Agenda packet — Rancho Cucamonga City Council, October 21, 2026 (part 4 of 6)

Version June 28, 2023
2024056 Page 42 of 74
(7) In the event of the contractor's noncompliance with the nondiscrimination clauses of this contract or with any of the said rules, regulations, or orders, this contract may be canceled, terminated, or suspended in whole or in part and the contractor may be declared ineligible for further Government contracts or federally assisted construction contracts in accordance with procedures authorized in Executive Order 11246 of September 24, 1965, and such other sanctions may be imposed and remedies invoked as provided in Executive Order 11246 of September 24, 1965, or by rule, regulation, or order of the Secretary of Labor, or as otherwise provided by law. (8) The contractor will include the portion of the sentence immediately preceding paragraph (1) and the provisions of paragraphs (1) through (8) in every subcontract or purchase order unless exempted by rules, regulations, or orders of the Secretary of Labor issued pursuant to section 204 of Executive Order 11246 of September 24, 1965, so that such provisions will be binding upon each subcontractor or vendor. The contractor will take such action with respect to any subcontract or purchase order as the administering agency may direct as a means of enforcing such provisions, including sanctions for noncompliance:

Provided, however, that in the event a contractor becomes involved in, or is threatened with, litigation with a subcontractor or vendor as a result of such direction by the administering agency, the contractor may request the United States to enter into such litigation to protect the interests of the United States.

The applicant further agrees that it will be bound by the above equal opportunity clause with respect to its own employment practices when it participates in federally assisted construction work: Provided, That if the applicant so participating is a State or local government, the above equal opportunity clause is not applicable to any agency, instrumentality or subdivision of such government which does not participate in work on or under the contract.

The applicant agrees that it will assist and cooperate actively with the administering agency and the Secretary of Labor in obtaining the compliance of contractors and subcontractors with the equal opportunity clause and the rules, regulations, and relevant orders of the Secretary of Labor, that it will furnish the administering agency and the Secretary of Labor such information as they may require for the supervision of such compliance, and that it will otherwise assist the administering agency in the discharge of the agency's primary responsibility for securing compliance.

The applicant further agrees that it will refrain from entering into any contract or contract modification subject to Executive Order 11246 of September 24, 1965, with a contractor debarred from, or who has not demonstrated eligibility for, Government contracts and federally assisted construction contracts pursuant to the Executive Order and will carry out such sanctions and penalties for violation of the equal opportunity clause as may be imposed upon contractors and subcontractors by the administering agency or the Secretary of Labor pursuant to Part II, Subpart D of the Executive Order. In addition, the applicant agrees that if it fails or refuses to comply with these undertakings, the administering agency may take any or all of the following actions: Cancel, terminate, or suspend in whole or in part this grant (contract, loan, insurance, guarantee); refrain from extending any further assistance to the applicant under the program with respect to which the failure or refund occurred until satisfactory assurance of future compliance has been received from such applicant; and refer the case to the Department of Justice for appropriate legal proceedings.

Page 600333 ends

Version June 28, 2023
2024056 Page 43 of 74

4. DAVIS-BACON ACT
a. Standard. All prime construction contracts in excess of $2,000 awarded by non- Federal entities must include a provision for compliance with the Davis-Bacon Act (40 U.S.C. §§ 3141- 3144 and 3146-3148) as supplemented by Department of Labor regulations at 29 C.F.R. Part 5 (Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction). See 2 C.F.R. Part 200, Appendix II(D). In accordance with the statute, contractors must be required to pay wages to laborers and mechanics at a rate not less than the prevailing wages specified in a wage determination made by the Secretary of Labor. In addition, contractors must be required to pay wages not less than once a week. b. Applicability. The Davis-Bacon Act applies to the Emergency Management Preparedness Grant Program, Homeland Security Grant Program, Nonprofit Security Grant Program, Tribal Homeland Security Grant Program, Port Security Grant Program, and Transit Security Grant Program.
c. Requirements. If applicable, the non-federal entity must do the following:
i. The non-Federal entity must place a copy of the current prevailing wage determination issued by the Department of Labor in each solicitation. The decision to award a contract or subcontract must be conditioned upon the acceptance of the wage determination. The non-Federal entity must report all suspected or reported violations to the Federal awarding agency.
ii. Additionally, pursuant 2 C.F.R. Part 200, Appendix II(D), contracts subject to the Davis-Bacon Act, must also include a provision for compliance with the Copeland “Anti-Kickback” Act (40 U.S.C. § 3145), as supplemented by Department of Labor regulations at 29 C.F.R. Part 3 (Contractors and Subcontractors on Public Building or Public Work Financed in Whole or in Part by Loans or Grants from the United States). The Copeland Anti- Kickback Act provides that each contractor or subrecipient must be prohibited from inducing, by any means, any person employed in the construction, completion, or repair of public work, to give up any part of the compensation to which he or she is otherwise entitled. The nonFederal entity must report all suspected or reported violations to FEMA. iii. Include a provision for compliance with the Davis-Bacon Act (40 U.S.C. 3141- 3144, and 3146-3148) as supplemented by Department of Labor regulations (29 CFR Part 5, “Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction”).

Suggested Language. The following provides a sample contract clause:

Compliance with the Davis-Bacon Act.
a. All transactions regarding this contract shall be done in compliance with the Davis-Bacon Act (40 U.S.C. 3141- 3144, and 3146-3148) and the requirements of 29 C.F.R. pt. 5 as may be applicable. The contractor shall comply with 40 U.S.C. 3141- 3144, and 3146-3148 and the requirements of 29 C.F.R. pt. 5 as applicable.

Page 600444 ends

Version June 28, 2023
2024056 Page 44 of 74
b. Contractors are required to pay wages to laborers and mechanics at a rate not less than the prevailing wages specified in a wage determination made by the Secretary of Labor.
c. Additionally, contractors are required to pay wages not less than once a week.

5. COPELAND ANTI-KICKBACK ACT
a. Standard. Recipient and subrecipient contracts must include a provision for compliance with the Copeland “Anti-Kickback” Act (40 U.S.C. 3145), as supplemented by Department of Labor regulations (29 CFR Part 3, “Contractors and Subcontractors on Public Building or Public Work Financed in Whole or in Part by Loans or Grants from the United States”). b. Applicability. This requirement applies to all contracts for construction or repair work above $2,000 in situations where the Davis-Bacon Act also applies. It DOES NOT apply to the FEMA Public Assistance Program.
c. Requirements. If applicable, the non-federal entity must include a provision for compliance with the Copeland “Anti-Kickback” Act (40 U.S.C. § 3145), as supplemented by Department of Labor regulations at 29 C.F.R. Part 3 (Contractors and Subcontractors on Public Building or Public Work Financed in Whole or in Part by Loans or Grants from the United States). Each contractor or subrecipient must be prohibited from inducing, by any means, any person employed in the construction, completion, or repair of public work, to give up any part of the compensation to which he or she is otherwise entitled. The non-Federal entity must report all suspected or reported violations to FEMA. Additionally, in accordance with the regulation, each contractor and subcontractor must furnish each week a statement with respect to the wages paid each of its employees engaged in work covered by the Copeland Anti-Kickback Act and the Davis Bacon Act during the preceding weekly payroll period. The report shall be delivered by the contractor or subcontractor, within seven days after the regular payment date of the payroll period, to a representative of a Federal or State agency in charge at the site of the building or work.

Sample Language. The following provides a sample contract clause:

Compliance with the Copeland “Anti-Kickback” Act.
a. Contractor. The contractor shall comply with 18 U.S.C. § 874, 40 U.S.C. § 3145, and the requirements of 29 C.F.R. pt. 3 as may be applicable, which are incorporated by reference into this contract. b. Subcontracts. The contractor or subcontractor shall insert in any subcontracts the clause above and such other clauses as FEMA may by appropriate instructions require, and also a clause requiring the subcontractors to include these clauses in any lower tier subcontracts.

The prime contractor shall be responsible for the compliance by any subcontractor or lower tier subcontractor with all of these contract clauses.
c. Breach. A breach of the contract clauses above may be grounds for termination of the contract, and for debarment as a contractor and subcontractor as provided in 29 C.F.R. §5.12.”

Page 6005 ends

Version June 28, 2023
2024056 Page 45 of 74

6. CONTRACT WORK HOURS AND SAFETY STANDARDS ACT
a. Standard. Where applicable (see 40 U.S.C. §§ 3701-3708), all contracts awarded by the non-Federal entity in excess of $100,000 that involve the employment of mechanics or laborers must include a provision for compliance with 40 U.S.C. §§ 3702 and 3704, as supplemented by Department of Labor regulations at 29 C.F.R. Part 5. See 2 C.F.R. Part 200, Appendix II(E). Under 40 U.S.C. § 3702, each contractor must be required to compute the wages of every mechanic and laborer on the basis of a standard work week of 40 hours. Work in excess of the standard work week is permissible provided that the worker is compensated at a rate of not less than one and a half times the basic rate of pay for all hours worked in excess of 40 hours in the work week. Further, no laborer or mechanic must be required to work in surroundings or under working conditions which are unsanitary, hazardous, or dangerous.
b. Applicability. This requirement applies to all FEMA contracts awarded by the non- federal entity in excess of $100,000 under grant and cooperative agreement programs that involve the employment of mechanics or laborers. It is applicable to construction work. These requirements do not apply to the purchase of supplies or materials or articles ordinarily available on the open market, or contracts for transportation or transmission of intelligence.
c. Suggested Language. The regulation at 29 C.F.R. § 5.5(b) provides contract clause language concerning compliance with the Contract Work Hours and Safety Standards Act. FEMA suggests including the following contract clause:

Compliance with the Contract Work Hours and Safety Standards Act. (1) Overtime requirements. No contractor or subcontractor contracting for any part of the contract work which may require or involve the employment of laborers or mechanics shall require or permit any such laborer or mechanic in any workweek in which he or she is employed on such work to work in excess of forty hours in such workweek unless such laborer or mechanic receives compensation at a rate not less than one and one-half times the basic rate of pay for all hours worked in excess of forty hours in such workweek. (2) Violation; liability for unpaid wages; liquidated damages. In the event of any violation of the clause set forth in paragraph (b)(1) of this section the contractor and any subcontractor responsible therefor shall be liable for the unpaid wages. In addition, such contractor and subcontractor shall be liable to the United States (in the case of work done under contract for the District of Columbia or a territory, to such District or to such territory), for liquidated damages. Such liquidated damages shall be computed with respect to each individual laborer or mechanic, including watchmen and guards, employed in violation of the clause set forth in paragraph (b)(1) of this section, in the sum of $27 for each calendar day on which such individual was required or permitted to work in excess of the standard workweek of forty hours without payment of the overtime wages required by the clause set forth in paragraph (b)(1) of this section. (3) Withholding for unpaid wages and liquidated damages. The Federal agency or loan/grant recipient shall upon its own action or upon written request of an authorized representative of the Department of Labor withhold or cause to be withheld, from any moneys payable on account of work performed by the contractor or subcontractor under any such contract or any other Federal contract with the same prime contractor, or any other federally-assisted contract subject to the Contract Work Hours and Safety Standards Act, which is held by the same prime contractor, such sums as may be determined to be necessary to satisfy any liabilities of such contractor or subcontractor for unpaid wages and liquidated damages as provided in the clause set forth in

Page 6006 ends

Version June 28, 2023
2024056 Page 46 of 74
paragraph (b)(2) of this section.
(4) Subcontracts. The contractor or subcontractor shall insert in any subcontracts the clauses set forth in paragraph (b)(1) through (4) of this section and also a clause requiring the subcontractors to include these clauses in any lower tier subcontracts. The prime contractor shall be responsible for compliance by any subcontractor or lower tier subcontractor with the clauses set forth in paragraphs (b)(1) through (4) of this section.

7. RIGHTS TO INVENTIONS MADE UNDER A CONTRACT OR AGREEMENT a. Standard. If the FEMA award meets the definition of “funding agreement” under 37C.F.R. § 401.2(a) and the non-Federal entity wishes to enter into a contract with a small business firm or nonprofit organization regarding the substitution of parties, assignment or performance of experimental, developmental, or research work under that “funding agreement,” the non- Federal entity must comply with the requirements of 37 C.F.R. Part 401 (Rights to Inventions Made by Nonprofit Organizations and Small Business Firms Under Government Grants, Contracts and Cooperative Agreements), and any implementing regulations issued by FEMA. See 2 C.F.R. Part 200, Appendix II(F). b. Applicability. This requirement applies to “funding agreements,” but it DOES NOT apply to the Public Assistance, Hazard Mitigation Grant Program, Fire Management Assistance Grant Program, Crisis Counseling Assistance and Training Grant Program, Disaster Case Management Grant Program, and Federal Assistance to Individuals and Households – Other Needs Assistance Grant Program, as FEMA awards under these programs do not meet the definition of “funding agreement.”
c. Funding Agreements Definition. The regulation at 37 C.F.R. § 401.2(a) defines “funding agreement” as any contract, grant, or cooperative agreement entered into between any Federal agency, other than the Tennessee Valley Authority, and any contractor for the performance of experimental, developmental, or research work funded in whole or in part by the Federal government. This term also includes any assignment, substitution of parties, or subcontract of any type entered into for the performance of experimental, developmental, or research work under a funding agreement as defined in the first sentence of this paragraph.

8. CLEAN AIR ACT AND THE FEDERAL WATER POLLUTION CONTROL ACT a. Standard. If applicable, contracts must contain a provision that requires the contractor to agree to comply with all applicable standards, orders, or regulations issued pursuant to the Clean Air Act (42 U.S.C. §§ 7401-7671q.) and the Federal Water Pollution Control Act as amended (33 U.S.C. §§ 1251-1387). Violations must be reported to FEMA and the Regional Office of the Environmental Protection Agency. See 2 C.F.R. Part 200, Appendix II(G).
b. Applicability. This requirement applies to contracts awarded by a non-federal entity of amounts in excess of $150,000 under a federal grant.
c. Suggested Language. The following provides a sample contract clause.

Clean Air Act

1. The contractor agrees to comply with all applicable standards, orders or regulations issued pursuant to the Clean Air Act, as amended, 42 U.S.C. § 7401 et seq.

Page 6007 ends

Version June 28, 2023
2024056 Page 47 of 74

2. The contractor agrees to report each violation to the Participating Public Agency and understands and agrees that the Participating Public Agency will, in turn, report each violation as required to assure notification to the Federal Emergency Management Agency, and the appropriate Environmental Protection Agency Regional Office.

3. The contractor agrees to include these requirements in each subcontract exceeding $150,000 financed in whole or in part with Federal assistance provided by FEMA.

Federal Water Pollution Control Act

1. The contractor agrees to comply with all applicable standards, orders, or regulations issued pursuant to the Federal Water Pollution Control Act, as amended, 33 U.S.C. 1251 et seq.

3. The contractor agrees to include these requirements in each subcontract exceeding $150,000 financed in whole or in part with Federal assistance provided by FEMA.

9. DEBARMENT AND SUSPENSION
a. Standard. Non-Federal entities and contractors are subject to the debarment and suspension regulations implementing Executive Order 12549, Debarment and Suspension (1986) and Executive Order 12689, Debarment and Suspension (1989) at 2 C.F.R. Part 180 and the Department of Homeland Security’s regulations at 2 C.F.R. Part 3000 (Non-procurement Debarment and Suspension).
b. Applicability. This requirement applies to all FEMA grant and cooperative agreement programs.
c. Requirements.
i. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs and activities. See 2 C.F.R. Part 200, Appendix II(H); and 2 C.F.R. § 200.213. A contract award must not be made to parties listed in the SAM Exclusions. SAM Exclusions is the list maintained by the General Services Administration that contains the names of parties debarred, suspended, or otherwise excluded by agencies, as well as parties declared ineligible under statutory or regulatory authority other than Executive Order 12549.

SAM exclusions can be accessed at www.sam.gov. See 2 C.F.R. § 180.530. ii. In general, an “excluded” party cannot receive a Federal grant award or a contract within the meaning of a “covered transaction,” to include subawards and subcontracts. This includes parties that receive Federal funding indirectly, such

Page 6008 ends

Version June 28, 2023
2024056 Page 48 of 74
as contractors to recipients and subrecipients. The key to the exclusion is whether there is a “covered transaction,” which is any non-procurement transaction (unless excepted) at either a “primary” or “secondary” tier. Although “covered transactions” do not include contracts awarded by the Federal Government for purposes of the non-procurement common rule and DHS’s implementing regulations, it does include some contracts awarded by recipients and subrecipients.
iii. Specifically, a covered transaction includes the following contracts for goods or services:

1. The contract is awarded by a recipient or subrecipient in the amount of at least $25,000.

2. The contract requires the approval of FEMA, regardlessof amount.

3. The contract is for federally-required audit services.

4. A subcontract is also a covered transaction if it is awarded by the contractor of a recipient or subrecipient and requires either the approval of FEMA or is in excess of $25,000.
d. Suggested Language. The following provides a debarment and suspension clause. It incorporates an optional method of verifying that contractors are not excluded or disqualified.

Suspension and Debarment
(1) This contract is a covered transaction for purposes of 2 C.F.R. pt. 180 and 2 C.F.R. pt. 3000. As such, the contractor is required to verify that none of the contractor’s principals (defined at 2 C.F.R. § 180.995) or its affiliates (defined at 2 C.F.R. § 180.905) are excluded (defined at 2 C.F.R. § 180.940) or disqualified (defined at 2 C.F.R. § 180.935).
(2) The contractor must comply with 2 C.F.R. pt. 180, subpart C and2 C.F.R. pt. 3000, subpart C, and must include a requirement to comply with these regulations in any lower tier covered transaction it enters into.
(3) This certification is a material representation of fact relied upon by the Participating Public Agency. If it is later determined that the contractor did not comply with 2 C.F.R. pt. 180, subpart C and 2 C.F.R. pt. 3000, subpart C, in addition to remedies available to the Participating Public Agency, the Federal Government may pursue available remedies, including but not limited to suspension and/or debarment. (4) The bidder or proposer agrees to comply with the requirements of 2 C.F.R. pt. 180, subpart C and 2 C.F.R. pt. 3000, subpart C while this offer is valid and throughout the period of any contract that may arise from this offer. The bidder or proposer further agrees to include a provision requiring such compliance in its lower tier covered transactions.

10. BYRD ANTI-LOBBYING AMENDMENT
a. Standard. Each tier certifies to the tier above that it will not and has not used Federal appropriated funds to pay any person or organization for influencing or attempting to

Page 6009 ends

Version June 28, 2023
2024056 Page 49 of 74
influence an officer or employee of any agency, a Member of Congress, officer or employee of Congress, or an employee of a Member of Congress in connection with obtaining any Federal contract, grant or any other award covered by 31 U.S.C. § 1352.

FEMA’s regulation at 44 C.F.R. Part 18 implements the requirements of 31 U.S.C. § 1352 and provides, in Appendix A to Part 18, a copy of the certification that is required to be completed by each entity as described in 31 U.S.C. § 1352. Each tier must also disclose any lobbying with non-Federal funds that takes place in connection with obtaining any Federal award. Such disclosures are forwarded from tier to tier up to the Federal awarding agency.
b. Applicability. This requirement applies to all FEMA grant and cooperative agreement programs. Contractors that apply or bid for a contract of $100,000 or more under a federal grant must file the required certification. See 2 C.F.R. Part 200, Appendix II(I); 31 U.S.C. § 1352; and 44 C.F.R. Part 18.
c. Suggested Language.

Byrd Anti-Lobbying Amendment, 31 U.S.C. § 1352 (as amended) Contractors who apply or bid for an award of $100,000 or more shall file the required certification. Each tier certifies to the tier above that it will not and has not used Federal appropriated funds to pay any person or organization for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, officer or employee of Congress, or an employee of a Member of Congress in connection with obtaining any Federal contract, grant, or any other award covered by 31 U.S.C. § 1352.

Each tier shall also disclose any lobbying with non-Federal funds that takes place in connection with obtaining any Federal award. Such disclosures are forwarded from tier to tier up to the recipient who in turn will forward the certification(s) to the awarding agency.
d. Required Certification. If applicable, contractors must sign and submit to the non-federal entity the following certification.

APPENDIX A, 44 C.F.R. PART 18 – CERTIFICATION REGARDING LOBBYING Certification for Contracts, Grants, Loans, and Cooperative Agreements The undersigned certifies, to the best of his or her knowledge and belief, that:

1. No Federal appropriated funds have been paid or will be paid, by or on behalf of the undersigned, to any person for influencing or attempting to influence an officer or employee of an agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with the awarding of any Federal contract, the making of any Federal grant, the making of any Federal loan, the entering into of any cooperative agreement, and the extension, continuation, renewal, amendment, or modification of any Federal contract, grant, loan, or cooperative agreement.

2. If any funds other than Federal appropriated funds have been paid or will be paid to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with this Federal contract, grant, loan, or cooperative agreement, the undersigned shall complete and submit Standard FormLLL, “Disclosure Form to Report Lobbying,” in accordance with its instructions.

Page 611100 ends

Version June 28, 2023
2024056 Page 50 of 74

3. The undersigned shall require that the language of this certification be included in the award documents for all subawards at all tiers (including subcontracts, subgrants, and contracts under grants, loans, and cooperative agreements) and that all subrecipients shall certify and disclose accordingly.

This certification is a material representation of fact upon which reliance was placed when this transaction was made or entered into. Submission of this certification is a prerequisite for making or entering into this transaction imposed by section 1352, title 31, U.S. Code. Any person who fails to file the required certification shall be subject to a civil penalty of not less than $10,000 and not more than $100,000 for each such failure.

The Contractor, , certifies or affirms the truthfulness and accuracy of each statement of its certification and disclosure, if any. In addition, the Contractor understands and agrees that the provisions of 31 U.S.C. Chap. 38, Administrative Remedies for False Claims and Statements, apply to this certification and disclosure, if any.

Signature of Contractor’s Authorized Official
Name and Title of Contractor’s Authorized Official
Date

Page 6111111 ends

2024056 Page 51 of 74

11. PROCUREMENT OF RECOVERED MATERIALS
a. Standard. A non-Federal entity that is a state agency or agency of a political subdivision of a state and its contractors must comply with Section 6002 of the Solid Waste Disposal Act, as amended by the Resource Conservation and Recovery Act. See 2 C.F.R. Part 200, Appendix II(J); and 2 C.F.R. § 200.322.
b. Applicability. This requirement applies to all contracts awarded by a non- federal entity under FEMA grant and cooperative agreement programs.
c. Requirements. The requirements of Section 6002 include procuring only items designated in guidelines of the EPA at 40 C.F.R. Part 247 that contain the highest percentage of recovered materials practicable, consistent with maintaining a satisfactory level of competition, where the purchase price of the item exceeds
$10,000 or the value of the quantity acquired by the preceding fiscal year exceeded $10,000; procuring solid waste management services in a manner that maximizes energy and resource recovery; and establishing an affirmative procurement program for procurement of recovered materials identified in the EPA guidelines.
d. Suggested Language.
i. In the performance of this contract, the Contractor shall make maximum use of products containing recovered materials that are EPA-designated items unless the product cannot be acquired—

1. Competitively within a timeframe providing for compliance with the contract performance schedule;

2. Meeting contract performance requirements; or

3. At a reasonable price.
ii. Information about this requirement, along with the list of EPA- designated items, is available at EPA’s Comprehensive Procurement Guidelines web site, https://www.epa.gov/smm/comprehensive-procurement-guideline-cpg-program. iii. The Contractor also agrees to comply with all other applicable requirements of Section 6002 of the Solid Waste Disposal Act.”

12. DOMESTIC PREFERENCES FOR PROCUREMENTS
As appropriate, and to the extent consistent with law, CONTRACTOR should, to the greatest extent practicable under a federal award, provide a preference for the purchase, acquisition, or use of goods, products or materials produced in the United States. This includes, but is not limited to, iron, aluminum, steel, cement, and other manufactured products.

Applicability For purchases in support of FEMA declarations and awards issued on or after November 12, 2020, all FEMA recipients and subrecipients are required to include in all contracts and purchase orders for work or products a contract provision encouraging domestic preference for procurements.

Domestic Preference for Procurements As appropriate, and to the extent consistent with law, the contractor should, to the greatest extent practicable, provide a preference for the purchase, acquisition, or use of goods, products, or materials produced in the United States. This includes, but is not limited to iron, aluminum, steel, cement, and other manufactured products. For purposes of this clause: Produced in the United States means, for iron and steel products, that all manufacturing processes, from the initial melting stage through the application of coatings, occurred in the United States. Manufactured products mean items and construction materials composed in whole or in part of non-ferrous metals such as aluminum; plastics and polymer-based products such as polyvinyl chloride pipe; aggregates such as concrete; glass, including optical fiber; and lumber.”

Page 6111222 ends

Version June 28, 2023
2024056 Page 52 of 74

13. ACCESS TO RECORDS
a. Standard. All recipients, subrecipients, successors, transferees, and assignees must acknowledge and agree to comply with applicable provisions governing DHS access to records, accounts, documents, information, facilities, and staff. Recipients must give DHS/FEMA access to, and the right to examine and copy, records, accounts, and other documents and sources of information related to the federal financial assistance award and permit access to facilities, personnel, and other individuals and information as may be necessary, as required by DHS regulations and other applicable laws or program guidance. See DHS Standard Terms and Conditions: Version 8.1 (2018).

Additionally, Section 1225 of the Disaster Recovery Reform Act of 2018 prohibits FEMA from providing reimbursement to any state, local, tribal, or territorial government, or private non-profit for activities made pursuant to a contract that purports to prohibit audits or internal reviews by the FEMA administrator or Comptroller General.

Access to Records. The following access to records requirements apply to this contract:
i.The Contractor agrees to provide Participating Public Agency, the FEMA Administrator, the Comptroller General of the United States, or any of their authorized representatives access to any books, documents, papers, and records of the Contractor which are directly pertinent to this contract for the purposes of making audits, examinations, excerpts, and transcriptions. ii.The Contractor agrees to permit any of the foregoing parties to reproduce by any means whatsoever or to copy excerpts and transcriptions as reasonably needed. iii. The Contractor agrees to provide the FEMA Administrator or his authorized representatives access to construction or other work sites pertaining to the work being completed under the contract.
iv.In compliance with the Disaster Recovery Act of 2018, the Participating Public Agency and the Contractor acknowledge and agree that no language in this contract is intended to prohibit audits or internal reviews by the FEMA Administrator or the Comptroller General of the United States.

4. CHANGES
a. Standard. To be eligible for FEMA assistance under the non-Federal entity’s FEMA grant or cooperative agreement, the cost of the change, modification, change order, or constructive change must be allowable, allocable, within the scope of its grant or cooperative agreement, and reasonable for the completion of project scope.
b. Applicability. FEMA recommends, therefore, that a non-Federal entity include a changes clause in its contract that describes how, if at all, changes can be made by either party to alter the method, price, or schedule of the work without breaching the contract. The language of the clause may differ depending on the nature of the contract and the end-item procured.

15. DHS SEAL, LOGO, AND FLAGS
a. Standard. Recipients must obtain permission prior to using the DHS seal(s), logos, crests, or reproductions of flags or likenesses of DHS agency officials. See DHS Standard Terms and Conditions: Version 8.1 (2018).
b. Applicability. FEMA recommends that all non-Federal entities place in their contracts a provision that a contractor shall not use the DHS seal(s), logos, crests, or reproductions of flags or likenesses of DHS agency officials without specific FEMA pre-approval. c. “The contractor shall not use the DHS seal(s), logos, crests, or reproductions of flags or likenesses of DHS agency officials without specific FEMA pre-approval.

Page 6111333 ends

Version June 28, 2023
2024056 Page 53 of 74

16. COMPLIANCE WITH FEDERAL LAW, REGULATIONS, AND EXECUTIVE ORDERS a. Standard. The recipient and its contractors are required to comply with all Federal laws, regulations, and executive orders.
b. Applicability. FEMA recommends that all non-Federal entities place into their contracts an acknowledgement that FEMA financial assistance will be used to fund the contract along with the requirement that the contractor will comply with all applicable Federal law, regulations, executive orders, and FEMA policies, procedures, and directives.
c. “This is an acknowledgement that FEMA financial assistance will be used to fund all or a portion of the contract. The contractor will comply with all applicable Federal law, regulations, executive orders, FEMA policies, procedures, and directives.”

17. NO OBLIGATION BY FEDERAL GOVERNMENT
a. Standard. FEMA is not a party to any transaction between the recipient and its contractor. FEMA is not subject to any obligations or liable to any party for any matter relating to the contract. b. Applicability. FEMA recommends that the non-Federal entity include a provision in its contract that states that the Federal Government is not a party to the contract and is not subject to any obligations or liabilities to the non-Federal entity, contractor, or any other party pertaining to any matter resulting from the contract.
c. “The Federal Government is not a party to this contract and is not subject to any obligations or liabilities to the non-Federal entity, contractor, or any other party pertaining to any matter resulting from the contract.”

18. PROGRAM FRAUD AND FALSE OR FRAUDULENT STATEMENTS OR RELATED ACTS a. Standard. Recipients must comply with the requirements of The False Claims Act (31 U.S.C. §§ 3729- 3733) which prohibits the submission of false or
fraudulent claims for payment to the federal government. See DHS Standard Terms and Conditions: Version 8.1 (2018); and 31 U.S.C. §§ 3801-3812, which details the administrative remedies for false claims and statements made. The non-Federal entity must include a provision in its contract that the contractor acknowledges that 31 U.S.C. Chap. 38 (Administrative Remedies for False Claims and Statements) applies to its actions pertaining to the contract. b. Applicability. FEMA recommends that the non-Federal entity include a provision in its contract that the contractor acknowledges that 31 U.S.C. Chap. 38 (Administrative Remedies for False Claims and Statements) applies to its actions pertaining to the contract. c. “The Contractor acknowledges that 31 U.S.C. Chap. 38 (Administrative Remedies for False Claims and Statements) applies to the Contractor’s actions pertaining to this contract.” d. In the event FTA or DOT funding is used by a Participating Public Agency, Contractor further acknowledges U.S. DOT regulations, “Program Fraud Civil Remedies,” 49 CFR Part 31, and apply to its actions pertaining to this Contract. Upon execution of the underlying Contract, Contractor certifies or affirms the truthfulness and accuracy of any statement it has made, it makes, it may make, or causes to me made, pertaining to the underlying Contract or the FTA assisted project for which this Contract Work is being performed.

In addition to other penalties that may be applicable, Contractor further acknowledges that if it makes, or causes to be made, a false, fictitious, or fraudulent claim, statement, submission, or certification, the Federal Government reserves the right to impose the penalties of the Program Fraud Civil Remedies Act of 1986 on Contractor to the extent the Federal Government deems appropriate.

Contractor also acknowledges that if it makes, or causes to me made, a false, fictitious, or fraudulent claim, statement, submission, or certification to the Federal Government under a contract connected

Page 6111444 ends

Version June 28, 2023
2024056 Page 54 of 74
with a project that is financed in whole or in part with Federal assistance originally awarded by FTA under the authority of 49 U.S.C. § 5307, the Government reserves the right to impose the penalties of 18 U.S.C. § 1001 and 49 U.S.C. § 5307 (n)(1) on the Contractor, to the extent the Federal Government deems appropriate.

Contractor agrees to include the above clauses in each subcontract financed in whole or in part with Federal assistance provided by FTA. It is further agreed that the clauses shall not be modified, except to identify the subcontractor who will be subject to the provisions.

Offeror agrees to comply with all terms and conditions outlined in the FEMA Special Conditions section of this solicitation.

Offeror’s Name: ______________________________________________ Address, City, State, and Zip Code: _____________________________________________________________________________ Phone Number: ________________________ Fax Number: ______________________________ Printed Name and Title of Authorized Representative: ____________________________________________________________ Email Address: _____________________________________________ Signature of Authorized Representative: ____________________________________ Date: ________________________________

Page 61115 ends

Page 61116 ends

Page 61117 ends

Page 61118 ends

Page 61119 ends

Page 622200 ends

Page 6222111 ends

Page 6222222 ends

Page 6222333 ends

Page 6222444 ends

Page 62225 ends

Page 62226 ends

Page 62227 ends

Page 62228 ends

Page 62229 ends

Page 633300 ends

Page 6333111 ends

Page 6333222 ends

Page 6333333 ends

Page 6333444 ends

EXHIBIT 1

DRAFT AGREEMENT
Version June 28, 2023
2024056 Page 74 of 74

EXHIBIT D

SPECIAL TERMS AND CONDITIONS FOR FEDERAL FUNDS
The Special Terms and Conditions for Federal Funds will be added here when Agreement is finalized.

Page 63335 ends

Page 63336 ends

Page 63337 ends

Page 63338 ends

Page 63339 ends

Page 644400 ends

Page 6444111 ends

Page 6444222 ends

Page 6444333 ends

Page 6444444 ends

Page 64445 ends

Page 64446 ends

Page 64447 ends

Page 64448 ends

Page 64449 ends

Page 6500 ends

Page 65111 ends

Page 65222 ends

Page 65333 ends

Page 65444 ends

Page 655 ends

Page 656 ends

Page 657 ends

Page 658 ends

Page 659 ends

Page 6600 ends

Page 66111 ends

Page 66222 ends

Page 66333 ends

Page 66444 ends

Amazon Web Services (AWS)
https://aws.amazon.com/agreement/
Google Cloud Platform (GCP)
https://cloud.google.com/terms
Microsoft Azure:
https://azure.microsoft.com/en-us/support/legal/

Page 665 ends

[Project Name]
Statement of Work
For [Customer Name]
SHI International Corp.

SOW # [#]
[Publish Date]
Presented By
{SHI-User}
Account Executive, SHI
{Email}
Created By
{Services Team Member}
{Title}
{Email}

Page 666 ends

STATEMENT OF WORK FOR [CUSTOMER NAME] [PROJECT NAME]
CONFIDENTIAL | SHI SOW2023 | PAGE 2 OF 13
Table of Contents 1 Executive Summary ...................................................................................................................... 3 2 Project Description ....................................................................................................................... 3

2.1 In Scope ............................................................................................................................................... 3

2.2 Deliverables ......................................................................................................................................... 3

2.3 Project Specific Assumptions ............................................................................................................ 3

2.4 Project Specific Customer Responsibilities ...................................................................................... 3

2.5 Out of Scope ........................................................................................................................................ 3

2.6 Project Duration .................................................................................................................................. 4

2.7 Project Management .......................................................................................................................... 4

2.8 Resources and Skills ........................................................................................................................... 5

2.9 Success Criteria .................................................................................................................................. 5 3 Assumptions ................................................................................................................................ 6 4 Customer Responsibilities ............................................................................................................ 6 5 Duties of SHI ................................................................................................................................ 8 6 Change Control Process ............................................................................................................... 8 7 Project Initiation Process.............................................................................................................. 8 8 Price and Payment Schedule......................................................................................................... 9

8.1 Credits or Discounts ........................................................................................................................... 9

8.1.1 Credits or Discount Terms: ........................................................................................................ 9

8.2 Payment Schedule .............................................................................................................................. 9

8.3 Travel Expenses ................................................................................................................................ 10

8.4 Billing Terms ...................................................................................................................................... 10

8.4.1 Exception ................................................................................................................................... 10

8.5 Final Acceptance ............................................................................................................................... 10 9 Terms and Conditions................................................................................................................. 11 10 SOW Acceptance .................................................................................................................... 11 11 Confidential ............................................................................................................................ 12 12 Billing Information .................................................................................................................. 12 13 Project Location(s) & Contact Information............................................................................... 12

Page 667 ends

STATEMENT OF WORK FOR [CUSTOMER NAME] [PROJECT NAME]
CONFIDENTIAL | SHI SOW2023 | PAGE 3 OF 13
1 Executive Sum m ar y [This should be a high-level executive description of the project.] [Customer Name] (“Customer”) has engaged SHI International Corp. (“SHI”) to [brief phrase describing high level goal] (“Services”).
2 Pr oject Descr ipt ion SHI shall provide the following Services to Customer on a fixed cost basis.

2.1 In Scope
• Bulleted list of Scope items

2.2 Deliverables
[This section should include any tangible customer deliverables such as documents, plans, diagrams.] All documents included in this section will be provided to the Customer. • Bulleted List of Deliverables

2.3 Pr oject Specific Assum pt ion s
• Bulleted List of project assumptions specific to the success of this project

2.4 Pr oject Specific Cust om er Respon sibilit ies
• Bulleted List of Customer Responsibilities or prerequisites specific to the success of this project

2.5 Out of Scope
Any services not explicitly listed above as “In Scope” shall be considered out of scope for this project.

Additionally, the areas that are out of scope for this project include, but are not limited to, the following list. If any of these items are required for your organization, they can be scoped separately. • Bulleted list of Out of Scope items

Page 668 ends

STATEMENT OF WORK FOR [CUSTOMER NAME] [PROJECT NAME]
CONFIDENTIAL | SHI SOW2023 | PAGE 4 OF 13

2.6 Pr oject Duration
Project duration is defined as the entire time taken to complete the project, based on the resources allocated. The estimated project duration is [XX DAYS/WEEKS/MONTHS] *.

SHI and the Customer will provide the required resources to deliver this project within the estimated duration. SHI and the Customer will allow for reasonable accommodations due to holidays, vacations, and unforeseen delays in deliveries.
* Please be advised that the above timeframe is to provide a general timeline for delivery and is not a true reflection of the total man hours/effort involved for this engagement.

2.7 Pr oject Management
[Replace if Partner is providing PM with their methodology. If SHI is providing PM, please choose one of the following 3 options.]
SHI will provide a Project Manager to work with the Customer to see the engagement through to completion. The SHI Project Manager will cover items such as, but not limited to:

Option 1 – Ex: Consulting, Onsite Services
• Acting as a point of contact that will be responsible for monitoring project progress as described in this Statement of Work.
• Conducting a project kick off.
• Monitoring the budget and providing a monthly status update. • Executing change requests to project scope, schedule, and or cost as needed. • Initiating project closure to confirm deliverables were achieved and request project acceptance.

Option 2 – Ex: Most standard engagements
• Leading the engagement to achieve the scope as described in this Statement of Work. • Conducting a project kick off and creating a project schedule to ensure that the project is executed on time and on budget.
• Responsible for coordinating resources based on the project scope and their expertise as well as establishing roles and responsibilities.
• Communicating status updates which includes action items, issues and risks as well as developing and facilitating mitigation plans.
• Executing change requests to project scope, schedule, and or cost as needed. • Acting as the single point of contact for any issues or escalations throughout the engagement. • Initiating project closure to confirm deliverables were achieved and request project acceptance.

Option 3 – Multiphase high user count migrations
• Determining which project methodologies to leverage in order to achieve the scope on time and within budget as described in this Statement of Work.
• Assembly of the project team based on scope and expertise, establishing roles and responsibilities and then coordinating resources throughout the engagement to ensure tasks are executed appropriately.

Page 669 ends

Page 6700 ends

STATEMENT OF WORK FOR [CUSTOMER NAME] [PROJECT NAME]
CONFIDENTIAL | SHI SOW2023 | PAGE 6 OF 13
3 Assum pt ion s [This section includes standard Assumptions and should not be edited. Project-specific Assumptions may be listed in section 2.3]
The project scope and associated price quoted within this Statement of Work are based on the following assumptions. Should any element(s) of these assumptions be lacking during execution of services, additional time and associated fees and expenses may be required to complete this Statement of Work.

1. Minimum lead time for scheduling project kickoff meeting is fifteen (15) business days from our receipt of the signed SOW or fifteen (15) business days from the confirmed start date between SHI and Customer; whichever date is later. Should you require more aggressive scheduling, please contact SHI to determine availability.

2. Please note that the time designated for Knowledge Transfer is throughout the project. Customer is responsible for providing a resource or resources focused on this project and the extent of the knowledge transfer is dependent upon the availability of these resources. A maximum of two hours of dedicated knowledge transfer at the project’s conclusion will be provided unless otherwise noted within this Statement of Work.

3. SHI is not responsible for delays caused by failures; including but not exclusive to systems, personnel or environmental causes or in receiving data from Customer.

4. Any restrictions or requirements regarding the SHI consultants’ use of personal equipment must be stated in advance of the commencement of the project.

5. All hardware and/or software and licensing required to perform the above services will be provided by and is the responsibility of Customer. All wiring, hardware, and software required to perform the above services are in working order.

6. All parties agree that personnel shall not be asked to perform, nor volunteer to perform, engineering and/or consulting tasks that lie outside the skill sets and experience of personnel.

Personnel have the right to decline on a service request if the request falls outside the scope of their experience and expertise.

7. Project activity will be scheduled during the hours of 8:00 AM to 5:00 PM local time. Any work performed outside these hours must be previously agreed upon by both parties and scheduled in advance.

8. All documentation will be delivered within fifteen (15) business days after the completion of the in-scope tasks or phases of the project. A standard document template will be utilized for this service delivery.
4 Customer Responsibilities [This section includes standard SHI Responsibilities and should not be edited. Project-specific Responsibilities may be listed in section 2.4]
Both Customer and SHI are responsible for the successful execution of this engagement. Prior to the start of this SOW, Customer will indicate to SHI in writing a person to be the point of contact. All project communications will be addressed to such point of contact (the “Customer Contact”). The Customer Contact is responsible for the following:

1. Performing a full working backup prior to the commencement of services as SHI is not responsible for lost data.

2. Ensuring all related information and communication regarding this project is done through the Project Manager as expeditiously as possible.

Page 67111 ends

Page 67222 ends

STATEMENT OF WORK FOR [CUSTOMER NAME] [PROJECT NAME]
CONFIDENTIAL | SHI SOW2023 | PAGE 8 OF 13
5 Duties of SHI SHI shall provide the Services and the SHI Work Product during the term of this engagement in accordance with this SOW and these terms and conditions.

1. SHI will provide all resources, facilities, management, labor, expertise, skills, tools, and equipment necessary for the performance of its obligations under this SOW.

2. Without limiting the foregoing, SHI shall:
a. keep the Customer Project Manager advised of the progress of the project and the status of the Deliverables;
b. permit any designated representative of Customer periodically to review the work of SHI personnel performing Services and preparing Deliverables; c. perform the Services in a timely manner and provide the Deliverables in accordance with this Statement of Work; and
d. keep accurate records of work performed on this Statement of Work, evidence of which SHI shall provide to Customer upon request.
6 Change Control Process The “Change Control Process” is that process which shall govern changes to the scope, schedule or price of the Project during the life of the Project. The Change Control Process will apply to new components and to enhancements of existing components. The Change Control Process will commence at the start of the Project and will continue throughout the Project's duration.

Under the Change Control Process, a written “Change Request” will be the vehicle for communicating any desired changes to the project. It will describe the proposed change; the reason for the change and the effect the change may have on the Project. The Project Manager of the requesting party will submit a written Change Request to the Project Manager for the other parties.

SHI and Customer will review the change request. All parties must sign the approval portion of the Change Request to authorize the implementation of any change that affects the Project’s scope, schedule or price.
7 Pr oject In it iat ion Pr ocess Upon receipt of a signed SOW and Purchase Order, planning for the project will commence. A key step in the planning process is the Kickoff Meeting with Customer’s Team.

In the kickoff meeting, the contents of the SOW will be reviewed. This is an opportunity for Customer’s team who will be involved with the project to understand the Project’s goals, tasks, deliverables, and timelines.

Upon completion of the project kickoff meeting, minutes of the Kickoff meeting will be created based on the meeting discussion and distributed to Customer. Any changes to the project will be documented in these minutes. If Change Orders are necessary due to changes, that process will be initiated after the Kick-off meeting.

Page 67333 ends

Page 67444 ends

STATEMENT OF WORK FOR [CUSTOMER NAME] [PROJECT NAME]
CONFIDENTIAL | SHI SOW2023 | PAGE 10 OF 13

8.3 Tr avel Expenses

CHOOSE ONE OF THE FOLLOWING
OPTION 1
Travel expenses are not included in the above price. Any Expenses incurred will be billed as actual and receipts will be provided. Any travel must be pre-approved in advance by Customer (a pre-approval form will be submitted for signature prior to the trip). Expenses will adhere to SHI’s Travel and Expense policy or the Customer’s, if required.

The estimated travel expenses for this project are $XX.

OPTION 2
No travel is required for this project.

OPTION 3
Travel and expenses are included in the above price.

8.4 Billin g Ter m s
SHI will request the approval of Customer when a milestone (see Payment Schedule above) has been completed. Upon receipt of Customer’s approval, SHI will invoice Customer for the milestone. All invoices are due and payable within 30 calendar days of the invoice date.

Fees DO NOT include applicable taxes that must be collected. Please allow for taxes that may apply to the work outlined in your Purchase Order. Tax will be applied to the address in the “Billing Information” section unless otherwise specified in “Exception” section below. *Update per section used*

8.4.1 Exception
**Select OPTION 1 “Taxes will be applied to the physical addresses where the work is performed.” when onsite field services are performed.

OPTION 1
Taxes will be applied to the physical addresses where work is performed.

OPTION 2
No exceptions apply.

8.5 Fin al Accept an ce
At the completion of the work SHI will provide a “Project Acceptance Form” for execution by Customer.

Customer’s signature on this form signifies the Customer’s Final Acceptance of the work, and agreement that all Deliverables have been completed in accordance with the SOW and the final invoice may be issued by SHI. If the Customer does not so accept the Deliverables then Customer shall, within fifteen calendar days after receipt of the Project Acceptance Form, state specifically which Deliverables were not Final Accepted and why, and return the form to SHI for resolution.

If Customer does not return the Project Acceptance Form within fifteen calendar days after the date of its transmittal, Customer shall be deemed to have Final Accepted the Deliverables, and consequently, the remainder of the Services, and SHI will invoice the Customer for the remainder of the price due to SHI.

Page 675 ends

Page 676 ends

Page 677 ends

Page 678 ends

Project Name
Statement of Work
For [Customer Name]
Presented By
SHIuser
Account Executive, SHI
{Email}
Created By
{Services Team Member}
{Title}
{Email}
SHI International Corp.

SOW # [#]
Publish Date

Page 679 ends

STATEMENT OF WORK FOR [CUSTOMER NAME] PROJECT NAME
CONFIDENTIAL | SHI SOW2023| PAGE 2 OF 13
Table of Contents 1 Executive Summary ...................................................................................................................... 3 2 Project Description ....................................................................................................................... 3

2.1 In Scope ............................................................................................................................................... 3

2.2 Deliverables ......................................................................................................................................... 3

2.3 Project Specific Assumptions ............................................................................................................ 3

2.4 Project Specific Customer Responsibilities ...................................................................................... 3

2.5 Out of Scope ........................................................................................................................................ 3

2.6 Project Duration .................................................................................................................................. 4

2.7 Project Management .......................................................................................................................... 4

2.8 Resources and Skills ........................................................................................................................... 5 3 Assumptions ................................................................................................................................ 6 4 Customer Responsibilities ............................................................................................................ 6 5 Duties of SHI ................................................................................................................................ 8 6 Change Control Process ............................................................................................................... 8 7 Project Initiation Process.............................................................................................................. 8 8 Price and Payment Information..................................................................................................... 9

8.1 Credits or Discounts ........................................................................................................................... 9

8.1.1 Credits or Discount Terms: ........................................................................................................ 9

8.2 Travel Expenses ................................................................................................................................ 10

8.3 Billing Terms ...................................................................................................................................... 10

8.3.1 Exception ................................................................................................................................... 10

8.4 Final Acceptance ............................................................................................................................... 10 9 Terms and Conditions................................................................................................................. 11 10 SOW Acceptance .................................................................................................................... 11 11 Confidential ............................................................................................................................ 12 12 Billing Information .................................................................................................................. 12 13 Project Location(s) & Contact Information............................................................................... 12

Page 6800 ends

STATEMENT OF WORK FOR [CUSTOMER NAME] PROJECT NAME
CONFIDENTIAL | SHI SOW2023| PAGE 3 OF 13
1 Executive Sum m ar y [This should be a high-level executive description of the project.] [Customer Name] (“Customer”) has engaged SHI International Corp (“SHI”) to [brief phrase describing high level goal] (“Services”).
2 Pr oject Descr ipt ion SHI shall provide the following Services to Customer on a time and materials cost basis.

2.1 In Scope
• Bulleted list of In Scope items

2.3 Pr oject Specific Assum pt ion s
• Bulleted List of project assumptions specific to the success of this project

2.4 Pr oject Specific Cust om er Respon sibilit ies
• Bulleted List of Customer Responsibilities or prerequisites specific to the success of this project

2.5 Out of Scope
Any Services not explicitly listed above as “In Scope” shall be considered out of scope for this project.

Page 68111 ends

STATEMENT OF WORK FOR [CUSTOMER NAME] PROJECT NAME
CONFIDENTIAL | SHI SOW2023| PAGE 4 OF 13

2.6 Pr oject Duration
Project duration is defined as the entire time taken to complete the project, based on the resources allocated. The estimated project duration is [XX DAYS/WEEKS/MONTHS] *.

SHI and the Customer will provide the required resources to deliver this project within the estimated duration. SHI and the Customer will allow for reasonable accommodations due to holidays, vacations, and unforeseen delays in deliveries.
*Note that Time and Materials budgets and durations are estimates. The final duration of the Services is affected by the actual time provided by all resources against the budget.

2.7 Pr oject Man agem en t
[Replace if Partner is providing PM with their methodology. If SHI is providing PM, please choose one of the following 3 options.]
SHI will provide a Project Manager to work with the Customer to see the engagement through to completion. The SHI Project Manager will cover items such as, but not limited to:

Page 68222 ends

Page 68333 ends

STATEMENT OF WORK FOR [CUSTOMER NAME] PROJECT NAME
CONFIDENTIAL | SHI SOW2023| PAGE 6 OF 13
3 Assum pt ion s [This section includes standard Assumptions and should not be edited. Project-specific Assumptions may be listed in section 2.3]
The project scope and associated price quoted within this Statement of Work are based on the following assumptions. Should any element(s) of these assumptions be lacking during execution of Services, additional time and associated fees and expenses may be required to complete this SOW.

1. Minimum lead time for scheduling Project Kickoff meeting is fifteen (15) business days from our receipt of the signed SOW or fifteen (15) business days from the confirmed start date between SHI and Customer; whichever date is later. Should you require more aggressive scheduling, please contact SHI to determine availability.

2. Please note that the time designated for knowledge transfer is throughout the engagement.

Customer is responsible for providing a resource dedicated to this engagement and the extent of the knowledge transfer is dependent upon the availability of this resource.

3. SHI is not responsible for delays caused by failures, including but not exclusive to systems, personnel, or environmental causes or in receiving data from Customer.

4. Any restrictions or requirements regarding the engineer’s use of personal equipment must be stated in advance of the commencement of the engagement.

5. All hardware and/or software and licensing required to perform the above Services will be provided by and is the responsibility of Customer. All wiring, hardware, and software required to perform the above Services are in working order.

6. All parties agree that personnel shall not be asked to perform, nor volunteer to perform, engineering and/or consulting tasks that lie outside the skill sets and experience of personnel.

Personnel have the right to decline on a service request if the request falls outside the scope of their experience and expertise.

7. Project activity will be scheduled during the hours of 8:00 AM to 5:00 PM local time. Any work performed outside these hours is considered "overtime" and subject to overtime rates. Overtime Services must be previously agreed upon by both parties, scheduled in advance and will require a change order authorizing such charges.

1. Performing a full working backup prior to the commencement of Services as SHI is not responsible for lost data.

Page 68444 ends

Page 685 ends

STATEMENT OF WORK FOR [CUSTOMER NAME] PROJECT NAME
CONFIDENTIAL | SHI SOW2023| PAGE 8 OF 13
5 Duties of SHI SHI shall provide the Services and the SHI Work Product during the term of this engagement in accordance with this SOW and these terms and conditions.

1. SHI will provide all resources, facilities, management, labor, expertise, skills, tools, and equipment necessary for the performance of its obligations under this SOW.

Upon completion of the project kickoff meeting, minutes of the Kickoff meeting will be created based on the meeting discussion and distributed to Customer. Any changes to the project scope will be documented in these minutes. If Change Orders are necessary due to scope changes, that process will be initiated after the Kickoff meeting.

Page 686 ends

Page 687 ends

STATEMENT OF WORK FOR [CUSTOMER NAME] PROJECT NAME
CONFIDENTIAL | SHI SOW2023| PAGE 10 OF 13

8.2 Tr avel Expenses

OPTION 2
No travel is required for this project.

8.3 Billin g Ter m s
Invoices are processed monthly. All invoices are due and payable within 30 calendar days of the invoice date.

8.3.1 Exception
**Select OPTION 1 “Taxes will be applied to the physical addresses where the work is performed.” when onsite field Services are performed.

OPTION 1
Taxes will be applied to the physical addresses where work is performed.

OPTION 2
No exceptions apply.

8.4 Fin al Accept an ce
At the completion of the work SHI will provide a “Project Acceptance Form” for execution by Customer.

Page 688 ends

Page 689 ends

Page 6900 ends

Page 69111 ends

Amazon Web Services Partner Package – US State
and Local Government and Education
Updated Q2 2023

Page 69222 ends

“This document is provided for informational purposes only. It represents AWS’s current product offerings and practices as of the date of issue of this document and is subject to change. Customers are responsible for making their own independent assessment of the information in this document and any use of AWS’s products or services.

This document does not create any warranties, representations, contractual commitments, conditions or assurances from AWS, its affiliates, suppliers or licensors. The responsibilities and liabilities of AWS to its customers are controlled by AWS agreements, and this document is not part of, nor does it modify, any agreement between AWS and its customers. For current prices for AWS services, please refer to the AWS website at www.aws.amazon.com.” Partner Package – US
Submitted by:

Amazon Web Services, Inc.
410 Terry Avenue North
Seattle, WA 98109-5210

Page 69333 ends

1. AWS History and Overview ............................................................................................... 5

2. State and Local Government and Education ................................................................... 7

2.1. What You Can Do With AWS....................................................................................... 7

2.1.1. State and Local Government ............................................................................. 7

2.1.2. Support for Remote Work and Learning ............................................................ 8

2.1.3. Education .......................................................................................................... 8

3. Benefits of Working with the AWS Partner Network (APN)............................................. 9

3.1. Benefits of APN for Customers .................................................................................... 9

4. AWS Cloud Security ........................................................................................................10

4.1. Shared Controls for Security and Compliance............................................................12

4.2. Data Privacy and Ownership......................................................................................12

4.3. Customer Control of Data Residency .........................................................................13

5. Services Overview ...........................................................................................................14

5.1. Compute Services......................................................................................................15

5.2. Storage Services........................................................................................................16

5.3. Database Services.....................................................................................................16

5.4. Analytics Services......................................................................................................16

5.5. Networking and Content Delivery Services ................................................................17

5.6. Migration and Transfer Services ................................................................................17

5.7. Management and Governance Services ....................................................................17

5.8. Security, Identity, and Compliance Services ..............................................................17

5.9. Developer Tools.........................................................................................................18

5.10. ML and AI Services....................................................................................................18

5.11. IoT Services...............................................................................................................18

5.12. Mobile Services..........................................................................................................19

5.13. Call Center Services ..................................................................................................19

5.14. Hybrid Services..........................................................................................................19

5.15. Other Services ...........................................................................................................20

6. AWS Cloud Infrastructure ...............................................................................................20

6.1. Access to Physical Infrastructure and Data Center Facilities......................................21

6.2. Data Center Audits.....................................................................................................22

6.3. Service Level Agreements .........................................................................................22

6.4. Data Center Virtual Tours ..........................................................................................23

6.5. Data Center Security..................................................................................................23

7. Automatic Scaling of Cloud Resources .........................................................................24

7.1. Scaling.......................................................................................................................24

7.2. Load Balancing ..........................................................................................................24

7.3. Monitoring and Alarms ...............................................................................................25

8. Architecting for High Availability and Reliability...........................................................25

8.1. AWS Responsibility: Data Center Availability and Reliability ......................................26

8.2. Customer Responsibility: Designing for Availability and Reliability .............................26

8.3. Resources and Reference Architecture......................................................................27

8.4. Building Secure Solutions on AWS ............................................................................27

Page 69444 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 ii

8.5. Granting and Managing Account Access....................................................................28

8.5.1. IAM Users........................................................................................................28

8.5.2. IAM Groups .....................................................................................................28

8.5.3. IAM Roles........................................................................................................29

8.5.4. Identity Federation...........................................................................................29

8.5.5. Setting Granular Permissions ..........................................................................29

8.5.6. Temporary Security Credentials ......................................................................29

8.6. Tools for Logical Separation.......................................................................................29

8.7. Tools for Encryption ...................................................................................................30

8.7.1. Protecting Data at Rest....................................................................................30

8.7.2. Protecting Data in Transit ................................................................................30

8.8. Automating Security and Compliance ........................................................................31

8.9. Penetration Testing....................................................................................................31

8.10. Data Breaches ...........................................................................................................31

9. AWS Training and Certification.......................................................................................31

9.1. Benefits of Training and Certification..........................................................................32

9.2. Approach to Training and Workforce Development ....................................................32

9.3. Learning Needs Analysis ...........................................................................................33

9.4. Modes of Training Delivery.........................................................................................34

9.5. AWS Certification.......................................................................................................35

10. Achieving Compliance on AWS ......................................................................................36

10.1. Certifications and Attestations....................................................................................37

10.2. Laws, Regulations, and Privacy .................................................................................37

10.2.1. FERPA ............................................................................................................37

10.2.2. HIPAA/HITECH ...............................................................................................38

10.2.2.1. AWS and HIPAA........................................................................................38

10.2.2.2. HIPAA for AWS Partners ...........................................................................39

10.2.3. IRS Pub 1075 ..................................................................................................39

10.2.4. VPAT/Section 508 ...........................................................................................39

10.2.4.1. AWS and VPAT/Section 508......................................................................39

10.3. Alignments/Frameworks.............................................................................................40

10.3.1. Criminal Justice Information Services ..............................................................40

10.3.1.1. AWS and CJIS...........................................................................................40

10.3.1.2. CJIS for AWS Partners ..............................................................................41

10.3.2. Cloud Security Alliance....................................................................................41

10.3.2.1. AWS and CSA ...........................................................................................41

10.3.2.2. CSA for AWS Partners...............................................................................41

10.3.3. Federal Information Security Management Act ................................................41

10.3.4. National Institute of Standards and Technology 800-53...................................42

10.3.4.1. AWS and NIST 800-53...............................................................................42

10.3.4.2. NIST 800-53 for AWS Partners..................................................................42

10.3.5. Uptime Institute Tiers.......................................................................................43

10.3.5.1. AWS and Uptime Institute Tiers .................................................................43

10.3.5.2. Uptime Institute Tiers for AWS Partners.....................................................43

11. Managing AWS Resources..............................................................................................44

11.1. AWS Management Console.......................................................................................44

11.2. Command Line Interface (CLI)...................................................................................44

11.3. Management Tools ....................................................................................................44

12. Back-up and Disaster Recovery (DR) .............................................................................45

Page 695 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 iii

12.1. Backup and Restore ..................................................................................................46

12.2. Pilot Light for Simple Recovery into AWS Warm Standby Solution.............................47

12.3. Warm Standby Solution in AWS.................................................................................47

12.4. Multi-Site Solution Deployed on AWS and Onsite ......................................................47

13. Security Questionnaires..................................................................................................47

14. AWS Public Sector Access Policy – Instructions..........................................................48 List of Figures
Figure 1: AWS Shared Responsibility Model.............................................................................11 Figure 2: Partner Model Determines Level of Involvement in Customer Responsibility. ............12 Figure 3: AWS Services. ...........................................................................................................15 Figure 4: AWS Regions and Availability Zones. ........................................................................21 Figure 5. Regions and Availability Zones ..................................................................................21 Figure 6: Auto Scaling and Elastic Load Balancing with Amazon CloudWatch alarms. .............25 Figure 7: Fault Tolerant AWS Reference Architecture...............................................................27 Figure 8: Phases of Learning Continuum ..................................................................................33 Figure 9: AWS Certification Programs.......................................................................................36 Figure 10: RPO and RTO..........................................................................................................46 Figure 11: Spectrum of DR Options. .........................................................................................46 Figure 12: 2022 Gartner Magic Quadrant for Cloud Infrastructure and Platform Services .......A-2 List of Tables
Table 1: Benefits of the Cloud .................................................................................................... 5 Table 2: Features of AWS Training and Certification Delivery...................................................35 Table 3: AWS SOC Reports.................................................................................................. C-12 Appendices
Appendix A. Industry Analyst Reports on AWS Market Position.............................................. A-1 Appendix B. AWS Resources.................................................................................................. B-3 Appendix C. Common AWS Certifications............................................................................... C-7

Page 696 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 4
How to Use this Document
This document contains information on the most frequently requested proposal topics from our Amazon Web Services, Inc. (AWS) Partner Network (APN) Partners. Please reach out to your aligned AWS partner manager if you need additional information to meet specific request for proposal/quotation/tender, etc. (RFx) requirements.

The content in this document is intended as informational material regarding AWS Cloud services that may be used to inform your responses to particular RFxs from your public sector customers. While AWS encourages you to rely on the Partner Package content to help you formulate your response, you may not attach the Partner Package to your response or copy and paste Partner Package content into your response without prior consent from AWS. Graphics or images may be copied and pasted into your response as long as: (1) clear and appropriate attribution is given to AWS or the third-party source of such images and (2) such images are copied in their entirety and without modification. You can refer to the cross-referenced RFx Aids at the top of each section for more information on the section’s topic.

AWS is not a party to any contract resulting from a proposal or tender. As it relates to your RFx response, AWS is a supplier—not a subcontractor—and we are not submitting a joint response or co-drafting a project scope. Your response must be on your letterhead and in your voice.

AWS cannot write your response—or any part of the response—on your behalf.

Page 697 ends

Page 698 ends

Page 699 ends

Page 70000 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 8
• Justice and public safety customers can use AWS to help them tackle public safety data needs like records management systems, digital investigation practices, and next generation 911 technology.
• Digital government solutions on AWS can span open data initiatives, traffic analysis, citizen service improvements, and IoT-based smart city projects, such as early flood warning systems, predictive analytics for road maintenance, and efficient trash pickup.
• Elections administrators, political campaigns, and civic organizations can leverage AWS to provide underlying elections infrastructure in a secure, costeffective, and scalable way. • AWS offers a business continuity solution called CloudEndure Disaster Recovery that minimizes downtime and data loss by providing fast, reliable, cloud-based disaster recovery. The solution continuously replicates applications from physical, virtual, or cloud-based infrastructure to a low-cost staging area that is automatically provisioned in any target AWS Region of choice.

2.1.2. Support for Remote Work and Learning
• Government agencies and educational institutions can quickly set up a cloudbased contact center with Amazon Connect for IT helpdesks and other departments needing to provide inbound and outbound support. • If you need to deliver personal cloud desktops to support remote work scenarios, you can use Amazon WorkSpaces to provision either Windows or Linux desktops in just a few minutes and quickly scale to provide thousands of desktops to users, anywhere.
• If you need to virtualize computer lab spaces to support online distance learning, you can centrally manage desktops and applications on Amazon AppStream 2.0 and securely deliver them to any computer using a web browser.

2.1.3. Education
• K12 and Primary Education can use AWS for data center migration, student data and analytics, and streamlining district IT operations, among other use cases. • Higher Education Institutions can support on-demand campus-wide IT management, easily deploy big data solutions, reduce their overall IT costs, and accelerate their research timelines by focusing on science rather than infrastructure.
• Join AWS Educate to access online learning modules for cloud computing to your students and virtual cloud labs to your faculty at no cost. • To help students gain industry-recognized certifications and prepare for indemand cloud jobs, higher education customers use AWS Academy, which offers a cloud-based curriculum for educators to stay current with cloud innovation and equip students with valuable cloud skills. • EdTechs can use AWS to build and launch solutions that help students learn, with the flexibility and agility needed to experiment.

Page 700111 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 9

3. Benefits of Working with the AWS Partner Network (APN) You can find more information and use cases at the AWS Partner Network website and our Customer Success Stories page.

The AWS Partner Network (APN) provides an extensive community of partner companies that offer solutions in areas such as value-added software, developer tools, and consulting expertise to help deploy and manage mission-critical workloads in the AWS Cloud. The APN program provides technical, business, and marketing support for this growing partner community.

The APN website includes information about our two types of partners:
• AWS Consulting Partners: AWS Consulting Partners are professional services firms that help customers design, architect, build, migrate, and manage workloads and applications on the AWS Cloud. AWS Consulting Partners include System Integrators (SIs), strategic consultancies, agencies, Managed Service Providers (MSPs), and ValueAdded Resellers (VARs). • AWS Technology Partners: In addition to consulting services, customers can work with AWS Technology Partners that provide software solutions that are either hosted on, or integrated with, the AWS Cloud. AWS Technology Partners include Independent Software Vendors (ISVs) and vendors for Software as a Service (SaaS), Platform as a Service (PaaS), developer tools, management, and security.

APN has 100,000 partners from over 150 countries, including partners with solutions and experience in delivering government, education, and nonprofit customer missions around the world. More information on APN, along with our directory of AWS Partners, can be found on the AWS Partner Network page.

AWS also outlines recommended partner procurement practices in the Procurement Best Practices for Partners whitepaper, available on the APN. This white paper provides tactical guidance for AWS Partners to educate, advise and shape their customers to adopt cloud procurement industry standards in federal acquisitions. It also provides strategies for AWS Partners to promote their partner programs and competencies as a competitive differentiator during acquisition shaping.

3.1. Benefits of APN for Customers
Many of our customers work in tandem with AWS Consulting Partners and AWS Technology Partners in order to leverage their experience in areas such as value-added software, established business applications, developer tools, and consulting expertise. APN provides access to qualified partners that resell AWS Cloud services and/or provide technical services to design, architect, build, migrate, and manage workloads and applications on AWS.

AWS Partners receive several benefits that distinguish them from other vendors and provide them with resources that assist their customers:
• AWS Partners have access to resources such as training, service information, certifications, and other tools that help them to be experts in the AWS Cloud. These resources help AWS Partners be more competent and confident in the solutions they offer to customers.
• AWS Partners have a direct line of access to AWS corporate resources—such as business developers, engineers, Solutions Architects, and more—to help build and enhance solutions that work the best for their customers. This level of support is not normally available to vendors and companies that do not participate in APN.

Page 700222 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 10
• AWS Partners can attain AWS Competencies based on their specialization in key AWS solution areas. Attainment of an AWS Competency, which requires meeting or exceeding several requirements and passing a rigorous third-party audit of capabilities, is a public indication of the AWS Partner’s ability to excel in an area of expertise. The AWS Public Sector Partner Program includes partners with solutions and experience in delivering on a combination of government, education, and non-profit customer missions around the world.
• Specific to reselling AWS services, AWS offers the Solution Provider Program— designed for systems integrators, managed service providers, value-added resellers, and other public sector partners—to resell AWS Services as part of a differentiated solution. Under this program, Authorized Solution Providers manage, service, support, and bill AWS accounts for end customers.The Solution Provider Program includes a tiered discount structure based on technical capabilities and success in driving a new business. It includes flexible contracting options to help meet unique end customer requirements, and it provides partners with multiple AWS Support models that align with most AWS partner practices.

Visit the Engage with AWS Partners page to learn more about customer success stories with AWS Partners, learn more about AWS Partner specialties, and search for AWS Partners by service, industry, workload, or solution. The APN Journal page provides additional information on how AWS Partners are helping customers achieve success in the AWS Cloud.

4. AWS Cloud Security
You can find more information in RFx Aid – Shared Responsibility.

Because our customers build systems on top of AWS Cloud infrastructure, security and compliance responsibilities are shared between AWS and the customer. This shared responsibility model can help relieve customers’ operational burden as AWS operates, manages, and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the service operates. Customers control how they architect and secure their applications and data put on the AWS Cloud. AWS provides a wide array of security and compliance services, and customers should carefully consider the services used, integration of those services into their IT environment, and applicable laws and regulations. AWS’s shared responsibility/security model is depicted in Figure 1. More information on how to build secure solutions on AWS can be found in Section 7.

Page 700333 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 11
Figure 1: AWS Shared Responsibility Model. This model reflects the respective responsibilities that AWS and the customer each have for securing the cloud and the resources and data it holds. Other parties such as a software provider or AWS Partner may sometimes hold security responsibilities.

This differentiation of responsibility is commonly referred to as security of the cloud versus security in the cloud.
• AWS Responsibility (Security of the Cloud): AWS is responsible for protecting the infrastructure that runs all of the services offered on the AWS Cloud. This infrastructure is composed of the hardware, software, networking, and facilities that run AWS Cloud services.
• Customer/APN Partner Responsibility (Security in the Cloud): Customers/AWS Partners assume responsibility and management of the guest operating system (including updates and security patches); other associated application software; configuration of the AWS-provided security group firewalls; and other security, change management, and logging features.

AWS’s shared responsibility model is further explained on the AWS Compliance webpage.

In partner-led acquisitions, there is another party to factor into this model—the partner. The level of CSP and customer responsibilities in the shared responsibility model depend on the cloud deployment model, as shown in Figure 2. For example, a reseller may pass along the same shared responsibility model while a managed service provider may take on many of the customer responsibilities in the Shared Responsibility Model. AWS Partners should encourage customers to be clear about their desired level of responsibility in a cloud procurement.

Page 700444 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 12
Figure 2: Partner Model Determines Level of Involvement in Customer Responsibility. Based on the type of partner support model, an AWS Partner may hold most, some, or none of the customer’s responsibilities in the AWS Shared Responsibility Model.

4.1. Shared Controls for Security and Compliance
Some controls apply to both the infrastructure layer (AWS responsibility) and customer layers (customer/APN Partner responsibility), but in completely separate contexts or perspectives. In a shared control, AWS provides the requirements for the infrastructure, and the customer/AWS Partner must provide their own control implementation within their use of AWS Cloud services.

Examples of these shared controls include the following:
• Patch Management: AWS is responsible for patching and fixing flaws within the infrastructure, but customers/AWS Partners are responsible for patching their guest operating systems and applications.
• Configuration Management: AWS maintains the configuration of its infrastructure devices, but customers/AWS Partners are responsible for configuring their own guest operating systems, databases, and applications.
• Awareness and Training: AWS trains AWS employees, but customer/AWS Partners must train their own employees.

For example, services such as Amazon Elastic Compute Cloud (Amazon EC2), Amazon Virtual Private Cloud (Amazon VPC), and Amazon Simple Storage Service (Amazon S3) are categorized as infrastructure as a service (IaaS) and, as such, require the customer to perform all of the necessary security configuration and management tasks. If a customer deploys an Amazon EC2 instance, they are responsible for management of the guest operating system (including updates and security patches), any application software or utilities installed by the customer on the instances, and the configuration of the AWS-provided firewall (called a security group) on each instance.

4.2. Data Privacy and Ownership
Customers maintain control of their data, and they can choose where to store their data within the cloud to conform to their country’s data residency regulations. Customers own their data and choose the Region(s) in which they store their data. AWS does not a move customer data

Page 7005 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 13
unless the customer decides to move it. In addition, customers can build hybrid cloud architectures that integrate their on-premises and cloud operations for use cases such as data center extension and edge computing. Read more in our Data Residency policy perspectives whitepaper and Hybrid Cloud with AWS page.

AWS Cloud services have been intentionally designed so that our customers (not AWS personnel) have complete control over their data and applications. Customers maintain ownership of their content, and they select which AWS Cloud services can process, store, and host their content. AWS does not access or use customers’ content for any purpose without their consent. AWS gives customers ownership and control over their content through simple, powerful tools that allow them to determine where their content will be stored, secure their content in transit and at rest, and manage their access to AWS Cloud services and resources for their users. AWS also implements responsible and sophisticated technical and physical controls that are designed to prevent unauthorized access to or disclosure of content.

Four basic guidelines of data privacy and ownership on AWS include the following:
• Access: Customers manage access to their content and user access to AWS Cloud services and resources. AWS provides an advanced set of access, encryption, and logging features to help them do this effectively (such as AWS CloudTrail). We do not access or use customers’ content for any purpose without their consent. Customer virtual instances are solely controlled by the customer who has full root access or administrative control over accounts, services, and applications. AWS personnel do not have the ability to log into customer instances. We never use customers’ content or derive information from it for marketing or advertising. • Geographical Location of Data: Customers choose the AWS Region(s) in which their content is stored. AWS does not move or replicate customers’ content outside of their chosen AWS Region(s) without their consent, except as legally required and as necessary to maintain the AWS Cloud services.
• Security: Customers choose how their content is secured, including via tokenization, data decomposition, cyber detection, and encryption. AWS has developed a security assurance program that uses best practices for global privacy and data protection to help customers operate securely within AWS, and to make the best use of our security control environment. These security protections and control processes are independently validated by multiple third-party independent assessments. We also offer strong encryption for content in transit and at rest, and we provide customers the option to manage their own encryption keys.
• Disclosure of Customer Content: We do not disclose customer content unless required to do so to comply with the law, or with a valid and binding order of a governmental or regulatory body. Unless we are prohibited from doing so or there is clear indication of illegal conduct in connection with the use of Amazon products or services, Amazon notifies customers before disclosing customer content so they can seek protection from disclosure. Additional information can be found in our latest transparency report and our Amazon Law Enforcement Guidelines.

4.3. Customer Control of Data Residency
AWS has taken steps to accommodate customer concerns and government mandates related to data residency—the requirement that all customer content processed and stored in an IT system remain within specific geographical borders. AWS data centers are secure by design based on our physical and environmental controls. Both Gartner and IDC concluded that the security posture of major cloud service providers (CSPs) is equal to or better than the best

Page 7006 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 14
enterprise data centers, and that security should no longer be considered a primary inhibitor to the adoption of public cloud services. In fact, customers benefit from the security native in the cloud. More information about AWS’s controls can be found at our website, or in Section 7.

5. Services Overview
You can find more information in RFx Aid – AWS Services.

AWS has continually expanded its services to support virtually any cloud workload. We now have more than 200 fully featured services, with several highlighted in the following subsections and depicted in Figure 3. In addition, our AWS Documentation page provides user guides, developer guides, API references, and tutorials to help our customers and AWS Partners get started on AWS and learn more about our services. Reference architectures and architecture whitepapers are available at AWS Architecture Center. The AWS This is My Architecture web page houses innovative cloud architectures from customers and AWS Partners.

Page 7007 ends

Page 7008 ends

Page 7009 ends

Page 711100 ends

Page 7111111 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 19
allow customers to control, manage, and secure large and diverse device fleets. Finally, our data services (AWS IoT Analytics, AWS IoT Events, and AWS IoT SiteWise) help customers extract value from IoT data.

5.12. Mobile Services
AWS offers a suite of services for building and deploying mobile applications, including AWS Amplify for provisioning and managing backends for mobile applications, AWS Device Farm for app testing, and Amazon Pinpoint and Amazon Simple Notification Service (Amazon SNS) for customer engagement.

5.13. Call Center Services
You can find more information in RFxAid – Amazon Connect.

Amazon Connect provides a seamless omnichannel experience through a single unified contact center for voice and chat. Amazon Connect is a cloud-based contact center service developed from the same contact center technology used by Amazon customer service associates around the world to power millions of customer conversations.

Contact center agents can use Amazon Connect to communicate with customers across channels like voice and live chat, without losing the account information, progress, or changing agents. Amazon Connect’s cloud-based, omnichannel functionality simplifies contact center operations, improves agent efficiency, and lowers costs for organizations seeking to enhance the customer experience. This includes a single set of tools for skills-based routing, powerful real-time and historical analytics, and intuitive management tools—all with pricing based on the resources used rather than capacity, agent seats, or maintenance.

Amazon Connect integrates with the leading customer relationship management (CRM), workforce management (WFM), analytics, and helpdesk solutions so customer contact centers can embed the Amazon Connect agent experience into the applications agents already use.

5.14. Hybrid Services
AWS offers hybrid cloud services that can help customers integrate a mix of cloud, on-premises data centers, and edge locations. VMware Cloud on AWS is an integrated cloud offering jointly developed by AWS and VMware that allows organizations to seamlessly migrate and extend their on-premises VMware vSphere-based environments to the AWS Cloud. AWS Outposts is a hybrid cloud solution that brings the AWS infrastructure, services, APIs, management tools, and support to virtually any data center, co-location space, or on-premises facility.

For migration and computing on the edge, AWS has the AWS Snow Family, a collection of physical devices that help migrate large amounts of data into and out of the cloud without depending on networks. The Snow Family, comprised of AWS Snowcone, AWS Snowball, and AWS Snowmobile, offers a number of physical devices and capacity points, most with built-in computing capabilities. These services help physically transport up to exabytes of data into and out of AWS, as described below.
• AWS Snowcone: The smallest member of the AWS Snow Family of edge computing, edge storage, and data transfer devices, weighing in at 4.5 pounds (2.1 kg) with 8 terabytes of usable storage. Snowcone is ruggedized, secure, and purpose-built for use outside of a traditional data center.
• AWS Snowball: A data migration and edge computing device that comes in two device options: Compute Optimized and Storage Optimized. Snowball Edge Storage Optimized

Page 7111222 ends

Page 7111333 ends

Figure 5 illustrates the relationship between regions and Availability Zones.

Figure 5. Regions and Availability Zones
The AWS products and services that are available in each Region are listed at the Region Table webpage.

6.1. Access to Physical Infrastructure and Data Center Facilities You can find more information in RFx Aid – Data Center Security and Access.

AWS does not disclose the exact location of data centers and does not allow data center access to customers, as this exposes a wide range of customers to physical access of a third party. To meet this customer need, an independent and competent auditor validates the presence and operation of controls as part of our System and Organization Controls (SOC 1) Type 2 report.

Page 7111444 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 22
This broadly accepted third-party validation provides customers with the independent perspective of the effectiveness of controls in place. A list of FAQs on how to access SOC reports is available through AWS Artifact here.

SOC reports are independent third-party examination reports that demonstrate how CSPs achieve key compliance controls and objectives. These reports help customers and their auditors understand the CSP infrastructure controls established to support operations and compliance. These third-party audits and attestations provide customers with assurance that the CSP maintains robust compliance controls and alleviates the need for customers to visit on-site facilities, thus enhancing CSP infrastructure security overall. See Appendix C for more information on SOC reports.

6.2. Data Center Audits
AWS only provides data center access and information to employees and contractors who have a legitimate business need for such privileges. As such, AWS does not allow data center access to customers, as this exposes a range of customers to physical access of an outside party.

Instead of allowing customers to perform physical audits, AWS has an independent third party perform audits of its data centers. These audits are conducted in accordance with the Federal Risk and Authorization Management Program (FedRAMP), American Institute of Certified Public Accountants (AICPA): AT 801 (formerly Statement on Standards for Attestation Engagements [SSAE] 16), and International Standards for Assurance Engagements (ISAE) 3402 professional standards.

The auditors produce a SOC 1 Type 2 report in connection with the audit. Independent reviews of data center physical security are also part of an International Organization for Standardization (ISO) 27001 audit, a Payment Card Industry (PCI) Data Security Standard (DSS) assessment, and an International Traffic in Arms Regulations (ITAR) audit.

Our rigorous attention to auditing provides peace of mind to our customers. Much as a customer trusts a bank based on reputation and regulation by the Federal Deposit Insurance Corporation (FDIC), our customers trust the independent third-party audits described above. It is widely accepted that such accrediting organizations are competent and qualified to assure customer confidence and acceptance without a personal inspection and accreditation—or customers having to hire their own accreditor.

To help fulfill customer-specific audit and regulatory requirements, we detail our controls on our Data Center website.

6.3. Service Level Agreements
You can find more information in RFx Aid – SLAs.

AWS provides service level agreements (SLAs) that apply to customer use of specific services.

Due to the rapidly evolving nature of AWS Cloud service offerings, our SLAs are best reviewed directly on our website here. In each service-specific SLA, we detail our general service commitment, including our monthly uptime percentage.

Our utility-based cloud model, customers can use our cloud infrastructure and its components as software-defined endpoints. This allows customers to achieve the highest levels of availability, performance, elasticity, scale, and geographic distribution to meet business service level requirements.

Page 71115 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 23

6.4. Data Center Virtual Tours
Customers and AWS Partners can take a virtual tour of our data centers to observe how we implement a layered security structure to keep our data centers secure. The following provides a list of each data center layer with a link to a virtual tour for each one. • Perimeter Layer: AWS data center physical security begins at the perimeter layer. This layer includes physical security features depending on the location, such as security guards, fencing, security feeds, intrusion detection technology, and other measures. • Infrastructure Layer: The infrastructure layer is the data center building and the equipment and systems that keep it running. Components like back-up power equipment, the HVAC system, and fire suppression equipment are all part of the infrastructure layer. These devices and systems help protect servers and data. • Data Layer: The data layer is the most critical point of protection because it is the only area that holds customer data. Protection begins by restricting access and maintaining a separation of privilege for each layer. In addition, we deploy threat detection devices, video surveillance, and system protocols, further safeguarding this layer. • Environmental Layer: The environmental layer is dedicated to environmental considerations from site selection and construction to operations and sustainability. AWS carefully chooses our data center locations to mitigate environmental risk such as flooding, extreme weather, and seismic activity.

6.5. Data Center Security
AWS’s data centers use innovative architectural and engineering approaches to ensures their security. Amazon has many years of experience in designing, constructing, and operating largescale data centers. This experience has been applied to the AWS Cloud. The following subsections address some of our customers’ frequently asked questions about our data center security.
• Physical and Environmental Security: AWS data centers are housed in nondescript facilities for anonymity. Physical access is strictly controlled at both the perimeter and at building ingress points by professional security staff using video surveillance, intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication a minimum of two times to access data center floors. All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff. AWS only provides data center access and information to employees and contractors who have a legitimate business need for such privileges.

When an employee no longer has a business need for these privileges, his or her access is immediately revoked, even if they continue to be an employee of Amazon or AWS. All physical access to data centers by AWS employees is logged and audited. • Fire Detection and Suppression: Automatic fire detection and suppression equipment has been installed to reduce risk. The fire detection system utilizes smoke detection sensors in all data center environments, mechanical and electrical infrastructure spaces, chiller rooms and generator equipment rooms. These areas are protected by either wetpipe, double-interlocked pre-action, or gaseous sprinkler systems. • Power: The data center electrical power systems are designed to be fully redundant and maintainable without impact to operations 24 hours a day and seven days a week.

Uninterruptible power supply (UPS) units provide backup power in the event of an electrical failure for critical and essential loads in the facility. Data centers use generators to provide backup power for the entire facility.

Page 71116 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 24
• Climate and Temperature: Climate control is required to maintain a constant operating temperature for servers and other hardware, which prevents overheating and reduces the possibility of service outages. Data centers are conditioned to maintain atmospheric conditions at optimal levels. Personnel and systems monitor and control temperature and humidity at appropriate levels.
• Physical Plant Management: AWS monitors electrical, mechanical, and life support systems and equipment so that any issues are immediately identified. Preventative maintenance is performed to maintain the continued operability of equipment. • Storage Device Decommissioning: As part of AWS’s storage decommissioning process, when a storage device has reached the end of its useful life, AWS procedures include a decommissioning process that is designed to prevent customer data from being exposed to unauthorized individuals. AWS uses the techniques detailed in National Institute of Standards and Technology (NIST) 800-88 (Guidelines for Media Sanitization) as part of the decommissioning process.

AWS will provide the SOC 1 Type 2 report to customers under NDA. The AWS Security Center provides up-to-date information on AWS audits by independent third-party auditors.

7. Automatic Scaling of Cloud Resources
You can find more information in RFx Aid – Scalability and Elasticity.

To help customers feel confident that infrastructure can handle a spike in traffic, they can use AWS Auto Scaling and Elastic Load Balancing to automatically scale their AWS cloud-based resources up to meet unexpected demand, and then scale those resources down as demand decreases. While AWS Auto Scaling adjusts capacity for multiple resources, Elastic Load Balancing distributes incoming application traffic across targets such as Amazon EC2 instances and containers.

7.1. Scaling
AWS Auto Scaling monitors customers’ applications and automatically adjusts capacity to maintain steady, predictable performance at the lowest possible cost. The service provides a user interface that lets customers build scaling plans for resources including Amazon EC2 instances and Spot Fleets, Amazon ECS tasks, Amazon DynamoDB tables and indexes, and Amazon Aurora Replicas.

Auto Scaling maintains the number of instances that the customers specifies by performing periodic health checks on the instances in the group. If an instance becomes unhealthy, the group terminates the unhealthy instance and launches another instance to replace it.

Auto Scaling policies can be used to automatically increase or decrease the number of running Amazon EC2 instances in a group of servers to meet changing conditions. When the scaling policy is in effect, the Auto Scaling group adjusts the desired capacity of the group and launches or terminates the instances as needed, either dynamically or on a schedule if there is a known and predictable ebb and flow of traffic.

7.2. Load Balancing
Elastic Load Balancing automatically distributes incoming application traffic across multiple targets, such as Amazon EC2 instances, containers, IP addresses, and AWS Lambda functions.

It can handle the varying load of application traffic in a single Availability Zone or across multiple Availability Zones. When combined with Auto Scaling, the number of healthy nodes is

Page 71117 ends

Elastic Load Balancing offers three types of load balancers that all feature the high availability, automatic scaling, and robust security necessary to make applications fault tolerant:
• Application Load Balancer: Best suited for load balancing of HTTP and HTTPS traffic • Network Load Balancer: Best suited for load balancing of Transmission Control Protocol (TCP) traffic where extreme performance is required • Classic Load Balancer: Best suited for applications that were built within the Amazon EC2-Classic network
• Gateway Load Balancer: Best suited for deploying and running of third-party virtual appliances.

7.3. Monitoring and Alarms
Customers can use Amazon CloudWatch to collect and track metrics, collect and monitor log files, and set alarms. Customers can architect their solutions so that Amazon CloudWatch’s metrics and alarms can work together with Auto Scaling and Elastic Load Balancing to dynamically deploy new instances on-demand, as depicted in Figure 6. This type of automation reduces the administrative burden of the customer because the infrastructure instantaneously changes capacity to meet demand without active management.

Figure 6: Auto Scaling and Elastic Load Balancing with Amazon CloudWatch alarms. Automatic scaling helps account for changes in capacity needs and user demand.

8. Architecting for High Availability and Reliability
You can find more information in RFx Aid – Reliability Resilience and Availability.

Availability and reliability are shared responsibilities between AWS and the customer or AWS partner. AWS is responsible for ensuring that our services are continuously available and that

Page 71118 ends

Customers or AWS Partners are responsible for designing, deploying, and testing their applications on AWS to achieve the availability and resiliency they need, including for missioncritical applications that require almost no downtime. The following subsections further detail AWS and customer responsibilities for availability and reliability.

8.1. AWS Responsibility: Data Center Availability and Reliability AWS builds to guard against outages and incidents, and we account for them in the design of our services—so when disruptions do occur, their impact on customers and the continuity of services is as minimal as possible.

To minimize disruptions, AWS employs compartmentalization. We have multiple constructs that provide different levels of independent, redundant components. For example, our Regions are isolated from each other, meaning that a disruption in one Region does not result in disruption in other Regions. Our Availability Zones are physically separated and isolated, and they are built with highly redundant networking to withstand local disruptions. AWS also leverages a concept known as cell-based architecture, by which resources and requests are partitioned into “cells” that are designed to be independent of each other. This design minimizes the chance that a disruption in one cell—for example, one subset of customers—would disrupt other cells.

Additionally, although the likelihood of large-scale incidents is very low, AWS is prepared to manage them should they occur. We maintain a series of incident response plans covering both common and uncommon events, and we update them regularly to incorporate lessons learned and prepare for emerging threats.

8.2. Customer Responsibility: Designing for Availability and Reliability While AWS goes to great lengths to provide availability and reliability of the cloud, our customers share responsibility for ensuring availability and reliability within the cloud. Some best practices we recommend for building highly resilient systems on the AWS Cloud include the following:
• Design for Failure: It is best practice to architect across multiple AZs in the same Region to achieve extremely high Recovery Time Objectives (RTOs), Recovery Point Objectives (RPOs), and service availability. For mission-critical applications, it is best practice to architect across Regions to handle the rare case of an entire Region failing— perhaps as a result of a major physical attack.
• Automate Failover and Recovery: Customers can use AWS Auto Scaling to monitor their applications and automatically adjust capacity to maintain the optimal level to satisfy demand without over- or under-provisioning. Customers can also use AWS Personal Health Dashboard, which provides alerts and remediation guidance when AWS is experiencing events that may impact them. AWS Personal Health Dashboard can integrate with Amazon CloudWatch Events, allowing customers to build custom rules and select targets such as AWS Lambda functions to define automated remediation actions.
• Test Recovery Procedures: Customers can use a test environment to simulate different failures or to recreate scenarios that led to failures before they occur. This exposes failure pathways that customers can test and fix before a real failure scenario, reducing the risk of components that have not been tested before failing.

Page 71119 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 27

8.3. Resources and Reference Architecture
The AWS Well-Architected Framework codifies the experiences of thousands of customers, helping customers assess and improve their cloud-based architectures and mitigate disruptions.

Our Reliability Pillar whitepaper provides guidance to help apply best practices to achieve reliability.

In addition, the AWS Architecture Center provides customers with the necessary guidance and application architecture best practices to build highly scalable and reliable applications in the AWS Cloud. Figure 7 provides a reference architecture for fault tolerance and high availability.

Figure 7: Fault Tolerant AWS Reference Architecture

8.4. Building Secure Solutions on AWS
You can find more information in RFx Aid – Security and AWS Security Best Practices,

Page 722200 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 28
AWS manages over a thousand security controls to provide a secure environment for our customers. The AWS virtual infrastructure is designed to provide optimum availability while ensuring customer security, privacy, and segregation. AWS’s highly secure data centers use state-of-the-art electronic surveillance and multi-factor access control systems and maintain strict, least-privileged-based access authorizations. Our environmental systems are designed to minimize the impact of disruptions to operations, and our multiple Regions and Availability Zones allow customers to remain resilient in the face of most failure modes.

Remember that security is a shared responsibility between AWS and the AWS Partner/customer. While AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud, AWS Partners/customers control how they architect and secure their applications and data on the AWS Cloud. In addition, AWS provides security documentation that shows how to configure AWS services to meet security and compliance objectives.

The following subsections provide further information on some of our most-inquired-about aspects of security. More information about security and responsibilities is available on our AWS Cloud Security and AWS Security Documentation webpages.

8.5. Granting and Managing Account Access
You can find more information in the RFx Aid – Access Control.

Identity and access management are key parts of an information security program, ensuring that only authorized and authenticated users are able to access customers’ resources, and only in a manner that customers intend. Using AWS Identity and Access Management (IAM), customers can create and manage AWS users and groups, assign them security credentials (e.g., access keys, passwords, and multi-factor authentication [MFA] devices), and use permissions to allow and deny their access to AWS resources. Customers can also request temporary security credentials for users who only require short-term access.

8.5.1. IAM Users
An IAM user is an entity that the customer creates in AWS. The IAM user represents the person or service who uses the IAM user to interact with AWS. A user in AWS consists of a name, a password to sign into the AWS Management Console, and up to two access keys that can be used with the API or CLI.

When the customer creates an IAM user, they grant it permissions either by making it a member of a group that has appropriate permission policies attached (recommended) or by directly attaching policies to the user. The customer can also clone the permissions of an existing IAM user, which automatically makes the new user a member of the same groups and attaches all the same policies.

A root user is a single sign-in identity that has complete access to all AWS Cloud services and resources in the account. It is a security best practice to not use the root account because of its complete access. Instead, create individual users and grant them each the minimum amount of privilege necessary, which is known as least privilege. Note that all users have zero privileges by default. Customers can manage users’ privilege by individual user or by groups.

8.5.2. IAM Groups
An IAM user group is a collection of IAM users. Customers can use groups to specify permissions for a collection of users, which can make those permissions easier to manage for those users. For example, a customer could have a group called Admins and give that group

Page 7222111 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 29
the types of permissions that administrators typically need. Any user in that group automatically has the permissions that are assigned to the group. Note that a group is not truly an identity because it cannot be identified as a Principal in a resource-based or trust policy. It is only a way to attach policies to multiple users at one time.

8.5.3. IAM Roles
An IAM role is very similar to a user, in that it is an identity with permission policies that determine what the identity can and cannot do in AWS. However, a role does not have any credentials (password or access keys) associated with it. Instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it. An IAM user can assume a role to temporarily take on different permissions for a specific task. A role can be assigned to a federated user who signs in by using an external identity provider instead of IAM.

AWS uses details passed by the identity provider to determine which role is mapped to the federated user.

8.5.4. Identity Federation
With Identity Federation, customers can use single sign-on (SSO) to access their AWS accounts using credentials from their corporate directory. Federation uses open standards such as Security Assertion Markup Language 2.0 (SAML) to exchange identity and security information between an identity provider and an application.

8.5.5. Setting Granular Permissions
Access control policies are attached to users, groups, and roles to assign permissions to AWS resources. By default, IAM users, groups, and roles have no permissions; users with sufficient permissions must use a policy to grant the desired permissions.

Using policies, customers can specify several layers of permission granularity. First, customers can define specific AWS service actions they wish to allow or explicitly deny access to. Second, depending on the action, they can define specific AWS resources upon which the actions can be performed. Third, customers can define conditions to specify when the policy is in effect (for example, if MFA is enabled or not).

8.5.6. Temporary Security Credentials
Customers can use the AWS Security Token Service (AWS STS) to create and provide trusted users with temporary security credentials that can control access to their AWS resources.

Temporary security credentials are short-term and are not stored with the user; rather, they are generated dynamically and provided to the user when requested.

8.6. Tools for Logical Separation
AWS Cloud services and features that provide logical separation are enough to meet most security requirements, despite legacy requirements for physical separation. Amazon VPC, for example, allows customers to define and provision their own logically isolated section of the AWS Cloud. Amazon VPC provides a networking layer for Amazon EC2, a service that provides compute capacity within the AWS Cloud. Each Amazon VPC is logically separated from other virtual networks on the AWS Cloud, and it allows customers to launch their resources into an IP address range that they determine.

Within a VPC, customers can create subnets, each with an associated route table. They can configure these route tables to control network traffic. Customers can attach an internet gateway

Page 7222222 ends

Customers can also create private subnets that only allow their Amazon EC2 instances to communicate with each other. Our Amazon VPC User Guide provides several example scenarios for building both public and private subnets.

In addition, AWS offers services like VPC Peering, AWS Transit Gateway, and AWS PrivateLink, which allow VPCs to communicate with each other and with other services on the AWS Cloud both securely and privately.

8.7. Tools for Encryption
All AWS Cloud services that store customer data offer the ability to encrypt that data. By defining an encryption approach, customers can provide protection for their content against unauthorized users and against unnecessary exposure to authorized users. The combination of AWS Key Management Service (KMS) and AWS CloudHSM is the centerpiece of a rigorous encryption solution.

AWS KMS helps customers manage encryption keys and integrates with many AWS Cloud services. This service provides durable, secure, and redundant storage for customers’ master keys. Customers can define their key aliases as well as key-level policies. The policies help define key administrators as well as key users. For example, a secret management system can be the only system that has access to the master key that encrypts the secrets for storage.

AWS CloudHSM is a cloud-based hardware security module (HSM) that allows customers to easily generate and use their own encryption keys on the AWS Cloud. It helps customers meet corporate, contractual, and regulatory compliance requirements for data security by using Federal Information Processing Standard (FIPS) 140-2 Level 3 validated HSMs.

8.7.1. Protecting Data at Rest
Multiple AWS Cloud services provide built-in integration with AWS KMS to allow easy encryption of data. Amazon S3 allows customers to encrypt content by selecting a KMS key on object upload. Amazon EBS allows customers to choose a KMS key to encrypt a block storage volume or Amazon Machine Image (AMI) copy operation. Amazon RDS allows customers to choose an encryption key for encrypting DB instance storage at rest (including backup snapshots).

Customers also have the option of implementing their own encryption-at-rest approach. For example, they can encrypt content before storing in an AWS Cloud service. Amazon S3 provides the facility to upload an already encrypted object. It also provides the ability to upload an object along with an encryption key that’s used in-memory to encrypt an object. To retrieve the object, the customer must supply the same key.

8.7.2. Protecting Data in Transit
When protecting data in transit, selecting secure protocols that implement the latest in cryptography standards such as Transport Layer Security (TLS) is a common best practice.

AWS Cloud services provide HTTPS endpoints using TLS for communication, thus providing encryption in transit when communicating with the AWS APIs. The customer has full control over their computing resources to implement encryption in transit across their services.

Additionally, the AWS Certificate Manager (ACM) service allows customers to manage and deploy public and private certificates for their workloads. They can also leverage virtual private network (VPN) connectivity into their VPC or across VPCs to facilitate encryption of traffic.

Page 7222333 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 31

8.8. Automating Security and Compliance
AWS offers a variety of security tools that customers can use to secure the applications they build on the AWS Cloud. These includes AWS CloudTrail and AWS CloudWatch for logging and monitoring, Amazon GuardDuty for threat detection, and AWS Shield for DDoS protection. Our Security, Identity, and Compliance on AWS page provides a more complete listing and details on the myriad services we offer. Customers can use these tools—and the tools of our AWS Partners—to automate security.

8.9. Penetration Testing
AWS customers are responsible for all scanning, penetration testing, file integrity monitoring, and intrusion detection for their Amazon EC2 instances, Amazon RDS databases, and various other applications. (Refer to the Penetration Testing page for terms of service regarding penetration testing.) Penetration tests should include customer IP addresses and not AWS endpoints. AWS endpoints are tested as part of AWS compliance vulnerability scans.

8.10. Data Breaches
Both AWS and customers (and any AWS Partners they engage) have responsibilities to respond to a data breach. AWS customers and AWS Partners retain the responsibility to monitor their own environment for privacy breaches. The AWS SOC reports provide an overview of the controls that are in place to monitor the AWS managed environment.

We recommend that customers and AWS Partners consider implementing the following best practices to protect against and detect security breaches:
• Use encryption to secure data.
• Configure AWS Cloud services to keep data secure. AWS provides information on how to secure resources in our security documentation.
• Implement least privilege permissions for access to resources and data. • Use monitoring tools like Amazon CloudWatch to track when data is accessed and by whom.
• Review AWS’s Best Practices for Security, Identity, and Compliance page for additional information on how to protect against and detect security breaches.

AWS Partners and customers are responsible for reporting incidents involving customer storage, virtual machines, and applications (for more information, refer to our Vulnerability Reporting page). AWS maintains the AWS Security Bulletins webpage to notify customers of security and privacy events affecting AWS Cloud services. Customers can subscribe to the Security Bulletin RSS Feed to keep abreast of security announcements on the Security Bulletin webpage. The customer support team maintains a Service Health Dashboard webpage to alert customers to any broadly impacting availability issues.

9. AWS Training and Certification
You can find more information in RFx Aid – AWS Training and Development.

AWS recommends that AWS Partners incorporate cloud training into migration or significant cloud initiatives. Industry studies show that comprehensively trained customers are more successful relative to their peers in implementing cloud, so we provide guidance below that AWS Partners can use when they are seeking to train government customers.

Page 7222444 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 32

9.1. Benefits of Training and Certification
AWS Training & Certification offers the cloud skills enablement resources that government entities need to modernize their agencies; create a culture of innovation; and attract, develop, and retain cloud talent. AWS works closely with AWS Partners to develop a workforce development plan to build cloud computing capabilities based on training needs. Leveraging AWS Training and Certification for organizational training can help accomplish the following:
• Achieve Cloud Adoption Goals Sooner: Organizations with comprehensive training adopt cloud technology faster than those who do not take advantage of a comprehensive training program. This helps move projects forward, get to market faster, drive revenue, and capitalize on the cost savings associated with AWS. • Gain Stakeholder Buy-In: AWS Training will help orient and familiarze teams with cloud initiatives. The Train to Accelerate Your Cloud Strategy whitepaper presented by the International Data Corporation (IDC) found that comprehensively-trained organizations were 4.4 times more likely to overcome operational and performance concerns. This means less time spent on stakeholder alignment and more time spent on innovation and business growth.
• Improve Employee Productivity: The IDC’s whitepaper also found that decision makers within comprehensively-trained organizations are 4.7 times more likely to agree that cloud technology can improve IT staff productivity. AWS Training helps teams become more productive by using the cloud.

9.2. Approach to Training and Workforce Development
AWS is investing hundreds of millions of dollars to provide free cloud computing training to 29 million people around the world by 20251
. AWS and its partners can provide a comprehensive
curriculum to organizations that need foundational technology upskilling and cloud computing training.

Our approach to workforce development typically begins in the classroom but must extend to solving real-world business and technology challenges. It constitutes a learning continuum across three building blocks: Learn, Explore, and Apply. Each phase can be customized to optimize the learning path for the specific organization’s growth. We illustrate each of these phases in Figure 8 below.

1 See Amazon to help 29 million people around the world grow their tech skills with free cloud computing skills training by 2025

Page 72225 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 33
Figure 8: Phases of Learning Continuum
• Learn: Focuses on traditional classroom (or virtual training) that educates students how to build on, secure, operate, and manage AWS services, supplemented by self-paced and on-demand digital training that can be consumed at any time. • Explore: Tailors learning opportunities to the agency’s environment and builds on base knowledge and skills though targeted and more focused interactive learning modalities. • Apply: Dives into building proofs of concept (POCs) and solutions that solve agencyspecific business and technology challenges.

9.3. Learning Needs Analysis
For customers with significant training needs for end-customers, AWS Partners can work with an AWS Training Lead to conduct a Learning Needs Analysis as described below.

AWS Training and Certification offers a no-cost self-assessment survey known as the Learning Needs Analysis (LNA). The LNA helps identify AWS skill gaps and recommends organizational and individual training plans to address these gaps. The LNA helps optimize training investments and acquire critical skills more quickly. This can be especially useful for scenarios involving large customers who can have large numbers of employees participate.

The LNA is a two-step process:

1. Complete the self-assessment survey: Individuals in the organization complete a self-assessment, which measures cloud knowledge and skill across multiple functional areas. The survey takes approximately 10 minutes to complete.

2. Review skills gaps and training plans: AWS identifies skill gaps and generates training plans based on survey results.

Once organizations complete the LNA, AWS Training Experts, Specialists, and Solution Architects can customize training, workshops, and deep dives specialized for their industry. We then support delivery of our customized offerings both digitally and onsite.

Page 72226 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 34

9.4. Modes of Training Delivery
We offer free digital training, in-depth classroom training, private onsite training, and select learning events. Training options include the following:
• Free Digital Training: Over 500 on-demand digital courses that help customers and AWS Partners learn new cloud skills and services when and where it is convenient for them, at no cost. For example, customers and partners can get free hands-on training with AWS hosted on qwikLABS.com.
• AWS Skill Builder: On-demand digital courses that are self-paced to help learners build new cloud skills.
• AWS Training Partner (ATP) Courses: Self-paced digital or classroom courses covering a range of topics, influding fundamental and advnaced AWS Cloud topics, all provided by top AWS Training Partners, including edX and Coursera. • Classroom Training: Live classes delivered virtually or in person by accredited AWS instructors who teach in-demand cloud skills and best practices using a mix of presentations, discussion, and hands-on labs.
• Private Onsite Training: Virtual or in-person classes with accredited AWS instructors who teach in-depth AWS Cloud skills in a private environment that brings the classroom to learners.
• Events: Register for online or in-person events to learn how to leverage the power of the AWS Cloud.

Table 2 illustrates features of AWS Training and Certification delivery.

Page 72227 ends

Page 72228 ends

Page 72229 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 37

10.1. Certifications and Attestations
Certifications and attestations are performed by a third-party independent auditor. Our certifications, audit reports, and attestations of compliance are based on the results of the auditor’s work. AWS offers its customers comprehensive compliance controls, and supports more security standards and compliance certifications than any other offering. We help customers satisfy compliance requirements for virtually every regulatory agency around the globe, including PCI-DSS, HIPAA/HITECH, FedRAMP, GDPR, FIPS 140-2, and NIST 800-171.

A list of the most frequently requested certifications in the US state, local, and education market includes:
• Federal Risk and Authorization Management Program (FedRAMP), • Federal Information Processing Standard (FIPS),
• International Organization for Standardization (ISO) 9001:2015, • ISO/International Electrotechnical Comission (IEC) 27001:2013, • ISO/IEC 27018:2019,
• Payment Card Industry Data Security Standard (PCI DSS), • System and Organization Control (SOC) Reports.

For more information about these certifications, see Appendix C. The full list of certifications and attestations can be found at https://aws.amazon.com/compliance/.

10.2. Laws, Regulations, and Privacy
AWS customers remain responsible for following applicable compliance laws and regulations. In some cases, AWS offers functionality (such as security features), enablers, and legal agreements (such as the AWS Data Processing Agreement and Business Associate Addendum) to support customer compliance. No formal certification is available to (or distributable by) a CSP like AWS within these law and regulatory domains. The following subsections provide details on the laws, regulations, and privacy considerations that AWS Partners ask about most often. These include:
• Family Educational Rights and Privacy Act (FERPA)
• Health Insurance Portability and Accountability Act of 1996 (HIPAA)/ Health Information Technology for Economic and Clinical Health (HITECH)
• Internal Revenue Service Publication 1075 (IRS Pub 1075) • Voluntary Product Accessibility Template (VPAT)/Section 508

10.2.1. FERPA
The Family Educational Rights and Privacy Act (FERPA) of 1974 was enacted to support and promote the protection of privacy and reasonable governance of student education records.

FERPA provides parents of students and eligible students with the following:
• The right to inspect and review their education records • Governance over disclosure of their education records • A mechanism to amend incorrect education records
FERPA requires states to use reasonable methods to ensure the security of their IT solutions.

This may be achieved by hosting education records on cloud computing solutions. The law, in general, requires covered institutions and agencies to reasonably safeguard student education

Page 733300 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 38
records from improper use or disclosure. Securing student record information, including students’ personally identifiable information (PII), is essential for educational institutions and vendors that provide services which fall under the purview of FERPA.

AWS and FERPA: AWS implements physical and logical controls for internal services and provides robust offerings externally for customers to leverage in order to comply with FERPA.

These controls are discussed in detail in our FERPA Compliance on AWS whitepaper.

FERPA for AWS Partners: Because FERPA was authored in 1974, it lacks clear guidance on modern technology use, which means that educational institutions are often left to create their own solutions. As part of this solution, customers are encouraged to take steps such as creating device compliance policies, threat protection plans, and data loss prevention plans that suit their organization to protect sensitive information. In addition, customers are encouraged to use encryption and access controls. Access controls also provide auditing and logging capabilities to customers in order to validate privacy and data protection policies that customers have in place.

AWS offers a comprehensive set of features and services to make encryption of PII easy to manage and simpler to audit, including AWS KMS. Customers with FERPA compliance requirements have a great deal of flexibility in how they meet encryption requirements for PII.

10.2.2. HIPAA/HITECH
Health Insurance Portability and Accountability Act (HIPAA) legislation is designed to make it easier for US workers to retain health insurance coverage when they change or lose their jobs.

This legislation also encourages electronic health records to improve the efficiency and quality of the US healthcare system through improved information sharing. Along with increasing the use of electronic medical records, HIPAA includes provisions to protect the security and privacy of protected health information (PHI).

Health Information Technology for Economic and Clinical Health (HITECH) expanded the HIPAA rules in 2009. HIPAA and HITECH together establish a set of federal standards that are intended to protect the security and privacy of PHI.

10.2.2.1. AWS and HIPAA
There is no HIPAA certification for a CSP such as AWS. In order to meet the HIPAA requirements applicable to our operating model, AWS aligns our HIPAA risk management program with FedRAMP and NIST 800-53, which are higher security standards that map to the HIPAA Security Rule. NIST supports this alignment and has issued SP 800-66: An Introductory Resource Guide for Implementing the HIPAA Security Rule, which documents how NIST 800-53 aligns to the HIPAA Security Rule.

Under the HIPAA regulations, AWS is considered a business associate. The BAA is an AWS contract that is required under HIPAA rules to ensure that AWS appropriately safeguards PHI.

The BAA also serves to clarify and limit, as appropriate, the permissible uses and disclosures of PHI by AWS, based on the relationship between AWS and our customers, and the activities or services being performed by AWS.

AWS has a standard BAA we present to customers for signature. This BAA accounts for the unique services AWS provides and accommodates within the AWS Shared Responsibility Model. To review, accept, and manage the status of the BAA for a specific account, sign in to AWS Artifact. Note that some AWS Artifact documentation is available under NDA, and use of the content is subject to the terms of that NDA.

Page 7333111 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 39

10.2.2.2. HIPAA for AWS Partners
AWS helps covered entities and their business associates use the secure AWS environment to process, maintain, and store PHI.

For detailed information about how to use AWS for the processing and storage of health information, see the whitepaper Architecting for HIPAA Security and Compliance on Amazon Web Services.

10.2.3. IRS Pub 1075
Internal Revenue Service Publication 1075 (IRS Pub 1075) provides guidance for US government agencies and their agents to protect Federal Tax Information (FTI).

While the IRS does not publish an official designation or certification for compliance with IRS Pub 1075, AWS supports organizations to protect FTI managed on the AWS Cloud by aligning our implementations of NIST 800-53 and FedRAMP security controls with the respective IRS Pub 1075 security requirements. AWS has worked closely with the IRS to ensure that the AWS GovCloud (US) and AWS US East/West Regions meet Pub 1075 requirements for storing and processing FTI. Refer to Appendix C.1 for information on AWS and FedRAMP security controls.

10.2.4. VPAT/Section 508
In 1998, the US Congress amended the Rehabilitation Act of 1973 to require Federal agencies to make their electronic and information technology accessible to people with disabilities.

Inaccessible technology interferes with an individual’s ability to obtain and use information quickly and easily. Section 508 was enacted to eliminate barriers in information technology (IT), make available new opportunities for people with disabilities, and encourage development of technologies that will help achieve these goals.

The law applies to all Federal agencies when they develop, procure, maintain, or use electronic IT. Under Section 508 (29 U.S.C. § 794 (d)), agencies must give disabled employees and members of the public access to information that is comparable to the access available to others. Because Section 508 is a federal and state requirement, any and all of AWS government customers will have Section 508 compliance needs.

10.2.4.1. AWS and VPAT/Section 508
AWS provides multiple interfaces to its cloud computing services, including application programming interfaces (APIs), software development kits (SDKs), integrated development environment (IDE) toolkits, and command line tools.

To address accessibility requirements, AWS offers the AWS Command Line Interface (AWS CLI), a unified tool that provides a consistent, text-based interface to interact with all parts of AWS. With just one tool, users can control services from the command line and automate them through scripts. The AWS CLI can be used by customers with a diverse range of needs, including those who use assistive technology such as Job Access with Speech (JAWS), Nonvisual Desktop Access (NVDA), and alternative input devices.

An Accessibility Conformance Report (ACR) was performed for the AWS CLI by completing Voluntary Product Accessibility Template® (VPAT) Version 2.3 in March 2019. The ACR provides assessments against Section 508 requirements and Web Content Accessibility Guidelines (WCAG) 2.1 Level A and AA requirements.

AWS also offer an alternative for users who prefer a graphical user interface. AWS ElasticWolf Client Console is a client-side application with an easy-to-use interface that is compatible with

Page 7333222 ends

Examples of its accessible design include semantically-marked up form field labels, visible and semantically-marked up button labels, and keyboard accessible content.

AWS ElasticWolf Client Console integrates with the AWS CLI and can manage AWS resources in all AWS Regions. It provides access to many foundational and widely-used AWS services, including AWS CloudFormation, AWS Identity and Access Management (IAM), Amazon Elastic Compute Cloud (Amazon EC2), Amazon EMR, Amazon Relational Database Service (Amazon RDS), Amazon Route 53, Amazon Simple Queue Service (Amazon SQS), and Amazon Simple Storage Service (Amazon S3).

An ACR was performed for AWS ElasticWolf Client Console by completing VPAT Version 2.3 in March 2020. The ACR, performed for both Windows and Linux versions, provides assessments against Section 508 requirements and WCAG 2.0 Level A and AA requirements. The ACR is available through AWS Artifact.

10.3. Alignments/Frameworks
Compliance alignments and frameworks include published security or compliance requirements for a specific purpose, such as a specific industry or function. AWS provides functionality (such as security features) and enablers (including compliance playbooks, mapping documents, and whitepapers) for these types of programs.

Requirements under specific alignments and frameworks may not be subject to certification or attestation; however, some alignments and frameworks are covered by other compliance programs. The following subsections provide details on the alignments and frameworks that AWS Partners ask about most frequently.

10.3.1. Criminal Justice Information Services
Criminal Justice Information (CJI) refers to the data necessary for law enforcement agencies to perform their mission and enforce the laws, such as biometric, identity history, person, organization, property, and case/incident history data. CJI also refers to data necessary for civil agencies to perform their mission, including data used to make hiring decisions.

The Criminal Justice Information Services (CJIS) Security Policy reflects the shared responsibility between Federal Bureau of Investigation (FBI) CJIS, CJIS Systems Agency, and the State Identification Bureaus (SIB) of the lawful use and appropriate protection of CJI. The CJIS Security Policy provides a baseline of security requirements for current and planned services and establishes a minimum standard for new initiatives.

10.3.1.1. AWS and CJIS
By using solutions built on AWS, agencies can manage and secure their applications, data, and other CJIS resources in the AWS GovCloud (US). AWS GovCloud (US) Regions consist of US data centers hosting services authorized to FedRAMP High, managed by US citizens, and offering the FIPS validated endpoints necessary to build CJIS-compliant solutions.

Technological advancements have removed the need to engage in the traditional method of relying on physical security and background checks as a way to qualify an individual’s “access” to unencrypted CJI. While the traditional approach can help achieve minimum compliance under the CJIS Security Policy, it doesn’t compare to the security that can be achieved using strong encryption practices and the deployment of “least privilege” principles to restrict CJI access to those with a need-to-know, right-to-know, and explicit authorization.

Page 7333333 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 41

10.3.1.2. CJIS for AWS Partners
Properly securing CJI and maintaining compliance with the CJIS Security Policy requires a number of security controls aimed at ensuring only authorized individuals have access to the CJI.

One critical control is the use of independently tested and validated encryption to protect sensitive information both in-transit and at-rest, regardless of physical location. AWS empowers customers and partners to encrypt their criminal justice data in AWS GovCloud (US) employing FIPS 140-2 validated encryption in-transit services and FIPS-197 compliant encryption for data at-rest. AWS GovCloud (US) also offers AWS Key Management Service (AWS KMS) using FIPS 140-2 validated hardware security modules, allowing customers to create, own, and manage their own customer master keys for all encryption. These customer master keys never leave the AWS KMS FIPS validated hardware security modules unencrypted and are never known to AWS personnel.

Another critical control involves limiting access to individuals who hold or manage encryption keys, allowing agencies to define and limit the universe of users with logical access to CJI. The principal of least privilege is one of the most fundamental underpinnings of the CJIS Security Policy based on a “need-to-know, right-to-know” standard. AWS GovCloud (US) customers can enforce least privilege by securely encrypting their CJI and limiting all access to the CJI to only those with access to the encryption keys. By using AWS GovCloud (US), customers are provided AWS Cloud services, tools, and security assurance to enable them to retain complete control and ownership over their own criminal justice data.

See our webpage, Using AWS for Criminal Justice Information Solutions, for additional information.

10.3.2. Cloud Security Alliance
Cloud Security Alliance (CSA) is a not-for-profit organization that aims to promote security assurance within cloud computing using reliable and recommended processes and practices, and to educate on the uses of cloud computing to help secure all other forms of computing.

10.3.2.1. AWS and CSA
AWS participates in the voluntary CSA Security, Trust & Assurance Registry (STAR) SelfAssessment to document our compliance with CSA-published best practices. We publish our completed CSA Consensus Assessments Initiative Questionnaire (CAIQ) on the AWS website.

10.3.2.2. CSA for AWS Partners
The CSA CAIQ provides a set of questions that the CSA anticipates a cloud consumer and/or cloud auditor would ask of a CSP like AWS. It provides a series of security, control, and process questions that can then be used for a wide range of uses, including cloud provider security evaluation.

10.3.3. Federal Information Security Management Act
AWS enables US government agencies to achieve and sustain compliance with the Federal Information Security Management Act (FISMA). AWS’s infrastructure has been evaluated by independent assessors for a variety of government systems as part of their system owners’ approval process. Numerous Federal Civilian and DoD organizations have successfully achieved security authorizations for systems hosted on AWS in accordance with the Risk Management Framework (RMF) process defined in NIST 800-37 and DoD Information

Page 7333444 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 42
Assurance Certification and Accreditation Process (DIACAP). AWS’s secure infrastructure has helped federal agencies expand cloud computing use cases and deploy sensitive government data and applications in the cloud while complying with the rigorous security requirements of federal standards.

10.3.4. National Institute of Standards and Technology 800-53 National Institute of Standards and Technology (NIST) 800-53 security controls are generally applicable to US Federal Information Systems. Federal Information Systems typically must go through a formal assessment and authorization process to ensure sufficient protection of confidentiality, integrity, and availability of information and information systems.

The NIST Cybersecurity Framework (CSF) is supported by governments and industries worldwide as a recommended baseline for use by any organization, regardless of its sector or size. Since Fiscal Year 2016, federal agency FISMA metrics have been organized around the CSF, and agencies are now required to implement the CSF under the Cybersecurity Executive Order.

10.3.4.1. AWS and NIST 800-53
AWS Cloud infrastructure and services have been validated by third-party testing performed against the NIST 800-53 Revision 4 controls and additional FedRAMP requirements. AWS has received FedRAMP ATOs from multiple authorizing agencies for both AWS GovCloud (US) and the AWS US East/West Regions. For more information, see the AWS FedRAMP compliance webpage, or the following FedRAMP Marketplace webpages:
• AWS East/West Region complete list of authorizing agencies • AWS GovCloud (US) complete list of authorizing agencies • AWS GovCloud JAB P-ATO at the high baseline

10.3.4.2. NIST 800-53 for AWS Partners
Under NDA, AWS provides an AWS FedRAMP SSP template based upon NIST 800-53 Rev. 4, which is prepopulated with the applicable NIST 800-5 Rev. 4 Low/Moderate/High control baseline. Control responsibility is as follows:
• Shared Responsibility: The customer will provide security and configurations of their software components, and AWS will provide security for its infrastructure. • Customer-Only Responsibility: The customer is fully responsible for guest operating systems, deployed applications, and select networking resources (for example, firewalls). More specifically, the customer is solely responsible for configuring and managing security in the cloud.
• AWS-Only Responsibility: AWS manages the cloud infrastructure, including the network, data storage, system resources, data centers, physical security, reliability, and supporting hardware and software. Applications built on top of the AWS system inherit the features and configurable options that AWS provides. AWS is solely responsible for configuring and managing security of the cloud.

For security authorization purposes, compliance with the FedRAMP requirements (based on NIST 800-53 rev 4 Low/Moderate/High control baseline) is contingent upon AWS fully implementing AWS-only and shared controls and the customer or AWS Partner implementing customer-only and shared controls. A FedRAMP-accredited 3PAO has assessed and authorized AWS implementation of our control responsibility. The portion of shared controls that the customer or AWS Partner is responsible for and the controls related to applications they

Page 73335 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 43
implement on top of the AWS infrastructure must be separately assessed and authorized by them in agreement with NIST 800-37 and their specific security authorization policies and procedures.

AWS FedRAMP-compliant systems have been granted authorizations, have addressed the FedRAMP security controls (NIST 800-53), use the required FedRAMP templates for the security packages posted in the secure FedRAMP Repository, have been assessed by an accredited independent 3PAO, and maintain the continuous monitoring requirements of FedRAMP.

Customers and AWS Partners can use our NIST CSF whitepaper to assess their AWS environment against the NIST CSF and improve the security measures they implement and operate. The whitepaper also provides a third-party auditor letter attesting to the AWS Cloud services’ conformance to NIST CSF risk management practices.

10.3.5. Uptime Institute Tiers
The Uptime Institute created the standard Tier Classification System to evaluate various data center facilities in terms of potential site infrastructure performance, or uptime. Uptime Institute has not authorized other organizations to certify data centers under its Tier Classification System. Uptime Institute does not design, build, or operate data centers.

10.3.5.1. AWS and Uptime Institute Tiers
AWS operates our data centers in alignment with the Tier III+ guidelines, but we have chosen not to have a certified Uptime Institute-based tiering level so that we have more flexibility to expand and improve performance. AWS’s approach to infrastructure performance acknowledges Uptime Institute’s tiering guidelines and applies them to our global data center infrastructure design to ensure the highest level of performance and availability for our customers. AWS then improves on the guidelines provided by the Uptime Institute to scale for global operations and produce an operating outcome for availability and performance that far exceeds that which would be achieved through the Uptime Institute tiering guidelines alone.

Although we do not claim alignment with Tier IV, we can ensure that our systems have a fault tolerant sequence of operations with self-correcting mitigations in place.

AWS has identified critical system components required to maintain the availability of the system and recover service in the event of outage. Critical system components are backed up across multiple, isolated locations known as Availability Zones. Each Availability Zone runs on its own physically distinct, independent infrastructure, and is engineered to be highly reliable.

Availability Zones are connected to each other with fast, private fiber-optic networking, enabling customers and AWS Partners to easily architect applications that automatically fail-over between Availability Zones without interruption.

10.3.5.2. Uptime Institute Tiers for AWS Partners
AWS customers can build highly resilient systems in the cloud by employing multiple instances in multiple Availability Zones plus data replication to achieve extremely high recovery time and recovery point objectives, as well as service availability of 99.999% and more. Service availability is therefore a function of the design; customers who care about the availability and performance of their applications want to deploy these applications across multiple Availability Zones in the same region for fault tolerance and low latency. Some AWS Cloud services, such as Amazon S3, are built to leverage all Availability Zones within the region and have a durability objective of 99.999999999%.

Page 73336 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 44

11. Managing AWS Resources
You can find more information in RFx Aid – Managing your AWS Resources.

With the AWS Cloud, customers can easily provision, manage, and monitor all of their IT resources in one location with the tool that best fits their unique needs. This helps them know what is going on in their cloud environment, such as instance health, logs of user actions, and ways to save money. AWS Cloud services are driven by robust APIs that allow for a wide variety of monitoring, management and developer tools to integrate easily with AWS Cloud resources. AWS supports common tools from vendors such as Microsoft, VMware, BMC Software, Okta, RightScale, Eucalyptus, CA, Xceedium, Symantec, Racemi, and Dell. Below are some AWS-native management options, which can be used alongside familiar management tools available on AWS Marketplace.

11.1. AWS Management Console
The AWS Management Console is a single destination for managing all AWS resources.

Customers can use the AWS Management Console to perform any number of tasks (e.g., deploying new applications, monitoring the health of applications, accessing monthly spending by service, and managing security credentials). The AWS Management Console supports all AWS Regions and lets customers provision resources across multiple Regions.

11.2. Command Line Interface (CLI)
The AWS CLI is a unified tool used to manage AWS Cloud services. With just one tool to download and configure, customers can control multiple AWS resources from the command line and automate them through scripts. The AWS CLI introduces a new set of simple file commands for efficient file transfers to and from Amazon S3.

11.3. Management Tools
AWS provides management tools that allows customers to programmatically provision, monitor, and automate all the components of their cloud environment. Using these tools, they can maintain consistent controls without restricting development velocity. These services all work together and are integrated with every part of the AWS platform, allowing customers to have greater insight into their cloud environment as well as maintain logs necessary for audits. Our management tools include the following:
• AWS Auto Scaling: Easily and safely scale multiple AWS resources. • Amazon CloudWatch: Collect and track metrics, collect and monitor log files, set alarms, and automatically react to changes in AWS resources.
• AWS CloudFormation: Model and provision—in an automated and secure manner—all the resources needed for applications across all regions and accounts. • AWS CloudTrail: Automatically log, continuously monitor, and retain account activity related to actions across AWS infrastructure.
• AWS Config: Inventory all configurations across AWS resources. • AWS Control Tower: Configure AWS management and security services based on established best practices in a secure, compliant, multi-account environment. • AWS License Manager: Manage licenses in AWS and on-premises servers from software vendors such as Microsoft, SAP, Oracle, and IBM. • AWS OpsWorks: Host and scale Chef Automate and Puppet Enterprise servers.

Page 73337 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 45
• AWS Personal Health Dashboard: View the performance and availability of the AWS Cloud services underlying AWS resources.
• AWS Systems Manager: Centralize operational data from multiple AWS Cloud services and automate tasks across AWS resources.
• AWS Service Catalog: Create, manage, and distribute catalogs of approved products to end users, who can then access the products they need in a personalized portal. • AWS Trusted Advisor: Provision resources by following best practices. • AWS Well-Architected Tool: Review the state of workloads and compare them to the latest AWS architectural best practices.

AWS also offers several tools for cost management:
• AWS Budgets: Set custom budgets that send alert when costs or usage exceed (or are forecasted to exceed) a budgeted amount.
• AWS Cost and Usage Report: Customize a report that lists AWS usage for each service category used by an account and its IAM users in hourly or daily line items, as well as any activated tags for cost allocation purposes .
• AWS Cost Explorer: Visualize, understand, and manage AWS costs and usage over time.

12. Back-up and Disaster Recovery (DR)
You can find more information in RFx Aid – Disaster Recovery and Resiliency.

Customers of all sizes are using AWS to enable faster disaster recovery (DR) of their critical IT systems without incurring the infrastructure expense of a second physical site. AWS takes care of the undifferentiated heavy lifting required to create, implement, and manage scalable backup and recovery solutions.

There are many advantages to using AWS as part of a data protection strategy:
• Durability: Amazon S3, Amazon S3 Glacier, and S3 Glacier Deep Archive are designed for 99.999999999 percent of durability. Both platforms offer reliable backup of data, with object replication across at least three geographically dispersed Availability Zones. Many AWS services use Amazon S3 for storage and export/import operations. For example, Amazon Elastic Block Store (Amazon EBS) uses Amazon S3 for snapshot storage. • Security: AWS provides a number of options for access control and data encryption while in-transit and at-rest.
• Global infrastructure: AWS services are available around the globe, so customers can back up and store data in the Region that meets their compliance and workload. • Compliance: AWS regularly achieves third-party validation for thousands of global compliance requirements that we continually monitor, so customers can easily fit the backup solution into their existing compliance regimen. Customers can access and download compliance reports through AWS Artifact.
• Scalability: With AWS, customers don’t have to worry about capacity. As their needs change, they can scale their consumption up or down without administrative overhead.

AWS Elastic Disaster Recovery (AWS DRS) continuously replicates customers’ machines (including operating system, system state configuration, databases, applications, and files) into a low-cost staging area in their target AWS account and preferred Region. In the case of a disaster, the customer can instruct CloudEndure Disaster Recovery to automatically launch thousands of their machines in their fully provisioned state in minutes.

Page 73338 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 46
Using these capabilities on our global infrastructure, customers can build a DR solution to fit their budget, recovery time objective (RTO), and recovery point objective (RPO) (depicted in Figure 10). An organization typically decides on an acceptable RTO and RPO based on the financial impact when systems are unavailable. The organization then plans solutions to provide cost-effective system recovery based on the RPO within the timeline and the service level established by the RTO.

Figure 10: RPO and RTO. RPO relates to data loss in the event of a disaster; RTO relates to the amount of time systems are down.

Figure 11 shows a spectrum of scenarios—backup and restore, pilot light, warm standby, and multi-site—arranged by how quickly a system can be available to users after a DR event.

Typically, the shorter the recovery, the higher the cost of the solution. Each DR option is discussed in more detail below.

Figure 11: Spectrum of DR Options. Customers can choose a preferred DR option based on preferences for cost and the time it takes to recover systems.

12.1. Backup and Restore
In most traditional environments, data is backed up to tape and sent offsite regularly. Recovery time is the longest using this method, and lack of automation leads to increased costs. Amazon S3 is ideal for backup data, as it is designed to provide 99.999999999% durability of objects over a given year. Amazon S3 offers a range of storage classes—including options for one-zone infrequent access and archive—to help save on costs. Transferring data to and from Amazon S3 is typically done via the network, and it is therefore accessible from any location. For a hybrid architecture, customers can use AWS Storage Gateway to automatically back up onpremises data to Amazon S3. To centralize and automate their backup, AWS Backup allows customers to configure backup policies and monitor backup activity.

Page 73339 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 47

12.2. Pilot Light for Simple Recovery into AWS Warm Standby Solution
In a gas heater, a small idle flame – called a pilot light – is always burning, and can quickly ignite the entire furnace to heat up a house as needed. This is analogous to the “pilot light” backup and restore approach. In this DR approach, customers replicate part of their IT structure for a limited set of core services in AWS. In the event of a disaster, the AWS cloud environment takes over. A small part of their infrastructure is always running, simultaneously syncing mutable data (such as databases or documents) while other parts of their infrastructure are switched off and used only during testing. Unlike a backup and recovery approach, the most critical core elements are already configured and running in AWS. When the time comes for recovery, the customer can rapidly provision a full-scale production environment around the critical core. The pilot light approach typically uses a compute service like Amazon EC2 or a database service like Amazon RDS.

12.3. Warm Standby Solution in AWS
The term “warm standby” is used to describe a DR scenario in which a scaled-down version of a fully functional environment is always running in the cloud. This decreases recovery time because some services are always running. By identifying business-critical systems, the customer can fully duplicate these systems on AWS and have them always on. These servers can run on a minimum-sized fleet of Amazon EC2 instances on the smallest sizes possible. This solution is not scaled to handle a full-production load, but it is fully functional. It can be used for non-production work, such as testing, quality assurance, and internal use. In a disaster, customers can scale out the system quickly to handle the production load by adding more instances. They can automate this process using Amazon EC2 Auto Scaling and Elastic Load Balancing.

12.4. Multi-Site Solution Deployed on AWS and Onsite
A multi-site solution runs in AWS and on the customer’s existing on-premises infrastructure in an active-active configuration. During a disaster situation, the customer sends all traffic to AWS servers, which can scale to handle the full production load. For this approach, customers can use a DNS service that supports weighted routing, such as Amazon Route 53, to route production traffic to different sites that deliver the same application or service. A proportion of traffic will go to the customer’s infrastructure in AWS, and the remainder will go to their onsite infrastructure. In an onsite disaster situation, the customer can adjust the DNS weighting and send all traffic to the AWS servers. The capacity of the AWS Cloud service can be rapidly increased to handle the full production load. Customers can automate this process using Amazon EC2 Auto Scaling and Elastic Load Balancing.

13. Security Questionnaires
Under the Shared Responsibility Model, AWS is responsible for security of the cloud: protecting the infrastructure that runs all of the services offered in the AWS Cloud. All other security in the cloud is dependent on the customer or AWS partner’s management of their account(s) and their solution. AWS personnel cannot fill out Security Questionnaires on behalf of our AWS Partners.

In addition, AWS Partners maintain full control of their content and responsibility for configuring access to AWS services and resources. We provide an advanced set of access, encryption, and logging features to help AWS Partners do this effectively (for example, AWS Identity and Access Management, AWS Organizations and AWS CloudTrail). AWS Partners and customers

Page 744400 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 48
can choose how their content is secured. In the event that they need assistance to complete a questionnaire to document AWS security and compliance positions, we have the following resources to assist with understanding security on AWS. If AWS Partners have additional questions about a specific requirement, they can reach out to their AWS Account team for further information.
• Compliance FAQs:This page answers frequently-asked questions about compliance. • AWS Artifact: AWS Artifact is a central resource for compliance-related information. It provides on-demand access to AWS’s security and compliance reports and select online agreements. The AWS SOC 2 report is particularly helpful for completing questionnaires because it provides a comprehensive description of the implementation and operating effectiveness of AWS security controls. Note that some AWS Artifact documentation is available under NDA, and use of the content is subject to the terms of that NDA. • CSA Consensus Assessments Initiative Questionnaire: The CSA Consensus Assessments Initiative Questionnaire provides a set of questions the CSA anticipates a cloud consumer and/or auditor would ask of a cloud provider. It provides a series of security, control, and process questions which can then be used for a wide range of uses, including cloud provider selection and security evaluation. This document contains the AWS answers to the CSA questionnaire.
• AWS Risk and Compliance Whitepaper: This document addresses AWS-specific information around general cloud computing compliance questions. There are detailed descriptions of all AWS certifications, programs, reports, and third-party attestations. • AWS Data Center Controls Web Page: Many questionnaires have an entire section with questions related to data center physical security. This web page provides insight into some of our physical and environmental controls.
• Data Privacy: This page details our data privacy and data security policies, practices, and technologies we’ve put in place.
• AWS Security and Compliance Quick Reference Guide: This guide provides an overview of our assurance programs and how to secure content on the AWS Cloud. • AWS Compliance Center: This page offers a central location to research cloud-related regulatory requirements and how they impact various industries.

14. AWS Public Sector Access Policy—Instructions
If this opportunity requires the resale of AWS offerings, AWS Partners must include the AWS Public Sector Access Policy (“Access Policy”) in their response and incorporate the Access Policy in any agreement regarding such resale, per their Reseller Agreement, as amended. The Access Policy sets out rules, conditions, and restrictions regarding use of the AWS cloud services. This AWS Public Sector Access Policy can be accessed here.

Page 7444111 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 A-1
Appendix A. Industry Analyst Reports on AWS Market
Position
[Note: “Do not edit content in this section, or use in a public document other than a direct RFx response.

Include all citations and disclaimers outlined below.”] You can find more information in RFx Aid – Analyst Reports.

AWS offers reports from trusted third-party analysts to help organizations understand the benefits and value of the AWS Cloud. The AWS in Analyst Research page provides reports and analysis from firms such as Gartner, IDC, and Forrester covering a variety of product categories and geographies.

Gartner, Inc., a leading information technology research company, recently released its 2022 Magic Quadrant for Cloud Infrastructure and Platform Services2 3 report. In Gartner's evaluation covering both cloud infrastructure and platform services (IaaS & PaaS, or "CIPS"), AWS is evaluated as a Leader placed highest in both axes of measurement: Ability to Execute and Completeness of Vision (see Figure 12). This is the twelfth consecutive year that Gartner has recognized AWS as a Leader in the Magic Quadrant, making AWS the longest-running CIPS Magic Quadrant Leader.

2 Gartner, Magic Quadrant for Cloud Infrastructure & Platform Services, Raj Bala, Dennis Smith, Kevin Ji, David Wright, Miguel Angel Borrega, 19 October 2022. Gartner and Magic Quadrant are registered trademarks of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. 3 All statements in this report attributable to Gartner represent AWS’s interpretation of data, research opinion or viewpoints published as part of a syndicated subscription service by Gartner, Inc., and have not been reviewed by Gartner. Each Gartner publication speaks as of its original publication date (and not as of the date of this proposal). The opinions expressed in Gartner publications are not representations of fact and are subject to change without notice.

Page 7444222 ends

AWS Partner Package – US State and Local Government and Education Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 A-2
Figure 12: 2022 Gartner Magic Quadrant for Cloud Infrastructure and Platform Services More analyst reports can be found at AWS in Analyst Research.

Page 7444333 ends

AWS Partner Package
Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 B-3
Appendix B. AWS Resources
B.1. AWS Overview
• What is Cloud Computing: https://aws.amazon.com/what-is-cloud-computing/ • Types of Cloud Computing: https://aws.amazon.com/types-of-cloud-computing/ • About AWS: https://aws.amazon.com/about-aws/
• AWS Global Infrastructure: https://aws.amazon.com/about-aws/global-infrastructure/ B.2. AWS Solutions
• Websites and Web Hosting: https://aws.amazon.com/websites/ • Backup and Restore: https://aws.amazon.com/backup-restore/ • Data Archive: https://aws.amazon.com/archive/
• Disaster Recovery: https://aws.amazon.com/disaster-recovery/ • Big Data: https://aws.amazon.com/big-data/
• High Performance Computing: https://aws.amazon.com/hpc/ • Internet of Things: https://aws.amazon.com/iot/
• Financial Services: https://aws.amazon.com/financial-services/ • Healthcare and Life Sciences: https://aws.amazon.com/health/ • Genomics: https://aws.amazon.com/health/genomics/
• Business Applications: https://aws.amazon.com/business-applications/ • DevOps: https://aws.amazon.com/devops/
B.3. AWS Products and Services
• List of all AWS cloud services: https://aws.amazon.com/products/ • AWS Marketplace: https://aws.amazon.com/marketplace/
• AWS service documentation : http://aws.amazon.com/documentation/ B.4. AWS in the Public Sector
• AWS Public Sector Homepage: https://aws.amazon.com/government-education/ • U.S. Federal Government: https://aws.amazon.com/federal/ • State and Local Government: https://aws.amazon.com/stateandlocal/ • Defense and Aerospace: https://aws.amazon.com/government-education/defense/ • Education: https://aws.amazon.com/education/
• Nonprofit Organizations: https://aws.amazon.com/government-education/nonprofits/ • AWS GovCloud (US) Region: http://aws.amazon.com/govcloud-us/ • AWS Government Partners: https://aws.amazon.com/partners/government/ • AWS Public Sector Blog: https://aws.amazon.com/blogs/publicsector/ B.5. AWS Partner Community
• AWS Partner Network: https://aws.amazon.com/partners/ • AWS Partner Directory: http://www.aws-partner-directory.com/

Page 7444444 ends

AWS Partner Package
Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 B-4
• AWS Partner Programs: https://aws.amazon.com/partners/programs/ B.6. AWS Professional Services
• AWS Professional Services: https://aws.amazon.com/professional-services/ • AWS Cloud Adoption Framework: https://aws.amazon.com/professional-services/CAF/ B.7. AWS Pricing
• AWS Pricing Overview: http://aws.amazon.com/pricing/
• AWS Economics Center: https://aws.amazon.com/economics/ • Cloud Financial Management: https://aws.amazon.com/aws-cost-management/ • AWS TCO Calculator: http://aws.amazon.com/tco-calculator/ B.8. AWS Billing
• AWS Billing and Cost Management:
http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-what-is.html • Consolidated Billing: http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/consolidatedbilling.html • Cost Explorer: http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-explorer-whatis.html • AWS Budgets and Forecasts:
http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/budgets-managing-costs.html B.9. AWS Security and Compliance
• AWS Security Center: http://aws.amazon.com/security/
• AWS Shared Responsibility Model: http://aws.amazon.com/security/sharing-the-securityresponsibility/ • AWS Compliance: http://aws.amazon.com/compliance/
• AWS Data Privacy: http://aws.amazon.com/compliance/data-privacy-faq/ • Access Control: http://aws.amazon.com/iam/
• AWS Security Blog: https://blogs.aws.amazon.com/security/ B.10. AWS Support
• AWS Support Tiers : https://aws.amazon.com/premiumsupport/ • Support Knowledge Center: https://aws.amazon.com/premiumsupport/knowledge-center/ • AWS Trusted Advisor: https://aws.amazon.com/premiumsupport/trustedadvisor/ B.11. AWS Training and Best Practices
• AWS Training and Certification: http://aws.amazon.com/training/ • AWS Architecture Center: http://aws.amazon.com/architecture/ • AWS Quick Starts: https://aws.amazon.com/quickstart/

Page 74445 ends

AWS Partner Package
Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 B-5
B.12. Industry Analysis
• Analyst Reports: http://aws.amazon.com/resources/analyst-reports/ • Gartner Magic Quadrant for Cloud Infrastructure and Platform Services (October 2022):
https://www.gartner.com/doc/reprints?id=1-2AOZQAQL&ct=220728&st=sb • IDC Report: Quantifying the Business Value of Amazon Web Services:
http://d0.awsstatic.com/analyst-reports/IDC Business Value of AWS May 2015.pdf B.13. AWS Case Studies
• AWS Case Studies: https://aws.amazon.com/solutions/case-studies/ B.14. Procurement
• AWS Public Sector Contract Center: http://aws.amazon.com/contract-center/ • 10 Considerations for a Cloud Procurement Whitepaper: http://d0.awsstatic.com/whitepapers/10- considerations-for-a-cloud-procurement.pdf
• How to Buy Cloud Computing Services for your Agency (Webinar):
https://aws.amazon.com/webinars/buying-cloud-computing-services/ B.15. Legal
• AWS Customer Agreement: http://aws.amazon.com/agreement/ • AWS Service Terms: https://aws.amazon.com/service-terms/ • AWS Acceptable Use Policy: http://aws.amazon.com/aup/ • AWS Trademark Guidelines: http://aws.amazon.com/trademark-guidelines/ • AWS Site Terms: http://aws.amazon.com/terms/
• AWS Privacy Notice: https://aws.amazon.com/privacy/
• AWS Tax Help: http://aws.amazon.com/tax-help/
B.16. Additional Resources
• AWS Blog: https://aws.amazon.com/blogs/aws/
• AWS Discussion Forums: https://forums.aws.amazon.com/index.jspa • What’s New from AWS: http://aws.amazon.com/new/
• AWS YouTube Channel: https://www.youtube.com/user/AmazonWebServices • AWS Twitter Feed: https://twitter.com/awscloud
• AWS on SlideShare: http://www.slideshare.net/AmazonWebServices • Events and Webinars: https://aws.amazon.com/about-aws/events/ • An E-Book of Cloud Best Practices: https://medium.com/aws-enterprise-collection/an-e-book-ofcloud-best-practices-for-your-enterprise-4a211840c55b#.corzpjf3m B.17. AWS Whitepapers
• AWS Whitepapers and Guides: http://aws.amazon.com/whitepapers/ • Overview of AWS Whitepaper: http://d0.awsstatic.com/whitepapers/aws-overview.pdf • Security Resources and Whitepapers: http://aws.amazon.com/security/security-resources/ • AWS Compliance whitepapers: http://aws.amazon.com/compliance/aws-whitepapers/

Page 74446 ends

AWS Partner Package
Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document Q2 2023 B-6
• Best Practices for Security, Identity, & Compliance: https://aws.amazon.com/architecture/securityidentity-compliance • AWS Risk and Compliance Whitepaper:
https://d0.awsstatic.com/whitepapers/compliance/AWS Risk and Compliance Whitepaper.pdf

Page 74447 ends

AWS Partner Package
Q2 2023 Page C-7
Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document.

Appendix C. Common AWS Certifications
C.1. Federal Risk and Authorization Management Program (FedRAMP) Federal Risk and Authorization Management Program (FedRAMP) is a US government-wide program that delivers a standard approach to the security assessment, authorization, and continuous monitoring for cloud products and services. The governing bodies of FedRAMP include the Office of Management and Budget (OMB), US General Services Administration (GSA), US Department of Homeland Security (DHS), US Department of Defense (DoD), National Institutes of Standards & Technology (NIST), and the Federal Chief Information Officers (CIO) Council.

Cloud services providers (CSPs) like AWS who want to offer their products and services to the US government must demonstrate FedRAMP compliance. FedRAMP uses the NIST Special Publication 800 series and requires CSPs to receive an independent security assessment conducted by a third-party assessment organization (3PAO) to ensure that authorizations are compliant with the Federal Information Security Management Act (FISMA).

There are two paths for CSPs to be FedRAMP compliant:
• Joint Authorization Board (JAB) Authorization – To receive FedRAMP JAB Provisional Authority to Operate (P-ATO), a CSP is reviewed by the FedRAMP Program Management Office (PMO), is assessed by a FedRAMP-accredited 3PAO, and receives a P-ATO from the JAB. The JAB is made up of the CIOs from DoD, DHS, and GSA. • Agency Authorization – To receive FedRAMP Agency Authority to Operate (ATO), a CSP is reviewed by a customer Agency CIO or Delegated Authorizing Official(s) to achieve a FedRAMP-compliant ATO that is verified by the FedRAMP PMO.

AWS and FedRAMP
AWS offers the following FedRAMP compliant systems that have been granted authorizations:
• AWS GovCloud (US), which has been granted a JAB P-ATO and multiple ATOs for high impact level. The services in scope of the AWS GovCloud (US) JAB P-ATO boundary at high baseline security categorization can be found within the AWS Services in Scope by Compliance Program.
• AWS US East-West, which has been granted a JAB P-ATO and multiple ATOs for moderate impact level. The services in scope of the AWS US East-West JAB P-ATO boundary at moderate baseline security categorization can be found within the AWS Services in Scope by Compliance Program.

FedRAMP for AWS Partners
AWS Partners and prospective customers can request access to the AWS APN Partner FedRAMP Security Package using AWS Artifact. Note that some AWS Artifact documentation is available under NDA, and use of the content is subject to the terms of that NDA.

C.2. Federal Information Processing Standard (FIPS)
The Federal Information Processing Standard (FIPS Publication 140-2) is a US government standard that specifies the security requirements for cryptographic modules that protect sensitive information.

Page 74448 ends

AWS Partner Package
Q2 2023 Page C-8
Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document.

AWS and FIPS
AWS works with customers to provide the information they need to manage compliance when using the AWS US East-West or AWS GovCloud (US) Regions. For more information about the standard, see Cryptographic Module Validation Program on the NIST Computer Security Resource Center website.

FIPS for AWS Partners
The Amazon VPC VPN endpoints in the AWS GovCloud (US) Regions operate using FIPS 140- 2 validated cryptographic modules. If you require use of FIPS 140-2 validated cryptographic modules when accessing AWS US East/West or AWS GovCloud (US) through use of the CLI or programmatically by using the APIs, the list of available FIPS endpoints by AWS Region can be found on our FIPS Publication 140-2 page.

C.3. International Organization for Standardization (ISO) 9001:2015 The International Organization for Standardization (ISO 9001:2015) outlines a process-oriented approach to documenting and reviewing the structure, responsibilities, and procedures required to achieve effective quality management within an organization. The key to the ongoing certification under this standard is establishing, maintaining, and improving the organizational structure, responsibilities, procedures, processes, and resources in a manner in which AWS products and services consistently satisfy ISO 9001:2015 quality requirements.

AWS and ISO 9001:2015
AWS has undergone a systematic, independent examination of our quality system to determine whether the activities and activity outputs comply with ISO 9001:2015 requirements. A certifying agent found our quality management system to comply with the requirements of ISO 9001:2015 for the activities described in the scope of registration. You can download AWS’s ISO 9001:2015 certification from our website.

ISO 9001:2015 for AWS Partners
The certification covers the quality management system over a specified scope of AWS Cloud services and Regions of operations. If you are pursuing ISO 9001:2015 certification while operating all or part of your IT systems on the AWS Cloud, you are not automatically certified by association. However, using an ISO 9001:2015 certified provider like AWS can make your certification process easier.

C.4. ISO/International Electrotechnical Commission 27001:2013 ISO/International Electrotechnical Commission (IEC) 27001:2013 is a security management standard that specifies security management best practices and comprehensive security controls following the ISO/IEC 27002 best practice guidance. The basis of this certification is the development and implementation of a rigorous security program, which includes the development and implementation of an Information Security Management System (ISMS) which defines how AWS perpetually manages security in a holistic, comprehensive manner. This widely-recognized international security standard specifies that AWS do the following:
• Systematically evaluate our information security risks, taking into account the impact of threats and vulnerabilities.

Page 74449 ends

AWS Partner Package
Q2 2023 Page C-9
Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document. • Design and implement a comprehensive suite of information security controls and other forms of risk management to address customer and architecture security risks. • Have an overarching management process to ensure that the information security controls meet our needs on an ongoing basis.

AWS and ISO/IEC 27001:2013
AWS has certification for compliance with ISO/IEC 27001:2013, 27017:2015, and 27018:2014.

These certifications are performed by independent third-party auditors. AWS’s ISO/IEC 27001:2013 certification can be downloaded from our website.

ISO/IEC 27001:2013 for AWS Partners
The ISO/IEC 27001:2013 certification for AWS covers the AWS security management process over a specified scope of services and data centers. If you are pursuing ISO/IEC certifications while operating part or all of your IT on the AWS Cloud, you are not automatically certified by association. However, using an ISO/IEC 27001:2013 certified provider like AWS can make your certification process easier.

C.5. ISO/IEC 27017:2015
ISO/IEC 27017:2015 provides guidance on the information security aspects of cloud computing, recommending the implementation of cloud-specific information security controls that supplement the guidance of the ISO/IEC 27002 and ISO/IEC 27001 standards. This code of practice provides additional information security controls implementation guidance specific to CSPs like AWS.

AWS and ISO/IEC 27017:2015
AWS’s attestation to the ISO/IEC 27017:2015 guidance not only demonstrates our ongoing commitment to align with globally-recognized best practices, but also verifies that AWS has a system of highly precise controls in place that are specific to cloud services. AWS’s ISO/IEC 27017:2015 certification can be downloaded from our website.

ISO/IEC 27017:2015 for AWS Partners
AWS’s ISO/IEC 27017:2015 certification covers the security management process and cloud provider specific controls. If you are pursuing ISO/IEC certifications while operating part or all of your IT environment on the AWS Cloud, you are not automatically certified by association.

However, using an ISO/IEC 27017:2015 certified provider like AWS can make your certification process easier. The AWS ISO/IEC 27017:2015 assessment provides evidence that our security controls are aligned with the 27017:2015 guidance specific to CSPs.

C.6. ISO/IEC 27018:2019
ISO/IEC 27018:2019 is a code of practice that focuses on protection of personal data in the cloud. It is based on ISO/IEC information security standard 27002 and provides implementation guidance on ISO/IEC 27002 controls applicable to public cloud personally identifiable information (PII). It also provides a set of additional controls and associated guidance intended to address public cloud PII protection requirements not addressed by the existing ISO/IEC 27002 control set.

AWS and ISO/IEC 27018:2019

Page 7500 ends

AWS Partner Package
Q2 2023 Page C-10
Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document.

AWS maintains the high bar of data protection and privacy controls outlined in ISO/IEC 27018:2014 for all customer content, regardless of whether or not any particular data is PII.

AWS’s ISO/IEC 27018:2019 certification can be downloaded from our website.

ISO/IEC 27018:2019 for AWS Partners
Alignment demonstrates to customers that AWS has a system of controls in place that specifically address the privacy protection of their content. AWS’s alignment with and independent third-party assessment of this internationally recognized code of practice demonstrates AWS’s commitment to the privacy and protection of customers’ content.

C.7. Payment Card Industry Data Security Standard (PCI DSS) The Payment Card Industry Data Security Standard (PCI DSS Level 1) is a proprietary information security standard administered by the PCI Security Standards Council, which was founded by American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa Inc.

PCI DSS applies to all entities that store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD), including merchants, processors, acquirers, issuers, and service providers. PCI DSS is mandated by the card brands and administered by the PCI Security Standards Council.

AWS and PCI DSS
AWS is certified as a PCI DSS 3.2 Level 1 Service Provider, the highest level of assessment available. The compliance assessment was conducted by Coalfire Systems Inc., an independent Qualified Security Assessor (QSA). The PCI DSS Attestation of Compliance (AOC) and Responsibility Summary is available to AWS customers by using AWS Artifact. Note that some AWS Artifact documentation is available under NDA and use of the content is subject to the terms of that NDA.

PCI DSS for AWS Partners
As a customer who uses AWS products and services to store, process, or transmit cardholder data, you can rely on AWS technology infrastructure as you manage your own PCI DSS compliance certification.

AWS does not directly store, transmit, or process any customer CHD. However, you may create your own cardholder data environment (CDE) that can store, transmit, or process cardholder data using AWS products.

Customers must manage their own PCI DSS compliance certification, and additional testing will be required to verify that your environment satisfies all PCS DSS requirements. However, for the portion of the PCI CDE that is deployed in AWS, your QSA can rely on AWS AOC without further testing.

C.8. System and Organization Control (SOC) Reports
AWS System and Organization Control (SOC Reports) are independent third-party examination reports that demonstrate how AWS achieves key compliance controls and objectives. The purpose of these reports is to help you and your auditors understand the AWS controls established to support operations and compliance. Table 3 describes the four AWS SOC Reports.

Page 75111 ends

AWS Partner Package
Q2 2023 Page C-11
Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document.

Page 75222 ends

Page 75333 ends

DATE: October 21, 2026
TO: Mayor and Members of the City Council
FROM: Elisa C. Cox, City Manager
INITIATED BY: Jason C. Welday, Director of Engineering Services SUBJECT: Consideration to Authorize the Director of Engineering Services/City Engineer to Accept Public Improvements Required for the Mixed Use Development on the Southwest Corner of Haven Avenue and Arrow Route (DRC2021-00200), File a Notice of Completion Upon Such Acceptance, and Authorize Release of Bonds. (CITY)
RECOMMENDATION:

Staff recommends the City Council:

1. Approve the public improvements and their design required for the mixed-use development on the southwest corner of Haven Avenue and Arrow Route (DRC2021- 00200) and authorize the Director of Engineering Services/City Engineer to accept the improvements and file the appropriate Notice of Completion upon completion to his satisfaction;

2. Release the Faithful Performance cash deposit previously accepted as security for construction of the public improvements less 10%; and

3. Retain 10% of the cash deposit as a Maintenance Bond for one year following the filing of the Notice of Completion if the improvements remain free from defects in material and workmanship.

BACKGROUND:

The Planning Commission approved Case No. DRC2021-00200 for a mixed use development comprised of 248 apartments and 23,750 square feet of commercial space on a vacant site located at the southwest corner of Haven Avenue and Arrow Route. The project was conditioned to construct public improvements along the project’s frontage on Haven Avenue and Arrow Route including street improvements, landscaping, and traffic signal modifications.

The developer, 8500 Haven, LLC submitted and on March 4, 2026 the City Council accepted security in the form of a Faithful Performance Cash Deposit in the amount of $647,600 to ensure the successful completion of the public improvements. Following significant progress toward completion of the improvements, the developer requested and staff administratively approved a reduction in the deposit by $323,800 (representing a 50% reduction) on June 11, 2026. The remaining Faithful Performance Cash Deposit is $323,800.

Page 75444 ends

Page 2 of 2 ends

ANALYSIS:

The developer has substantially completed the public improvements with the exception of a diverter median island at the driveway on Haven Avenue south of Arrow Route and minor corrective items identified by the project inspector. In order to streamline the process of acceptance and avoid undue delay in release of funds on deposit following completion of these items, staff is requesting that the City Council delegate authority to accept the public improvements upon their successful completion to the Director of Engineering Services/City Engineer and to subsequently file the appropriate Notice of Completion. Further, given the de minimus estimated value for the remaining improvements (estimated to be less than the amount of the 10% Maintenance Cash Deposit), staff is recommending that the City Council authorize the release of the remaining cash deposit less 10% which would be retained as a Maintenance Cash Deposit.

Faithful Performance Cash Deposit (March 4, 2026): $647,600 Reduction in Faithful Performance Cash Deposit (June 11, 2026): ($323,800) Maintenance Cash Deposit to be Retained (10%): ($64,760) Cash Deposit to be Released: $259,040
City staff will conduct an inspection one year after the acceptance of the improvement to ensure that they remain free from defects in material and workmanship. Upon successful completion of the one-year period, the Director of Engineering Services/City Engineer will release the Maintenance Cash Deposit.

FISCAL IMPACT:

None
COUNCIL MISSION / VISION / VALUE(S) ADDRESSED:

This item addresses the City Council’s Core Values of a safe and healthy community by furthering the process to develop high-quality public improvements necessary to meet the community’s vision as outlined in the General Plan.

ATTACHMENTS:

Attachment 1 – Vicinity Map

Page 755 ends

ATTACHMENT #1
Case No. DRC2021-00200

Vicinity Map

NOT TO SCALE

Page 756 ends

DATE: October 21, 2026
TO: Mayor and Members of the City Council
FROM: Elisa C. Cox, City Manager
INITIATED BY: Peter Castro, Deputy City Manager
Jason C. Welday, Director of Engineering Services/City Engineer Christopher Sorensen, Senior Engineer
SUBJECT: Consideration to Accept as Complete, File the Notice of Completion and Authorize Release of Retention and Bonds for the Fiscal Year 2025/26 Local Slurry Seal Pavement Rehabilitation Project. (CITY) RECOMMENDATION:

Staff recommends that the City Council:

1. Accept the Fiscal Year (FY) 2025/26 Local Slurry Seal Pavement Rehabilitation, Contract No. 2026-039 Project (Project), as complete;

2. Approve the final contract amount of $167,270;

3. Authorize the release of the Faithful Performance Bond 35 days after recordation of Notice of Completion and accept a Maintenance Guarantee Bond;

4. Authorize the release of the Labor and Materials Bond in the amount of $175,410, six (6) months after the recordation of said notice if no claims have been received;

5. Authorize the City Engineer to file a Notice of Completion and release the Project retention, 35 days after recordation of the Notice of Completion; and

6. Authorize the City Engineer to approve the release of the Maintenance Bond one (1) year following the filing of the Notice of Completion if the improvements remain free from defects in material and workmanship.

BACKGROUND:

On April 15, 2026, the City Council awarded a construction contract to American Asphalt South, Inc., in the amount of $175,410 plus 10% contingency in the amount of $17,550 for the construction of the Project. The scope of work consisted of weed kill, routing and crack sealing, application of slurry seal, protecting existing utilities, installation of pavement markers and thermoplastic striping and related items of work per plan. A vicinity map illustrating the various neighborhood streets that received slurry seal is included as Attachment 1.

A copy of the April 15, 2026, City Council Staff Report is on file with the City Clerk.

Page 757 ends

Page 2 of 2 ends

ANALYSIS:

The Project has been completed in accordance with the approved plans and specifications and to the satisfaction of the City Engineer. One (1) contract change order was issued during construction, resulting in a net decrease of $8,140 to the contract amount due to the contractor’s failure to meet the Wet Track Abrasion Testing (WTAT) requirements in certain areas. The WTAT method is a laboratory procedure used to measure the wear resistance, durability, and moisture susceptibility to the slurry seal application. Per Greenbook Specifications and project contract documents, if the WTAT fails to conform to the requirements, the contractor agrees that payment for the work represented by the failed tests shall be reduced. A detailed description of the contract change order is on file with the City’s Engineering Services Department.

At the end of the one (1) year maintenance period, if the improvements remain free from defects in materials and workmanship, the City Clerk will release the Maintenance Bond upon approval by the City Engineer.

FISCAL IMPACT:

A total of $300,000 was budgeted in FY 2025/26 from the Gas Tax R&T7360 (Fund 174) and Measure I (Fund 177), which is identified under the Capital Improvement Project Account Numbers listed below:

Account No. Funding Source Description Amount
F174 CC307 SC 7004;
PID2222-177
Gas Tax R&T7360
(F174)
Local Street Rehab $150,000
F177 CC307 SC 7004;
PID2222-177
Measure I (F177) Local Street Rehab $150,000
The final project cost is $249,050 as shown below:

A total of $50,950 remains in the budget for this Project and will be returned to the Gas Tax R&T7360 (Fund 174) and Measure I (Fund 177) balances to be used for future capital improvement projects.

COUNCIL MISSION / VISION / VALUE(S) ADDRESSED:

This project reflects the City Council’s core values by planning for a sustainable future, strengthening infrastructure to support our commitment to prosperity, and fostering a safe and healthy community.

ATTACHMENTS:

Attachment 1 - Vicinity Map
Expenditure Category Amount
Final Construction Contract $167,270
Construction Inspection Services $64,300
Construction Materials Testing $15,940
Bid Noticing Advertisement $1,540
Estimated Construction Costs $249,050

Page 758 ends

ATTACHMENT 1
PROJECT# 800-2025-02
FY 2025/26 LOCAL SLURRY SEAL PAVEMENT REHABILITATIONS

VICINITY MAP

NOT TO SCALE
Project Site Hermosa Avenue

Page 759 ends

DATE: October 21, 2026
TO: Mayor and Members of the City Council
FROM: Elisa C. Cox, City Manager
INITIATED BY: Peter Castro, Deputy Manager
Jason C. Welday, Director of Engineering/City Engineer
Miguel Sotomayor, Principal Engineer
Ulises Benavente, Associate Engineer
SUBJECT: Consideration to Approve a Reimbursement Agreement Among the City of Rancho Cucamonga, Core Rancho, LLC, and JCLIN Investment, L.P. for Reimbursement of Completed Frontage Improvements along Foothill Boulevard, Related to Case No. SUBTT19945. (RESOLUTION NO. 2026- 103) (CITY)
RECOMMENDATION:

Staff recommends the City Council approve and adopt the attached resolution approving a Reimbursement Agreement among the City of Rancho Cucamonga, Core Rancho, LLC, and JCLIN Investment, L.P. for reimbursement of completed frontage improvements along Foothill Boulevard and authorize the City Manager to sign said agreement.

BACKGROUND:

On May 11, 2016, the Planning Commission approved Case No. SUBTT19945 for the development of a 193-unit mixed-use development with 3,246 square feet of commercial space on eight (8) acres of vacant land located at the northwest corner of Foothill Boulevard and East Avenue.

The project was conditioned to complete certain frontage public improvements along Foothill Boulevard within the limits of the neighboring property to the west (APN: 1100-201-05-0000).

Pursuant to the conditions of approval, the developer may request to enter into a reimbursement agreement to recover the costs of the completed public improvements from the neighboring property owner within six (6) months of the public improvements being accepted by the City.

ANALYSIS:

On October 1, 2025, the City Council accepted the public improvements for Case No.

SUBTT19945 and the developer, Core Rancho, LLC, submitted their request to enter into a reimbursement agreement within the required six (6) month timeframe. Both the developer and the neighboring property owner, JCLIN Investment, L.P., have executed the reimbursement agreement. Under this agreement, the City’s role is to accept reimbursement funds from JCLIN Investment, L.P. prior to building permit issuance. The City then will reimburse the funds to Core Rancho, LLC. Adoption of the attached resolution will approve the reimbursement agreement and authorize the City Manager to sign said agreement.

Page 7600 ends

Page 2 of 2 ends

FISCAL IMPACT:

There is no direct impact to City funds. The City will serve as a conduit deposit holder to collect required funds from the Property Owner and pass them through to the Developer. The Engineering Department will work with the Finance Department to set up the appropriate deposit account for processing the collection and disbursement.

COUNCIL MISSION / VISION / VALUE(S) ADDRESSED:

This item addresses the City Council’s vision to build on our success as a world class community, to create an equitable, sustainable, and vibrant city, rich in opportunity for all to thrive through the construction of high-quality public improvements.

ATTACHMENTS:

Attachment 1 – Vicinity Map
Attachment 2 – Reimbursement Agreement
Attachment 3 – Resolution 2026-103

Page 76111 ends

ATTACHMENT 1
Case No. SUBTT19945

Vicinity Map

NOT TO SCALE

Page 76222 ends

ATTACHMENT 2

ATTACHMENT #3
RESOLUTION NO. 2026-XXX

A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF RANCHO

CUCAMONGA, CALIFORNIA, APPROVING A REIMBURSEMENT

AGREEMENT AMONG THE CITY OF RANCHO CUCAMONGA, JCLIN
INVESTMENT, L.P., AND CORE RANCHO, LLC FOR FOOTHILL

BOULEVARD FRONTAGE PUBLIC IMPROVEMENTS, RELATED TO
CASE NO. SUBTT19945.

WHEREAS, the City Council of the City of Rancho Cucamonga, California, has for its consideration a Reimbursement Agreement among the City of Rancho Cucamonga (“City”), JCLIN Investment, L.P. (“Property Owner”), and Core Rancho, LLC (“Developer”) for the reimbursement of completed frontage public improvements located on Foothill Boulevard related to Case No. SUBTT19945; and WHEREAS, Developer constructed certain public frontage improvements along Foothill Boulevard related to Case No. SUBTT19945 that directly benefit the adjacent property owned by Property Owner; and WHEREAS, Pursuant to “Reimbursement Agreement Among The City of Rancho Cucamonga, Property Owner and Developer”, Property Owner is required to reimburse Developer for its proportional share of the public improvement cost prior to building permit issuance; and WHEREAS, City Staff has reviewed the construction costs submitted by the Developer in the amount of $335,328.03 and determined the proposed reimbursement amount to be fair and reasonable.

NOW, THEREFORE, THE CITY COUNCIL OF THE CITY OF RANCHO CUCAMONGA, HEREBY RESOLVES, as follows:

SECTION 1: That said Reimbursement Agreement and the same is hereby approved and the City Manager is hereby authorized to sign said Reimbursement Agreement on behalf of the City of Rancho Cucamonga.

SECTION 2: That the City Clerk shall cause a certified copy of this resolution to be recorded in the office of the County Recorder of San Bernardino County, California.

SECTION 3: That the City Clerk shall certify to the passage and adoption of this resolution, and it shall thereupon take effect and be in force.

PASSED, APPROVED, AND ADOPTED this day of 2026.

Resolution No. 2026-XXX – Page 1 of 1

Page 796 ends

DATE: October 21, 2026
TO: President and Members of the Board of Directors
FROM: Elisa C. Cox, City Manager
INITIATED BY: Julie A. Sowles, Deputy City Manager
Robert Neiuber, Human Resources Director
Emily Nielsen, Deputy Director of Human Resources
SUBJECT: Consideration to Approve a Resolution Adopting Side Letter Agreements Between the Rancho Cucamonga Fire Protection District and Fire Union Local 2274 and Fire Support Services Association. (RESOLUTION NO.

FD 2026-024) (FIRE)
RECOMMENDATION:

Staff recommends the Fire Board adopt the attached resolution approving Side Letter Agreements between the Rancho Cucamonga Fire Protection District and Fire Union Local 2274 and Fire Support Services Association.

BACKGROUND:

The Fire Board previously approved a Memorandum of Understandings (MOU) between the Rancho Cucamonga Fire Protection District (District) and Fire Union Local 2274 (Fire Union) effective July 1, 2026 through June 30, 2029. In September of 2026, the District and Fire Union met and conferred in good faith and agreed to update the MOU to replace annual performance evaluations with a professional development plan known as My Action Plan (MAP), to update conversion factors for vacation, sick, and holiday leave, and to update eligibility for the Fire Staff Premium.

The Fire Board previously approved a MOU between the Rancho Cucamonga Fire Protection District (District) and Fire Support Services Association (Fire Support) effective July 1, 2025 through June 30, 2027. In September of 2026, the District and Fire Support met and conferred in good faith and agreed to update the MOU to replace annual performance evaluations with a professional development plan known as My Action Plan (MAP).

ANALYSIS:

The agreed amendments to the Fire Union MOU are as follows:
• Article II, Section 2: Professional Development Plan and Merit Increase - Replacing the annual performance evaluations with a professional development plan known as My Action Plan (MAP). Additionally, adjusting the timeframe for eligible merit increases for new sworn District employees on a probationary period.
• Article III, Section 4: Conversion Factor – Correcting the conversion factor for vacation, sick, and holiday leave accruals for employees transitioning from a forty (40) hour per week personnel to a fifty-six (56) hour per week personnel and from a fifty-six (56) hour per week personnel to a forty (40) hour per week personnel.

Page 797 ends

Page 2 ends

The agreed amendments to the Fire Support MOU are as follows:
• Article II, Section 2: Professional Development Plan and Merit Increase- Replacing the annual performance evaluations with a professional development plan known as My Action Plan (MAP). Additionally, adjusting the timeframe for eligible merit increases for new nonsworn District employees on a probationary period.

These Side Letter Agreements shall be incorporated into the MOUs. The MOUs will remain in full force and effect except to the extent modified by these Side Letter Agreements.

Staff recommends the Fire Board adopt the attached resolution approving the Side Letter Agreements between the Rancho Cucamonga Fire Protection District and Fire Union and Fire Support.

FISCAL IMPACT:

The fiscal impact is $94,792 for FY 2026-27.

COUNCIL MISSION / VISION / GOAL(S) ADDRESSED:

This item addresses the City Council’s core value of the relentless pursuit of improvement.

ATTACHMENTS:

Attachment 1 – Resolution FD 2026-024 – Side Letter Agreements

Page 798 ends

RESOLUTION NO. FD 2026-XXX

A RESOLUTION OF THE BOARD OF DIRECTORS OF THE

RANCHO CUCAMONGA FIRE PROTECTION DISTRICT,

RANCHO CUCAMONGA, CALIFORNIA, APPROVING SIDE

LETTER AGREEMENTS BETWEEN RANCHO CUCAMONGA
FIRE PROTECTION DISTRICT AND FIRE UNION LOCAL 2274,
AND FIRE SUPPORT SERVICES ASSOCIATION.

WHEREAS, representatives of the Rancho Cucamonga Fire Protection District (District), Fire Union Local 2274, and Fire Support Services Association representatives have met and conferred pursuant to the provisions of Meyers-Milias-Brown Act (California Government Code §3500, et seq.) with regard to terms and conditions of employment; and WHEREAS, representatives of the District, Fire Union Local 2274, and Fire Support Services Association have agreed upon and presented to this Fire Board a Side Letter Agreement (see attached Side Letter Agreements), effective October 21, 2026; and

NOW, THEREFORE, THE FIRE BOARD OF THE RANCHO CUCAMONGA FIRE PROTECTION DISTRICT HEREBY RESOLVES that said Side Letter Agreements with Fire Union Local 2274 and Fire Support Services Association are hereby approved and the City Manager is hereby authorized to sign said Side Letter Agreements on behalf of the Rancho Cucamonga Fire Protection District, and the City Clerk to attest thereto.

PASSED, APROVED AND ADOPTED this ______ day of ___________, 2026.

ATTACHMENT 1

Page 799 ends

SIDE LETTER AGREEMENT

BETWEEN RANCHO CUCAMMONGA FIRE PROTECTION DISTRICT
AND FIREFIGHTERS ASSOCIATION – IAFF LOCAL 2274
The Rancho Cucamonga Fire Protection District (''District''} and Rancho Cucamonga Firefighters Association – IAFF Local 2274 (collectively, the "Parties''} entered into a Memorandum of Understanding ("MOU'') that commenced on July 1, 2026 and expires on June 30, 2029.

The Parties met and conferred in good faith in August and September of 2026. The Parties agreed to amend MOU language to add Article II, §2. A. 2. Professional Development Plan and Merit Increase and amending Article II, §5 Conversion Factors for vacation, sick, and holiday leave to align with current District leave tables.

ARTICLE II – COMPENSATION
§ 2. Salary Plan
A. 2. Professional Development Plan and Merit Increases (All other parts under Article II §2 A would remain and be renumbered) The annual performance evaluation shall be replaced with a professional development plan known as My Action Plan (MAP) and at least two (2) coaching check-ins per year. This MOU Section supersedes any other conflicting MOU sections.

The Fire District will form a committee of representatives from the City Management Team, Human Resources, and all bargaining groups which have agreed to change from an annual performance review to a MAP, which includes the Fire Support Services Association, Fire Union Local 2274 (“Local 2274”), and the Fire Management Group. The committee will develop a MAP document that incorporates the District’s current performance and management competencies: Leadership, Work Relationships, Communication, Decision Making, Initiative & Dependability, and Professional Development. Training and sample forms will be provided to employees and supervisors to assist with the professional development plan and coaching check-ins. The District will review the form(s) and process with this committee at least every three (3) years to assure their usefulness for employees and supervisors.

New nonsworn District employees on or starting an initial probationary period and all current District employees starting a promotional probationary period after September 1, 2026, will be eligible to receive a merit increase at six months (5%) and an additional merit increase at twelve months (5%) or at the end of their probationary period, whichever occurs later. New Sworn District covered employees on or starting a probationary period after October 22, 2026, will be eligible to receive a merit increase (5%) upon completion of the Fire Academy and an additional merit increase (5%) twelve months later or at the end of their probationary period, whichever occurs later. Both would then be eligible for a merit increase in the next professional development plan cycle as long as the initial probationary period was completed

Page 80000 ends

Page 2 of 5 ends

.
.
before the end of November (e.g., an employee whose initial or promotional probationary period ends during the months of March through November would be eligible for the increase the following February; an employee whose probationary period ends during the months of December through February would not be eligible for an additional increase until the February of the following year).

In November of each year, employees and their supervisors will work together to develop the employee’s MAP. The plan must be completed by the employee and the supervisor by the end of the second week of December each year.

My Action Plan Timeline:
• First week of October – MAP and MAP supporting documents are distributed to employees.
• First and Second week of November – Employees complete their MAPs. • Third and Fourth week of November – Employees and their supervisor work together on the MAP, and the supervisor reviews the plan with their Department Manager Team (as determined by the department). • Remainder of November through the second week of December – Supervisor finalizes the employee’s MAP taking into account the input of the Department Manager Team review. Supervisor goes over the MAP with the employee prior to submittal.

Upon submission of the completed MAP in December (as outlined in the timeline above), employees who are not at top step will receive a merit increase of five percent (5%), but no base salary shall exceed top step, which will be reflected in the first full pay period the following February. Employees at the top of their salary range will be eligible to receive a non-PERSable stipend of $500, paid in conjunction with the check from the first full pay period in February.

There shall be no retroactivity for MAPs where the employee portion is not timely submitted to the supervisor by the end of the second week of November. If, due to unforeseen circumstances, the employee is unable to submit the MAP by the end of the second week of November, the Department Head may agree to provide additional time and/or resources as necessary.

Employees on a Performance Improvement Plan (PIP) as of December will not be eligible for a MAP merit increase or a MAP stipend the following February. All Performance Improvement Plans will be reviewed in November by the Department Management Team.

Initial Transition
During the initial transition to MAPs in November of 2026, the following process will be followed:

Page 800111 ends

Page 3 of 5 ends

.
.
• All employees not at top step whose evaluation due dates are prior to December 1, 2027, will receive the merit increase they are due as currently outlined in the MOU.

Supervisors are expected to timely complete these evaluations. • All employees not at top step and not on probation whose evaluation due dates are in February to November 2026, will complete their MAPs as outlined in the Timeline and receive a MAP increase the first full pay period in February 2027. • All employees that are expected to be at top step and not on probation as of the end of November 2026, will complete their MAPs as outlined in the Timeline (First two weeks in November 2026) and receive their MAP stipend the first full pay period in February 2027.
• All employees that are expected to complete their probation in December 2026, or January 2027, or non-probationary employees not at top step whose evaluation dates fall in that same period will complete their MAPs in 2026 as outlined in the Timeline (First two weeks in November 2026) and receive a MAP merit increase on their current evaluation date.
o These employees will continue to complete their future MAPs as outlined in the Timeline and receive their MAP increase on their current evaluation due date until they reach top step.
 e.g., Eval due January 3, 2027 – Get MAP merit increase on January 3, 2027. This is the same time they would receive it if the MAP had not been put in place. If still not at top step. they would be eligible for another MAP merit increase on January 3, 2028.
 e.g., Probation ends December 15, 2026, – Get evaluation merit increase on December 15, 2026. If still not at top step, they would be eligible for a MAP increase on December 15, 2027.
o These employees are eligible to receive their MAP stipend of $500 on the first full pay period in February following or in the month that they reach top step.
 e.g., If employee is eligible for a MAP merit increase on January 3, 2028, that results in the employee now being at top step – Get MAP merit increase on January 3, 2028, and get map stipend the first full pay period in February 2028.
 e.g., Reach top step after MAP merit increase in December 15, 2028, – Get MAP merit increase on December 15, 2028, and get MAP stipend the first full pay period in February 2029.

Once these employees all reach top step this “Initial Transition” section will be removed from the MOU.

Page 800222 ends

Page 4 of 5 ends

.
.

ARTICLE III – LEAVES
§ 4. Conversion Factor
The factor used to convert the accruals for forty (40) hour per week personnel to fifty-six (56) hour per week personnel will be vacation, holiday, and sick leave:

Work Week Basis
Vacation 40 Hour 56 Hour Conversion
Factor
30 days-3 years 85.72 120 1.399906673
4-7 years 128.57 180 1.400015556
8-10 years 171.43 240 1.399988333
11-14 years 188.58 264 1.399936367
15-19 years
20-24 years
205.72
222.86
288
312

1.399961112

1.399982052
25+ years 240 336 1.4
Holiday 140 168 1.2
Sick 120 144 1.2
The following reciprocal factor will be used to convert the vacation, sick leave, and holiday accruals for fifty-six (56) hours per week personnel to forty (40) hours per week personnel as of January 2026:

Work Week Basis
Vacation 56 Hour 40 Hour Reciprocal
Factor
1year-3 years 120 85.72 0.714333333
4-7 years 180 128.57 0.714277778
8-10 years 240 171.43 0.714291667
11-14 years
15-19 years
264
288
188.58
205.72

0.714318182

0.714305556
20-24 years 312 222.86 0.714294872
25+ years 336 240 0.714285714
Holiday 168 85.72 0.833333333
Sick 144 128.57 0.833333333

Page 800333 ends

Page 5 of 5 ends

.
.

For the Fire Protection District For the Rancho Cucamonga Firefighters Association – IAFF Local 2274
___________________________ _________________________________ Elisa C. Cox Daniel Navarette
City Manager President

Page 800444 ends

SIDE LETTER AGREEMENT

BETWEEN RANCHO CUCAMMONGA FIRE PROTECTION DISTRICT

AND FIRE SUPPORT SERVICES ASSOCIATION
The Rancho Cucamonga Fire Protection District (''District''} and Rancho Cucamonga Fire Support Services Association (collectively, the "Parties''} entered into a Memorandum of Understanding ("MOU'') that commenced on July 1, 2026, and expires on June 30, 2029.

The Parties met and conferred in good faith in August and September of 2026. The Parties agreed to amend MOU language to add Article II, §2. B. Professional Development Plan and Merit Increase.

ARTICLE II – COMPENSATION
§ 2. Salary Plan
B. Professional Development Plan and Merit Increases
(All other parts under Article II §2 A would remain and be renumbered) The annual performance evaluation shall be replaced with a professional development plan known as My Action Plan (MAP) and at least two (2) coaching check-ins per year. This MOU Section supersedes any other conflicting MOU sections.

Page 8005 ends

Page 2 of 4 ends

.
.
be eligible for the increase the following February; an employee whose probationary period ends during the months of December through February would not be eligible for an additional increase until the February of the following year).

Initial Transition
During the initial transition to MAPs in November of 2026, the following process will be followed:

Page 8006 ends

Page 3 of 4 ends

.
.
• All employees not at top step whose evaluation due dates are prior to December 1, 2027, will receive the merit increase they are due as currently outlined in the MOU.

Once these employees all reach top step this “Initial Transition” section will be removed from the MOU.

Page 8007 ends

Page 4 of 4 ends

.
.

For the Fire Protection District For the Fire Support Staff Association ___________________________ _________________________________ Elisa C. Cox Stephanie Balzano
City Manager Fire Management Analyst I
__________________________________
Jesus Gomez
Fire Emergency Vehicle Technician II

Page 8008 ends

DATE: October 21, 2026
TO: Mayor and Members of the City Council
FROM: Elisa C. Cox, City Manager
INITIATED BY: Peter Castro, Deputy City Manager
Jennifer Nakamura, CNU-A, Planning Director
SUBJECT: Consideration of a General Plan Amendment to Amend the Traditional Neighborhood, Suburban Very Low, Suburban Low and Suburban Moderate Land Use Designations to Include the Implementing Zones for Each Designation Consistent with the Adopted Zoning Map. This Item is Exempt from the California Environmental Quality Act (CEQA) under CEQA Guidelines Section 15061(b)(3). Applicant: City of Rancho Cucamonga.

Record Number: DRC2026-00232. (RESOLUTION NO. 2026-104) (CITY) RECOMMENDATION:

Planning Commission and Staff recommend that the City Council adopt Resolution No. 2026-104 approving a General Plan Amendment to amend the Traditional Neighborhood, Suburban Very Low, Suburban Low and Suburban Moderate Land Use Designations to include the implementing zones for each designation consistent with the adopted Zoning Map and find that the project is exempt from the California Environmental Quality Act (CEQA).

BACKGROUND:

In January 2026, the Etiwanda Heights Neighborhood Conservation Plan Amendment highlighted differences between the density in the Specific Plan versus the General Plan. Whereas the Specific Plan allowed housing types in specific areas, ranging from two units per acre to six units per acre, the corresponding general plan designation, Traditional Neighborhood, allowed for up to 8 dwelling units per acre. State laws, which were signed into law after adoption of the original Specific Plan, allow for development at the General Plan’s density, regardless of the existing limits in the Specific Plan. As a result of that discussion, City Council directed staff to review the scope of the issue and to develop an approach to address the inconsistencies between the density in General Plan and the implementing zones citywide.

On July 15, 2026, City Council and Planning Commission held a joint workshop to discuss land use issues and updates affecting the city. As part of this discussion, Staff recommended targeted studies to clarify which implementing zones correspond to each land use designation and to address inconsistencies in four Neighborhood Placetypes (Traditional Neighborhood, Suburban Neighborhood – Very Low, Suburban Neighborhood – Low, Suburban Neighborhood – Moderate). Upon hearing staff’s recommendation, City Council and Planning Commission directed staff to prepare a General Plan Amendment to address these concerns.

The General Plan Text Amendment (Amendment) would modify the Traditional Neighborhood, Suburban-Very Low, Suburban-Low and Suburban-Moderate Land Use Designations to clarify the implementing zones for each designation consistent with the adopted zoning map. The

Page 8009 ends

Page 2 of 5 ends

Amendment would not change general plan designations or zoning designations for any individual parcel.

On September 23, 2026, the Planning Commission considered the proposed General Plan amendment at a publicly noticed hearing and by unanimous vote, recommended approval of the amendment.

ANALYSIS:

In December 2021, City Council adopted the General Plan (PlanRC), which is a state-required “constitution” that establishes the city’s vision and priorities for the next 10-20 years and guides future policy implementation. PlanRC’s Land Use & Community Character chapter defines the distinct types of places designed to create the community’s vision. Each Placetype establishes the land use designations that define the intended character, form, connectivity, and development intensity for specific neighborhoods throughout the city. This vision for each land use designation is implemented by the Rancho Cucamonga Municipal Code (RCMC) Title 17 (Development Code), which establishes density, development standards, and land uses allowed for each zone.

In October 2019, the Governor signed Senate Bill 330, the Skinner Housing Crisis Act of 2019 (SB330). This law made several modifications to existing legislation, such as the Permit Streamlining Act and the Housing Accountability Act. Section 65589.5(j)(4) of the Housing Accountability Act was amended to state “a proposed housing development project is not inconsistent with the applicable zoning standards and criteria, and shall not require a rezoning, if the housing development project is consistent with the objective general plan standards and criteria but the zoning for the project site is inconsistent with the general plan.” The intent of this language was to restrict cities from requiring housing developers to rezone a property for housing development of a density of type or types that is consistent with the objective standards in the General Plan, but the current zoning code was inconsistent with those standards.

In the past cities would use the General Plan land use designations to show the general density over a larger area, such as “up to 8 dwelling units per acre” and use the zoning code to determine density at a more granular level based on adjacencies and existing land use patterns. Under SB 330, the General Plan’s objective density standard for a property would be deemed consistent with a proposed housing development that is consistent with such objective density standard, even if the Development Code’s density standard is lower. When this occurs, the Housing Accountability Act provides that the City’s “standards and criteria shall be applied to facilitate and accommodate development at the density allowed on the site by the general plan and proposed by the proposed housing development project.” This provision has the effect of waiving or modifying development standards that preclude development at the density standard outlined in the General Plan.

Each PlanRC land use designation sets a maximum density allowed and is implemented by several zones as shown in Table 1. The density requirement in the zones offer more specificity and generally reflect the reality of what is already built out. In other words, where the general plan land use designation sets the general vision for specific neighborhoods, the zoning provides the standards to develop that vision.

Currently, the general plan text for each land use designation is missing the granular density of the implementing zones, meaning that, per state law, developers can legally use the general plan density, even in cases where the implementing zone is less intense. The biggest discrepancies between the general plan and zoning are in the Neighborhood Placetypes as

Page 811100 ends

Page 3 of 5 ends

shown in Table 1. For example, where the Traditional Neighborhood land use designation allows up to 8 dwelling units per acre, one of the implementing zones, Very Low Residential (VL), only allows up to 2 dwelling units per acre. Without the Amendment, for a 9.75 acre lot in the VL zone, a developer could apply to build 78 units (per the maximum of 8 du/ac in the General Plan) rather than the 20 units that are allowed per the maximum of 2 du/ac in the VL zone.

Table 1 – General Plan Land Use Designation and Implementing Zones General Plan Land
Use Designation
Max
Density
(du/ac)
Implementing Zones Density
(du/ac)
VL - Very Low Residential 2 du/ac
L - Low Residential 6 du/ac
L-ESP - Low Residential - Etiwanda Specific
Plan 2-6 du/ac
LM - Low Medium Residential 4-8 du/ac
NE2 - Neighborhood Estate 2 8 du/ac
Traditional
Neighborhood 8 du/ac
M - Medium Residential 8-14 du/ac
VL - Very Low Residential 2 du/ac
L-ESP - Low Residential - Etiwanda Specific
Plan 2-6 du/ac
L - Low Residential 6 du/ac
Suburban
Neighborhood -
Very Low
6 du/ac
FC/UC - Flood Control/Utility Corridor
LM-ESP - Low Medium Residential - Etiwanda
Specific Plan 4-8 du/ac
LM-TV - Low Medium Residential - Terra Vista 4-8 du/ac
LM-ESP - Low Medium Residential - Etiwanda
Specific Plan South 4-8 du/ac
M-TV1 - Medium Residential - Terra Vista 1 8-14 du/ac
M - Medium Residential 8-14 du/ac
M-ESP - Medium Residential - Etiwanda Specific
Plan 8-14 du/ac
Suburban
Neighborhood -
Low
14 du/ac
MH-TV - Medium High Residential - Terra Vista 14-24 du/ac LM - Low Medium Residential 4-8 du/ac
MH - Medium High Residential 14-24 du/ac
MH-TV Medium High Residential - Terra Vista 14-24 du/ac Suburban
Neighborhood -
Moderate
30 du/ac
H - High Residential 24-30 du/ac
Staff evaluated parcels within the affected Neighborhood Placetypes to understand where the amendment would have the greatest effect. Of the 40,876 parcels in these designations, approximately 100 parcels are currently vacant and developable and therefore represent the greatest potential for future development. If all vacant parcels within these designations were developed at the General Plan’s maximum allowed density, they would yield 2057 units, representing an 80% increase above the maximum density permitted by the implementing zone.

Page 8111111 ends

Page 4 of 5 ends

Table 2 – Dwelling Unit Per Acres (DU/AC) of Vacant lots in Neighborhood Placetypes General Plan Land Use Designations All Implementing Zones Number of Parcels
Max du/ac Max du/ac Min du/ac
Traditional Neighborhood 1073 486 112 37
Suburban Neighborhood - Very
Low 685 382 125 53
Suburban Neighborhood - Low 187 185 106 10
Suburban Neighborhood -
Moderate 112 89 52 1
Total 2057 1142 395 101
*This table represents the maximum density allowable per each General Plan Land Use designation. Actual unit count for each lot would consider street dedications, building types, parking, easements, etc. which may yield less units.

To preserve the existing character of residential neighborhoods, the Amendment would change the text in four Neighborhood Placetypes (Traditional Neighborhood, Suburban Neighborhood – Very Low, Suburban Neighborhood – Low, Suburban Neighborhood – Moderate) to include the implementing zones for each land use designation consistent with the adopted zoning map. This clarifies that the zone’s maximum density would take precedence over the maximum density identified in the General Plan. This text change is intended to only clarify the required density and will not make changes to the land use designations or zoning designations of individual parcels.

Environmental Review
This Item is Exempt from the California Environmental Quality Act (CEQA) under CEQA Guidelines Section 15061(b)(3). The Amendment changes the text to clarify which zones implement each land use designation and does not make any change to individual parcels.

Tribal Consultation
Senate Bill 18 (SB18) requires cities to consult with California Native American tribes before adopting or amending a general plan. In compliance SB 18’s engagement requirements, the city formally invited the appropriate Native American tribes to consult on the project. The city participated in a meaningful conservation with one tribe where staff explained the targeted update to the code. Other tribes either opted-out of the consultation or did not respond to the city’s invitation to consult.

Correspondence
This item was advertised as a public hearing with a legal advertisement in the Inland Valley Daily Bulletin newspaper on October 9, 2026. As a citywide update, individual noticing is not required.

FISCAL IMPACT:

Staff does not anticipate fiscal impacts as a result of approving the General Plan Amendment since the amendment is simply to clarify which zones implement the general plan land use designations.

COUNCIL MISSION / VISION / VALUE(S) ADDRESSED:

These amendments support the Council’s value of relentless pursuit of improvement by clarifying

Page 8111222 ends

Page 5 of 5 ends

which zones implement the General Plan land use designations. They also support the value of excellent quality of life by preserving the intent of the adopted general plan and zoning map.

ATTACHMENTS:

Attachment 1 – Map of Subject General Plan Designations Attachment 2 – Planning Commission Resolution and Draft Meeting Minutes Attachment 3 – Resolution No. (2026-104)

Page 8111333 ends

land
Rancho
Cucamonga
Subject General Plan Land Use Designations
Sources: Esri, TomTom, Garmin, FAO, NOAA, USGS, ©
OpenStreetMap contributors, and the GIS User
Community
N Traditional Neighborhood
N Suburban Neighborhood Very Low
N Suburban Neighborhood Low
N Suburban Neighborhood Moderate
City Boundary Sphere Of Influence Outline 0 0.5 1 2 mi
0 0.75 1.5 3 km
General Plan Place Types 1:52,001
ATTACHMENT 1

Page 8111444 ends

RESOLUTION NO. 2026-034

A RESOLUTION OF THE PLANNING COMMISSION OF THE CITY OF

RANCHO CUCAMONGA, CALIFORNIA, RECOMMENDING THAT THE

CITY COUNCIL APPROVE A GENERAL PLAN AMENDMENT TO AMEND

THE TRADITIONAL NEIGHBORHOOD, SUBURBAN VERY LOW,

SUBURBAN LOW AND SUBURBAN MODERATE LAND USE

DESIGNATIONS TO INCLUDE THE IMPLEMENTING ZONES FOR EACH

DESIGNATION CONSISTENT WITH THE ADOPTED ZONING MAP, AND

MAKING A FINDING OF EXEMPTION FROM THE CALIFORNIA
ENVIRONMENTAL QUALITY ACT UNDER SECTION 15061(6)(3) OF

THE CEQA GUIDELINES
A. RECITALS
WHEREAS, The City of Rancho Cucamonga has prepared General Plan Amendment DRC2026-00232 to amend the Traditional Neighborhood, Suburban Very Low, Suburban Low and Suburban Moderate Land Use Designations to include the implementing zones for each designation consistent with the adopted zoning map described in the title of this Resolution. Hereinafter in this Resolution, the subject General Plan Amendment is referred to as "the application"; WHEREAS, in October 2019, the Governor signed Senate Bill 330, the Skinner Housing Crisis Act of 2019 (SB330) which amended Section 65589.50)(4) of the Housing Accountability Act to state "a proposed housing development project is not inconsistent with the applicable zoning standards and criteria, and shall not require a rezoning, if the housing development project is consistent with the objective general plan standards and criteria but the zoning for the project site is inconsistent with the general plan"; and WHEREAS, on September 23, 2026, the Planning Commission of the City of Rancho Cucamonga conducted a duly noticed public hearing on the application and concluded the hearing on that date; and
WHEREAS, all legal prerequisites prior to the adoption of this Resolution have occurred.

B. RESOLUTION

NOW, THEREFORE, THE PLANNING COMMISSION OF THE CITY OF RANCHO CUCAMONGA, HEREBY RESOLVES:

1. Procedural Findings. The Planning Commission hereby finds that all of the facts set forth in the Recitals, Part A, of this Resolution are true and correct.

2. Project Findings. Based upon the substantial evidence presented to the Planning Commission during the public hearing on September 23, 2026, including written and oral staff reports, together with public testimony, the Planning Commission hereby finds as follows:
a. There are currently inconsistences between the density in the General Plan land use designations and the implementing zones.
b. The application would amend the text in the Traditional Neighborhood, Suburban Very Low, Suburban Low and Suburban Moderate Land Use Designations to include the implementing zones for each designation consistent with the adopted zoning map.

3. Findings for Approval of General Plan Amendment. Based upon the substantial evidence presented to the Planning Commission during the public hearing, and upon the specific findings ATTACHMENT 2 Page 81115

Page 81116 ends

HPC/PC Draft Minutes

Page 1 of 4 ends

Historic Preservation Commission and
Planning Commission
September 23, 2026
Draft Minutes
Rancho Cucamonga, CA 91730
6:00 p.m.

The regular joint meeting of the Planning and Historic Preservation Commission was held on September 23, 2026. The meeting was called to order by Chairman Boling at 6:00 p.m.

A. Roll Call
Planning Commissioners present: Chairman Boling, Vice Chairman Dopp, Commissioner Morales, Commissioner Diaz, and Commissioner Cooke.

Staff present: Serita Young, Assistant City Attorney; Jennifer Nakamura, Planning Director; Matt Marquez, Director of Economic Development; Tanya Spiegel, Deputy Director of Economic Development; Eddie Flores, Management Analyst; Kim Chacon, Management Analyst; Michael Armendariz, Parking Services Supervisor; Elizabeth Thornhill, Executive Assistant.

B. Public Communications
Chairman Boling opened public communications, and hearing no comments closed the public communications.

C. Consent Calendar
C1. Consideration to adopt the Regular Meeting Minutes of August 26, 2026 Motion: Moved by Commissioner Diaz; seconded by Vice Chairman Dopp to approve the minutes as presented. Motion carried unanimously, 5-0 vote.

D. Public Hearings
D1. Recommendation to City Council of a General Plan Amendment to Amend the Traditional Neighborhood, Suburban Very Low, Suburban Low and Suburban Moderate Land Use Designations to Include the Implementing Zones for Each Designation Consistent with the Adopted Zoning Map. This Item is Exempt from the California Environmental Quality Act (CEQA) under CEQA Guidelines Section 15061(b)(3). Applicant: City of Rancho Cucamonga. Record Number: DRC2026-00232.

Planning Director Nakamura provided a PowerPoint presentation (copy on file).

Commissioner Diaz clarified with staff that the intent is to align the implementing zones with the General Plan and acknowledged that the implementing zones are the regulations that must be followed.

Planning Director Nakamura confirmed.

Vice Chairman Dopp stated that the only applications that have not been deemed complete must comply with the new code. He noted that applications deemed complete prior to adoption of the ordinance would continue to be subject to the General Plan zoning designation.

Page 81117 ends

HPC/PC Draft Minutes

Page 2 of 4 ends

Planning Director Nakamura confirmed and explained that pursuant to new state law SB 330, applicants may freeze the applicable standards in effect prior to submitting their application.

Vice Chairman Dopp asked whether the Regional Housing Needs Allocation (RHNA) numbers would affect the calculations.

Planning Director Nakamura stated that they would not.

Chairman Boling opened the public hearing and with no comments from the public, closed the public hearing. He then asked for Commissioner comments and discussion.

Commissioner Morales stated that the updates would provide clarity for everyone, help the City meet its RHNA goals, facilitate collaboration with developers, and support the City’s continued growth as a premier city.

Commissioner Diaz thanked staff for addressing this matter so quickly. She noted that the City is ahead of schedule on this particular ordinance and highlighted that the updates are being made to comply with State law.

Commissioner Cooke thanked staff for the Joint Workshop with the City Council in July, which provided clarity on this issue.

Motion: Moved by Vice Chairman Dopp; seconded by Commissioner Cooke to adopt Resolution 2026-034 recommending that the City Council approve General Plan Amendment DRC2026-00232. Motion carried unanimously, 5-0.

E. General Business
E1. Consideration to Receive and File the Economic Development Strategy Annual Progress Report for 2025-2026.

Director of Economic Development Marquez, along with his team, provided a PowerPoint presentation (copy on file).

Commissioner Morales asked where the marketing analysis was obtained.

Director Marquez responded that The Retail Coach is a consulting service that assists with recruiting new retail businesses throughout the city.

Commissioner Diaz referred to the slide regarding the Japanese noodle house, which indicated that the restaurant draws customers from other communities, and asked how the data was obtained.

Director Marquez explained that the data came from Placer.ai, which uses mobile device location data to determine where visitors are coming from.

Commissioner Diaz discussed Chaffey College and the Emprendedor@s Program and stated that she would like to see the partnership strengthened. She noted that the City is fortunate to have Chaffey College and described it as a jewel on the hill. She said that developing a stronger partnership with the college would support the City’s “Live, Work, Play” vision. She asked how the City could help Chaffey College students develop the skills needed to obtain employment with local businesses, allowing them to live, work and spend money locally.

Director Marquez stated that staff have discussed this with Chaffey College representatives, who are excited to explore opportunities to strengthen the partnership. He added that a follow-up discussion is being planned.

Page 81118 ends

HPC/PC Draft Minutes

Page 3 of 4 ends

Vice Chairman Dopp asked whether there was any information regarding what is being sought through the Request for Qualifications (RFQ) for the three parcels at the Epicenter.

Director Marquez explained that the City is seeking parties interested in implementing the vision for the Epicenter, which includes creating a more vibrant and lively district throughout the year. He noted that potential uses include entertainment, restaurants, and retail and stated that there are several interested parties.

Vice Chairman Dopp, referring to Vallarta Market, asked whether there has been an increase in demand and interest in ethnic markets given Vallarta Market’s success.

Director Marquez confirmed that there has been increased interest and stated that he has had conversations with representatives of ethnic markets. He noted that there is a high level of interest, but the biggest challenge is finding suitable locations for these businesses.

Vice Chairman Dopp asked whether they have established any partnerships or networking opportunities with four-year universities in the area.

Director Marquez stated that staff recently spoke with representatives of UC Riverside and have begun working with the Advanced Immigrated Manufacturing Hub to explore opportunities and develop a pipeline for implementing future programs.

Commissioner Cooke thanked staff for the informative presentation and for their efforts to advance the City’s business development initiatives.

Chairman Boling stated that the purpose of the City and its role as an organization is to maintain and grow the economic value of the community. He explained that this is accomplished through the provision of municipal services and noted that the report demonstrates the Economic Development team’s contributions through a balanced approach to business attraction and retention. He pointed out that the addition of new businesses and the City’s low vacancy rate indicate that new businesses are locating in the community quickly. He stated that everyone here works toward economic development and serves being ambassadors for this organization and the community. He asked how we could better serve them in their roles as ambassadors for economic development.

Director Marquez responded that he was not sure there was anything more they could do, as they already do an incredible job. He stated that what his staff strives to achieve is “Certainly, Simplicity and Speed”.

He encouraged everyone to continue striving toward that goal, noting that while it is a simple concept, it is significant.

With no further comments, Chairman Boling announced that the Commission would receive and file the report.

F. Director Announcements
Planning Director Nakamura made two announcements:
1) The City has released a new series called “Know Your RC”, which consists of short videos designed to help the community better understand how local government works. The videos are available on the City’s social media platforms and website.
2) The next HPC/PC meeting will be held on October 14th.

G. Commission Announcements
Commissioner Morales expressed his appreciation for the City’s efforts to collaborate with the community through the “Know Your RC” series to better inform residents. He stated that the series will be very helpful to the community.

Page 81119 ends

HPC/PC Draft Minutes

Page 4 of 4 ends

H. Adjournment
Motion: Commissioner Diaz moved to adjourn the meeting. Hearing no objections, Chairman Boling adjourned the meeting at 6:58 p.m.

Respectfully submitted,
Elizabeth Thornhill, Executive Assistant
Planning Department
Approved:

Page 822200 ends

RESOLUTION NO. 2026-XXX

A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF RANCHO

CUCAMONGA, CALIFORNIA, TO APPROVE A GENERAL PLAN

AMENDMENT TO AMEND THE TRADITIONAL NEIGHBORHOOD,

SUBURBAN VERY LOW, SUBURBAN LOW AND SUBURBAN

MODERATE LAND USE DESIGNATIONS TO INCLUDE THE

IMPLEMENTING ZONES FOR EACH DESIGNATION CONSISTENT WITH

THE ADOPTED ZONING MAP, AND MAKING A FINDING OF

EXEMPTION FROM THE CALIFORNIA ENVIRONMENTAL QUALITY
ACT UNDER SECTION 15061(B)(3) OF THE CEQA GUIDELINES
A. RECITALS
WHEREAS, The City of Rancho Cucamonga has prepared General Plan Amendment DRC2026-00232 to amend the Traditional Neighborhood, Suburban Very Low, Suburban Low and Suburban Moderate Land Use Designations to include the implementing zones for each designation consistent with the adopted zoning map described in the title of this Resolution. Hereinafter in this Resolution, the subject General Plan Amendment is referred to as “the amendment”; WHEREAS, in October 2019, the Governor signed Senate Bill 330, the Skinner Housing Crisis Act of 2019 (SB330) which amended Section 65589.5(j)(4) of the Housing Accountability Act to state “a proposed housing development project is not inconsistent with the applicable zoning standards and criteria, and shall not require a rezoning, if the housing development project is consistent with the objective general plan standards and criteria but the zoning for the project site is inconsistent with the general plan”; and WHEREAS, on September 28, 2026, the Planning Commission of the City of Rancho Cucamonga conducted a duly noticed public hearing on the application and concluded the hearing on that date and unanimously recommended approval to the City Council of the amendment through the adoption of Planning Commission Resolution 2026-034; and
WHEREAS, on October 21, 2026, the City Council of the City of Rancho Cucamonga conducted a duly noticed public hearing on the application and concluded the hearing on that date and unanimously recommended approval to the City Council of the amendment; and WHEREAS, all legal prerequisites prior to the adoption of this Resolution have occurred.

NOW, THEREFORE, THE CITY COUNCIL OF THE CITY OF RANCHO CUCAMONGA, HEREBY RESOLVES:

1. Procedural Findings. The City Council hereby finds that all of the facts set forth in the Recitals, Part A, of this Resolution are true and correct.

2. Project Findings. Based upon the substantial evidence presented to the City Council during the public hearing on October 21, 2026, including written and oral staff reports, together with public testimony, the City Council hereby finds as follows:
a. There are currently inconsistences between the density in the General Plan land use designations and the implementing zones.
b. The application would amend the text in the Traditional Neighborhood, Suburban Very Low, Suburban Low and Suburban Moderate Land Use Designations to include the implementing zones for each designation consistent with the adopted zoning ATTACHMENT 3 Page 8222111
Resolution No. 2026-XXX – Page 2 of 3
map.

3. Findings for Approval of General Plan Amendment. Based upon the substantial evidence presented to the City Council during the public hearing, and upon the specific findings of facts set forth in Paragraphs 1 and 2 above stated, the City Council finds and determines the following with respect to the application pursuant to Rancho Cucamonga Municipal Code (RCMC) Section 17.22.070.E:
a. The city council may approve a general plan amendment upon finding that the amendment is in the public interest and that the general plan as amended will remain internally consistent.

The General Plan Amendment will amend the Traditional Neighborhood, Suburban Very Low, Suburban Low and Suburban Moderate Land Use Designations to include the implementing zones for each designation consistent with the adopted zoning map. This amendment clarifies the General Plan text to list the implementing zones of the above listed land use designations and does not change any parcel-level land use designations.

Therefore, the General Plan as amended will remain internally consistent.

4. California Environmental Quality Act Findings. Planning Department staff determined that the proposed project is exempt from the requirements of the California Environmental Quality Act (CEQA) and the City’s CEQA Guidelines pursuant to CEQA Guidelines Section 15061(b)(3) because the text clarifies which zones implement each land use designation and does not make any change to individual parcels. The City Council has reviewed the administrative record concerning the proposed project and Planning Department staff’s determination of exemption, and, based on its own independent judgement, concurs in the staff determination of exemption.

5. Recommendation of Approval of Application. Based upon the findings and conclusions set forth in paragraphs 1, 2, 3, and 4 above, the City Council approves the amendment attached hereto as Exhibit A and incorporated herein by this reference.

6. Certification. The Secretary to this Commission shall certify to the adoption of this Resolution.

PASSED, APPROVED, AND ADOPTED This 21st Day of October 2026.

PLANNING COMMISSION OF THE CITY OF RANCHO CUCAMONGA

Page 8222222 ends

Resolution No. 2026-XXX – Page 3 of 3
EXHIBIT A:

General Plan Amendment

Page 8222333 ends

67 VOLUME 2 • CHAPTER 1: LAND USE & COMMUNITY CHARACTER

TRADITIONAL NEIGHBORHOOD
Purpose & Intent
To maintain and promote single family housing in neighborhoods with traditional pedestrian-oriented neighborhood development patterns, including in new master planned neighborhoods.

Land Use & Development Intensity
Uses are primarily low and low-medium density residential. Context-sensitive neighborhood commercial uses are also allowed in certain locations, such as neighborhood edges and at designated nodes within new master planned neighborhoods (see Chapter 2 Focus Areas for additional details on the Etiwanda Heights Town Center).

Civic uses, such as fire stations, schools, and churches may be allowed provided such uses are oriented toward serving the needs of neighborhoods. (Note: The land use designation is implemented by the VL, L, L-ESP, LM, LM-ESP, NE2 Zones)
+ Residential Density: Max. 8 units/acre
+ Non-Residential Intensity: Max. 0.4 FAR
Built Form & Character
Neighborhoods are traditional in character. Buildings are set back from the sidewalk with moderately sized front yards and welcoming entries scaled and oriented to pedestrians. Commercial groundfloors may be set nearer to the sidewalk to support such activities as outdoor dining and provide clear views into shopfronts. Buildings are up to 2.5 stories in height with varied massing and a wide range of architectural styles compatible with the existing character of adjacent houses. Multifamily and mixed-use buildings are compatible in scale, form, and character with nearby houses.

Lots, blocks, and streets conform to the natural terrain, minimizing grading and preserving natural landforms. Streetscapes provide safe and comfortable environments for pedestrians and bicyclists with continuous sidewalks uninterrupted by wide driveways, large shade trees and native landscaping.

Access & Connectivity
Streets are highly interconnected with a grid network pattern and humanscale blocks. Pedestrian and equestrian connections to trail systems are provided from neighborhood streets. Buffered or protected bike lanes may be added to collector streets along with street trees and other landscape enhancements that define the public spaces and provide shade canopy.

Parks & Open Space
Open space is in the form of neighborhood parks for active and passive recreational use for all ages and other small open spaces such as plazas and squares at mixed-use and commercial areas.

Lots conform to natural terrain
Traditional Neighborhood
“House-form” town houses

ALTA LOMA

RED HILL

CUCAMONGA

CENTRAL

SOUTH SOUTHEAST

EASTSIDE

ETIWANDA

CENTRAL
NORTH
This page is not part of the Amendment

Page 8222444 ends

68 PLANRC 2040 • CITY OF RANCHO CUCAMONGA 69
VOLUME 2 • CHAPTER 1: LAND USE & COMMUNITY CHARACTER

SUBURBAN NEIGHBORHOOD - VERY
LOW
Purpose & Intent
To maintain and enhance the character of established suburban neighborhoods of single family detached housing.

Land Use & Development Intensity
Uses are primarily low density residential. Civic uses, such as fire stations, schools, and churches are allowed provided such uses are oriented toward serving the needs of the neighborhoods. (Note: The land use designation is implemented by the VL, L-ESP, L Zones)
+ Residential Density: Max. 6 units/acre
+ Non-Residential Intensity: NA
Built Form & Character
Neighborhoods are suburban in character. Building setbacks are deep with large front yards defining the outdoor spaces of the public realm with landscaped edges.

Remodels of existing homes and accessory dwelling units (ADUs) reinforce the suburban character of the neighborhood in size, scale and form.

Building heights are typically 1 to 2 stories and can be up to 2.5 stories.

Streetscapes provide safe and comfortable environments for bicyclists and pedestrians with continuous sidewalks, large shade trees and native landscaping.

Access & Connectivity
Street networks provide relatively low vehicular interconnectivity and are generally internalized. Nonetheless, pedestrian and bike connections are provided to major streets, trails, and neighborhood-serving uses and amenities.

Parks & Open Space
Open space is in the form of neighborhood parks for active and passive recreational use for all ages. On-site neighborhood amenities are required for large neighborhood projects.

Suburban Neighborhood - Very Low
Suburban neighborhood with a range
of housing types and styles
Common open space fronting
bungalows

SUBURBAN NEIGHBORHOOD - LOW
Purpose & Intent
To maintain and enhance the character of established suburban neighborhoods of single family detached and attached housing, such as duplexes, triplexes, quadplexes, and townhomes, in house-form buildings.

Land Use & Development Intensity
Uses are primarily low and low-medium density residential. Civic uses, such as fire stations, schools, and churches are allowed provided such uses are oriented toward serving the needs of the neighborhoods. (Note: The land use designation is implemented by the LM-ESP, LM-TV, LM-ESP, M-TV1, M, M-ESP, MH-TV Zones)
+ Residential Density: Max. 14 units/acre
+ Non-Residential Intensity: NA
Built Form & Character
Neighborhoods are suburban in character. Building setbacks are short with the facades forming the outdoor spaces of the public realm. Neighborhood commercial buildings are set near or at the sidewalk to support such activities as outdoor dining and provide clear views into shopfronts.

Remodels of existing homes and accessory dwelling units (ADUs) reinforce the suburban character of the neighborhood in size, scale and form.

Neighborhood-serving commercial buildings are compatible in size, scale and character with existing houses in the neighborhood. Building heights are up to 3 stories.

Streetscapes provide safe and comfortable environments for bicyclists and pedestrians with continuous sidewalks, large shade trees and native landscaping.

Parks & Open Space
Open space is in the form of neighborhood parks for active and passive recreational use for all ages and other small open spaces such as plazas and squares at commercial areas. On-site neighborhood amenities are required for large neighborhood projects.

Suburban Neighborhood - Low
Attached single family homes in houseform buildings
Courtyards provide open space for
attached homes

ALTA LOMA

RED HILL

CUCAMONGA

CENTRAL

SOUTH SOUTHEAST

EASTSIDE

ETIWANDA

CENTRAL
NORTH

ALTA LOMA

RED HILL

CUCAMONGA

CENTRAL

SOUTH SOUTHEAST

EASTSIDE

ETIWANDA

CENTRAL
NORTH

Page 82225 ends

Rancho Cucamonga City CouncilOctober 21, 2026

Rancho Cucamonga City Council
October 21, 2026