P
rofessional Services
Rev. Oct 16,2024
CITY OF PALO ALTO CONTRACT NO. C26195689
AGREEMENT FOR PROFESSIONAL SERVICES
BETWEEN THE CITY OF PALO ALTO AND COQUINA LABS INC. dba CONCOURSE TECH INC.
This Agreement for Professional Services (this “Agreement”) is entered into as of the 4th day of June, 2026 (the “Effective Date”), by and between the CITY OF PALO ALTO, a California chartered municipal corporation (“CITY”), and COQUINA LABS INC. dba CONCOURSE TECH INC., a corporation, located at 169 Madison Ave., Suite 15520, New York, NY 10016 (“CONSULTANT”).
The following recitals are a substantive portion of this Agreement and are fully incorporated herein by this reference:
RECITALS
A. CITY intends to create a customer characterization tool for staff to use for the commercial energy efficiency and electrification program (the “Project”) and desires to engage a consultant to provide a cloud- based customer characterization tool for customer identification, outreach, engagement, and project management in connection with the Project ( the “Services”, as detailed more fully in Exhibit A).
B. CONSULTANT represents that it, its employees and subconsultants, if any, possess the necessary professional expertise, qualifications, and capability, and all required licenses and/or certifications to provide the Services.
C. CITY, in reliance on these representations , desires to engage CONSULTANT to provide the Services as more fully described in Exhibit A, entitled “SCOPE OF SERVICES”.
NOW, THEREFORE, in consideration of the recitals, covenants, terms, and conditions, in this Agreement, the parties agree as follows:
SECTION 1. SCOPE OF SERVICES. CONSULTANT shall provide CITY with access to its proprietary cloud-based Customer Characterization Tool software-as-a-service platform and shall perform the related implementation and other Services described in Exhibit A in accordance with the terms and conditions contained in this Agreement. During the Term, CONSULTANT grants CITY a limited, non -exclusive right to access and use such platform solely for CITY’s internal business purposes in connection with the Project. The performance of all Services shall be to the reasonable satisfaction of CITY. CONSULTANT shall use commercially reasonable efforts to make the proprietary cloud-based Customer Characterization Tool software-as-a-service platform available at least 99.5% of the time in each calendar month, excluding scheduled maintenance (for which CONSULTANT shall provide at least forty- eight (48) hours’ prior notice to CITY, and which shall be performed outside of normal business hours to the extent reasonably practicable) and emergency maintenance or outages caused by factors outside of CONSULTANT’s reasonable control.
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
Optional On-Call Provision (This provision only applies if checked and only applies to on-call agreements.)
CITY may elect to, but is not required to, authorize on- call Services up to the maximum compensation amount set forth in Section 4 (Not to Exceed Compensation).
CONSULTANT shall provide on- call Services only by advanced, written authorization from CITY as detailed in this Section. On -call Services, if any, s hall be authorized by CITY, as needed, with a Task Order assigned and approved by CITY’s Project Manager, as identified in Section 13 (Project Management). Each Task Order shall be in substantially the same form as Exhibit A -1 entitled “PROFESSIONAL SERVICES TASK ORDER”.
Each Task Order shall contain a specific scope of s ervices, schedule of performance and maximum compensation amount, in accordance with the provisions of this Agreement.
Compensation for on-call Services shall be specified by CITY in the Task Order, based on whichever is lowest: the compensation structure set forth in Exhibit C, the hourly rates set forth in Exhibit C-1, or a negotiated lump sum.
To accept a Task Order, CONSULTANT shall sign the Task Order and return it to CITY’s Project Manager within the time specified by the Project Manager, and upon authorization by CITY (defined as counter-signature by the CITY Project Manager), the fully exec uted Task Order shall become part of this Agreement. The cumulative total compensation due to CONSULTANT for all Task Orders issued under this Agreement shall not exceed the amount of compensation set forth in Section 4. CONSULTANT shall only be compensated for on -call Services performed under an authorized Task Order and only up to the maximum compensation amount set forth in Section 4. Performance of and payment for any on-call Services are subject to all requirements and restrictions in this Agreement.
SECTION 2. TERM.
The term of this Agreement shall be from the E ffective Date of this agreement through June 4, 2029, unless terminated earlier pursuant to Section 19 (Termination) of this Agreement.
SECTION 3. SCHEDULE OF PERFORMANCE. Time is of the essence in the performance of Services under this Agreement. CONSULTANT shall complete the Services within the term of this Agreement and in accordance with the schedule set forth in Exhibit B, entitled “SCHEDULE OF PERFORMANCE”. Any Services for which times for performance are not specified in this Agreement shall be commenced and completed by CONSULTANT in a reasonably prompt and timely manner based upon the circumstances and direction communicated to the CONSULTANT.
CITY’s agreement to extend the term or the schedule for performance shall not preclude recovery of damages for delay if the extension is required due to the fault of CONSULTANT.
SECTION 4. NOT TO EXCEED COMPENSATION. The compensation to be paid to CONSULTANT for performance of the Services shall be based on the compensation structure detailed in Exhibit C, entitled “COMPENSATION,” including any reimbursable expenses specified therein, and the maximum total compensation shall not exceed One Hundred Thirty- Five Thousand Dollars ($135,000). T he hourly schedule of rates , if applicable, is set out in Exhibit C-1, entitled “SCHEDULE OF RATES.” Any work performed or expenses incurred for which payment would result in a total exceeding the maximum compensation set forth in this Section 4 shall be at no cost to the CITY.
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
Optional Additional Services Provision (This provision applies only if checked and a not-to-exceed compensation amount for Additional Services is allocated below under this Section 4.)
In addition to the not-to-exceed compensation specified above, CITY has set aside the not- to-exceed compensation amount of Thirteen Thousand Five Hundred Dollars ($13,500) for the performance of Additional Services (as defined below). The total compensation for performance of the Services, Additional Services and any reimbursable expenses specified in Exhibit C , shall not exceed One Hundred Forty-Eight Thousand Five Hundred Dollars ($148,500), as detailed in Exhibit C.
“Additional Services” means any work that is determined by CITY to be necessary for the proper completion of the Project, but which is not included within the Scope of Services described at Exhibit A. CITY may elect to, but is not required to, authorize Additional Services up to the maximum amount of compensation set forth for Additional S ervices in this Section 4. CONSULTANT shall provide Additional Services only by advanced, written authorization from CITY as detailed in this Section . Additional Services, if any, shall be authorized by CITY with a Task Order assigned and authorized by CITY’s Project Manager, as identified in Section 13 (Project Management). Each Task Order shall be in substantially the same form as Exhibit A-1, entitled “PROFESSIONAL SERVICES TASK ORDER”. Each Task Order shall contain a specific scope of services, schedule of performance and maximum compensation amount, in accordance with the provisions of this Agreement. Compensation for Additional Services shall be specified by CITY in the Task Order, based on whichever is lowest: the compensation structure set forth in Exhibit C, the hourly rates set forth in Exhibit C-1, or a negotiated lump sum.
To accept a Task Order, CONSULTANT shall sign the Task Order and return it to CITY’s Project Manager within the time specified by the Project Manager, and upon authorization by CITY (defined as counter-signature by the CITY Project Manager), the fully exec uted Task Order shall become part of this Agreement. The cumulative total compensation to CONSULTANT for all Task Orders authorized under this Agreement shall not exceed the amount of compensation set forth for Additional Services in this Section 4 .
CONSULTANT shall only be compensated for Additional Services performed under an authorized Task Order and only up to the maximum amount of compensation set forth for Additional Services in this Section 4. Performance of and payment for any Additional Services are subject to all requirements and restrictions in this Agreement.
SECTION 5. INVOICES. In order to request payment, CONSULTANT shall submit monthly invoices to the CITY describing the S ervices performed and the applicable charges (including, if applicable, an identification of personnel who performed the Services, hours worked, hourly rates, and reimbursable expenses), based upon Exhibit C or, as applicable, CONSULTANT’s schedule of rates set forth in Exhibit C-1. If applicable, the invoice shall also describe the percentage of completion of each task. The information in CONSULTANT’s invoices shall be subject to verification by CITY. CONSULTANT shall send all invoices to CITY’s Project Manager at the address specified in Section 13 (Project Management) below. CITY will generally process and pay invoices within thirty (30) days of receipt of an acceptable invoice.
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
SECTION 6. QUALIFICATIONS/STANDARD OF CARE. All Services shall be performed by CONSULTANT or under CONSULTANT’s supervision. CONSULTANT represents that it , its employees and subcontractors, if any, possess the professional and technical personnel necessary to perform the Services required by this Agreement and that the personnel have sufficient skill and experience to perform the Services assigned to them. CONSULTANT represents that it, its employees and subcontractors, if any, have and shall maintain during the term of this Agreement all licenses, permits, qualifications, insurance and approvals of whatever nature that are legally required to perform the Services. All Services to be furnished by CONSULTANT under this A greement shall meet the professional standard and quality that prevail among professionals in the same discipline and of similar knowledge and skill engaged in related work throughout California under the same or similar circumstances.
SECTION 7. COMPLIANCE WITH LAWS . CONSULTANT shall keep itself informed of and in compliance with all federal, state and local laws, ordinances, regulations, and orders that may affect in any manner the Project or the performance of the Services or those engaged to perform Services under this Agreement, as amended from time to time . CONSULTANT shall procure all permits and licenses, pay all charges and fees, and give all notices required by law in the performance of the Services.
SECTION 8. ERRORS/OMISSIONS. CONSULTANT is solely responsible for reasonable direct costs, including, but not limited to, increases in the cost of Services, arising from or caused by CONSULTANT’s material errors and omissions, including, but not limited to, the costs of correcting such errors and omissions or any change order markup costs; provided, however, that CONSULTANT’s obligation with respect to such material errors and omissions shall be limited, at CITY’s option, to (i) re-performance of the deficient Services, or (ii) refund of fees paid for the deficient Services in lieu of such re -performance. CONSULTANT shall not be responsible or liable for any consequential, incidental, special, exemplary, punitive or indirect damages, except for reasonable direct costs arising from delay or failure to perform the Services.
SECTION 9. COST ESTIMATES. If this Agreement pertains to the design of a public works project, CONSULTANT shall submit estimates of probable construction costs at each phase of design submittal. If the total estimated construction cost at any submittal exceeds the CITY’s stated construction budget by ten percent (10%) or more , CONSULTANT shall make recommendations to CITY for aligning the P roject design with the budget, incorporate CITY approved recommendations, and revise the design to meet the Project budget, at no additional cost to CITY.
SECTION 10. INDEPENDENT CONTRACTOR. CONSULTANT acknowledges and agrees that CONSULTANT and any agent or employee of CONSULTANT will act as and shall be deemed at all times to be an independent contractor and shall be wholly responsible for the manner in which CONSULTANT performs the S ervices requested by CITY under this Agreement.
CONSULTANT and any agent or employee of CONSULTANT will not have employee status with CITY, nor be entitled to participate in any plans, arrangements, or distributions by CITY pertaining to or in connection with any retirement, health or other benefits that CITY may offer its employees. CONSULTANT wi ll be responsible for all obligations and payments, whether imposed by federal, state or local law, including, but not limited to, FICA, income tax withholdings, workers’ compensation, unemployment compensation, insurance, and other similar responsibilities re lated to CONSULTANT’s performance of the S ervices, or any agent or Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
employee of CONSULTANT providing same. Nothing in this Agreement shall be construed as creating an employment or agency relationship between CITY and CONSULTANT or any agent or employee of CONSULTANT. Any terms in this Agreement referring to direction from CITY shall be construed as providing for direction as to policy and the result of CONSULTANT ’s provision of the Services only, and not as to the means by which such a result is obtained.
SECTION 11. ASSIGNMENT . The parties agree that the expertise and experience of CONSULTANT are material considerations for this Agreement. CONSULTANT shall not assign or transfer any interest in this Agreement nor the performance of any of CONSULTANT’s obligations hereunder without the prior written approval of the C ity Manager. Any purported assignment made without the prior written approval of the City Manager will be void and without effect. Subject to the foregoing, the covenants, terms, conditions and provisions of this Agreement will apply to, and will bind, the heirs, successors, executors, administrators and assignees of the parties.
SECTION 12. SUBCONTRACTING.
Option A: No Subcontractor: CONSULTANT shall not subcontract any portion of the Services to be performed under this Agreement without the prior written authorization of the City Manager or designee. In the event CONSULTANT does subcontract any portion of the work to be performed under this Agreement, CONSULTANT shall be fully responsible for all acts and omissions of subcontractors.
Option B: Subcontracts Authorized: Notwithstanding Section 11 (Assignment) above, CITY agrees that subcontractors may be used to complete the Services. The subcon tractors authorized by CITY to perform work on this Project are:
CONSULTANT shall be responsible for directing the work of any subcontractors and for any compensation due to subcontractors . CITY assumes no responsibility whatsoever concerning compensation of subcontractors. CONSULTANT shall be fully responsible to CITY for all acts and omissions of subcontractors . CONSULTANT shall change or add subcontractors only with the prior written approval of the City Manager or designee.
SECTION 13. PROJECT MANAGEMENT. CONSULTANT will assign Thomas Smyth as the CONSULTANT’s Project Manager to have supervisory responsibility for the performance, progress, and execution of the Services and represent CONSULTANT during the day -to-day performance of the Services. If circumstances cause the substitution of the CONSULTANT’s Project Manager or any other of CONSULTANT’s key personnel for any reason, the appointment of a substitute Project Manager and the assignment of any key new or replacement personnel will be subject to the prior written approval of the CITY’s P roject Manager. CITY's approval of any substitute Project Manager or key personnel shall not be unreasonably withheld, conditioned, or delayed. CONSULTANT, at CITY’s request, shall promptly remove CONSULTANT personnel who CITY finds materially fail to perform the Services in accordance with this Agreement or engage in documented misconduct . CITY's right to remove CONSULTANT personnel shall be limited to situations involving material failure to perform the Services in accordance with this Agreement or documented misconduct.
CITY’s Project Manager is Shelby Sinkler, Utilities Department, 250 Hamilton Ave., Palo Alto, Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
CA, 94301, Telephone: 650-329- 2525, Email: [email protected]. CITY’s Project Manager will be CONSULTANT’s point of contact with respect to performance, progress and execution of the Services. CITY may designate an alternate Project Manager from time to time.
SECTION 14. OWNERSHIP OF MATERIALS. “City Data” means all data, information, and materials provided by CITY to CONSULTANT, or generated, collected, or derived from such data by CONSULTANT in connection with the Services. A ll work product, including without limitation, all writings, drawings, studies, sketches, photographs, plans, reports, specifications, computations, models, recordings, data, documents, and other materials and copyright interests developed under this Agreement, in any form or media, that are specifically created for CITY and delivered to CITY as part of the Services (the “Deliverables”), including configurations and customizations specific to CITY and CITY Data and compilations thereof, shall be and remain the exclusive property of CITY without restriction or limitation upon their use. CONSULTANT agrees that all copyrights which arise from creation of the Deliverables pursuant to this Agreement are vested in CITY, and CONSULTANT hereby waives and relinquishes all claims to copyright or other intellectual property rights in favor of CITY with respect to the Deliverables.
Notwithstanding the foregoing, CONSULTANT retains all right, title and interest in and to its pre- existing software, SaaS platform, and other proprietary tools, materials and technology, and any general improvements or enhancements thereto. To the extent any such items are incorporated in the Deliverables, CONSULTANT grants CITY a nonexclusive, perpetual, irrevocable, royalty- free license to use them solely as necessary to use the Deliverables for CITY’s internal purposes .
Neither CONSULTANT nor its subcontractors, if any, shall make any of such Deliverables available to any individual or organization without the prior written approval of the City Manager or designee. CITY retains all right, title, and interest in and to all City Data, and CONSULTANT may access and use City Data solely for purposes of performing the Services under this Agreement and for no other purpose . CONSULTANT makes no representation of the suitability of the Deliverables for use in or application to circumstances not contemplated by the Scope of Services.
SECTION 15. AUDITS . CONSULTANT agrees to permit CITY and its authorized representatives to audit, at any reasonable time during the term of this Agreement and for four (4) years from the date of final payment, CONSULTANT’s records pertaining to matters covered by this Agreement, including without limitation records demonstrating compliance with the requirements of Section 10 (Independent Contractor). CONSULTANT further agrees to maintain and retain accurate books and records in accordance with generally accepted accounting principles for at least four (4) years after the expiration or earlier termination of this Agreement or the completion of any audit hereunder, whichever is later.
SECTION 16. INDEMNITY.
16.1. To the fullest extent permitted by law, CONSULTANT shall indemnify, defend and hold harmless CITY, its Council members, officers, employees and agents (each an “Indemnified Party”) from and against any and all third party demands, claims, or liability of any nature, including death or injury to any person, property damage or any other loss, including all costs and expenses of whatever nature including attorney’ s fees, experts fees, court costs and disbursements (“Claims”) to the extent that such Claims arise out of, pertain to, or relate to the negligence, recklessness, or willful misconduct of CONSULTANT, its officers, employees, agents or contractors under this Agreement, regardless of whether or not it is caused in part by an Indemnified Party. CITY will reimburse CONSULTANT for the proportionate percentage of Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
defense costs exceeding CONSULTANT’s proportionate percentage of fault as determined by the final judgment of a court of competent jurisdiction.
16.2. Notwithstanding the above, nothing in this Section 16 shall be construed to require CONSULTANT to indemnify an Indemnified Party from a Claim arising from the active negligence or willful misconduct of an Indemnified Party that is not contributed to by any act of, or by any omission to perform a duty imposed by law or agreement by, CONSULTANT, its officers, employees, agents or contractors under this Agreement.
16.3. The acceptance of CONSULTANT’s Services and duties by CITY shall not operate as a waiver of the right of indemnification. The provisions of this Section 16 shall survive the expiration or early termination of this Agreement.
16.4 In addition to the foregoing, CONSULTANT shall indemnify, defend and hold harmless CITY and its Indemnified Parties from and against any and all Claims by any third party alleging infringement or misappropriation of any patent, copyright, trademark, trade secret, or other intellectual property right arising out of the use of the Services or CONSULTANT’s software, SaaS platform, or related technology by CITY in accordance with the terms of this Agreement. NO LIMITATION OF LIABILITY SET FORTH ELSEWHERE IN THIS AGREEMENT SHALL APPLY TO CONSULTANT’S OBLIGATIONS UNDER THIS SECTION 16.4. CONSULTANT shall have the right to investigate, defend and settle any such Claim. CONSULTANT shall have no liability for any Claim under this Section 16.4 to the extent it is based on (a) CITY’s unauthorized modification of the Services or CONSULTANT’s technology, or (b) CITY’s use of the Services in combination with products or services not provided by CONSULTANT, where such Claim would not have arisen but for such modification or combination.
SECTION 17. WAIVERS. No waiver of a condition or nonperformance of an obligation under this Agreement is effective unless it is in writing in accordance with Section 2 9.4 of this Agreement. No delay or failure to require performance of any provision of this Agreement shall constitute a waiver of that provision as to that or any other instance. Any waiver granted shall apply solely to the specific instance expressly stated. No single or partial exercise of any right or remedy will preclude any other or further exercise of any right or remedy.
SECTION 18. INSURANCE.
18.1. CONSULTANT, at its sole cost and expense, shall obtain and maintain, in full force and effect during the term of this Agreement, the insurance coverage described in Exhibit D, entitled “INSURANCE REQUIREMENTS”. CONSULTANT and its contractors, if any, shall obtain a policy endorsement naming CITY as an additional insured under any general liability or automobile policy or policies.
18.2. All insurance coverage required hereunder shall be provided through carriers with AM Best’s Key Rating Guide ratings of A -:VII or higher which are licensed or authorized to transact insurance business in the State of California. Any and all contractors of CONSULTANT retained to perform Services under this Agreement will obtain and maintain, in full force and effect during the term of this Agreement, identical insurance coverage, naming CITY as an additional insured under such policies as required above.
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
18.3. Certificates evidencing such insurance shall be filed with CITY concurrently with the execution of this Agreement. The certificates will be subject to the approval of CITY’s Risk Manager and will contain an endorsement stating that the insurance is primar y coverage and will not be canceled, or materially reduced in coverage or limits, by the insurer except after filing with the Purchasing Manager thirty (30) days ’ prior written notice of the cancellation or modification. If the insurer cancels or modifies the insurance and provides less than thirty (30) days’ notice to CONSULTANT , CONSULTANT shall provide the Purchasing Manager written notice of the cancellation or modification within two (2) business days of the CONSULTANT’s receipt of such notice. CONSULTANT shall be responsible for ensuring that current certificates evidencing the insurance are provided to CITY’s Chief Procurement Officer during the entire term of this Agreement.
18.4. The procuring of such required policy or policies of insurance will not be construed to limit CONSULTANT ’s liability hereunder nor to fulfill the indemnification provisions of this Agreement. Notwithstanding the policy or policies of insurance, CONSULTANT will be obligated for the full and total amount of any damage, injury, or loss caused by or directly arising as a result of the Services performed under this Agreement, including such damage, injury, or loss arising after the Agreement is terminated or the term has expired.
SECTION 19. TERMINATION OR SUSPENSION OF AGREEMENT OR SERVICES.
19.1. The City Manager may suspend the performance of the Services, in whole or in part, or terminate this Agreement, with or without cause, by giving thirty (30) days prior written notice thereof to CONSULTANT. In the event of termination without cause , CITY shall compensate CONSULTANT for all work performed through the termination date, including reasonable, documented wind-down costs not to exceed ten (10) percent of the remaining contract value. If CONSULTANT fails to perform any of its material obligations under this Agreement, in addition to all other remedies provided under this Agreement or at law, the City Manager may terminate this Agreement sooner upon written notice of termination. Upon receipt of any notice of suspension or termination , CONSULTANT will discontinue its performance of the Services on the effective date in the notice of suspension or termination.
19.2. In event of suspension or termination, CONSULTANT wi ll deliver to the City Manager on or before the effective date in the notice of suspension or termination, any and all work product, as detailed in Section 14 (Ownership of Materials), whether or not completed, prepared by CONSULTANT or its contractors, if any, in the performance of this Agreement. Such work product is the property of CITY, as detailed in Section 14 (Ownership of Materials).
19.3. In event of suspension or termination, CONSULTANT will be paid for the Services rendered and work products delivered to CITY in accordance with the Scope of Services up to the effective date in the notice of suspension or termination; provided, however, if this Agreement is suspended or terminated on account of a default by CONSULTANT, CITY will be obligated to compensate CONSULTANT only for that portion of CONSULTANT’s S ervices provided in material conformity with this Agreement as such determination is made by the City Manager acting in the reasonable exercise of his/her discretion . The following Sections will survive any expiration or termination of this Agreement: 14, 15, 16, 17, 19.2, 19.3, 19.4, 19.5, 20, 25, 27, 28, 29 and 30.
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
19.4. No payment, partial payment, acceptance, or partial acceptance by CITY will operate as a waiver on the part of CITY of any of its rights under this Agreement, unless made in accordance with Section 17 (Waivers).
19.5. Upon expiration or termination of this Agreement, CONSULTANT shall, upon request, promptly and in no event later than ten (10) days, provide CITY with a complete copy of all City Data in a commercially reasonable, machine-readable format, at no additional cost to CITY. CITY shall have the option to specify a reasonable method for obtaining such City Data.
Such obligation shall apply to all City Data in the possession of CONSULTANT and its subcontractors, if any. Upon written confirmation from CITY that the City Data has been successfully transferred, CONSULTANT shall promptly delete or securely destroy such data from its systems.
SECTION 20. NOTICES.
All notices hereunder will be given in writing and mailed, postage prepaid, by certified mail, addressed as follows:
To CITY: Office of the City Clerk
City of Palo Alto
Post Office Box 10250
Palo Alto, CA 94303
With a copy to the Purchasing Manager
To CONSULTANT: Attention of the P roject Manager at the address of CONSULTANT recited on the first page of this Agreement.
CONSULTANT shall provide written notice to CITY of any change of address.
SECTION 21. CONFLICT OF INTEREST.
21.1. In executing this Agreement, CONSULTANT covenants that it presently has no interest, and will not acquire any interest, direct or indirect, financial or otherwise, which would conflict in any manner or degree with the performance of the Services.
21.2. CONSULTANT further covenants that, in the performance of this Agreement, it will not employ subcontractors or other persons or parties having such an interest.
CONSULTANT certifies that no person who has or will have any financial interest under this Agreement is an officer or employee of CITY; this provision will be interpreted in accordance with the applicable provisions of the Palo Alto Municipal Code and the Government Code of the State of California, as amended from time to time . CONSULTANT agrees to notify CITY if any conflict arises.
21.3. If the CONSULTANT meets the definition of a “Consultant” as defined by the Regulations of the Fair Political Practices Commission, CONSULTANT will file the appropriate financial disclosure documents required by the Palo Alto Municipal Code and the Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
Political Reform Act of 1974, as amended from time to time.
SECTION 22. NONDISCRIMINATION; COMPLIANCE WITH ADA.
22.1. As set forth in Palo Alto Municipal Code S ection 2.30.510, as amended from time to time, CONSULTANT certifies that in the performance of this Agreement, it shall not discriminate in the employment of any person due to that person’s race, skin color, gender, gender identity, age, religion, disability, national origin, ancestry, sexual orientation, pregnancy, genetic information or condition, housing status, marital status, familial status, weight or height of such person. CONSULTANT acknowledges that it has read and understands the provisions of Section
2.30.510 of the Palo Alto Municipal Code relating to Nondiscrimination Requirements and the penalties for violation thereof, and agrees to meet all requirements of Section 2.30.510 pertaining to nondiscrimination in employment.
22.2. CONSULTANT understands and agrees that pursuant to the Americans Disabilities Act (“ADA”), programs, services and other activities provided by a public entity to the public, whether directly or through a contractor or subcontractor, are required to be accessible to the disabled public. CONSULTANT will provide the Services specified in this Agreement in a manner that complies with the ADA and any other applicable federal, state and local disability rights laws and regulations, as amended from time to time. CONSULTANT will not discriminate against persons with disabilities in the provision of services, benefits or activities provided under this Agreement.
SECTION 23. ENVIRONMENTALLY PREFERRED PURCHASING AND ZERO WASTE REQUIREMENTS. CONSULTANT shall comply with t he CITY’s Environmentally Preferred Purchasing policies which are available at CITY ’s Purchasing Department , hereby incorporated by reference and as amended from time to time. CONSULTANT shall comply with waste reduction, reuse, recycling and disposal requirements of CITY’s Zero Waste Program. Zero Waste best practices include, first, minimizing and reducing waste; second, reusing waste ; and, third, recycling or composting waste. In particular, C ONSULTANT shall comply with the following Zero Waste requirements:
(a) All printed materials provided by CONSULTANT to C ITY generated from a personal computer and printer including but not limited to, proposals, quotes, invoices, reports, and public education materials, shall be double-sided and printed on a minimum of 30% or greater post-consumer content paper, unless otherwise approved by CITY ’s Project Manager. Any submitted materials printed by a professional printing company shall be a minimum of 30% or greater post-consumer material and printed with vegetable-based inks. (b) Goods purchased by C ONSULTANT on behalf of CITY shall be purchased in accordance with CITY’s Environmental Purchasing Policy including but not limited to Extended Producer Responsibility requirements for products and packaging. A copy of this policy is on file at the Purchasing Department’s office.
(c) Reusable/returnable pallets shall be taken back by CONSULTANT , at no additional cost to CITY, for reuse or recycling. CONSULTANT shall provide documentation from the facility accepting the pallets to verify that pallets are not being disposed.
SECTION 24. COMPLIANCE WITH PALO ALTO MINIMUM WAGE ORDINANCE .
CONSULTANT shall comply with all requirements of the Palo Alto Municipal Code Chapter 4.62 (Citywide Minimum Wage), as amended from time to time. In particular, for any employee Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
otherwise entitled to the State minimum wage, who performs at least two (2) hours of work in a calendar week within the geographic boundaries of the City, CONSULTANT shall pay such employees no less than the minimum wage set forth in Palo Alto Municipal Code Section 4.62.030 for each hour worked within the geographic boundaries of the City of Palo Alto. In addition, CONSULTANT shall post notices regarding the Palo Alto Minimum Wage Ordinance in accordance with Palo Alto Municipal Code Section 4.62.060.
SECTION 25. NON-APPROPRIATION. This Agreement is subject to the fiscal provisions of the Charter of the City of Palo Alto and the Palo Alto Municipal Code, as amended from time to time. This Agreement will terminate without any penalty (a) at the end of any fiscal year in the event that funds are not appropriated for the following fiscal year, or (b) at any time within a fiscal year in the event that funds are only appropriated for a portion of the fiscal year and funds for this Agreement are no longer available. This S ection shall take precedence in the event of a conflict with any other covenant, term, condition, or provision of this Agreement.
SECTION 2 6. PREVAILING WAGES AND DIR REGISTRATION FOR PUBLIC WORKS CONTRACTS.
26.1. This Project is not subject to prevailing wages and related requirements. CONSULTANT is not required to pay prevailing wages and meet related requirements under the California Labor Code and California Code of Regulations in the performance and implementation of the Project if the contract:
(1) is not a public works contract;
(2) is for a public works construction project of $25,000 or less, per California Labor Code Sections 1782(d)(1), 1725.5(f) and 1773.3(j); or (3) is for a public works alteration, demolition, repair, or maintenance project of $15,000 or less, per California Labor Code Sections 1782(d)(1), 1725.5(f) and 1773.3(j).
SECTION 27. CLAIMS PROCEDURE FOR “9204 PUBLIC WORKS PROJECTS” . For purposes of this Section 27, a “9204 Public Works Project” means the erection, construction, alteration, repair, or improvement of any public structure, building, road, or other public improvement of any kind. (Cal. Pub. Cont. Code § 9204.)
This Project is not a 9204 Public Works Project.
SECTION 28. CONFIDENTIAL INFORMATION.
28.1. In the performance of this Agreement, CONSULTANT may have access to CITY’s Confidential Information (defined below). CONSULTANT will hold Confidential Information in strict confidence, not disclose it to any third party, and will use it only for the performance of its obligations to CITY under this Agreement and for no other purpose.
CONSULTANT will maintain reasonable and appropriate administrative, technical and physical safeguards to ensure the security, confidentiality and integrity of the Confidential Information.
Notwithstanding the foregoing, CONSULTANT may disclose Confidential Information to its employees, agents and subcontractors, if any, to the extent they have a need to know in order to perform CONSULTANT’s obligations to CITY under this Agreement and for no other purpose, provided that the CONSULTANT informs them of, and requires them to follow, the confidentiality Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
and security obligations of this Agreement.
28.2. “Confidential Information” means all data, information (including without limitation “Personal Information” about a California resident as defined in Civil Code S ection 1798 et seq., as amended from time to time) and materials, in any form or media, tangible or intangible, provided or otherwise made available to CONSULTANT by CITY, directly or indirectly, pursuant to this Agreement, including any City Data. Confidential Information excludes information that CONSULTANT can show by appropriate documentation: (i) was publicly known at the time it was provided or has subsequently become publicly known other than by a breach of this Agreement; (ii) was rightfully in CONSULTANT’s possession free of any obligation of confidence prior to receipt of Confidential Information; (iii) is rightfully obtained by CONSULTANT from a third party without breach of any confidentiality obligation; (iv) is independently developed by employees of CONSULTANT without any use of or access to the Confidential Information; or (v) CONSULTANT has written consent to disclose signed by an authorized representative of CITY.
28.3. Notwithstanding the foregoing, CONSULTANT may disclose Confidential Information to the extent required by order of a court of competent jurisdiction or governmental body, provided that CONSULTANT will notify CITY in writing of such order immediately upon receipt and prior to any such disclosure (unless CONSULTANT is prohibited by law from doing so), to give CITY an opportunity to oppose or otherwise respond to such order.
28.4. CONSULTANT will notify CITY promptly upon learning of any breach in the security of its systems or unauthorized disclosure of, or access to, Confidential Information in its possession or control, and if such Confidential Information consists of Personal Information, CONSULTANT will provide information to CITY sufficient to meet the notice requirements of Civil Code Section 1798 et seq., as applicable, as amended from time to time.
28.5. Prior to or upon termination or expiration of this Agreement, CONSULTANT will honor any request from the CITY to return or securely destroy all copies of Confidential Information. All Confidential Information is and will remain the property of the CITY and nothing contained in this Agreement grants or confers any rights to such Confidential Information on CONSULTANT.
28.6. If selected in Section 30 (Exhibits), this Agreement is also subject to the terms and conditions of the Information Privacy Policy and Cybersecurity Terms and Conditions.
SECTION 29. MISCELLANEOUS PROVISIONS.
29.1. This Agreement will be governed by California law, without regard to its conflict of law provisions.
29.2. In the event that an action is brought, the parties agree that trial of such action will be vested exclusively in the state courts of California in the County of Santa Clara, State of California.
29.3. The prevailing party in any action brought to enforce the provisions of this Agreement may recover its reasonable costs and attorneys’ fees expended in connection with that Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
action. The prevailing party shall be entitled to recover an amount equal to the fair market value of legal services provided by attorneys employed by it as well as any attorneys’ fees paid to third parties.
29.4. This Agreement, including all exhibits, constitutes the entire and integrated agreement between the parties with respect to the subject matter of this Agreement, and supersedes all prior agreements, negotiations, representations, statements and undertakings , either oral or written. This Agreement may be amended only by a written instrument, which is signed by the authorized representatives of the parties and approved as required under Palo Alto Municipal Code, as amended from time to time.
29.5. If a court of competent jurisdiction finds or rules that any provision of this Agreement is void or unenforceable, the unaffected provisions of this Agreement will remain in full force and effect.
29.6. In the event of a conflict between the terms of this Agreement and the exhibits hereto (per Section 30) or CONSULTANT’s proposal (if any), the Agreement shall control. In the event of a conflict between the exhibits hereto and CONSULTANT’s proposal (if any), the exhibits shall control.
29.7. The provisions of all checked boxes in this Agreement shall apply to this Agreement; the provisions of any unchecked boxes shall not apply to this Agreement.
29.8. All section headings contained in this Agreement are for convenience and reference only and are not intended to define or limit the scope of any provision of this Agreement.
29.9. This Agreement may be signed in multiple counterparts, which, when executed by the authorized representatives of the parties, shall together constitute a single binding agreement.
SECTION 30. EXHIBITS. Each of the following exhibits, if the check box for such exhibit is selected below, is hereby attached and incorporated into this Agreement by reference as though fully set forth herein:
EXHIBIT A: SCOPE OF SERVICES
EXHIBIT A-1 PROFESSIONAL SERVICES TASK ORDER
EXHIBIT B: SCHEDULE OF PERFORMANCE
EXHIBIT C: COMPENSATION
EXHIBIT C-1: SCHEDULE OF RATES
EXHIBIT D: INSURANCE REQUIREMENTS
EXHIBIT E: INFORMATION PRIVACY POLICY
EXHIBIT F: CYBERSECURITY TERMS AND CONDITIONS
THIS AGREEMENT IS NOT COMPLETE UNLESS ALL SELECTED EXHIBITS ARE ATTACHED.
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
CONTRACT NO. C26195689
SIGNATURE PAGE
IN WITNESS WHEREOF, the parties hereto have by their duly authorized representatives executed this Agreement as of the date first above written.
CITY OF PALO ALTO
____________________________
City Manager
APPROVED AS TO FORM:
__________________________
City Attorney or designee
COQUINA LABS INC. dba
CONCOURSE TECH INC.
Officer 1
By: ________________________________
Name: ______________________________
Title: _______________________________
Officer 2 (Required for Corp. or LLC)
By: ________________________________
Name: ______________________________
Title: _______________________________
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3 Thomas Smyth
CEO
Rapolas Binkys
Assistant Treasurer
Professional Services
Rev. Oct 16,2024
EXHIBIT A
SCOPE OF SERVICES
CONSULTANT shall provide the Services detailed in this Exhibit A , entitled “ SCOPE OF SERVICES”. Notwithstanding any provision herein to the contrary, CONSULTANT’s duties and services described in this Scope of Services shall not include preparing or assisting CITY with any portion of CITY’s preparation of a request for proposals, request for qualifications, or any other solicitation regarding a subsequent or additional contract with CITY. CITY shall at all times retain responsibility for public contracting, including with respect to any subsequent phase of this project.
CONSULTANT’s participation in the planning, discussions, or drawing of project plans or specifications shall be limited to conceptual, preliminary, or initial plans or specifications.
CONSULTANT shall cooperate with CITY to ensure that all bidders for a subsequent contract on any subsequent phase of this project have access to the same information, including all conceptual, preliminary, or initial plans or specifications prepared by CONSULTANT pursuant to this Scope of Services.
Phase 1: Discovery and Requirements
Task 1.1 Project Kickoff
CONSULTANT will execute a project kickoff meeting which will include stakeholder interviews with utilities staff and key account representatives to determine data sources needed for the tool.
CONSULTANT will include its Characterization results as .CSV outputs so that City of Palo Alto Utilities (CPAU) can integrate these tables into its Customer Relationship Management (CRM) tools and other future platforms. CONSULTANT will use commercially reasonable efforts to integrate the platform with the CRM tool.
Task 1.1 Deliverables:
• Project Plans
• Requirements document
• Integration assessment report
Task 1.2 Data Inventory and Gap Analysis
CONSULTANT will collect data from the CITY and other resources to obtain the information needed to build the Characterization Tool. All data will be open-source, delivered by the CITY, or paid for by the CITY. CONSULTANT will not be expected to purchase any data for the analysis tool. Exact data requirements will be discussed as part of the initial discovery phase.
CONSULTANT shall be responsible for identifying data requirements and notifying CITY of any material data gaps or quality issues that may affect performance of the Services. The tool will provide data including but not limited to commercial property inventory, utility usage, property owner and tenant contact information, rooftop unit inventory, and property level Energy Use Intensity (EUI) analysis. CONSULTANT will report the results and methodologies for the Characterization Tool. Expected data collection needed to develop the tool includes, but is not Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
limited to:
Inventory of Commercial Properties
• Commercial Property Aggregation: CONSULTANT will utilize multiple data sources such as utility data, meter matching data, County data, commercial real estate data, satellite imagery, GIS, and building footprint data. These sources are used to identify and aggregate individual tax lot information into larger commercial complexes. • Commercial Building Inventory: CONSULTANT will use remote sensing tools, such as LiDAR, to identify individual buildings, rooftop equipment, and building data for each property. Machine learning models are utilized to predict missing building attributes such as number of stories, building vintage and other variables that are often missing at high rates in the property databases.
• Best Contact Information Analytics: To improve CPAU’s ability to contact a decisionmaker building site, CONSULTANT will utilize CoStar, county assessor, the Palo Alto business registry, real estate data, business contact databases, such as Open Corporates, and other sources to integrate contact information from its multiple sources to identify the best commercial customer contact information. • Commercial Property Level EUI: CONSULTANT will utilize monthly gas and electricity consumption data from CPAU to calculate EUI (kBTU/sqft/year) at the property level based on the property aggregation (total property sqft) and with aggregated kWh and therm consumption for matched meters, kWh/sqft, and therms/sqft.
Identify Commercial Rooftop Packaged HVAC Units
• Commercial Rooftop Packaged HVAC Unit (RTU) Classification: CONSULTANT will create a tool that uses high resolution ortho- imagery and supervised image classification tools to identify rooftop units on each commercial building in CPAU territory. • Commercial Energy Disaggregation Analytics: CONSULTANT will utilize building energy modeling tools to identify cost-effective energy efficiency upgrades at commercial properties through its load disaggregation algorithms that will identify different end- uses including heating, cooling, and baseload kWh and therms. This analysis is what will estimate RTU age through property heating and cooling efficiency as a proxy for age.
Task 1.2 Deliverables:
• Data inventory report
• Gap analysis of existing systems
Phase 2 System Design and Development
Task 2 System architecture design and technical specifications Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
CONSULTANT will deploy a secure online data application for CPAU that allows program staff, program administrators, and analysts at CPAU to access the results. CONSULTANT will develop advanced mapping and visualization tools that can be customized according to CPAU’s needs.
This task includes, but is not limited to:
• Backend development with database and API creation
• Frontend development with responsive user interface
• GIS integration and data processing modules
• Customer segmentation algorithms and analytics
• Integrated testing throughout development process
CONSULTANT will ensure that all the project data will be stored on hyper-secure Amazon Web Service (AWS), easily accessible by staff, which integrates the latest cyber -security tools and standards for software as a service (SaaS) platform. The Characterization dashboard is available as an Application Programming Interface (API) that will enable CPAU to integrate its functions into existing technological tools.
Task 2 Deliverables:
• System architecture
• Working prototype
• Integration modules
Phase 3 Testing and Quality Assurance
Task 3.1 Internal Testing
CONSULTANT shall conduct functional testing of all system components, which includes performance testing, optimization, security testing and vulnerability assessment. CONSULTANT will also conduct integration testing with existing CPAU systems.
Task 3.1 Deliverables:
• Test results
• Performance metrics
• Security assessment results
Task 3.2 User Acceptance Testing with CPAU
CONSULTANT will plan, organize, and facilitate User Acceptance Testing (UAT) in coordination with CPAU staff to validate that the tool meets business and operational requirements. This includes developing a clear UAT plan, defining test scenarios and succe ss criteria, scheduling testing sessions, and providing guidance to staff throughout the process. The consultant will Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
document feedback, track issues to resolution, and confirm final sign- off to ensure the system is ready for deployment.
Task 3.2 Deliverables:
• UAT summary report
Phase 4 Training and Deployment
Task 4.1 CPAU Staff Training
CONSULTANT shall develop clear, user -friendly user manuals for both system administrators and end users. CONSULTANT will ensure all documentation reflects finalized tool functionality and incorporates feedback from UAT. CONSULTANT is to provide documentation in editable and accessible formats for future updates and internal use.
CONSULTANT is to provide end-user training focused on core functionality, workflows, and best practices aligned with day -to-day operations. CONSULTANT will deliver training sessions in accessible formats (e.g., virtual sessions and recorded materials) to accommodate staff availability.
Task 4.1 Deliverables:
• User training manuals
• User training recordings
Task 4.2 Project Handoff
CONSULTANT will provide CITY with a login to the tool to access commercial customer information and energy data. The tool will allow CITY to export and use the data for program design, customer identification, outreach, and high- level energy analysis. CONS ULTANT will support a structured transition from implementation to operational ownership, ensuring the system is fully deployed, validated, and supported by staff. This includes, but is not limited to:
• Production system deployment
• Data migration and system configuration
• Go-live support and initial user assistance
• Final system validation and acceptance
• Support procedures and escalation setup
Task 4.2 Deliverables:
• Production system
• Procedures document
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
EXHIBIT A-1
PROFESSIONAL SERVICES TASK ORDER
CONSULTANT shall perform the Services detailed below in accordance with all the terms and conditions of the Agreement referenced in Item 1A below. All exhibits referenced in Item 8 are incorporated into this Task Order by this reference. CONSULTANT shall furnish the necessary facilities, professional, technical and supporting personnel required by this Task Order as described below.
CONTRACT NO.
OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE)
1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE):
1B. TASK ORDER NO.:
2. CONSULTANT NAME:
3. PERIOD OF PERFORMANCE: START: COMPLETION:
4 TOTAL TASK ORDER PRICE: $__________________
BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT $_______________
5. BUDGET CODE_______________
COST CENTER________________
COST ELEMENT______________
WBS/CIP__________
PHASE__________
6. CITY PROJECT MANAGER’S NAME & DEPARTMENT:_____________________________________
7. DESCRIPTION OF SCOPE OF SERVICES (Attachment A)
MUST INCLUDE:
SERVICES AND DELIVERABLES TO BE PROVIDED
SCHEDULE OF PERFORMANCE
MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable) REIMBURSABLE EXPENSES, if any (with “not to exceed” amount)
8. ATTACHMENTS: A: Task Order Scope of Services B (if any): _____________________________
I hereby authorize the performance of the
work described in this Task Order.
APPROVED:
CITY OF PALO ALTO
BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________
I hereby acknowledge receipt and acceptance of
this Task Order and warrant that I have
authority to sign on behalf of Consultant.
APPROVED:
COMPANY NAME: ______________________
BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
EXHIBIT B
SCHEDULE OF PERFORMANCE
CONSULTANT shall perform the Services so as to complete each milestone within the number of days/weeks specified below. The time to complete each milestone may be increased or decreased by mutual written agreement of the Project Managers for CONSULTANT and CITY so long as all work is completed within the term of the Agreement. CONSULTANT shall provide a detailed schedule of work consistent with the schedule below within 2 weeks of receipt of the notice to proceed (“NTP”) from the CITY.
Milestones
Completion
Number of Days/Weeks (as specified below)
from NTP
Task 1 Discovery and Requirements
Weeks 1-2
Task 2 System Design and Development
Weeks 3-8
Task 3 Testing and Quality Assurance
Week 9
Task 4 Training and Deployment
Week 10
User Licenses Ongoing, during Term
Maintenance and Support Ongoing, during Term
Optional Schedule of Performance Provision for On-Call or Additional Services Agreements. (This provision only applies if checked and only applies to on- call agreements per Section 1 or agreements with Additional Services per Section 4.)
The schedule of performance shall be as provided in the approved Task Order, as detailed in Section 1 (Scope of Services) in the case of on-call Services, or as detailed in Section 4 in the case of Additional Services, provided in all cases that the schedule of performance shall fall within the term as provided in Section 2 (Term) of this Agreement.
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
EXHIBIT C
COMPENSATION
CITY agrees to compensate CONSULTANT for Services performed in accordance with the terms and conditions of this Agreement, and as set forth in the budget schedule below. Compensation shall be calculated based on the rate schedule attached as E xhibit C-1 up to the not to exceed budget amount for each task set forth below.
CITY’s Project Manager may approve in writing the transfer of budget amounts between any of the tasks or categories listed below , provided that the total compensation for the Services, including any specified reimbursable expenses, and the total compensation for Additional Services (if any, per Section 4 of the Agreement) do not exceed the amounts set forth in Section 4 of this Agreement.
CONSULTANT agrees to complete all Services , any specified reimbursable expenses, and Additional Services (if any, per Section 4), within this /these amount(s). Any work performed or expenses incurred for which payment would result in a total exceeding the maximum amount of compensation set forth in this Agreement shall be at no cost to the CITY.
BUDGET SCHEDULE
TASK NOT TO EXCEED AMOUNT
Task 1 Discovery and Requirements $18,000.00
Task 2 System Design and Development $72,000.00
Task 3 Testing and Quality Assurance $6,000.00
Task 4 Training and Deployment $9,000.00
User Licenses $6,000.00
Maintenance and Support for Year 2 and 3 $24,000.00
Sub-total for Services $135,000.00
Reimbursable Expenses (if any) $0
Total for Services and Reimbursable Expenses $135,000.00 Additional Services (if any, per Section 4) $13,500.00
Maximum Total Compensation $148,500.00
Fees for user licenses, maintenance, and support shall be prorated to the effective date of termination or expiration of the Agreement.
REIMBURSABLE EXPENSES
CONSULTANT’S ordinary business expenses, such as administrative, overhead, administrative support time /overtime, information systems, software and hardware, photocopying, telecommunications (telephone, internet), in -house printing, insurance and other ordinary business expenses, are included within the scope of payment for Services and are not reimbursable expenses hereunder.
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
Reimbursable expenses, if any are specified as reimbursable under this section , will be reimbursed at actual cost. The expenses (by type, e.g. travel) for which CONSULTANT will be reimbursed are: NONE up to the not-to-exceed amount of: $0.00.
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
EXHIBIT C-1
SCHEDULE OF RATES
CONSULTANT’s schedule of rates is as follows:
Table 2 – Commercial Customer Characterization Tool
Scope Task Deliverable Estimat
ed
Hour
ly
Subtotal
($) Assumptions/Not
es Stakeholder
120 $150 $18,000 Comprehensive
it 2.1 Discovery
&
Requirement
s
Existing Data
Inventory
gathering with all stakeholders
Requirements
Category 2: Documentation
2.1 Subtotal
$18,000 Customer
Architecture
Characterizat
ion
2.2 System
Design and
480 $150 $72,000 Full-stack
development with
Backend
Identification, Frontend
Outreach, GIS/Data
Engagement,
2.2 Subtotal
$72,000
Project 2.3 Testing Testing 80 $150 $6,000 Comprehensive t ti ith Management 2.3 Subtotal
$6,000 feedback integration
2.4 Training
&
Staff Training 60 $150 $9,000 Complete deployment ith
User
Manual/Docume
documentation
System Launch
2.4 Subtotal
$9,000
2.5 User
Licenses
Licensing 20 $150 $6,000 Annual
licensing for
unlimited
users
Other
2.5 Subtotal
($)
$6,000
2.6 Maintenance
& Support
Ongoing Tech
Support 0 N/A $24,000 Annual
support and
maintenance
fee for Year
2 and 3
Updates
2.6 Subtotal
($) $24,000
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
EXHIBIT D
INSURANCE REQUIREMENTS
CONSULTANTS TO THE CITY OF PALO ALTO (CITY), AT THEIR SOLE EXPENSE, SHALL FOR THE TERM OF THE
CONTRACT OBTAIN AND MAINTAIN INSURANCE IN THE AMOUNTS FOR THE COVERAGE SPECIFIED BELOW, AFFORDED BY COMPANIES WITH AM BEST’S KEY RATING OF A-:VII, OR HIGHER, LICENSED OR AUTHORIZED TO TRANSACT INSURANCE BUSINESS IN THE STATE OF CALIFORNIA.
AWARD IS CONTINGENT ON COMPLIANCE WITH CITY’S INSURANCE REQUIREMENTS AS SPECIFIED HEREIN.
REQUIRED TYPE OF COVERAGE REQUIREMENT
MINIMUM LIMITS
EACH
OCCURRENCE AGGREGATE
YES
YES
WORKER’S COMPENSATION
EMPLOYER’S LIABILITY
STATUTORY
STATUTORY STATUTORY STATUTORY
YES
GENERAL LIABILITY, INCLUDING
PERSONAL INJURY, BROAD FORM
PROPERTY DAMAGE BLANKET
CONTRACTUAL, AND FIRE LEGAL
LIABILITY
BODILY INJURY
PROPERTY DAMAGE
BODILY INJURY & PROPERTY
DAMAGE COMBINED.
$1,000,000
$1,000,000
$1,000,000
$1,000,000
$1,000,000
$1,000,000
YES
AUTOMOBILE LIABILITY,
INCLUDING ALL OWNED, HIRED,
NON-OWNED
BODILY INJURY
- EACH PERSON
- EACH OCCURRENCE
PROPERTY DAMAGE
BODILY INJURY AND PROPERTY
DAMAGE, COMBINED
$1,000,000
$1,000,000
$1,000,000
$1,000,000
$1,000,000
$1,000,000
$1,000,000
$1,000,000
$1,000,000
$1,000,000
YES
PROFESSIONAL LIABILITY,
INCLUDING, ERRORS AND
OMISSIONS, MALPRACTICE (WHEN
APPLICABLE), AND NEGLIGENT
PERFORMANCE
ALL DAMAGES $1,000,000
YES
THE CITY OF PALO ALTO IS TO BE NAMED AS AN ADDITIONAL INSURED: CONSULTANT, AT ITS SOLE COST
AND EXPENSE, SHALL OBTAIN AND MAINTAIN, IN FULL FORCE AND EFFECT THROUGHOUT THE ENTIRE TERM
OF ANY RESULTANT AGREEMENT, THE INSURANCE COVERAGE HEREIN DESCRIBED, INSURING NOT ONLY CONSULTANT AND ITS SUBCONSULTANTS, IF ANY, BUT ALSO, WITH THE EXCEPTION OF WORKERS’ COMPENSATION, EMPLOYER’S LIABILITY AND PROFESSIONAL INSURANCE, NAMING AS ADDITIONAL INSUREDS CITY, ITS COUNCIL MEMBERS, OFFICERS, AGENTS, AND EMPLOYEES.
I. INSURANCE COVERAGE MUST INCLUDE:
A. A CONTRACTUAL LIABILITY ENDORSEMENT PROVIDING INSURANCE COVERAGE FOR CONSULTANT’S AGREEMENT TO INDEMNIFY CITY.
II. THE CONSULTANT MUST SUBMIT CERTIFICATES(S) OF INSURANCE EVIDENCING REQUIRED COVERAGE AT THE FOLLOWING EMAIL: [email protected]
III. ENDORSEMENT PROVISIONS WITH RESPECT TO THE INSURANCE AFFORDED TO ADDITIONAL INSUREDS:
A. PRIMARY COVERAGE
WITH RESPECT TO CLAIMS ARISING OUT OF THE OPERATIONS OF THE NAMED INSURED,
INSURANCE AS AFFORDED BY THIS POLICY IS PRIMARY AND IS NOT ADDITIONAL TO OR
CONTRIBUTING WITH ANY OTHER INSURANCE CARRIED BY OR FOR THE BENEFIT OF THE ADDITIONAL INSUREDS.
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3
Professional Services
Rev. Oct 16,2024
B. CROSS LIABILITY
THE NAMING OF MORE THAN ONE PERSON, FIRM, OR CORPORATION AS INSUREDS UNDER
THE POLICY SHALL NOT, FOR THAT REASON ALONE, EXTINGUISH ANY RIGHTS OF THE
INSURED AGAINST ANOTHER, BUT THIS ENDORSEMENT, AND THE NAMING OF MULTIPLE
INSUREDS, SHALL NOT INCREASE THE TOTAL LIABILITY OF THE COMPANY UNDER THIS POLICY.
C. NOTICE OF CANCELLATION
1. IF THE POLICY IS CANCELED BEFORE ITS EXPIRATION DATE FOR ANY REASON
OTHER THAN THE NON-PAYMENT OF PREMIUM, THE CONSULTANT SHALL PROVIDE CITY AT LEAST A THIRTY (30) DAY WRITTEN NOTICE BEFORE THE EFFECTIVE DATE OF CANCELLATION.
2. IF THE POLICY IS CANCELED BEFORE ITS EXPIRATION DATE FOR THE NON-PAYMENT OF PREMIUM, THE CONSULTANT SHALL PROVIDE CITY AT LEAST A TEN (10) DAY WRITTEN NOTICE BEFORE THE EFFECTIVE DATE OF CANCELLATION.
EVIDENCE OF INSURANCE AND OTHER RELATED NOTICES ARE REQUIRED TO BE FILED WITH THE CITY OF PALO ALTO SENT TO THE FOLLOWING EMAIL:
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3 DocuSign Envelope ID: 87E1232D-F46E-405A-95CD-91CC38106A93
POLICY AND PROCEDURES 1‐64/IT
Revised: December 2017
EXHIBIT “E” INFORMATION PRIVACY POLICY
POLICY STATEMENT
The City of Palo Alto (the “City”) strives to promote and sustain a superior quality of life for persons in Palo Alto. In promoting the quality of life of t hese persons, it is the policy of the City, consistent with the provisions of the California Public Records Act, California Government Code §§
6250 – 6270, to take appropriate measures to safeguard the security and privacy of the personal (including, without limitation, financial) information of persons, collected in the ordinary course and scope of conducting the City’s business as a local government agency.
These measures are generally observed by federal, state and local authorities and reflected in federal and California laws, the City’s rules and regulations, and industry best practices, including, without limitation, the provisions of California Civil Code §§ 1798.3(a), 1798.24, 1798.79.8(b), 1798.80(e), 1798.81.5, 1798.82(e), 1798.83(e)(7), and 1798.92(c). Though some of these provisions do not apply to local government agencies like the City, the City will conduct business in a manner which promotes the privacy of personal information, as reflected in federal and California laws. The objective of this Policy is to describe the City’s data security goals and objectives, to ensure the ongoing protection of the Personal Information, Personally Identifiable Information, Protected Critical Infrastructure Information and Personally Identifying Information of persons doing business wit the City and receiving services from the City or a third party under contract to the City to provide services. The terms “Personal Information,” “Protected Critical Infrastructure Information”, “Personally Identifiable Information” and “Personally Identifying Information” (collectively, the “Information”) are defined in the California Civil Code sections,
reference.
referred to above, and are incorporated in this Policy by
PURPOSE
The City, acting in its governmental and proprietary capacities, collects the Information pertaining to persons who do business with or receive services from the City. The Information is collected by a variety of means, including, without limitation, from persons applying to receive services provided by the City, persons accessing the City’s website, and persons who access other information portals maintained by the City’s staff and/or authorized third‐party contractors. The City is committed to protecting the privacy and security of the Information collected by the City. The City acknowledges federal and California laws, policies, rules, regulations and procedures, and industry best practices are dedicated to ensuring the Information is collected, stored and utilized in compliance with applicable laws.
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3 DocuSign Envelope ID: 87E1232D-F46E-405A-95CD-91CC38106A93
POLICY AND PROCEDURES 1‐64/IT
Revised: December 2017
The goals and objectives of the Policy are: (a) a safe, productive, and inoffensive work environment for all users having access to the City’s applications and databases; (b) the appropriate maintenance and security of database information assets owned by, or entrusted to, the City; (c) the controlled access and security of the Information provided to the City’s staff and third party contractors; and (d) faithful compliance with legal and regulatory requirements.
SCOPE
The Policy will guide the City’s staff and, indirectly, third party contractors, which are by contract required to protect the confidentiality and privacy of the Information of the persons whose personal information data are intended to be covered by the Policy and which will be advised by City staff to conform their performances to the Policy should they enjoy conditional access to that information.
CONSEQUENCES
The City’s employees shall comply with the Policy in the execution of their official duties to the extent their work implicates access to the Information referred to in this Policy. A failure to comply may result in employment and/or legal consequences.
EXCEPTIONS
In the event that a City employee cannot fully comply with one or more element(s) described in this Policy, the employee may request an exception by submitting Security Exception Request.
The exception request will be reviewed and administered by the City’s Information Security Manager (the “ISM”). The employee, with the approval of his or her supervisor, will provide any additional information as may be requested by the ISM. The ISM will conduct a risk assessment of the requested exception in accordance with guidelines approved by the City’s Chief Information Officer (“CIO”) and approved as to form by the City Attorney. The Policy’s guidelines will include at a minimum: purpose, source, collection, storage, access, retention, usage, and protection of the Information identified in the request. The ISM will consult with the CIO to approve or deny the exception request. After due consideration is given to the request, the exception request disposition will be communicated, in writing, to the City employee and his or her supervisor. The approval of any request may be subject to countermeasures established by the CIO, acting by the ISM.
MUNICIPAL ORDINANCE
This Policy will supersede any City policy, rule, regulation or procedure regarding information privacy.
RESPONSIBILITIES OF CITY STAFF
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3 DocuSign Envelope ID: 87E1232D-F46E-405A-95CD-91CC38106A93
POLICY AND PROCEDURES 1‐64/IT
Revised: December 2017
A. RESPONSIBILITY OF CIO AND ISM
The CIO, acting by the ISM, will establish an information security management framework to initiate and coordinate the implementation of information security measures by the City’s government.
The City’s employees, in particular, software application users and database users, and, indirectly, third party contractors under contract to the City to provide services, shall by guided by this Policy in the performance of their job responsibilities.
The ISM will be responsible for: (a) developing and updating the Policy, (b) enforcing compliance with and the effectiveness of the Policy; (c) the development of privacy standards that will manifest the Policy in detailed, auditable technical requirements, which will be designed and maintained by the persons responsible for the City’s IT environments; (d) assisting the City’s staff in evaluating security and privacy incidents that arise in regard to potential violations of the Policy; (e) reviewing and approving department‐specific policies and procedures which fall under the purview of this Policy; and (f) reviewing Non‐ Disclosure Agreements (NDAs) signed by third party contractors, which will provide services, including, without limitation, local or ‘cloud‐based’ software services to the City.
B. RESPONSIBILITY OF INFORMATION SECURITY STEERING COMMITTEE The Information Security Steering Committee (the “ISSC”), which is comprised of the City’s employees, drawn from the various City departments, will provide the primary direction, prioritization and approval for all information security efforts, including key information security and privacy risks, programs, initiatives and activities. The ISSC will provide input to the information security and privacy strategic planning processes to ensure that information security risks are adequately considered, assessed and addressed at the appropriate City department level.
C. RESPONSIBILITY OF USERS
All authorized users of the Information will be responsible for complying with information privacy processes and technologies within the scope of responsibility of each user.
D. RESPONSIBILITY OF INFORMATION TECHNOLOGY (IT) MANAGERS The City’s IT Managers, who are responsible for internal, external, direct and indirect connections to the City’s networks, will be responsible for configuring, maintaining and securing the City’s IT networks in compliance with the City’s information security and privacy policies. They are also responsible for timely internal reporting of events that may have compromised network, system or data security.
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3 DocuSign Envelope ID: 87E1232D-F46E-405A-95CD-91CC38106A93
POLICY AND PROCEDURES 1‐64/IT
Revised: December 2017
E. RESPONSIBILITY OF AUTHORIZATION COORDINATION
The ISM will ensure that the City’s employees secure the execution of Non‐Disclosure Agreements (NDA), whenever access to the Information will be granted to third party contractors, in conjunction with the Software as a Service (SaaS) Security and Privacy Terms and Conditions. An NDA must be executed prior to the sharing of the Information of persons covered by this Policy with third party contractors. The City’s approach to managing information security and its implementation (i.e. objectives, policies, processes, and procedures for information security) will be reviewed independently by the ISM at planned intervals, or whenever significant changes to security implementation have occurred.
The CIO, acting by the ISM, will review and recommend changes to the Policy annually, or as appropriate, commencing from the date of its adoption.
GENERAL PROCEDURE FOR INFORMATION PRIVACY
A. OVERVIEW
The Policy applies to activities that involve the use of the City’s information assets, namely, the Information of persons doing business with the City or receiving services from the City, which are owned by, or entrusted to, the City and will be made available to the City’s employees and third party contractors under contract to the City to provide Software as a Service consulting services. These activities include, without limitation, accessing the Internet, using e‐mail, accessing the City’s intranet or other networks, systems, or devices.
The term “information assets” also includes the personal information of the City’s employees and any other related organizations while those assets are under the City’s control. Security measures will be designed, implemented, and maintained to ensure that only authorized persons will enjoy access to the information assets. The City’s staff will act to protect its information assets from theft, damage, loss, compromise, and inappropriate disclosure or alteration. The City will plan, design, implement and maintain information management systems, networks and processes in order to assure the appropriate confidentiality, integrity, and availability of its information assets to the City’s employees and authorized third parties.
B. PERSONAL INFORMATION AND CHOICE
Except as permitted or provided by applicable laws, the City will not share the Information of any person doing business with the City, or receiving services from the City, in violation of this Policy, unless that person has consented to the City’s sharing of such information during the conduct of the City’s business as a local government agency with third parties under contract to the City to provide services.
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3 DocuSign Envelope ID: 87E1232D-F46E-405A-95CD-91CC38106A93
POLICY AND PROCEDURES 1‐64/IT
Revised: December 2017
C. METHODS OF COLLECTION OF PERSONAL INFORMATION
The City may gather the Information from a variety of sources and resources, provided that the collection of such information is both necessary and appropriate in order for the City to conduct business as a local government agency in its governmental and proprietary capacities. That information may be gathered at service windows and contact centers as well as at web sites, by mobile applications, and with other technologies, wherever the City may interact with persons who need to share such formation in order to secure the City’s services.
The City’s staff will inform the persons whose Information are covered by this Policy that the City’s web site may use “cookies” to customize the browsing experience with the City of Palo Alto web site. The City will note that a cookie contains unique information that a web site can use to track, among others, the Internet Protocol address of the computer used to access the City’s web sites, the identification of the browser software and operating systems used, the date and time a user accessed the site, and the Internet address of the website from which the user linked to the City’s web sites. Cookies created on the user’s computer by using the City’s web site do not contain the Information, and thus do not compromise the user’s privacy or security. Users can refuse the cookies or delete the cookie files from their computers by using any of the widely available methods. If the user chooses not to accept a cookie on his or her computer, it will not prevent or prohibit the user from gaining access to or using the City’s sites.
D. UTILITIES SERVICE
In the provision of utility services to persons located within Palo Alto, the City of Palo Alto Utilities Department (“CPAU”) will collect the Information in order to initiate and manage utility services to customers. To the extent the management of that information is not specifically addressed in the Utilities Rules and Regulations or other ordinances, rules, regulations or procedures, this Policy will apply; provided, however, any such Rules and Regulations must conform to this Policy, unless otherwise directed or approved by the Council. This includes the sharing of CPAU‐collected Information with other City departments except as may be required by law.
Businesses and residents with standard utility meters and/or having non‐metered monthly services will have secure access through a CPAU website to their Information, including, without limitation, their monthly utility usage and billing data. In addition to their regular monthly utilities billing, businesses and residents with non‐standard or experimental electric, water or natural gas meters may have their usage and/or billing data provided to them through non‐City electronic portals at different intervals than with the standard monthly billing.
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3 DocuSign Envelope ID: 87E1232D-F46E-405A-95CD-91CC38106A93
POLICY AND PROCEDURES 1‐64/IT
Revised: December 2017
Businesses and residents with such non‐standard or experimental metering will have their Information covered by the same privacy protections and personal information exchange rules applicable to Information under applicable federal and California laws.
E. PUBLIC DISCLOSURE
The Information that is collected by the City in the ordinary course and scope of conducting its business could be incorporated in a public record that may be subject to inspection and copying by the public, unless such information is exempt from disclosure to the public by California law.
F. ACCESS TO PERSONAL INFORMATION
The City will take reasonable steps to verify a person’s identity before the City will grant anyone online access to that person’s Information. Each City department that collects Information will afford access to affected persons who can review and update that information at reasonable times.
G. SECURITY, CONFIDENTIALITY AND NON‐DISCLOSURE
Except as otherwise provided by applicable law or this Policy, the City will treat the Information of persons covered by this Policy as confidential and will not disclose it, or permit it to be disclosed, to third parties without the express written consent of the person affected. The City will develop and maintain reasonable controls that are designed to protect the confidentiality and security of the Information of persons covered by this Policy.
The City may authorize the City’s employee and or third party contractors to access and/or use the Information of persons who do business with the City or receive services from the City. In those instances, the City will require the City’s employee and/or the third party contractors to agree to use such Information only in furtherance of City‐related business and in accordance with the Policy.
If the City becomes aware of a breach, or has reasonable grounds to believe that a security breach has occurred, with respect to the Information of a person, the City will notify the affected person of such breach in accordance with applicable laws. The notice of breach will include the date(s) or estimated date(s) of the known or suspected breach, the nature of the Information that is the subject of the breach, and the proposed action to be taken or the responsive action taken by the City.
H. DATA RETENTION / INFORMATION RETENTION
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3 DocuSign Envelope ID: 87E1232D-F46E-405A-95CD-91CC38106A93
POLICY AND PROCEDURES 1‐64/IT
Revised: December 2017
The City will store and secure all Information for a period of time as may be required by law, or if no period is established by law, for seven (7) years, and thereafter such information will be scheduled for destruction.
I. SOFTWARE AS A SERVICE (SAAS) OVERSIGHT
The City may engage third party contractors and vendors to provide software application and database services, commonly known as Software‐as‐a‐Service (SaaS).
In order to assure the privacy and security of the Information of those who do business with the City and those who received services from the City, as a condition of selling goods and/or services to the City, the SaaS services provider and its subcontractors, if any, including any IT infrastructure services provider, shall design, install, provide, and maintain a secure IT environment, while it performs such services and/or furnishes goods to the City, to the extent any scope of work or services implicates the confidentiality and privacy of the Information.
These requirements include information security directives pertaining to: (a) the IT infrastructure, by which the services are provided to the City, including connection to the City's IT systems; (b) the SaaS services provider’s operations and maintenance processes needed to support the IT environment, including disaster recovery and business continuity planning; and (c) the IT infrastructure performance monitoring services to ensure a secure and reliable environment and service availability to the City. The term “IT infrastructure” refers to the integrated framework, including, without limitation, data centers, computers, and database management devices, upon which digital networks operate.
Prior to entering into an agreement to provide services to the City, the City’s staff will require the SaaS services provider to complete and submit an Information Security and Privacy Questionnaire. In the event that the SaaS services provider reasonably determines that it cannot fulfill the information security requirements during the course of providing services, the City will require the SaaS services provider to promptly inform the ISM.
J. FAIR AND ACCURATE CREDIT TRANSACTION ACT OF 2003
CPAU will require utility customers to provide their Information in order for the City to initiate and manage utility services to them.
Federal regulations, implementing the Fair and Accurate Credit Transactions Act of 2003 (Public Law 108‐159), including the Red Flag Rules, require that CPAU, as a “covered financial institution or creditor” which provides services in advance of payment and which can affect consumer credit, develop and implement procedures for an identity theft program for new and existing accounts to detect, prevent, respond and mitigate potential identity theft of its customers’ Information.
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3 DocuSign Envelope ID: 87E1232D-F46E-405A-95CD-91CC38106A93
POLICY AND PROCEDURES 1‐64/IT
Revised: December 2017
CPAU procedures for potential identity theft will be reviewed independently by the ISM annually or whenever significant changes to security implementation have occurred. The ISM will recommend changes to CPAU identity theft procedures, or as appropriate, so as to conform to this Policy.
There are California laws which are applicable to identity theft; they are set forth in California Civil Code § 1798.92.
NOTE: Questions regarding this policy should be referred to the Information Technology Department, as appropriate.
12/5/2017
Recommended:
Director Information Technology/CIO Date
12/13/2017
Approved:
City Manager Date
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3 City of Palo Alto
Information Security
Document Version: V3.0
Doc: InfoSec 110
P age 1 of 3
EXHIBIT “F”
CYBERSECURITY TERMS AND CONDITIONS
I
n order to assure the privacy and security of the personal information of the City 's customers and people who do business with the City, including, without limitation, vendors, utility customers, library patrons, and other individuals and companies, who are required to share such information with the City, as a condition of receiving services from the City or selling goods and services to the City, including, without limitation, the Software as a Service services provider (the "Consultant") and its subcontractors, if any, including, without limitation, any Information Technology ("IT") infrastructure services provider, shall design, install, provide, and maintain a secure IT environment, described below, while it renders and performs the Services and furnishes goods, if any, described in the Statement of Work, Exhibit B, to the extent any scope of work implicates the confidentiality and privacy of the personal information of the City's customers. The Consultant shall fulfill the data and information security requirements (the "Requirements") set forth in Part A below.
A "s
ecure IT environment" includes (a) the IT infrastructure, by which the Services are provided to the City, including connection to the City's IT systems; (b) the Consultant's operations and maintenance processes needed to support the environment, including disaster recovery and business continuity planning; and (c) the IT infrastructure performance monitoring services to ensure a secure and reliable environment and service availability to the City . "IT infrastructure" refers to the integrated framework, including, without limitation, data centers, computers, and database management devices, upon which digital networks operate.
I
n the event that, after the Effective Date, the Consultant reasonably determines that it cannot fulfill the Requirements, the Consultant shall promptly inform the City of its determination and submit, in writing, one or more alternate countermeasure options to the Requirements (the "Alternate Requirements" as set forth in Part B), which may be accepted or rejected in the reasonable satisfaction of the Information Security Manager (the "ISM").
P
art A. Requirements:
The C
onsultant shall at all times during the term of any contract between the City and the Consultant:
(
a) Appoint or designate an employee, preferably an executive officer, as the security liaison to the City with respect to the Services to be performed under this Agreement. (b) Comply with the City's Information Privacy Policy:
(c) H ave adopted and implemented information security and privacy policies that are documented, are accessible to the City , and conform to ISO 27001/2 – Information Security Management Systems (ISMS) Standards. See the following:
http://www.iso.org/iso/home/store/catalogue_tc/catalogue_detail.htm?csnumber=42103 http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=50297 (d) Conduct routine data and information security compliance training of its personnel that is appropriate to their role.
(e) Develop and maintain detailed documentation of the IT infrastructure, including softwar e v
ersions and patch levels.
(f) Develop an independently verifiable process, consistent with industry standards, for performing professional and criminal background checks of its employees that (1) would permit verification of employees' personal identity and employment status, and (2) would enable the immediate denial of access to the City's confidential data and information by any of its employees who no Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3 City of Palo Alto
Information Security
Document Version: V3.0
Doc: InfoSec 110
longer would require access to that information or who are terminated. (g) Provide a list of IT infrastructure components in order to verify whether the Consultant has met or has failed to meet any objective terms and conditions. (h) Implement access accountability (identification and authentication) architecture and support role-based access control ( "RBAC") and segregation of d uties ( "SoD") mechanisms for all personnel, systems, and Software used to provide the Services. "RBAC" refers to a computer systems security approach to restricting access only to authorized users. "SoD" is an approach that would require more than one individual to complete a security task in order to promote the detection and prevention of fraud and errors.
(i) Assist the City in undertaking annually an assessment to assure that: (1) all elements of the Services' environment design and deployment are known to the City, and (2) it has implemented measures in accordance with industry best practices applicable to secure coding and secure IT architecture.
(j) Provide and maintain secure intersystem communication paths that would ensure the confidentiality, integrity, and availability of the City's information. (k) Deploy and maintain IT system upgrades, patches and configurations conforming to current patch and/or release levels by not later than one (1) week after its date of release. Emergency security patches must be installed within 24 hours after its date of release. (l) Provide for the timely detection of, response to, and the reporting of security incidents, including on-going incident monitoring with logging.
(m) Notify the City within one (1) hour of detecting a security incident that results in the unauthorized access to or the misuse of the City's confidential data and information. (n) Inform the City that any third party service provider(s) meet(s) all of the Requirements. (o) Perform security self-audits on a regular basis and not less frequently than on a quarterly basis, and provide the required summary reports of those self -audits to the ISM on the annual anniversary date or any other date agreed to by the Parties. (p) Accommodate, as practicable, and upon reasonable prior notice by the City, the City 's performance of random site security audits at the Consultant's site(s), including the site(s) of a third-party service provider(s), as applicable. The scope of these audits will extend to the Consultant's and its third-party service provider(s)' awareness of security policies and practices, systems configurations, access authentication and authorization, and incident detection and response.
(q) Cooperate with the City to ensure that to the extent required by applicable laws, rules and regulations, and the Confidential Information will be accessible only by the Consultant and any authorized third-party service provider's personnel.
(r) Perform regular, reliable secured backups of all data needed to maximize the availability of the Services. Adequately encrypt the City of Palo Alto's data, during the operational process, hosted at rest, and the backup stage at the Vendors' environment (including Vendor's contracting organization's environment).
(s) Maintain records relating to the Services for a period of three (3) years after the expiration or earlier termination of this Agreement and in a mutually agreeable storage medium. Within thirty (30) days after the effective date of expiration or earlier ter mination of this Agreement, all of those records relating to the performance of the Services shall be provided to the ISM. (t) Maintain the Confidential Information in accordance with applicable federal, state, and local data and information privacy laws, rules, and regulations.
(u) Encrypt the Confidential Information before delivering the same by electronic mail to the City and or any authorized recipient.
(v) Provide Network Layer IP filtering services to allow access only from the City of Palo Alto's IP address to the Vendor environment (primarily hosted for the City of Palo Alto). (w) Offer a robust disaster recovery and business continuity (DR-BCP) solutions to the City for the systems and services the Vendor provides to the City.
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3 City of Palo Alto
Information Security
Document Version: V3.0
Doc: InfoSec 110
(x) Provide and support Single Sign- on (SSO) and Multifactor Authentication (MFA) solutions for authentication and authorization services from the "City's environment to the Vendor's environment," and Vendor's environment to the Vendor's cloud services/hosted environment ." The Vendor shall allow two employees of the City to have superuser and super -admin access to the Vendor's IT environment, and a cloud-hosted IT environment belongs to the City. (y) Unless otherwise addressed in the Agreement, shall not hold the City liable for any direct, indirect or punitive damages whatsoever including, without limitation, damages for loss of use, data or profits, arising out of or in any way connected with the City 's IT environment, including, without limitation, IT infrastructure communications.
(z) The Vendor must provide evidence of valid cyber liability insurance policy per the City’s
EXHIBIT “D” INSURANCE REQUIREMENTS.
Part B. Alternate Requirements:
Docusign Envelope ID: 5B9C1927-A269-4007-AA4C-F3F018D8A4F3