) Attachment B; (d) Attachment C; (e) Attachment D; (f) Attachment E; (g) Exhibit I.

4. Authorization Warranty: Contractor represents and warrants that the person or persons executing this Contract on behalf of and for Contractor is an authorized agent who has actual authority to bind Contractor to each and every term, condition and obligation of this Contract and that all requirements of Contractor have been fulfilled to provide such actual authority.

5. Breach: The failure of Contractor to comply with any of the provisions, covenants, requirements, or conditions of this Contract shall be a material breach of this Contract. In such event, County may, in addition to any other remedies available at law, in equity, or otherwise specified in this Contract, do any of the following:
a. Afford Contractor written notice of the breach and, if the breach is curable, ten (10) calendar days or such shorter time that may be specified in this Contract, within which Contractor is to cure the breach;
b. Discontinue payment to Contractor for and during the period in which Contractor is in breach; c. Offset against any monies billed by Contractor but yet unpaid by County those monies disallowed pursuant to the above; and
d. Terminate the Contract immediately pursuant to paragraph “K”.

Any reference to specific breaches being material breaches within this Contract will not be construed to mean that other breaches are not material.

6. County’s Project Manager: County shall appoint a Project Manager that shall: (a) act as the primary liaison between County and the Contractor’s Project Manager; (b) have overall responsibility for directing and coordinating County’s activities hereunder; and (c) be vested with the necessary authority to fulfill all of the responsibilities of the County’s Project Manager described in this Contract. County represents that the individual designated as the County’s Project Manager is, and shall ensure that any replacement holder of such position shall be, an experienced manager who is knowledgeable as to County, its respective businesses, business practices, functions, and related activities, and its respective systems, requirements, and needs.

7. Contractor’s Project Manager: Contractor shall appoint a Project Manager to direct Contractor’s efforts in fulfilling Contractor’s obligations under this Contract. The Contractor’s Project Manager shall at all times: (i) act as the primary liaison between Contractor and the County’s Project Manager; (ii) have overall responsibility for directing all of Contractor’s activities hereunder, including directing the performance of all Services from inception through completion; (iii) be vested with the necessary authority to fulfill all of the responsibilities of the Contractor’s Project Manager described in this Contract; and (iv) coordinate and conduct periodic program review sessions with County to discuss costs, Attachments, and any relevant technical aspects of Contractor’s performance under this Contract. Contractor represents that the individual designated as the Contractor’s Project Manager is, and promises that any replacement holder of such position shall be, an experienced manager who is knowledgeable as to County, its respective businesses, business practices, functions, and related activities, and its respective solution, requirements, and needs. County shall have the right to interview, as County deems necessary, and participate (by elect not to renew or extend this Contract. Any renewal may require approval of the County of Orange Board of Supervisors.
35 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

8. Contractor’s Power and Authority: Contractor represents and warrants that it has the full power and authority to grant the rights herein granted and will indemnify and defend and hold County and County Indemnitees harmless from and against any and all loss, cost, liability, and expense, including reasonable attorney fees, arising out of any breach of this representation and warranty.

Further, Contractor avers that it will not enter, and has not entered, into any arrangement with any third party which might abridge any rights of County under this Contract.

9. Conflict of Interest – (Contractor): Contractor shall exercise reasonable care and diligence to prevent any actions or conditions that result in a conflict with the best interests of County. This obligation shall apply to Contractor; Contractor’s employees, agents, relatives, sub-tier contractors, and third parties associated with accomplishing work and Services hereunder. Contractor’s efforts shall include, but are not limited to, establishing precautions to prevent its employees or agents from making, receiving, providing, or offering gifts, entertainment, payments, loans, or other considerations which could be deemed to appear to influence individuals to act contrary to the best interest of County.

10. Conditions Affecting Work: Contractor shall be responsible for taking all steps reasonably necessary to ascertain the nature and location of the work to be performed under this Contract and to reasonably know the general conditions which can affect the work or the cost thereof. Any unreasonable failure by Contractor to do so shall not relieve Contractor from responsibility for successfully performing the work without additional cost to County. County assumes no responsibility for any understanding or representations made by any of its officers or agents during or prior to the execution of this Contract concerning the nature, location(s), or general conditions of the Contract, unless such understanding or representations by County are expressly stated in the Contract and the Contract expressly provides that County assumes the responsibility.

11. Contractor’s Expense: Contractor will be responsible for all costs related to photocopying, telephone communications, fax communications, travel, parking, and any and all “out of pocket” expenses incurred by Contractor during the performance of the Services under this Contract, unless otherwise specified. Contractor shall be responsible for payment of all parking costs and expenses incurred at a County facility while performing work under this Contract, except to the extent the County facility has free parking available to the public and Contractor makes appropriate use of this free parking. However, County will at no point provide free parking to Contractor in the County Civic Center.

12. Defaults: The following constitute events of default:
a. Any material misrepresentation, whether negligent or willful and whether in the inducement or in the performance, made by Contractor to County.
b. Failure, as a result of insolvency, filing for bankruptcy or assignment for the benefit of creditor, to perform the Services in a manner reasonably satisfactory to County. providing input and recommendations) in the final selection of the Contractor’s Project Manager.

Without the prior written consent of the County’s Project Manager, which consent shall not be unreasonably withheld, Contractor shall not: (a) designate a replacement for the Contractor’s Project Manager; or (b) voluntarily replace or reassign the individual serving as the Contractor’s Project Manager during the first twelve (12) months after the date that such individual commences performing the duties of the Contractor’s Project Manager hereunder. The County’s Project Manager shall have the right to require the removal and replacement of the Contractor’s Project Manager from providing Services to County under this Contract. The County’s Project Manager shall notify Contractor in writing of such action. Contractor shall accomplish the removal within three (3) calendar days after written notice by the County’s Project Manager. County is not required to provide any reason, rationale or factual information in the event it elects to request the removal of the Contractor’s Project Manager from providing Services to County under this Contract. 36 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
c. Discontinuance of the Services for reasons within Contractor’s reasonable control. d. Contractor’s default under any other agreement it may presently have or may enter into with County during the life of this Contract. Contractor acknowledges and agrees that in the event of a default under this Contract, County may also declare a default under any other such contracts.
e. Contractor’s repeated or continued violations of County ordinances unrelated to performance under the Contract that in the reasonable opinion of County indicate a willful or reckless disregard for County laws and regulations.

13. Disputes: The Parties shall deal in good faith and attempt to resolve potential disputes informally.

If the dispute concerning a question of fact arising under the terms of this Contract is not disposed of in a reasonable period of time by the Contractor’s Project Manager and the County’s Project Manager, such matter shall be brought to the attention of the Deputy Purchasing Agent by way of the following process:

Contractor shall submit to the Deputy Purchasing Agent a written demand for a final decision regarding the disposition of any dispute between the Parties arising under, related to, or involving this Contract, unless County, on its own initiative, has already rendered such a final decision.

Contractor’s written demand shall be fully supported by factual information, and, if such demand involves a cost adjustment to the Contract, Contractor shall include with the demand a written statement signed by a senior official of Contractor indicating that the demand is made in good faith, that the supporting data are accurate and complete, and that the amount requested accurately reflects the contract adjustment for which Contractor believes County is liable.

Pending the final resolution of any dispute arising under, related to, or involving this Contract, Contractor will diligently proceed with the performance of this Contract, including the provision of Services, as specified in Attachment A, Scope of Work. Contractor’s failure to diligently proceed shall be considered a material breach of this Contract.

Any final decision of County shall be expressly identified as such, shall be in writing, and shall be signed by the Deputy Purchasing Agent. If County fails to render a decision within ninety (90) calendar days after receipt of Contractor’s demand, it shall be deemed a final decision adverse to Contractor’s contentions. County’s final decision shall be conclusive and binding regarding the dispute unless Contractor commences action in a court of competent jurisdiction to contest such decision within ninety (90) calendar days following the date of County’s final decision or one (1) year following the accrual of the cause of action, whichever is later.

Nothing in this paragraph shall be construed as affecting County’s right to terminate the Contract pursuant to Paragraph “K”, Termination.

14. Disputed Amounts: County may withhold payment of fees or any other charges otherwise due to Contractor under this Contract to the extent that County disputes such charges in good faith. In such case, County shall provide to Contractor a reasonably detailed written explanation of the basis for the dispute and shall continue to make payments of undisputed amounts as otherwise provided in this Contract. If any disputed amounts are later determined to have been improperly withheld (i.e., properly charged by Contractor), then County shall be obligated to pay the withheld amount in accordance with this Contract, until paid in full. If any paid amounts are later disputed by County and determined to have been improperly paid (i.e., improperly charged by Contractor), then Contractor shall promptly pay County, in cash, the improperly paid amount. The failure of County to withhold payment shall not waive any other rights County may have with respect to disputed amounts or overpayments. Except as otherwise provided herein, any dispute relating to amounts owed by a Party hereunder, shall be considered a disagreement. This right to withhold is in addition 37 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

15. Employee Qualification Verification: Subject to and in accordance with applicable law, Contractor, prior to assigning an individual as Contractor personnel and at Contractor’s sole expense, shall have appropriately verified the qualifications of such individual, including verifying employment history, conducting reference checks, verifying non-employer technical certifications or education completed or degrees awarded.

16. Gratuities: Contractor represents and warrants that no gratuities, in the form of entertainment, gifts, or otherwise, were offered or given by Contractor or any agent or representative of Contractor to any officer or employee of County with a view toward securing the Contract or securing favorable treatment with respect to any determinations concerning the performance of the Contract.

For breach or violation of this representation and warranty, County shall have the right to terminate the Contract, either in whole or in part, and any loss or damage sustained by County in procuring on the open market any goods or Services which Contractor agreed to supply shall be borne and paid for by Contractor. The rights and remedies of County provided in this paragraph shall not be exclusive and are in addition to any other rights and remedies provided by law or under the Contract.

17. No Third-Party Beneficiaries: This Contract is an agreement by and between the Parties and does not: (a) confer any rights upon any of the employees, agents, or contractors, of either Party or upon any other person or entity not a party hereto; or (b) preclude any actions or claims against, or rights of recovery from, any person or entity not a party hereto.

18. Non-Exclusivity: Nothing herein shall prevent County from providing for itself or obtaining from any third party, at any time during the term or thereafter, the Services, or any type of products or services in any way analogous, similar, or comparable to the Services, as applicable, or any other products or services. Nor shall anything in this Contract be construed or interpreted as limiting County’s right or ability during the term to increase or decrease its demand for Services hereunder.

19. Non-Solicitation of Employees: Except as otherwise expressly provided in this Contract, during the term and for the first twelve (12) months thereafter, neither Party shall, without the prior written consent of the other Party, directly or indirectly solicit, entice, encourage, or otherwise recruit any employee of such other Party whose duties and responsibilities include performing Services directly or indirectly connected with performance under this Contract to leave such other Party’s employ in order to accept employment or other engagement with the soliciting Party, its affiliates, or any other person. Notwithstanding the foregoing, the Parties acknowledge and agree that this Contract shall not prohibit solicitations by either Party through general advertising or other publications of general circulation. In no way is this paragraph intended, nor shall it be deemed, to restrict or limit any individual’s right to seek employment, but rather this paragraph is intended to, and shall, prevent each Party from actively recruiting the employees of the other Party (except as provided in this Contract), thereby depriving such other Party of vital resources in the securing, development, training, and deployment of whom it has expended considerable time and resources.

20. Notice of Claims: Contractor shall give County immediate notice in writing of any legal action or suit filed related in any way to this Contract or which may affect the performance of work under this Contract and prompt notice of any claim made against Contractor by any subcontractor which may result in litigation related in any way to this Contract or which may affect the performance of work under this Contract.
to, and not a limitation of, any other remedies available to County. Contractor may not fail to perform or suspend performance of any Services hereunder by reason of County’s good faith withholding of any payment or amount in accordance with this paragraph. Contractor’s failure to perform shall be considered a material breach of this Contract. 38 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

21. Right to Access and Use Services: Contractor grants County a non-transferable and non-exclusive right to use and access all Services and other functionalities or services, provided, furnished, or accessible under this Contract, including that described in Attachment A, Scope of Work. This shall include the right of County to, and access to, all System maintenance and warranty updates, upgrades, patches, fixes and support without Contractor requiring a separate maintenance or support agreement. Subject to the agreed limitation on the number of users, County may use the Services with any computer, computer system, server, or desktop workstation owned or utilized by County or other authorized users. User access to the Services shall be routinely provided by Contractor. The right to access and use Services, including any associated payment for such right, shall commence on the Go-Live date.

22. Set-Off: County may set-off against any and all amounts otherwise payable to Contractor pursuant to any of the provisions of this Contract: (i) any and all amounts claimed by County in good faith to be owed by Contractor to County pursuant to any of the provisions of this Contract; and (ii) any and all amounts claimed by County in good faith to be owed by Contractor pursuant to any other written agreement between the Parties. Within twenty (20) calendar days after any such set-off by County, County shall provide Contractor with a written accounting of such set-off and a written statement of the reasons therefore. If the amount set-off is insufficient to cover the excess costs, Contractor is liable for and must promptly remit to County the balance upon written demand. This right to set-off is in addition to, and not a limitation of, any other remedies available to County.

Contractor may not fail to perform or suspend performance of any Services hereunder by reason of County’s good faith set-off in accordance with this paragraph. Contractor’s failure to perform shall be considered a material breach of this Contract.

23. Stop Work: County may, at any time, by written stop work order to Contractor, require Contractor to stop all or any part of the work called for by this Contract for a period up to ninety (90) business days after the stop work order is delivered to Contractor and for any further period to which the Parties may agree. The stop work order shall be specifically identified as such and shall indicate it is issued under this paragraph. Upon receipt of the stop work order, Contractor shall immediately comply with its terms and take all reasonable steps to minimize the incurrence of costs allocable to the work covered by the stop work order during the period of work stoppage. Within a period of ninety (90) business days after a stop work order is delivered to Contractor or within any extension of that period to which the Parties shall have agreed, County shall either:
a. Cancel the stop work order; or
b. Terminate the Contract in whole or in part in writing as soon as feasible. County is not required to provide thirty (30) calendar day-notice of the termination of the Contract to Contractor if a stop work order has been issued by County.

County shall not be liable to Contractor for loss of profits because of a stop work order issued under this paragraph.

24. Orderly Termination: Upon receipt of a termination notice from County, Contractor shall stop work under this Contract on the date and to the extent specified in the termination notice.

Contractor shall complete performance of such part of the work as shall not have been terminated by the termination notice, if any. County shall pay Contractor all undisputed amounts due and payable hereunder, if any. Contractor shall pay County all amounts due and payable hereunder, such as performance credits and prepaid fees, if any. Upon termination or expiration of this Contract, each Party shall assist the other Party in transferring all assets, tangible and intangible, as may be necessary for the orderly, non-disruptive business continuation of each Party. Each Party shall promptly return to the other Party all papers, materials, and other properties of the other held by each for purposes of performance of this Contract and Contractor shall return all County data to County in the file format specified by County within thirty (30) calendar days. In addition, 39 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

25. Reports/Meetings: Contractor shall develop reports and any other relevant documents necessary to complete the Services and requirements as set forth in this Contract. The County’s Project Manager and the Contractor’s Project Manager shall meet on reasonable notice to discuss Contractor’s performance and progress under this Contract. If requested, the Contractor’s Project Manager and other project personnel shall attend all meetings. Contractor shall provide such information that is requested by County for the purpose of monitoring progress under this Contract.

26. News/Information Release: Contractor will not issue any news releases in connection with either the award of this Contract or any subsequent amendment of or effort under this Contract without first obtaining review and express prior written consent of said news releases from County through the County’s Project Manager.

27. Promotional/Advertisement: County owns all rights to the name, logos and symbols of County.

The use and/or reproduction of County’s name and/or logo for any purpose, including commercial advertisement, promotional purposes, announcements, displays or press releases, without County’s express prior written consent is expressly prohibited. No use or reproduction may state or imply that County endorses Contractor’s products or Services.

28. Publication: No copies of sketches, schedules, written documents, computer based data, photographs, maps or graphs, including graphic art work, resulting from performance or prepared in connection with this Contract, are to be released by Contractor and/or anyone acting under the supervision of Contractor to any person, partnership, company, corporation, or agency, without County’s express prior written consent, except as necessary for the performance of the Services under this Contract. All press releases, including but not limited to graphic display information to be published in newspapers and magazines, are to be administered only by County unless otherwise agreed to by both Parties.

29. Errors and Omissions: All reports, files, and other documents prepared and submitted by Contractor shall be complete and shall be carefully checked by the professional(s) identified by Contractor as Project Manager, prior to submission to County. Contractor agrees that County review is discretionary and Contractor shall not assume that County shall discover errors and/or omissions. If County discovers any errors or omissions prior to approving Contractor's reports, files, and other written documents, the reports, files, or other written documents shall be returned to Contractor for correction. Should County or others discover errors or omissions in the reports, files, or other written documents submitted by Contractor after County approval thereof, County approval of Contractor's reports, files, or other written documents shall not be used as a defense by Contractor in any action between County and Contractor, and the reports, files, or other written documents shall be returned to Contractor for correction.

30. Debarment: Contractor certifies that neither Contractor nor its principles are presently debarred, proposed for debarment, declared ineligible or voluntarily excluded from participation in the transaction by any Federal department or agency.

Contractor shall erase, destroy, and render unreadable all data in its entirety remaining in Contractor’s (including any subcontractor’s) possession, but only after the County data has been returned to County. County data must be rendered in a manner that prevents its physical reconstruction through the use of commonly available file restoration utilities. Certification in writing that these actions have been completed must be provided within thirty (30) calendar days of termination or expiration of this Contract or within seven (7) calendar days of a request of County, whichever shall come first. Notwithstanding the foregoing, the foregoing requirement to return, erase, destroy and render data unreadable, including County data, shall not apply to electronic copies of such data maintained in a non-production environment in accordance with Contractor’s standard procedures for electronic archiving. 40 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

31. Notices: Any and all notices, requests, demands, and other communications contemplated, called for, permitted, or required to be given hereunder shall be in writing, except through the course of the Parties’ project managers’ routine exchange of information and cooperation during the term of the Contract and except as otherwise provided herein. Any such communications shall be deemed duly given (1) upon actual delivery, if delivery is by hand; (2) upon delivery by United States mail, if delivery is by postage paid registered or certified return receipt requested mail; or (3) upon delivery via electronic mail with paper copy delivered by United States mail or hand to Party. Each such notice shall be sent to the respective Party at the address indicated below or to any other address as the respective Parties may designate from time to time upon notice in the manner aforesaid.

CONTRACTOR CONTACT
Tevora Business Solutions, Inc.

Attn: Cindy Curley
Street Address: 17875 Von Karmen Ave, Suite 100
Irvine CA, 92614
Phone: 858-361-7743
Email: [email protected]

COUNTY CONTACTS
OCIT/Contracts & Procurement Division
1055 N. Main St., 6th Floor
Santa Ana, CA 92701
Attn: Tim Shears, Deputy Purchasing Agent
Phone: (714) 567-7488
Email: [email protected]
OCIT/Project Manager
1055 N. Main St., 6th Floor
Santa Ana, CA 92701
Attn: Andrew Song
Phone: (714) 834-4081
Email: [email protected]

32. Equal Employment Opportunity: Contractor shall comply with Executive Order 11246, “Equal Employment Opportunity”, as amended by Executive order 11375 and as supplemented in Department of Labor regulations (41 CFR, Part 60), and applicable state of California regulations as may now exist or be amended in the future. Contractor shall not discriminate against any employee or applicant for employment on the basis of race, color, national origin, ancestry, religion, sex, marital status, political affiliation or physical or mental condition.

Contractor will not discriminate against any employee or applicant for employment because of a physical or mental handicap for any position for which the employee or applicant for employment is qualified. Contractor will provide equal opportunity to handicapped persons in employment or in advancement in employment or otherwise treat qualified handicapped individuals without discrimination based upon their physical or mental handicaps in all employment practices, including: employment, upgrading, promotions, transfers, recruitments, advertising, layoffs, terminations, rate of pay or other forms of compensation, and selection for training, including apprenticeship. Contractor will comply with the provisions of Sections 503 and 504 of the Rehabilitation Act of 1973, as amended, pertaining to prohibition of discrimination against qualified handicapped persons in all programs and/or activities as detailed in regulations signed by the Secretary of the Department of Health and Human Services effective June 3, 1977, and found in the Federal Register, Volume 42, No. 68 dated May 4, 1977, as may now exist or be amended in the future.

Further, Contractor will comply with applicable provisions of Title 1 of the Americans with Disabilities Act of 1990, as may now exist or be amended in the future. 41 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

33. Civil Rights: Contractor attests that Services provided shall be in accordance with the provisions of Title VI and Title VII of the Civil Rights Act of 1964, as amended; Section 504 of the Rehabilitation Act of 1973, as amended; the Age Discrimination Act of 1975, as amended; Title II of the Americans with Disabilities Act of 1990, and other applicable state and federal laws and regulations prohibiting discrimination on the basis of race, color, national origin, ethnic group identification, age, religion, marital status, sex or disability.

34. Lobbying: On best information and belief, Contractor certifies no federal appropriated funds have been paid or will be paid by, or on behalf of, Contractor to any person for influencing or attempting to influence an officer or employee of Congress; or an employee of a member of Congress in connection with the awarding of any federal contract, continuation, renewal, amendment, or modification of any federal contract, grant, loan, or cooperative agreement.

35. Ownership of Documents: County has permanent ownership of all directly connected and derivative materials produced under this Contract by Contractor. All documents, reports and other incidental or derivative work or materials furnished hereunder shall become and remains the sole property of County and may be used by County as it may require without additional cost to County. None of the documents, reports and other incidental or derivative work or furnished materials shall be used by Contractor without the express written consent of County.

Notwithstanding the foregoing or anything else to the contrary in this Contract, nothing in this Contract shall be deemed to convey to County or any third party any right, title or interest in or to materials in which Contractor or its suppliers, subcontractors and vendors have an existing intellectual property right (“Existing Materials”); provided, however, that Contractor hereby grants to County a non-exclusive, fully paid, perpetual, worldwide license to use such Existing Materials for County’s internal business purposes to the extent such Existing Materials are incorporated into a Deliverable. However, such Existing Materials may be subject to disclosure pursuant to Section 6250 et seq. of the California Public Records Act.

36. Materials Subject to Disclosure: This Contract including its Attachments may be subject to disclosure pursuant to court order or applicable law, including but not limited to Section 6250 et seq. of the California Public Records Act.

37. Third Party Software: Contractor has obtained all necessary licenses for County to use any third party software (including without limitation, all Open Source licenses) provided with Contractor’s Services. Contractor complies with and shall continue to comply with all third party licenses (including, without limitation, all Open Source licenses) associated with any third party software provided with Contractor’s Software and Services. To the extent any third party software are provided with Contractor’s Services, County’s use of the System as provided by Contractor and in accordance with this Contract or any additional agreements issued hereunder will not be in conflict with any third party license requirements and will satisfy all conditions on use, modification or distribution of any such third party software without the need for any additional, unanticipated action or license fees on County’s part. County does not and will not need to procure any rights or licenses to any patents or other third party intellectual property rights to use as intended in this Contract.

38. Data - Title to: All materials, documents, data or information obtained from the County data files or any County medium furnished to Contractor in the performance of this Contract will at all times remain the property of the County. Such data or information may not be used or copied for direct or indirect use by Contractor after completion or termination of this Contract without the express written consent of the County. All materials, documents, data or information, including copies, must be returned to the County at the end of this Contract. 42 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

39. Data Location: Except where Contractor obtains County’s express prior written consent, the physical location of Contractor’s data center where County data is stored shall be within the continental United States.

40. Trans-Border Data Flows: Contractor shall not transfer any County data across a country border.

Furthermore, Contractor shall perform all work and Services required under this Contract within the continental United States.

41. Discovery: Contractor shall promptly notify County upon receipt of any requests which in any way might reasonably require access to County data or County’s use of Contractor’s Services.

Contractor shall notify County by the fastest means available and also in writing, with additional notification provided to the County’s Project Manager or designee, unless prohibited by law from providing such notification. Contractor shall provide such notification within forty-eight (48) hours after Contractor receives the request. Contractor shall not respond to subpoenas, service of process, Public Records Act requests, and other legal requests directed at Contractor regarding this Contract without first notifying County, unless prohibited by law from providing such notification.

Contractor will provide its intended responses to County with adequate time for County to review, revise, and, if necessary, seek a protective order in a court of competent jurisdiction. Contractor shall not respond to legal requests directed at County unless authorized in writing to do so by County.

42. Counterparts: This Contract may be executed in multiple counterparts, each of which when executed and delivered shall be deemed an original, but all of which together shall constitute one and the same agreement. This Contract shall be deemed executed and binding upon the Parties when at least one counterpart bears the signature of each Party’s authorized signatory or signatories.

43. Cooperative Contract: This Contract is a cooperative contract and may be utilized by all County of Orange departments.

The provisions and pricing of this Contract will be extended to other governmental entities. Governmental entities wishing to use this Contract will be responsible for issuing their own purchase documents, providing for their own acceptance, and making any subsequent payments. Contractor shall be required to include in any subordinate contract entered into with another governmental entity pursuant to this Contract, a contract clause that will hold harmless the County of Orange from all claims, demands, actions or causes of actions of every kind resulting directly or indirectly, arising out of, or in any way connected with the use of this Contract. Failure to do so will be considered a material breach of this Contract and grounds for immediate Contract termination. Governmental entities are responsible for obtaining all certificates of insurance, endorsements and bonds required. The Parties agree that any other governmental entity utilizing this Contract shall not be deemed to be an agent or employee of County for any purpose whatsoever.

The Contractor is responsible for providing each governmental entity a copy of this Contract upon request. The County of Orange makes no guarantee of usage by other users of this Contract.

The Contractor shall be required to maintain a list of the County of Orange departments and governmental entities using this Contract. The list shall report dollar volumes spent annually and shall be provided on an annual basis to the County, at the County’s request.

Subordinate contracts must be executed prior to the expiration or earlier termination of this Contract and may survive the expiration of this Contract up to a maximum of one year.

44. Information Technology Confidentiality and Security Requirements:

All Contractors with access to County data and/or systems shall establish and maintain policies, procedures, and technical, physical, and administrative safeguards designed to (i) ensure the confidentiality, integrity, and availability of all County data and any other confidential 43 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
A. County of Orange Information Technology Security Standards: County of Orange security standards follows the latest National Institute of Standards and Technology (NIST) 800-53 framework to ensure the highest levels of operational resiliency and cybersecurity.

Contractor, Contractor personnel, Contractor’s subcontractors, any person performing work on behalf of Contractor, and all other agents and representatives of Contractor will, at all times, comply with and abide by all County of Orange Information Technology Security Standards (“Security Standards”), as existing or modified, that pertain to Contractor in connection with the Services performed by Contractor as set forth in the scope of work of this Contract. Any violations of such Security Standards shall, in addition to all other available rights and remedies available to County, be cause for immediate termination of this Contract. Such Security Standards include, but are not limited to, Attachment C - County of Orange Information Technology Security Standards and Attachment D - Business Associate Contract.

Contractor shall use industry best practices and methods with regard to confidentiality, integrity, availability, and the prevention, detection, response, and elimination of threat, by all appropriate means, of fraud, abuse, and other inappropriate or unauthorized access to County data and/or system(s) accessed in the performance of Services under this Contract.

B. The Contractor shall implement and maintain a written information security program that contains reasonable and appropriate security measures designed to safeguard the confidentiality, integrity, availability, and resiliency of County data and/or system(s). The Contractor shall review and update its information security program in accordance with contractual, legal, and regulatory requirements. Contractor shall provide to County a copy of the organization’s information security program and/or policies.

C. Information Access: Contractor shall use appropriate safeguards and security measures to ensure the confidentiality and security of all County data.

County may require all Contractor personnel, subcontractors, and affiliates approved by County to perform work under this Contract to execute a confidentiality and non-disclosure agreement concerning access protection and data security in the form provided by County.

County shall authorize, and Contractor shall issue, any necessary information-access mechanisms, including access IDs and passwords, and in no event shall Contractor permit any such mechanisms to be shared or used by other than the individual Contractor personnel, subcontractor, or affiliate to whom issued.

Contractor shall provide each Contractor personnel, subcontractors, or affiliates with only such level of access as is required for such individual to perform his or her assigned tasks and functions.
information that the Contractor receives, stores, maintains, processes, transmits, or otherwise accesses in connection with the provision of the contracted services, (ii) protect against any threats or hazards to the security or integrity of County data, systems, or other confidential information, (iii) protect against unauthorized access, use, or disclosure of personal or County confidential information, (iv) maintain reasonable procedures to prevent, detect, respond, and provide notification to the County regarding any internal or external security breaches, (v) ensure the return or appropriate disposal of personal information or other confidential information upon contract conclusion (or per retention standards set forth in the contract), and (vi) ensure that any subcontractor(s)/agent(s) that receives, stores, maintains, processes, transmits, or otherwise accesses County data and/or system(s) is in compliance with statements and the provisions of statements and services herein.
44 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
D. Data Security Requirements: Without limiting Contractor’s obligation of confidentiality as further described in this Contract, Contractor must establish, maintain, and enforce a data privacy program and an information and cyber security program, including safety, physical, and technical security and resiliency policies and procedures, that comply with the requirements set forth in this Contract and, to the extent such programs are consistent with and not less protective than the requirements set forth in this Contract and are at least equal to applicable best industry practices and standards (NIST 800-53).

Contractor also shall provide technical and organizational safeguards against accidental, unlawful, or unauthorized access or use, destruction, loss, alteration, disclosure, transfer, commingling, or processing of such information that ensure a level of security appropriate to the risks presented by the processing of County Data.

Contractor personnel and/or subcontractor personnel and affiliates approved by County to perform work under this Contract may use or disclose County personal and confidential information only as permitted in this Contract. Any other use or disclosure requires express approval in writing by the County of Orange. No Contractor personnel and/or subcontractor personnel or affiliate shall duplicate, disseminate, market, sell, or disclose County personal and confidential information except as allowed in this Contract. Contractor personnel and/or subcontractor personnel or affiliate who access, disclose, market, sell, or use County personal and confidential information in a manner or for a purpose not authorized by this Contract may be subject to civil and criminal sanctions contained in applicable federal and state statutes.

Contractor shall take all reasonable measures to secure and defend all locations, equipment, systems, and other materials and facilities employed in connection with the Services against hackers and others who may seek, without authorization, to disrupt, damage, modify, access, or otherwise use Contractor systems or the information found therein; and prevent County data from being commingled with or contaminated by the data of other customers or their users of the Services and unauthorized access to any of County data.

Throughout the Contract term, upon request from County but at least once each calendar year, Contractor shall provide County with an accurate, up-to-date list of those Contractor personnel and/or subcontractor personnel having access to County systems and/or County data, and the respective security level or clearance assigned to each such Contractor personnel and/or subcontractor personnel. County reserves the right to require the removal and replacement of Contractor personnel and/or subcontractor personnel at the County’s sole discretion. Removal and replacement shall be performed within 14 calendar days of notification by the County.

All County resources (including County systems), County data, County hardware, and County software used or accessed by Contractor: (a) shall be used and accessed by such Contractor and/or subcontractors personnel solely and exclusively in the performance of their assigned duties in connection with, and in furtherance of, the performance of Contractor’s obligations hereunder; and (b) shall not be used or accessed except as expressly permitted hereunder, or commercially exploited in any manner whatsoever, by Contractor or Contractor’s personnel and subcontractors, at any time.

Contractor acknowledges and agrees that any failure to comply with the provisions of this paragraph shall constitute a breach of this Contract and entitle County to deny or restrict the rights of such non-complying Contractor personnel and/or subcontractor personnel to access and use the County data and/or system(s), as County in its sole discretion shall deem appropriate.
45 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
E. Enhanced Security Measures: County may, in its discretion, designate certain areas, facilities, or solution systems as ones that require a higher level of security and access control. County shall notify Contractor in writing reasonably in advance of any such designation becoming effective. Any such notice shall set forth, in reasonable detail, the enhanced security or accesscontrol procedures, measures, or requirements that Contractor shall be required to implement and enforce, as well as the date on which such procedures and measures shall take effect.

Contractor shall and shall cause Contractor personnel and subcontractors to fully comply with and abide by all such enhanced security and access measures and procedures as of such date.

F. General Security Standards: Contractor will be solely responsible for the information technology infrastructure, including all computers, software, databases, electronic systems (including database management systems) and networks used by or for Contractor (“Contractor Systems”) to access County resources (including County systems), County data or otherwise in connection with the Services and shall prevent unauthorized access to County resources (including County systems) or County data through the Contractor Systems.

At all times during the contract term, Contractor shall maintain a level of security with regard to the Contractor Systems, that in all events is at least as secure as the levels of security that are common and prevalent in the industry and in accordance with industry best practices (NIST 800-53). Contractor shall maintain all appropriate administrative, physical, technical, and procedural safeguards to secure County data from data breach, protect County data and the Services from loss, corruption, unauthorized disclosure, and from hacks, and the introduction of viruses, disabling devices, malware, and other forms of malicious and inadvertent acts that can disrupt County’s access and use of County data and the Services.

G. Security Failures: Any failure by the Contractor to meet the requirements of this Contract with respect to the security of County data, including any related backup, disaster recovery, or other policies, practices or procedures, and any breach or violation by Contractor or its subcontractors or affiliates, or their employees or agents, of any of the foregoing, shall be deemed a material breach of this Contract and may result in termination and reimbursement to County of any fees prepaid by County prorated to the date of such termination. The remedy provided in this paragraph shall not be exclusive and is in addition to any other rights and remedies provided by law or under the Contract.

H. Security Breach Notification: In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, availability, confidentiality, and/or integrity of County data or the physical, technical, administrative, or organizational safeguards required under this Contract that relate to the security, availability, confidentiality, and/or integrity of County data, Contractor shall, at its own expense, (1) immediately (or within 24 hours of potential or suspected breach), notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence; (2) perform a root cause analysis of the actual, potential, or Contractor shall also continuously monitor its systems for potential areas where security could be breached. In no case shall the safeguards of Contractor’s data privacy and information and cyber security program be less stringent than the safeguards used by County. Without limiting any other audit rights of County, County shall have the right to review Contractor’s data privacy and information and cyber security program prior to commencement of Services and from time to time during the term of this Contract.

All data belongs to the County and shall be destroyed or returned at the end of the contract via digital wiping, degaussing, or physical shredding as directed by County. 46 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
Notification shall be sent to:

Rafael Linares
Chief Information Security Officer
1055 N. Main St., 6th Floor
Santa Ana, CA 92701
Phone: (714) 567-7611
[email protected]
Linda Le, CHPC, CHC, CHP
County Privacy Officer
1055 N. Main St., 6th Floor
Santa Ana, CA 92701
Phone: (714) 834-4082
[email protected]
I. Security Audits: Contractor shall maintain complete and accurate records relating to its system and Organization Controls (SOC) Type II audits or equivalent’s data protection practices, internal and external audits, and the security of any of County-hosted content, including any confidentiality, integrity, and availability operations (data hosting, backup, disaster recovery, external dependencies management, vulnerability testing, penetration testing, patching, or other related policies, practices, standards, or procedures).

Contractor shall inform County of any internal/external security audit or assessment performed on Contractor’s operations, information and cyber security program, disaster recovery plan, and prevention, detection, or response protocols that are related to hosted County content, within sixty (60) calendar days of such audit or assessment. Contractor will provide a copy of the audit report to County within thirty (30) days after Contractor’s receipt of request for such report(s).
suspected breach; (3) provide a remediation plan that is acceptable to County within 30 days of verified breach, to address the occurrence of the breach and prevent any further incidents; (4) conduct a forensic investigation to determine what systems, data, and information have been affected by such event; and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, forensics, investigative evidence, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County).

County shall make the final decision on notifying County officials, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required.

Contractor shall reimburse County for all notification and related costs incurred by County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications.

In the case of a breach, Contractor shall provide third-party credit and identity monitoring services to each of the affected individuals for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following the date of notification to such individuals.

Contractor shall indemnify, defend with counsel approved in writing by County, and hold County and County Indemnitees harmless from and against any and all claims, including reasonable attorney’s fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from County in connection with the occurrence.
47 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
J. Business Continuity and Disaster Recovery (BCDR):

For the purposes of this section, “Recovery Point Objectives” means the maximum age of files (data and system configurations) that must be recovered from backup storage for normal operations to resume if a computer, system, or network goes down as a result of a hardware, program, or communications failure (establishing the data backup schedule and strategy). “Recovery Time Objectives” means the maximum duration of time and a service level within which a business process must be restored after a disaster (or disruption) in order to avoid unacceptable consequences associated with a loss of functionality.

The Contractor shall maintain an comprehensive risk management program focused on managing risks to County operations and data, including mitigation of the likelihood and impact of an adverse event occurring that would negatively affect contracted services and operations of the County. Business continuity management will enable the Contractor to identify and minimize disruptive risks and restore and recover hosted County businesscritical services and/or data within the agreed terms following an adverse event or other major business disruptions. Recovery and timeframes may be impacted when events or disruptions are related to dependencies on third parties. The County and Contractor will agree on Recovery Point Objectives and Recovery Time Objectives (as needed)) and will periodically review these objectives. Any disruption to services of system will be communicated to the County within 4 hours, and every effort shall be undertaken to restore contracted services, data, operations, security, and functionality.

All data and/or systems and technology provided by the Contractor internally and through third-party vendors shall have resiliency and redundancy capabilities to achieve high availability and data recoverability. Contractor Systems shall be designed, where practical and possible, to ensure continuity of service(s) in the event of a disruption or outage [Remainder of this page intentionally left blank]
Contractor shall reasonably cooperate with all County security reviews and testing, including but not limited to penetration testing of any cloud-based solution provided by Contractor to County under this Contract. Contractor shall implement any required safeguards as identified by County or by any audit of Contractor’s data privacy and information/cyber security program.

In addition, County has the right to review Plans of Actions and Milestones (POA&M) for any outstanding items identified by the SOC 2 Type II report requiring remediation as it pertains to the confidentiality, integrity, and availability of County data. County reserves the right, at its sole discretion, to immediately terminate this Contract or a part thereof without limitation and without liability to County if County reasonably determines Contractor fails or has failed to meet its obligations under this section. 48 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

CONTRACT SIGNATURE PAGE
IN WITNESS WHEREOF, the Parties hereto have executed this Contract RCA-017-23010029 on the date set forth opposite their signature(s).

Contractor shall provide two signatures as follows:
1) The first signature must be either the Chairman of the Board, President, or any Vice President; 2) The second signature must be that of the Secretary, an Assistant Secretary, the Chief Financial Officer, or any Assistant Treasurer.

In the alternative, a single corporate signature is acceptable when accompanied by a corporate resolution or by-laws demonstrating the legal authority of the signature to bind the company.

Tevora Business Solutions, Inc.

Signature # 1
Print Name Title
Signature Date
Signature # 2
Print Name Title
Signature Date
County of Orange, a political subdivision of the State of California Deputy Purchasing Agent Authorized Signature:

Timothy Shears, DPA Deputy Purchasing Agent
Print Name Title
Signature Date
EVP of Sales
12/14/2022
12/14/2022
Nazy Fouladirad CFO
Steve Stumpfl
Dec 27, 2022
49 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

ATTACHMENT A

SCOPE OF WORK
I. Introduction
The County of Orange (County) is establishing this Regional Cooperative Agreement (RCA) for the provision of Cybersecurity Assessment and Audit Services on an as-needed basis. RCAs awarded by the County of Orange are intended to be used as cooperative agreements against which individual subordinate contracts may be executed by participating County agencies/departments and non-County public entities, during the term of the RCA. Subordinate contracts issued under the contemplated RCA shall incorporate all of the RCA terms, conditions, and pricing.

County agencies/departments and non-County public entities may utilize the RCA by contracting directly with the Contractor using a subordinate contract. All subordinate contracts executed against this RCA shall include a project specific, detailed Scope of Work and shall incorporate by reference the terms and conditions of the RCA.

II. Contractor’s Requirements
Cybersecurity Assessment Contractor Requirements:

Contractor shall:

1. Conduct requested cyber security assessments and cyber security gap analysis and prepare written reports of findings (infrastructure security assessments). The written report component of all infrastructure security assessments shall include specific recommended actions to accomplish short and long-term remediation of the County’s cyber security infrastructure, processes and procedures, and specifically identify steps necessary to bring any such infrastructure, processes and procedures into compliance with applicable state and federal regulations.

2. Comply with all applicable state and federal regulations as they now exist or may hereafter be modified, changed, or amended during the Term of this Contract, regarding data confidentiality, including, but not limited to, the information security requirements of the following:
a. Title 42, USC § 290dd–2
b. Title 42, CFR Part2
c. Title 42, CFR Part 96, § 96.132(e)
d. Title 42, USC §§ 1320d through 1320d-8
e. Title 42, CFR §§ 431.300 et. seq.
f. Title 45, CFR Parts 160, 162, and 164 – the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act (the Final Omnibus Rule)
g. Title 45, CFR §§ 205.50 et. seq
h. Welfare and Institutional code, § 14100.2, which is specific to Medi-Cal i. HSC §§ 11812 and 11845.5
j. HSC §§ 123110 through 123149.5 – Patient Access to Health Records k. Title 22, CCR § 51009, which is specific to Medi-Cal l. Civil Code §§ 56 through 56.37 – Confidentiality of Medical Information Act m. Civil Code §§ 1798.80 through 1798.82 – Customer Records (breach of security) 50 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
n. Civil Code § 1798.85 – Confidentiality of Social Security Number o. The American Recovery and Reinvestment Act of 2009 (ARRA) Electronic Health Records (EHR) Incentive Program – Meaningful Use
p. U.S. Department of Justice Federal Bureau of Investigation Criminal Justice Information Services (CJIS) Security Policy
q. Payment Card Industry (PCI) Data Security Standard (DSS) r. Department of Motor Vehicles (DMV) – Information Security Agreement (ISA) s. The Social Security Administration (SSA) (Computer Matching and Privacy Protection Act Agreement, Information Exchange Agreement and Electronic Information Exchange Security Requirements and Procedures for State and Local Agencies Exchanging Electronic Information) t. The Department of Homeland Security, United States Citizenship and Immigration Services (DHS-USCIS) Computing Matching Agreement
u. The Internal Revenue Service (IRS) Publication 1075 Tax Information Security Guidelines

3. The Parties understand and agree that the methodologies used for the performance and preparation of the IT Infrastructure Security Assessments shall include a combination of hardware and software tools, utilities, and will be performed in accordance with industry best practices. Therefore, the tests listed herein are a sub-set of all the activities expected in order to properly identify and resolve potential points of security failure in the following areas:
a. Architectural design,
b. Infrastructure,
c. Software application,
d. Authentication,
e. Maintenance process,
f. Process,
g. Procedures, or
h. Other factors that would impact solution security and/or “Fit-for-Use” of the intended business application.

All testing and data shall be encrypted based on a testing plan developed/approved by the County for each SAE.

III. Cybersecurity Assessment Services
A. HIPAA Audit Services

1. Conduct a thorough analysis of the current standing of County business practices in relation to the HIPAA Privacy Rule and the HIPAA Security Rule. This will include current County operations and policy status as compared to HIPAA Privacy and Security Rule standard (45 CFR §164.308, 164.310, 164.312, 164.314, 164.316) and specific remediation steps to correct potential violations. The Analysis will include all HIPAA connected offices and departments, related administrative policies and procedures, physical facility and office conditions, and information technologies in use by County.

2. Compare HIPAA Privacy and Security regulations with all California state security and confidentiality statutes and identify which state statutes are more restrictive than the federal law.

3. Conduct onsite visits of all involved agencies in order to evaluate physical structures to 51 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

4. Interview selected management and staff members regarding common privacy and security related practices within agencies and between agencies to include, but not be limited to, disposal, storage, and encryption practices or procedures.

5. Identify all information systems and communication networks that store, maintain, or transmit electronically-stored Protected Health Information (“ePHI”) and determine compliance with HIPAA Privacy and Security regulations or other state privacy and security statutes.

6. Evaluate the potential risks, including all associated potential financial costs (inclusive of, but not limited to, notifying the public of release of Protected Health Information (“PHI”) and other financial exposure), associated with how the different agencies collect, use, manage, house, disclose and dispose of information and evaluate options or changes to current practices in order to meet HIPAA Privacy and Security regulations or other state privacy and security statutes. Evaluate risks related to management, investigation and remediation of privacy and security breaches.

7. Analyze the current County physical and electronic PHI-handling and monitoring practices against the requirements of HIPAA Privacy and Security regulations and identify areas of noncompliance.

8. Review County procedures for release, disclosure and recording of health information for compliance with each of the following HIPAA Privacy and Security standards:
a. 164.308 Administrative Safeguards
b. 164.310 Physical Safeguards
c. 164.312 Technical Safeguards
d. 164.502(b) Standard: Minimum Use and Disclosure of PHI e. 164.530(a) Standard: Personnel Designations
f. 164.530(b) Standard: Training
g. 164.530(c) Standard: Safeguards
h. 164.530(d) Standard: Complaints to the Covered Entity i. 164.530(e) Standard: Sanctions
j. 164.530(f) Standard: Mitigation
k. 164.530(g) Standard: Refraining from Intimidating and Retaliatory Acts l. 164.530(h) Standard: Waiver Rights
m. 164.530(i) Standard: Policies and Procedures
n. 164.530(j) Standard: Documentation

9. Review the County HIPAA Breach incident reporting and response practices, procedures and policies for sufficiency.

10. Review a sampling of County Contracts, Master Agreements, Memoranda of Understanding, Service Agreements, and other organizational relationships for HIPAA Privacy and Security compliance.

11. Review County HIPAA Privacy and Security training modules currently used by the agencies to determine if there are gaps between training content and HIPAA Privacy and Security standards or state privacy and security statutes. Evaluate training module to determine appropriate changes to improve training efficacy. Identify training requirements for staff, management, and executive levels to include determination if some training should be procured externally for specific programs and services.

12. Review County Human Resource Services policies, procedures and practices for HIPAA Privacy and Security compliance, including the review of all HIPAA-related agreements for new hires (County employees, Contracted employees, temporary employees, volunteers, etc.), the sufficiency of the HIPAA Privacy and Security Officers’ job descriptions and job determine if building or space modifications are required to comply with HIPAA Privacy and Security regulations or other state privacy and security statutes. 52 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

13. Describe in detail the analysis process to be followed for each division/program including a work plan documenting tasks to be accomplished, timeframes and the responsible Party.

14. Commence requested HIPAA Audit within fifteen (15) calendar days of Contract award and complete the analysis within one hundred twenty (120) calendar days of Contract award.

Submit to County a comprehensive report detailing the findings of the audit, due within fifteen (15) calendar days of completing the field analysis (timeframe for completion to be negotiated).

15. Suggest specific short and long-term projects and remediation for each individual audited agency, including a tentative timeframe and budget, for the correction of identified discrepancies in HIPAA Privacy and Security compliance.

16. Provide written verification of all residence status and signed non-disclosure agreements for all staff to provide services under this Contract. Contractor’s staff shall be knowledgeable of all required software and scanning tools.

17. Not change the project staff during the duration of any engagement unless approved by the County in writing.

18. Supply all of its own hardware, software, media and materials required to complete a project under this Contract. Contractor shall provide evidence of ownership of any software used during the engagement and certify that any software installed has been removed prior to the close-out meeting with the County.

B. Payment Card Industry Data Security Standard (PCI DSS) The PCI DSS is payment card network (Visa, Mastercard, Discover, and American Express) and industry-mandated requirements for handling of credit card information, classification of merchants, and validation of merchant compliance. Merchants are responsible for the security of cardholder data. They must be careful not to store certain types of data on their systems or the systems of their third-party service providers. Merchants are also responsible for any damages or liability resulting from a data security breach or other non-compliance with the PCI DSS. The PCI DSS encompasses all merchants and third-party service providers that store, process, or transmit cardholder data.

Contractor shall:

1. Hold certifications to validate merchant compliance with PCI DSS (Qualified Security Assessor) and perform vulnerability scanning (Approved Scanning Vendor).

2. Provide services to ensure the security, confidentiality, and integrity of payment transactions and cardholder information.

3. Provide services to ensure the periodic review to identify new and emerging threats and vulnerabilities.

4. Provide services to take appropriate measures to remediate and remove emerging and existing threats and vulnerabilities.

5. Provide services to achieve compliance with the PCI DSS, including, but not limited to, network scans, penetration tests, self-assessment questionnaires, attestations of compliance, and compliance reports.

C. Policies & Procedures Review and Development
Contractor Shall:

1. Prepare Procedures for the County

2. Address how PII and PHI shall be controlled by setting forth what uses and disclosures are authorized or required including what rights patients have with respect to their health information.

3. Be structured to have countywide applicability, provided, however, that agency-specific assessments, employee disciplinary process and the protocol for addressing breach-related infractions.
53 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
policies and procedures shall be developed as deemed necessary.

4. Conduct a review of Cyber Security Awareness Training Contractor shall:

1. Review mandated Cyber Security Awareness training programs for all County staff and, if necessary, develop necessary enhancements and/or a training plan (timeframe for completion to be negotiated). The training plan shall include:
a. All federally mandated Privacy and Security and state privacy and security requirements, respectively.
b. A plan to validate the effectiveness of training programs. c. List, in order of importance, the topics to be included in the training programs.

2. Develop a training plan which includes all federally mandated Privacy and Security and state privacy and security requirements, respectively.

3. Develop a plan to validate the effectiveness of training programs.

4. List, in order of importance, the topics to be included in the training programs.

5. Describe what Contractor considers effective communication and training techniques to maximize the effectiveness of training programs.

6. Describe how the Contractor would incorporate agency specific information into this training D. On-Site Validation of Physical Security Controls:

1. Assessment: Federal and State regulations requires compliance with Safeguards to protect the confidentiality, integrity, and availability of Personal Identifiable Information (PII) and Protected Health Information (PHI). Contractor shall assess the state of County compliance with the following areas:
a. Administrative Safeguards
b. Physical Safeguards
c. Technical Safeguards
d. Organizational Requirements

2. Reporting: A compliance report shall be issued which includes an assessment of County’s compliance with the regulations, along with risk rated prioritization of recommendations for remediation of any identified compliance gaps.

E. Security Risk Analysis

1. Contractor shall perform a risk assessment of the PII and PHI held by the County. The assessment will include the following stages:
a. Asset Identification: Work with Contractor(s) personnel to identify each asset where PHI is either stored or transmitted.
b. Threat Identification: Facilitate a review with Contractor to identify the types of threats that may affect the identified assets.
c. Vulnerability Identification: Facilitate a review with Contractor to identify any known or likely vulnerabilities to the identified assets.
d. Inherent risk: Based on the above details, Contractor will facilitate a risk assessment of the inherent risk to PHI in the identified assets.
e. Controls identification: Identify any existing controls that may reduce the inherent risk for these assets.
f. Gaps identified: Based on the threats, vulnerabilities, and controls identified, and using 54 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
the assessors’ judgment, what are the current gaps?
g. Residual risk: Reevaluate the risk of to the asset based on the existing controls. h. Recommended remediation: Based on the residual risks, a list of recommended controls will be recommended for consideration.

2. Contactor shall deliver a risk assessment report that will include the results from each portion of the assessment, the final risk profile, and potential solutions.

F. Penetration Testing

1. Internal Penetration Test:

Taking a vulnerability assessment beyond a simple “check the box” approach, Contractor should use an attacker mindset to increase the effectiveness and findings of the internal assessment. In this case, the assessment is specifically targeting network. Infrastructure and segmentation, end-user workstations, and exfiltration techniques. Contractor must use a realistic perspective of the effectiveness of the defensive mechanisms currently in place at preventing and detecting an attacker. In general terms, exploitations techniques are listed below.
a. Internal network reconnaissance
b. System fingerprinting
c. Server and workstation configuration flaws
d. Privilege escalation
e. Vulnerability exploitation
f. Password policy requirements
g. Database vulnerability scanning
h. Firewall and ACL testing
i. Protocol poisoning
j. Egress testing
k. Website filtering
l. Insider threat analysis

2. External Penetration Testing
Included in the scope of this security assessment, is an external network penetration test.

Contractor(s) security methodology should include more than a simple IP range scan testing of a variety of vulnerabilities. Going beyond the surface, Contractor(s) security professionals should apply advanced attacker tactics and techniques targeting the external infrastructure including routers, servers, VPNs, firewalls, and any other external services. However, in contrast with the external penetration test, the external vulnerability assessment focuses more on vulnerability discovery and remediation than exploitation and impact identification. Attacks that may be included in the external penetration test are listed below. a. System Fingerprinting
b. Services Probing
c. Analysis and Identification of Attack Vectors (including social engineering) d. Exploit Testing
e. Authentication Attacks
55 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
f. Vulnerability Exploitation
g. Privilege Escalation
h. Exploitation of Configuration Flaws
The scope of the external network vulnerability assessment will include external IP addresses maintained by County. Prior to the assessment beginning, County will provide Contractor Security with the list of IP addresses to be included in the assessment.

3. Social Engineering
Social engineering penetration testing may consist of, but not limited to, common scams to test employees' adherence to the security policies and practices or various types of phishing attempts for the purpose of determining the organization's level of vulnerability to this type of exploit and the effectiveness of the organization’s cyber security awareness training.

4. Project Report
Upon completion of the penetration test, Contractor will provide a report to County within fourteen (14) days of completion. The report will contain documented and detailed findings as a result of performing the services contained and outlined.

G. One-time compromise testing
Similar to penetration testing, the goal of this service is to evaluate information technology infrastructure, systems and services as well as employee workspace for the presence of attacker activity. The purpose of this assessment is to identify or confirm security breaches that currently or may have existed for extended periods of time resulting in the theft of valuable intellectual property, personally identifiable information, protected health information, payment card information, or other sensitive information.

H. Cyber Incident Response Remediation
Incident response is an organized approach to addressing and managing the aftermath of a security breach or attack (also known as an incident). The goal is to handle the situation in a way that limits damage and reduces recovery time and costs to the organization.

I. DHS Cyber Resilience Review (CRR)
Contractor shall provide services to perform and facilitate for the completion of the DHS CRR assessment. In addition, the County has a GRC platform where the completed assessment and final report should be submitted by the vendor.

The CRR is an interview-based assessment of an organization’s cybersecurity management program. It seeks to understand the cybersecurity management of services, and their associated assets, that are critical for an organization’s mission success. The CRR focuses on protection and sustainment practices within key areas that typically contribute to the overall cyber resilience of an organization. The CRR measures essential cybersecurity capabilities and behaviors to provide meaningful indicators of an organization’s operational resilience during normal operations and during times of operational stress.

The CRR is derived from the CERT Resilience Management Model (CERT-RMM), a process improvement model developed by Carnegie Mellon University’s Software Engineering Institute for managing operational resilience. The CRR is based on the premise that an organization deploys its assets (people, information, technology, and facilities) to support specific critical services or products. Based on this principle, the CRR evaluates the maturity of your organization’s capacities and capabilities in performing, planning, managing, measuring and defining cybersecurity capabilities across 10 domains.
https://www.cisa.gov/uscert/resources/assessments
56 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
IV. Deliverables
A. IT infrastructure Security Assessment Engagements (SAE) These engagements shall include the following components as described below:

1. Host Review – Contractor shall scan, automatically and manually, for any and all potential vulnerabilities in the host-based components of the specific IT infrastructure. Targeted systems may include, but are not limited to, servers, workstations, routers and firewalls. The Contractor shall look for missing patches, misconfigurations, un-patched or enabled services, inappropriate user accounts and other related problems on the target hosts. The Contractor shall provide recommendations for remediation of all vulnerabilities discovered. Both vulnerabilities and recommendations shall be provided to the County electronically, in an Excel 2016 or later file format.

2. Network Architecture – Contractor shall look for vulnerabilities at various layers of the target environment and test for flaws in the targeted environment including, but not limited to, network connectivity (including wireless) and router and firewall designs to control network access between the target servers and the rest of the County IT infrastructure. The Contractor will determine if the architecture and implementation protections are appropriate for the specified servers and at the right network layer, to secure the servers from potential types of attacks from other parts of the network and/or the Internet.

3. Enterprise Architecture Review – Contractor shall review (via documentation, interviews and testing) the system’s appropriateness for the specific purpose identified by the County and provide a security architectural assessment documenting key assumptions and impacts, including, but not limited to, security model, host access, system controls, authentication, administration, maintenance, business resiliency and continuity.

Enterprise Architecture Review activities shall include, but not be limited to, the following automatic and manual tasks:
a. Architectural review of the infrastructure for best practices and security weakness. b. Network topology review and device scanning for identification and mapping. c. Host review of all hardware/software configurations settings, patches, versions, etc. d. Host scan for all known applications, services, code engine and database vulnerabilities. e. Identify all known sever and application administration flaws. f. Review intended data flows between web, applications, databases and other systems. g. Test County’s infrastructure for: Social Engineering weaknesses, wireless capabilities, etc. h. Review settings for account authentication, authorization and audit controls. i. Identify areas where regulatory compliance might not exist or be at risk. j. Identify opportunities to write to the host file system or execute uploaded files. k. Identify inappropriate files, debugging information, developer accounts, etc. l. Review if fraudulent transactions across architectural separation can be performed. m. Review Operational Procedures documentation for the specific tested solution. n. Review for IT Solution weakness or non-best practices for this intended purpose. o. Certification of the specific tested solution as “Secure Fit-for-Use.” B. Software Application Security Assessments
57 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
These engagements shall involve the four (4) service areas identified below:

1. Application Architecture Review – Contractor shall review the software to assess security weaknesses that occur as a result of the design, use of coding techniques, use of tiers for different service layers, web services, thick client modules, etc.

2. Database Security Review – Contractor shall review the database usage and design as part of this assessment. The data classification for the data fields is a key part of assessing the security of the database, as well as, authentication, authorization, access controls and a nonexhaustive list of characteristics listed in the Compensation, Pricing and Payment schedule in Attachment B – Compensation, Pricing and Payment.

3. Web Application Penetration Test – Contractor shall attempt to breach the web site and web pages contained within the County’s web application solution. The County will also provide at least two sets of credentials, which the Contractor shall use to try to escalate their rights/access to the web site. As part of this test, the Contractor shall document all potential weaknesses discovered.

4. Application Code Review – Contractor shall complete detailed application design discussions with actual developers and/or support engineers responsible for; coding, technical support, network and databases in order to build a threat model that exposes the vulnerabilities of the application. This model shall be analyzed and recommendations shall be provided to allow remediation. Since the Contractor is a security expert, they shall also provide a statement as to the fit-for-use of this application for the County’s business application or solution.

C. Policies and Procedures Review and Development

1. Policies & Procedures Review

2. Physical Security Review

3. Training

4. Social Engineering Assessment

5. Organizational Cultural Review
V. Reporting Requirements
All reporting requirements shall be handled as Confidential Information and provided over secured medium ONLY to the County’s Designated Representative.

A. Daily Progress Updates:
• Contractor shall provide written daily progress updates of the engagement to the County’s Designated Representative.
• Immediately report to County’s Designated Representative any issues detected that require urgent attention and mediation.
• Report shall indicate “there was no activity today” if applicable. • Report to include details for preliminary findings, potential and or identified issues (security, schedule, risk, etc.) and recommendations for remediation. • Contractor shall arrange a meeting with the County’s Designated Representative to review any critical findings which might impact the assessment and/or remediation schedule.

B. Findings and Recommendations
• For each SAE and upon request, Contractor shall provide the County’s Designated Representative a daily, weekly, or periodic report of Findings and Recommendations. 58 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
• Contractor shall report findings and recommendations in accordance with compliance laws and regulations listed above.
• Contractor shall destroy the report(s) at the direction of the County’s Designated Representative.
• Contractor shall not distribute the report(s) to any other persons other than the Contractor’s Representative. General support staff of the Parties is not to receive the report nor the findings of the report even if the general staff was involved in some portion of the SAE. • Prepare and deliver on request an executive level summary of findings and recommendations.

C. Activity Log
• For each SAE or the execution of a subordinate contract executed by participating County departments, Contractor shall provide an activity log at the beginning of each engagement. • Contractor shall provide certification of remediation performed by the County. Certification shall be provided the following week after the County performs any required remediation.

D. Close-Out
• Contractor shall provide working draft Close-Out reports during and at the end of each engagement or at other times as requested by the County’s Designated Representative. • The Close-Out reports shall consist of the following:
i. Executive overview highlighting the scope, approach, and final Security Certification statement;
ii. Technical summary highlighting the risk rating for major findings and remediation by area; iii. Detailed technical section which includes the business or technical risk for each vulnerability finding with remediation and how to eliminate or reduce the risk; and iv. Electronic spreadsheet of findings with columns for risk, ranking, type, impacted systems, risk (H-M-L), recommended action, actual resolution.
v. Grading report and/or standing with compliance to the laws and regulations listed above.

End of Attachment A
59 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

ATTACHMENT B

COMPENSATION, PRICING AND PAYMENT
A. Compensation: Contractor agrees to provide services at the fixed rates and prices, and agrees to accept the specified compensation as set forth in this Contract as full remuneration for (a) providing all Services and furnishing all staffing and materials required under this Contract, (b) any reasonably unforeseen difficulties which may arise or be encountered in the performance of the Services until acceptance, (c) risks connected with the Services, and (d) performance by Contractor of all its duties and obligations required herein as they now exist or may hereafter be amended.

Except for the payment of its fees, neither Contractor nor Contractor’s agents, employees, or subcontractors, are entitled to any damages from County, nor is any Party entitled to be reimbursed by County, for damages, charges, or other losses or expenses incurred by Contractor by reason of delays or hindrances in the performance of the Services, whether or not caused by County.

B. Pricing: Contractor shall bill County for goods provided and services rendered according to the rates listed in Section F, “Pricing” below.

C. Price Increase/Decreases: No price increases will be permitted during the first period of the Contract. The County requires documented proof of cost increases on Contracts prior to any price adjustment. A minimum of 30-days advance notice in writing is required to secure such adjustment. No retroactive price adjustments will be considered.

All price decreases will automatically be extended to the County. The County may enforce, negotiate, or cancel escalating price Contracts or take any other action it deems appropriate, as it sees fit. The net dollar amount of profit will remain firm during the period of the Contract. Adjustments increasing the Contractor’s profit will not be allowed.

D. Payments and Invoicing:

Contractor shall reference Contract number on invoice. Payment will be in arrears and net forty-five (45) days after receipt of an invoice in a format acceptable to County and verified and approved by County and subject to routine processing requirements. The responsibility for providing an acceptable invoice rests with Contractor.

Billing shall cover services and/or goods not previously invoiced. Contractor shall reimburse County for any monies paid to Contractor for goods or services not provided or when goods or services do not meet Contract requirements.

Payments made by County shall not preclude the right of County from thereafter disputing any items or services involved or billed under this Contract and shall not be construed as acceptance of any part of the goods or services.

Contractor will provide an invoice on Contractor’s letterhead for services rendered. Each invoice will have a number and will include the following information:

1. Contractor’s remittance address 5. Service Description

2. Name of County agency department 6. Contractor’s Federal Taxpayer Identification Number

3. County Subordinate Contract number 7. Total Invoice Amount

4. Service date(s)
E. Payment (Electronic Funds Transfer): County offers Contractor the option of receiving payment directly to its bank account via an Electronic Fund Transfer (EFT) process in lieu of a check payment. Payment made via EFT shall also receive an Electronic Remittance Advice with the payment details via e-mail. An e-mail address shall need to be provided to County via an EFT Authorization Form. Contractor may request a form from the agency/department representative listed in the Contract. 60 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
F. Pricing:

DESCRIPTION
1 HIPAA Risk Assessment
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

1.1 Small

1.5 Weeks $20,250.00 $20,958.00
Number of systems and network devices: 1 to 50
Number of personnel to interview: 1 to 5
Number of business associates that have access to
ePhi: 1 to 5

1.2 Medium
2 Weeks $27,000.00 $27,945.00
Number of systems and network devices: 51-100
Number of personnel to interview: 5-10
Number of business associates that have access to
ePhi: 5-10

1.3 Large
3 Weeks $40,500.00 $41,917.00
Number of systems and network devices: 101-200
Number of personnel to interview: 11-30
Number of business associates that have access to
ePhi: 11-20
2 PCI Gap Analysis
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

2.1 Small
1 Week $13,500.00 $13,972.00
Locations: Up to 2
DR Facilities: Up to 2
Employees to Interview: Up to 15
Number of Servers: Up to 1,000
Number of Workstations: Up to 500
Number of services included in-scope: Up to 2
61 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

2.2 Medium

1.5 Weeks $20,250.00 $20,958.00
Locations: Up to 3
DR Facilities: Up to 2
Employees to Interview: Up to 20
Number of Servers: Up to 2,000
Number of Workstations: Up to 1,000
Number of services included in-scope: Up to 3

2.3 Large
2-3 Weeks $30,750.00 $31,826.00
Locations: Up to 5
DR Facilities: Up to 2
Employees to Interview: Up to 25
Number of Servers: Up to 3,000
Number of Workstations: Up to 1,500
Number of services included in-scope: Up to 4
3 Level One PCI Assessment
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

3.1 Small
2 Weeks $27,000.00 $27,945.00
Locations: Up to 2
DR Facilities: Up to 2
Employees to Interview: Up to 15
Number of Servers: Up to 1,000
Number of Workstations: Up to 500
Number of services included in-scope: Up to 2

3.2 Medium
3 Weeks $40,500.00 $41,917.00
Locations: Up to 3
DR Facilities: Up to 2
Employees to Interview: Up to 20
Number of Servers: Up to 2,000
Number of Workstations: Up to 1,000
Number of services included in-scope: Up to 3
62 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

3.3 Large
4-4.5 Weeks $54,000.00 $55,890.00
Locations: Up to 5
DR Facilities: Up to 2
Employees to Interview: Up to 25
Number of Servers: Up to 3,000
Number of Workstations: Up to 1,500
Number of services included in-scope: Up to 4
4 PCI Policy and Procedure Creation
Service Level (customized policies) Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

4.1 Small
1 Week $13,500.00 $13,972.00
1-5 policies

4.2 Medium
2 Weeks $27,000.00 $27,945.00
6-10 policies

4.3 Large 3 Weeks $40,500.00 $41,917.00 11 to 15 policies 5 PCI Policy and Procedure Templates
Service Level (template policies) Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

5.1 Small
2 Days $5,400.00 $5,589.00
1-10 policies

5.2 Medium
4 Days $10,800.00 $11,178.00
11-15 policies

5.3 Large 6 Days $16,200.00 $16,767.00 16 to 20 policies 6 DHS Cyber Resilience Procedure Review
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

6.1 Normal
2-3 Weeks $33,750.00 $34,931.00 Includes interviews with county department personnel only

6.2 Add-On
2-3 Days $5,400.00 $5,589.00 Include one third party in interview process 7 Policy and Procedure Review and Development Services
Service Level (customized policies for any
requirements) Timeline CostYears 1 - 3
Cost
Years 4 - 5

7.1 Small
2 Weeks $27,000.00 $27,945.00
1 to 10 policies

7.2 Medium
3 Weeks $40,500.00 $41,917.00
11 to 15 policies
63 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

7.3 Large

3.5-4 Weeks $47,250.00 $48,903.00 16 to 20 policies
8 On-Site Validation of Physical Security Controls
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

8.1 Normal
2-3 Days $5,400.00 $5,589.00
One department, one location

8.2 Add-On Additional location 1 Day $2,700.00 $2,794.00 9 Security Risk Analysis Services
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

9.1 Small

1.5 Weeks $20,250.00 $20,958.00
Number of workstations: Up to 250
Number of systems and network devices: Up to 100
Number of personnel to interview: Up to 15 Number of
core applications in scope: Up to 2

9.2 Medium
3 Weeks $40,500.00 $41,917.00
Number of workstations: 251-1000
Number of systems and network devices: Up to 400
Number of personnel to interview: Up to 20
Number of core applications in scope: Up to 3

9.3 Large
4-5 Weeks $60,750.00 $60,876.00
Number of workstations: over 1000
Number of systems and network devices: Up to 5,000
Number of personnel to interview: Up to 30
Number of core applications in scope: Up to 8
10 Vulnerability Assessment
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

10.1 Small

1.5 Weeks $20,250.00 $20,958.00
Number of devices: 1-1000

10.2 Medium

2.5 Weeks $33,750.00 $34,931.00 Number of devices: 1001-2000

10.3 Large 3.5 Weeks $47,250.00 $48,903.00 Number of devices: 2,001-5,000

10.4 Add-On Remediation Validation 1 Day $2,700.00 $2,794.00 11 External Penetration Testing
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

11.1 Small
1 Week $13,500.00 $13,972.00
1-50 devices

11.2 Medium
2 Weeks $27,000.00 $27,945.00
51-150 devices

11.3 Large 3 Weeks $40,500.00 $41,917.00
151-500 devices
64 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services
11 External Penetration Testing
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

11.4 Add-On Remediation Validation 1 Day $2,700.00 $2,794.00 12 Social Engineering Penetration Test
Service Level (phone or email testing) Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

12.1 Phone Testing Small 1-5 targets 3 Days $8,100.00 $8,359.00

12.2 Phone Testing Medium 6-12 targets 1 Week $13,500.00 $13,972.00

12.3 Phone Testing Large 13-50 targets 2 Weeks $27,000.00 $27,945.00

12.4 Email Testing Small 1-25 targets 3 Days $8,100.00 $8,359.00

12.5 Email Testing Medium 26-100 targets 1 Week $13,500.00 $13,972.00

12.6 Email Testing Large 101-1000 targets 1.5 Weeks $20,250.00 $20,958.00 13 One Time Compromise Testing Services
Service Level Estimated
Timeline*
Per Hour
Years 1 - 3
Per Hour
Years 4 - 5

13.1 Small
40 Hours $350.00 $362.00
1-2 devices

13.2 Medium
80 Hours $350.00 $362.00
3-10 devices

13.3 Large
120 Hours $350.00 $360.00
11-25 devices
14 Incident Response Readiness Assessment
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

14.1 Small

2.5 Weeks $33,750.00 $34,931.00 Readiness Assessment Report

14.2 Medium

3.5 Weeks $47,250.00 $48,903.00 Readiness Assessment Report Incident Response Plan

14.3 Large
Readiness Assessment Report Incident Response Plan 4.5 Weeks $60,750.00 $62,876.00 Five (5) Runbooks
15 Incident Response Support Hours
Service Level Per Hour
Years 1 - 3
Per Hour
Years 4 - 5

15.1 With Completed Readiness Assessment $400.00 $414.00

15.2 Without Completed Readiness Assessment $450.00 $465.00 16 Network Security Assessment
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

16.1 Small
1 Weeks $13,500.00 $13,972.00
1-50 devices

16.2 Medium
2 Weeks $27,000.00 $27,945.00
51-200 devices
65 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

16.3 Large 3 Weeks $40,500.00 $41,917.00
201-1000 devices
17 Software Application Security Assessment
Service Level Timeline Cost
Years 1 - 3
Cost
Years 4 - 5

17.1 Low Complexity 1-5 active pages 1 Week $13,500.00 $13,972.00

17.2 Medium Complexity 6-20 active pages 1.5 Weeks $20,250.00 $20,958.00

17.3 High Complexity 21-50 active pages 2.5 Weeks $33,750.00 $34,931.00

17.4 Add-On Remediation Validation 1 Day $2,700.00 $2,794.00 18 ADDITIONAL CONSULTING (NOT INCLUDED IN ABOVE ACTIVITIES) Additional Consulting Per Hour
Years 1 - 3
Per Hour
Years 4 - 5

18.1 Basic Security Tester $220.00 $227.00

18.2 Web Penetration Expert $225.00 $232.00

18.3 Senior Security Specialist $325.00 $336.00
End of Attachment B
66 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

ATTACHMENT C
County of Orange Information Technology Security Standards (See separate Attachment)
67 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

ATTACHMENT D
Business Associate Contract
(See Separate Attachment)
68 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

ATTACHMENT E

CERTIFICATION OF RETURN OR DESTRUCTION AND NON-DATA BREACH Upon the earlier of the closing of this project engagement, as a result of completion and/or other means, or the request (at any time) of County, Contractor shall (1) thoroughly complete the tables herein with information sufficient to allow the County to account for its documents, materials, and information and ensure their secure return or destruction; (2) at the County’s option and pursuant to the County’s written authorization: (a) return all copies of documents, materials, and information obtained from, or on behalf of, the County; and/or (b) securely destroy all documents, materials, and information obtained from, or on behalf of, the County; and (3) sign the certification below.

In the event Contractor returns documents, materials, and information to the County, the Contractor shall thoroughly complete the following table (including additional lines as needed):

Vendor Project What was supplied to the Vendor
and Date
What was returned to the County
and Date
In the event the County authorizes certain documents, materials, and information not to be returned to the County and authorized their destruction, Contractor shall securely destroy the residual data in accordance with secure destruction NIST Special Publication 800-88 Revision 1 (or the most current version) or a documented manner acceptable to the County Chief Security Officer and thoroughly complete the following table (including additional lines as needed):

Vendor Project Unique Certificate
Number
What was securely
destroyed?
When was it securely
destroyed?
The undersigned hereby certifies that Contractor has returned or securely destroyed all copies of documents and materials provided to it by, or on behalf of, the County of Orange, as described on the attached Receipt Acknowledgements, other than those documents and materials listed in Attachment A to this certification. The undersigned further certifies that there have been no known or suspected data breaches pertaining to the documents and materials described on the attached Receipt Acknowledgments while they were in the possession, custody or control of Tevora Business Solutions, Inc. and its approved Affiliates, if any.

Tevora Business Solutions, Inc.

Name:
_____________________________________
Title:
_____________________________________
Signature:
_____________________________________
Date:
_____________________________________
69 County of Orange – OCIT
Tevora Business Solutions, Inc.

File Folder: 2360401
Contract RCA-017-23010029
Cybersecurity Assessment & Audit Services

EXHIBIT I
Staffing Plan
Key Personnel Staff to perform Contract duties
Name Title Phone Email
Steve Stumpfl Executive Vice President 949-398-0121 [email protected] Cindy Curley Account Director 858-361-7743 [email protected] Clayton Riness Principal Consultant 949-398-0129 [email protected] Christina Whiting Principal Consultant 949-398-0132 [email protected] Matt Mosley Managing Director, Incident
Response 971-266-0132 [email protected]
Jeremiah Sahlberg
Managing Director, Federal,
Third-Party Risk, Enterprise
Risk, Healthcare
703-298-8375 [email protected]
Ben Dimick Director, Security Consulting
Services
714-222-6543 [email protected]
Chris Callas Senior Manager, Cloud
Services 929-456-7703 [email protected]
Kevin Dick Manager, Threat Services 858-922-4047 [email protected] Anir Desai Manager, Information
Security and Compliance
562-274-3818 [email protected]
Bill Nguyen Manager, Information
Security and Compliance
714-326-4927 [email protected]
Jason Lee Associate Manager,
Healthcare
213-820-5499 [email protected]
Justin Graham Associate Manager,
Healthcare
512-665-4829 [email protected]
Brandon Richardson Associate Manager 858-248-0240 [email protected] 70