AGREEMENT FOR PROJECT SERVICES
BETWEEN THE CITY OF REDONDO BEACH
AND NETFILE, INC.
THIS AGREEMENT FOR PROJECT SERVICES (this "Agreement") is made between the City of Redondo Beach, a chartered municipal corporation ("City") and Netfile, Inc., a California corporation ("Contractor" or "Consultant").
The parties hereby agree as follows:
A. Description of Project or Scope of Services. The project description or scope of services to be provided by Contractor, and any corresponding responsibilities of City or services required to be performed by City are set forth in Exhibit "A".
B. Term and Time of Completion. Contractor shall commence and complete the project or services described in Exhibit "A" in accordance with the schedule set forth in Exhibit "B".
C. Compensation. City agrees to pay Contractor for work performed in accordance with Exhibit "C".
Insurance. Contractor shall adhere to the insurance requirements outlined in Exhibit "D", unless otherwise waived by the City's Risk Manager. *****
GENERAL PROVISIONS
Independent Contractor. Contractor acknowledges, represents and warrants that Contractor is not a regular or temporary employee, officer, agent, joint venturer or partner of the City, but rather an independent contractor. This Agreement shall not be construed as a contract of employment. Contractor shall have no rights to any benefits which accrue to City employees unless otherwise expressly provided in this Agreement. Due to the independent contractor relationship created by this Agreement, the City shall not withhold state or federal income taxes, the reporting of which shall be Contractor's sole responsibility.
2. Brokers. Contractor acknowledges, represents and warrants that Contractor has not hired, retained or agreed to pay any entity or person any fee, commission, percentage, gift, or any other consideration, contingent upon or resulting from the award or making of this Agreement.
City Property. All plans, drawings, reports, calculations, data, specifications, videos, graphics or other materials prepared for or obtained pursuant to this Agreement shall upon request be delivered to the City within a reasonable time, 1 and the rights thereto shall be deemed assigned to the City. If applicable, Contractor shall prepare check prints upon request. Said plans, drawings, reports, calculations, data, specifications, videos, graphics or other materials shall be specific for the project herein and shall not be used by the City for any other project without Contractor's consent. Notwithstanding the foregoing, Contractor shall not be obligated to assign any proprietary software or data developed by or at the direction of Contractor for Contractor's own use; provided, however, that Contractor shall, pursuant to Paragraph 14 below, indemnify, defend and hold the City harmless from and against any discovery or Public Records Act request seeking the disclosure of any such proprietary software or data.
4. Inspection. If the services set forth in Exhibit "A" shall be performed on City or other public property, the City shall have the right to inspect such work without notice. If such services shall not be performed on City or other public property, the City shall have the right to inspect such work upon reasonable notice.
Inspections by the City shall not relieve or minimize the responsibility of Contractor to conduct any inspections Contractor has agreed to perform pursuant to the terms of this Agreement. Contractor shall be solely liable for said inspections performed by Contractor. Contractor shall certify in writing to the City as to the completeness and accuracy of each inspection required to be conducted by Contractor hereunder.
5. Services. The project or services set forth in Exhibit "A" shall be performed to the full satisfaction and approval of the City. In the event that the project or services set forth in Exhibit "A" are itemized by price in Exhibit "C" , the City in its sole discretion may, upon notice to Contractor, delete certain items or services set forth in Exhibit "A" , in which case there shall be a corresponding reduction in the amount of compensation paid to Contractor. City shall furnish Contractor, to the extent available, with any City standards, details, specifications and regulations applicable to the Project and necessary for the performance of Contractor's services hereunder. Notwithstanding the foregoing, any and all additional data necessary for design shall be the responsibility of Contractor.
6. Records. Contractor, including any of its subcontractors, shall maintain full and complete documents and records, including accounting records, employee time sheets, work papers, and correspondence pertaining to the project or services set forth in Exhibit "A". Contractor, including any of its subcontractors, shall make such documents and records available for City review or audit upon request and reasonable notice, and shall keep such documents and records, for at least four (4) years after Contractor's completion of performance of this Agreement. Copies of all pertinent reports and correspondence shall be furnished to the City for its files.
2 Changes and Extra Work. All changes and/or extra work under this Agreement shall be provided for by a subsequent written amendment executed by City and Contractor.
Additional Assistance. If this Agreement requires Contractor to prepare plans and specifications, Contractor shall provide assistance as necessary to resolve any questions regarding such plans and specifications that may arise during the period of advertising for bids, and Contractor shall issue any necessary addenda to the plans and specifications as requested. In the event Contractor is of the opinion that City's requests for addenda and assistance is outside the scope of normal services, the parties shall proceed in accordance with the changes and extra work provisions of this Agreement.
Professional Ability. Contractor acknowledges, represents and warrants that Contractor is skilled and able to competently provide the services hereunder, and possesses all professional licenses, certifications, and approvals necessary to engage in its occupation. City has relied upon the professional ability and training of Contractor as a material inducement to enter into this Agreement.
Contractor shall perform in accordance with generally accepted professional practices and standards of Contractor's profession.
10. Business License. Contractor shall obtain a Redondo Beach Business License before performing any services required under this Agreement. The failure to so obtain such license shall be a material breach of this Agreement and grounds for immediate termination by City; provided, however, that City may waive the business license requirement in writing under unusual circumstances without necessitating any modification of this Agreement to reflect such waiver.
11. Termination Without Default. Notwithstanding any provision herein to the contrary, the City may, in its sole and absolute discretion and without cause, terminate this Agreement at any time prior to completion by Contractor of the project or services hereunder, immediately upon written notice to Contractor. In the event of any such termination, Contractor shall be compensated for: (1) all authorized work satisfactorily performed prior to the effective date of termination; and (2) necessary materials or services of others ordered by Contractor for this Agreement prior to Contractor's receipt of notice of termination, irrespective of whether such materials or services of others have actually been delivered, and further provided that Contractor is not able to cancel such orders. Compensation for Contractor in such event shall be determined by the City in accordance with the percentage of the project or services completed by Contractor; and all of Contractor's finished or unfinished work product through the time of the City's last payment shall be transferred and assigned to the City. In conjunction with any termination of this Agreement, the City may, at its own expense, make copies or extract information from any notes, sketches, computations, drawings, and specifications or other data, whether complete or not.
3 12. Termination in the Event of Default. Should Contractor fail to perform any of its obligations hereunder, within the time and in the manner provided or otherwise violate any of the terms of this Agreement, the City may immediately terminate this Agreement by giving written notice of such termination, stating the reasons for such termination. Contractor shall be compensated as provided immediately above, provided, however, there shall be deducted from such amount the amount of damages, if any, sustained by the City by virtue of Contractor's breach of this Agreement.
13. Conflict of Interest. Contractor acknowledges, represents and warrants that Contractor shall avoid all conflicts of interest (as defined under any federal, state or local statute, rule or regulation, or at common law) with respect to this Agreement. Contractor further acknowledges, represents and warrants that Contractor has no business relationship or arrangement of any kind with any City official or employee with respect to this Agreement. Contractor acknowledges that in the event that Contractor shall be found by any judicial or administrative body to have any conflict of interest (as defined above) with respect to this Agreement, all consideration received under this Agreement shall be forfeited and returned to City forthwith. This provision shall survive the termination of this Agreement for one (1) year.
14. Indemnity. To the maximum extent permitted by law, Contractor hereby agrees, at its sole cost and expense, to defend protect, indemnify, and hold harmless the City, its elected and appointed officials, officers, employees, volunteers, attorneys, and agents (collectively "Indemnitees") from and against any and all claims, including, without limitation, claims for bodily injury, death or damage to property, demands, charges, obligations, damages, causes of action, proceedings, suits, losses, stop payment notices, judgments, fines, liens, penalties, liabilities, costs and expenses of every kind and nature whatsoever, in any manner arising out of, incident to, related to, in connection with or arising from any act, failure to act, error or omission of Contractor's performance or work hereunder (including any of its officers, agents, employees, Subcontractors) or its failure to comply with any of its obligations contained in the Agreement, or its failure to comply with any current or prospective law, except for such loss or damage which was caused by the sole negligence or willful misconduct of the City. Contractor's obligation to indemnify shall not be restricted to insurance proceeds, if any, received by Contractor or Indemnitees. This indemnification obligation shall survive this Agreement and shall not be limited by any term of any insurance policy required under this Agreement.
a. Nonwaiver of Rights. Indemnitees do not and shall not waive any rights that they may possess against Contractor because the acceptance by City, or the deposit with City, of any insurance policy or certificate required pursuant to this Agreement.
4 b. Waiver of Right of Subrogation. Contractor, on behalf of itself and all parties claiming under or through it, hereby waives all rights of subrogation and contribution against the Indemnitees.
15. Insurance. Contractor shall comply with the requirements set forth in Exhibit "D." Insurance requirements that are waived by the City's Risk Manager do not require amendments or revisions to this Agreement.
16. Non-Liability of Officials and Employees of the City. No official or employee of the City shall be personally liable for any default or liability under this Agreement.
17. Compliance with Laws. Contractor shall comply with all federal, state and local laws, statutes, ordinances, rules and regulations, and the orders and decrees of any courts or administrative bodies or tribunals, with respect to this Agreement, including without limitation all environmental laws, employment laws, and non- discrimination laws.
18. Non-Discrimination. Contractor shall comply with all applicable federal, state, and local laws, ordinances, regulations, and codes prohibiting discrimination, including but not limited to the Civil Rights Act of 1964, the Americans with Disabilities Act of 1990, and the California Fair Employment and Housing Act.
Contractor shall not discriminate against any employee or applicant for employment on the basis of race, religious creed, color, national origin, ancestry, physical disability, mental disability, medical condition, genetic information, marital status, sex, gender, gender identity, gender expression, age, sexual orientation, or military and veteran status. Contractor shall ensure that the evaluation and treatment of its employees and applicants for employment are free from such discrimination and harassment. Contractor shall include a similar non-discrimination provision in all subcontracts related to the performance of this Agreement.
19. Limitations upon Subcontracting and Assignment. Contractor acknowledges that the services which Contractor shall provide under this Agreement are unique, personal services which, except as otherwise provided herein, Contractor shall not assign or sublet to any other party without the prior written approval of City, which approval may be withheld in the City's sole and absolute discretion. In the event that the City, in writing, approves any assignment or subletting of this Agreement or the retention of subcontractors by Contractor, Contractor shall provide to the City upon request copies of each and every subcontract prior to the execution thereof by Contractor and subcontractor. Any attempt by Contractor to assign any or all of its rights under this Agreement without first obtaining the City's prior written consent shall constitute a material default under this Agreement.
The sale, assignment, transfer or other disposition, on a cumulative basis, of twenty-five percent (25%) or more of the ownership interest in Contractor or 5 twenty-five percent (25%) or more the voting control of Contractor (whether Contractor is a corporation, limited liability company, partnership, joint venture or otherwise) shall constitute an assignment for purposes of this Agreement.
Further, the involvement of Contractor or its assets in any transaction or series of transactions (by way of merger, sale, acquisition, financing, transfer, leveraged buyout or otherwise), whether or not a formal assignment or hypothecation of this Agreement or Contractor's assets occurs, which reduces Contractor's assets or net worth by twenty-five percent (25%) or more shall also constitute an assignment for purposes of this Agreement.
20. Subcontractors. Contractor shall provide properly skilled professional and technical personnel to perform any approved subcontracting duties. Contractor shall not engage the services of any person or persons now employed by the City without the prior written approval of City, which approval may be withheld in the City's sole and absolute discretion.
21. Integration. This Agreement constitutes the entire agreement between the parties concerning the subject matter hereof and supersedes any previous oral or written agreement; provided, however, that correspondence or documents exchanged between Contractor and City may be used to assist in the interpretation of the exhibits to this Agreement.
22. Amendment. This Agreement may be amended or modified only by a subsequent written amendment executed by both parties.
23. Conflicting Provisions. In the event of a conflict between the terms and conditions of this Agreement and those of any exhibit or attachment hereto, this Agreement proper shall prevail. In the event of a conflict between the terms and conditions of any two or more exhibits or attachments hereto, those prepared by the City shall prevail over those prepared by Contractor.
24. Non-Exclusivity. Notwithstanding any provision herein to the contrary, the services provided by Contractor hereunder shall be non-exclusive, and City reserves the right to employ other contractors in connection with the project.
25. Exhibits. All exhibits hereto are made a part hereof and incorporated herein by reference; provided, however, that any language in Exhibit "A" which does not pertain to the project description, proposal, or scope of services (as applicable) to be provided by Contractor, or any corresponding responsibilities of City, shall be deemed extraneous to, and not a part of, this Agreement.
26. Time of Essence. Time is of the essence of this Agreement.
27. Confidentiality. To the extent permissible under law, Contractor shall keep confidential its obligations hereunder and the information acquired during the performance of the project or services hereunder.
6 28. Third Parties. Nothing herein shall be interpreted as creating any rights or benefits in any third parties. For purposes hereof, transferees or assignees as permitted under this Agreement shall not be considered "third parties."
29. Governing Law and Venue. This Agreement shall be construed in accordance with the laws of the State of California without regard to principles of conflicts of law. Venue for any litigation or other action arising hereunder shall reside exclusively in the Superior Court of the County of Los Angeles, Southwest Judicial District.
30. Attorneys' Fees. In the event either party to this Agreement brings any action to enforce or interpret this Agreement, the prevailing party in such action shall be entitled to reasonable attorneys' fees (including expert witness fees) and costs This provision shall survive the termination of this Agreement.
31. Claims. Any claim by Contractor against City hereunder shall be subject to Government Code §§ 800 et seq. The claims presentation provisions of said Act are hereby modified such that the presentation of all claims hereunder to the City shall be waived if not made within six (6) months after accrual of the cause of action.
32. Interpretation. Contractor acknowledges that it has had ample opportunity to seek legal advice with respect to the negotiation of this Agreement. This Agreement shall be interpreted as if drafted by both parties.
33. Warranty. In the event that any product shall be provided to the City as part of this Agreement, Contractor warrants as follows: Contractor possesses good title to the product and the right to transfer the product to City; the product shall be delivered to the City free from any security interest or other lien; the product meets all specifications contained herein; the product shall be free from material defects in materials and workmanship under normal use for a period of one (1) year from the date of delivery; and the product shall be fit for its intended purpose(s). Notwithstanding the foregoing, consumable and maintenance items (such as light bulbs and batteries) shall be warranted for a period of thirty (30) days from the date of delivery. All repairs during the warranty period shall be promptly performed by Contractor, at Contractor's expense, including shipping.
Contractor shall not be liable under this warranty for an amount greater than the amount set forth in Exhibit "C" hereto.
34. Severance. Any provision of this Agreement that is found invalid or unenforceable shall be deemed severed and all remaining provisions of this Agreement shall remain enforceable to the fullest extent permitted by law.
35. Authority. City warrants and represents that upon City Council approval, the Mayor of the City of Redondo Beach is duly authorized to enter into and execute 7 this Agreement on behalf of City. The party signing on behalf of Contractor warrants and represents that he or she is duly authorized to enter into and execute this Agreement on behalf of Contractor, and shall be personally liable to City if he or she is not duly authorized to enter into and execute this Agreement on behalf of Contractor.
36. Waiver. The waiver by the City of any breach of any term or provision of this Agreement shall not be construed as a waiver of any subsequent breach.
SIGNATURES FOLLOW ON NEXT PAGE
8 IN WITNESS WHEREOF, the parties have executed this Agreement in Redondo Beach, California, as of this 15th day of October, 2024.
CITY OF REDONDO BEACH, NETFILE, INC.,
a chartered municipal corporation a California corporation - Signed by:
tom Diebert, NetFile
James A. Light, Mayor Name metereynetrite
Title:
ATTEST: APPROVED:
Eleanor Manzano, City Clerk Diane Strickfaden, Risk Manager APPROVED AS TO FORM:
Michael W. Webb, City Attorney
9 EXHIBIT "A"
PROJECT DESCRIPTION AND SCOPE OF SERVICES
I. CONTRACTOR'S DUTIES
Contractor shall develop, implement, and maintain a system that provides the following functions:
A. Filers Using the Internet
1. The system will allow the User to provide Filers with a unique user ID and password for secure access to a site hosted on Contractor's web server, accessible through the User's website.
2. Filers will be able to log in, enter data, and upload electronic formats of FPPC Statement of Economic Interest Forms to Contractor's secure site.
3. Upon submission, the system will validate the filings and notify the Filer whether the submission was accepted or declined. If declined, the system will provide a reason for the rejection.
4. Once the forms have been uploaded, Contractor's secure site shall validate the submitted filing and notify the Filer that the filing was accepted or, if declined, explains why the filing was declined.
Filers will have the ability to print a copy of the forms they uploaded via Adobe Acrobat.
6. Filers will have access to previously validated electronically filed forms.
B. User Functions
1. The system will enable the User to track all Filers and electronically filed forms within a database.
The User will be able to scan hard copy filings and upload them to the waiver form. Waiver orm, able dami la, suy rect to maly redonted documents not under the Contractor's control during the redaction process.
C. EPPC Forms Uploaded to Contractor's Secure Site. The system will produce two versions of FPPC Forms in PDF format:
Non-public version: Includes all filed information, with no redactions, and not accessible by the public.
10 Public version: Blocks street addresses and bank account information, if applicable, from public view.
D. Public Access
The system will allow the public to search and view electronically filed documents, with street addresses and bank account information redacted, via the internet.
2. If a document is not available electronically, the system will notify the searcher that the document can be viewed in person at the City Clerk's office.
E. General System Functions
The system will issue unique user IDs and passwords for Filers.
The system will allow different access and security levels for User staff.
It will store and allow editing of general information about Filers.
4. The system will store and allow editing of filings by individual statement periods, where applicable.
5. The system will generate notification letters to inform Filers of upcoming filing deadlines.
6. It will track how filings were received.
The system will track filing deadlines and generate letters notifying Filers of delinquencies.
It will track delinquencies and generate letters notifying Filers of fines.
The system will enable the public to search and view the database of redacted electronic filings via the internet.
10. The public will also be able to search and view unredacted filings at a City Clerk's office kiosk, provided that the City has set up the internet- enabled kiosk.
11. The Contractor will maintain sufficient backup hardware, software, policies, and procedures to ensure that no data under its control is irretrievably lost or destroyed.
11 12. Contractor will provide unlimited support to User staff via email or phone during business hours (Monday to Friday, 9:00 am to 5:00 pm), responding to emails within the following timeframes:
a. User Staff inquiries: One business day.
b. Filer help inquiries: Three business days.
F. Performance Standards
The system's performance will be evaluated based on meeting deliverables within the City's timeline and ensuring functionality and timeliness. Contractor guarantees an uptime of 99% for its servers.
G. Limitation of Liability
The maximum liability to the User by Contractor and its licensors, if any, under this agreement, or arising out of any claim by the User related to Contractor's services, products, equipment or software for direct damages, whether in contract, tort or otherwise, shall be limited to the total amount of fees received during the last 12 months by Contractor from the User hereunder up to the time the cause of action giving rise to such liability occurred. In no event shall Contractor or its licensors be liable to the User for any indirect, incidental, consequential, or special damages related to the use of Contractor's services, products, equipment or software or Contractor's failure to perform its obligations under this agreement, even if advised of the possibility of such damages. However, the foregoing provision shall not apply in the case of Contractor's negligence or willful misconduct. Provided, however, that for any peril or exposure insured against under the insurance required pursuant to Exhibit "D", the limits of liability to User by Contractor shall not be less than the amount of applicable, valid, and collectible insurance set forth in Exhibit H. Intellectual Property
All intellectual property, including existing source code or code developed for this system, remains the sole property of Contractor. In the event Contractor ceases operations during the term of the Agreement, it will provide the User with all relevant source code for the User's system.
Cybersecurity
Contractor shall comply with the Information Security Management System ("ISMS") document, titled NetFile ISMS Document MG 01, Revision 1.4, is attached hereto as Attachment "A-1" and incorporated by reference.
1. Data Location
a. Data Storage: Contractor shall store all data in secure data centers located within the United States. Data shall not be moved outside this region without prior written approval from the City.
12 b. Compliance with Laws: Contractor shall ensure that its data centers comply with applicable data protection regulations, such as the California Consumer Privacy Act (CCPA) as described in the Privacy Policy located at https://www.netfile.com/corp/#privacy-policy
2. Deletion upon Termination or Expiration. Upon termination or expiration of this Agreement, Contractor shall, within thirty (30) days of the City's request, provide a complete and secure copy of all City data.
Furthermore, within thirty (30) days of providing the data copy, Contractor shall permanently delete all City data from its systems, ensuring that no copies, backups, or derivatives of the data remain, unless retention is required by law. Contractor shall provide written confirmation of the data deletion to the City upon completion.
13 ATTACHMENT "A-1"
ISMS DOCUMENT
See attached.
14 NetFile Information Security Management System ISMS
NetFile
Information Security Management System
(ISMS)
Information Security Management System
Document No.: MG 01 - ISMS
Revision:
Release Date: August 2022
Document Owner: NetFile - Information Technology Department NetFile: Security Confidential Uncontrolled if Printed Page 1 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
DOCUMENT APPROVAL
Name Title Signature for Initial Approval Date
05/22/2020
David CEO
Montgomery
This document describes NetFile's ISMS - Information Security Management System.
Section 1 and 2 of this document are initially approved by NetFile CEO.
Section 1 and 2 will be reviewed for updates on an annual basis.
Section 3 provides procedures, checklists, and other documentation.
The General IT control policies and procedures are reviewed and approved at a minimum of once a year.
REVISION RECORD
Ltr. Date Change Description Approved
A 4/30/2020 Initial Release MB
B 05/22/2020 Approved Final Draft DM
10/21/2020 Update AC 12 rev 1.1 and PS 3 rev DM
D 10/12/2022 Review DM
E 08/24/2022 2.16.2 System Development Life DM
Cycle - Change Management
Source Code Analysis
F 10/01/2023 Formal review MB
G 06/01/2024 Changes to Antivirus/EDR and SAN MB
Contingency Plan
09/15/2024 Changes to Contingency Plan for DM/MB
Backup Tier's approved. Rollout
10/3/2024
NetFile: Security Confidential Uncontrolled if Printed Page 2 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
TABLE OF CONTENT
1 GENERAL INFORMATION.. ..5
1.1 Background... ....5
1.2 Purpose and Objectives..... 5
1.3 Scope 5
2 NETFILE'S POLICIES AND PROCESSES .. ..6
2.1 NetFile Organization and Responsibility 6
2.2 AC - Access Control to NetFile's Systems 6
2.2.1 New User Accounts...
2.2.2 Account Changes and Terminations
2.2.3 User Account Reviews...
2.2.4 Access Enforcement....
2.2.5 Use of External Information Systems
2.2.6 Publicly Accessible Content..
2.3 AT - Security Awareness Training 9
2.4 AU - Audit and Accountability .... 9
2.5 CA - Security Assessment and Authorization .. ... 10
2.6 CM - Configuration Management. 11
2.6.1 Configuration of Systems and Applications 11
2.6.2 Least Functionality ..... 11
2.6.3 Information System Component Inventory. 12
2.6.4 Software Usage Restrictions.... 12
2.7 CP - Contingency Planning...... 12
2.7.1 Systems Backup and Restore.. 12
2.8 IA - Identification and Authentication…. ... 13
2.9 IR - Incident Response.. ... 13
2.10 MA - System Maintenance ... 14
2.11 MP - Media Protection.. .. 14
2.12 PE - Physical and Environmental Protection.. ... 14
2.13 PL - Security Planning - System Security - Risk Management Plan. .. 15
2.14 PS - Personnel Security .... .. 15
2.14.1 New Employees.. 16
2.14.2 Employee Review and Training Processes 16
2.14.3 Termination of Employment.. 16
2.15 RA - Risk Assessment............................ .. 17
2.16 SA - System and Services Acquisition. 17
2.16.1 Vendor Selection.. 18
2.16.2 System Development Life Cycle - Change Management 18
2.17 SC - System and Communications Protection .. 18
NetFile: Security Confidential Uncontrolled if Printed Page 3 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
2.18 SI - System and Information Integrity. ........... 19 NetFile: Security Confidential Uncontrolled if Printed Page 4 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
1 General Information
1.1 Background
NetFile provides hosted solutions for electronic filing. NetFile's corporate headquarters are located in Mariposa, California. NetFile specializes in the following solutions:
• Campaign Disclosure: Turn difficult paper-based campaign filing processes into a simple paperless solution.
• FPPC Form 700 Statement of Economic Interests: NetFile's turnkey paperless filing solution saves around 90% of the time involved compared to dealing with paper filings. • Campaign and Lobbyist Disclosure for Professional Treasurers: NetFile provides an online Professional Treasurer software for Campaign and Lobbyist filings.
To support the applications and infrastructure, NetFile employs information technology experts.
1.2 Purpose and Objectives
The purpose of this document is to provide an overview of NetFile's IT operations as it relates to Information Security Policy Controls.
1.3 Scope
Information security related policies and activities for NetFile include but are not limited to the following areas:
• NetFile IT corporate infrastructure and network;
NetFile backup and business resiliency solutions;
• Departmental applications and processes.
Much of the information NetFile processes and stores is public information (i.e. information that needs to be disclosed to the public by filers). However, there are segments of the business where sensitive information is processed and stored (i.e. Personal Identifiable Information - PII), business information, financial and payroll information.
NetFile: Security Confidential Uncontrolled if Printed Page 5 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
A current overview about NetFile's IT assets is available:
• GD 03 IT Assets
2 NetFile's Policies and Processes
2.1 NetFile Organization and Responsibility
NetFile assigns responsibility and accountability for corporate matters. NetFile's corporate organizational chart documents responsibilities to manage and support information technology and information security.
Review and approval of the Information Security Management System, policies and other documents is done by IT Manager / ISO. Policy and procedure documents are reviewed and approved by CEO and CTO. For any discrepancies on who is responsible to review and approve policy and procedure documents, the NetFile CEO will be the final decision maker.
Refer to GD 02 - Organizational Structure.
2.2 AC - Access Control to NetFile's Systems
Physical and logical access to NetFile's sensitive assets and facilities is managed, restricted, and monitored. An access control plan lays out responsibilities and principles.
There are 3 types of in-scope systems with active access controls:
(1) NetFile hosted systems (production environment, other instances, colocation/disaster recovery site).
(2) NetFile corporate offices
(3) Administrative access to infrastructure and security devices.
Unauthorized access, use or tampering to NetFile systems is restricted. To gain access to the network, NetFile IT Department issues network credentials to authorized NetFile staff, contractors, and 3d party members. NetFile uses Active Directory to control access to the network and various applications. Certain applications (especially cloud-based applications) may NetFile: Security Confidential Uncontrolled if Printed Page 6 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
require multi-factor authentication to gain access. Procedural documents define login requirements for other applications.
Relevant procedures:
• AC 01 - Access Control Policy and Procedure
• AC 02 - Account Management
• GD 03 - IT Assets
2.2.1 New User Accounts
Each user account must have unique username/password combinations for access to NetFile systems. User accounts are approved by respective management. For employees, managers and/or authorized supervisors are responsible for requesting new user credentials. For contractors and temps, the supervisor or manager the contractor reports to is responsible to request user credentials if necessary.
Relevant procedures:
• AC 02 - Account Management
• AC 14 - Permitted Actions without Identification or Authentication
2.2.2 Account Changes and Terminations
Account changes must maintain the least-privileges required, including granting or revoking privileges due to user change in status, transfer, or termination.
The user's manager is responsible for notifying IT to request user access changes, in the case of change of user duties, transfer and / or terminations. Request for changes need to be routed to system owners (or their designees) for approval. Account changes are tracked in a ticketing system and an accompanying document (log).
System owners are responsible for reviewing and approving account changes.
Relevant procedures:
• AC O2 - Account Management
• GD 03 - IT Assets
NetFile: Security Confidential Uncontrolled if Printed Page 7 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
2.2.3 User Account Reviews
System owners need to review account privileges at least once a year to verify appropriate levels of access. System owners are responsible to identify and change account privileges as required (e.g. user terminated, or other change in status and access requirements). Review of user accounts is documented with a combination of a ticketing system and other means (Change Management process).
Relevant procedures:
• AC 02 - Account Management
2.2.4 Access Enforcement
NetFile's systems are configured to enforce approved authorizations for logical access. Where technically feasible:
• Systems and applications must automatically enforce password strength requirements, history requirements, and reset requirements.
• Accounts must automatically lock and the event logged after a specific number of repeated invalid attempts. The account can be manually unlocked by an administrator or use of the self-service password reset function.
Relevant procedures:
• AC 03 - Access Enforcement
• AC 07 - Unsuccessful Logon Events
• AC 08 - System Use Notification
• AC 11 - Session Lock
• AC 17 - Remote Access
• AC 18 - Wireless Access
• AC 19 - Access Control for Mobile Devices
2.2.5 Use of External Information Systems
NetFile permits individuals to use external information systems to process, store, or organization-controlled information only after authorization and if there is an urgent business need.
NetFile: Security Confidential Uncontrolled if Printed Page 8 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
Relevant procedures:
• AC 20 - Use of External Information Systems
2.2.6 Publicly Accessible Content
NetFile has measures in place to ensure that publicly accessible content does not contain any sensitive or confidential information.
Relevant procedures:
AC 22 - Publicly Accessible Content
2.3 AT - Security Awareness Training
All NetFile employees are required to take security awareness training, as part of the hiring process and ongoing (at least annually) thereafter. Acceptance of security related issues is mandatory prerequisite for employment.
Security awareness training is provided in person and / or online, training participation is documented.
Relevant procedure:
• AT 01 - Security Awareness and Training Policy and Procedures • AT 02 - Security Awareness Training
• AT 03 - Role-Based Security Awareness Training
• AT 04 - Security Training Records
2.4 AU - Audit and Accountability
Auditable events are logged and reviewed by NetFile on an as needed basis for exceptions.
NetFile monitors logs for production systems for inappropriate or unusual activity. Support personnel is alerted as necessary.
In the event of an incident or a change of risk to the information system, NetFile adjusts the level of audit review and analysis.
NetFile: Security Confidential Uncontrolled if Printed Page 9 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
Relevant procedures:
• AU 01 - Audit and Accountability Policy and Procedures • AU 02 - Audit Events
• AU 03 - Content of Audit Records
• AU 04 - Audit Storage Capacity
• AU 05 - Response to Audit Processing Failure
• AU 06 - Audit Review, Analysis and Reporting
• AU 08 - Time Stamps
• AU 09 - Protection of Audit Information
• AU 11 - Audit Record Retention
• AU 12 - Audit Generation
2.5 CA - Security Assessment and Authorization
NetFile manages security controls to ensure that information and systems are secure and reflect applicable law, rules and regulations.
Compliance assessments, security assessments, penetration testing and other activities are performed based on risk-based assessments. NetFile develops a plan of remediation to correct weaknesses identified in the security assessments.
Continuous monitoring of security controls using automated support tools facilitates near real- time risk management and promotes organizational situational awareness with regard to the security state of the information system.
NetFile establishes security agreements when connecting the NetFile information system to other information systems. NetFile ensures that internal connections to the information system are authorized and secure.
Relevant procedures:
• CA 01 - Security Assessment and Authorization Policies and Procedures • CA 02 - Security Assessments
• CA 03 - System Interconnections
• CA 05 - Plan of Actions and Milestones
• CA 06 - Security Authorizations
• CA 07 - Continuous Monitoring
• CA 09 - Internal System Connections
NetFile: Security Confidential Uncontrolled if Printed Page 10 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
2.6 CM - Configuration Management
NetFile establishes a baseline configuration for in-scope systems. Changes to this configuration are applied following the Change Management process.
Relevant procedures:
• CM 01- Configuration Management Policy and Procedure
• CM 02 - Baseline Configurations
• CM 04 - Security Impact Analysis
• CM 06 - Configuration Settings
• CM 07 - Least Functionality
• CM 08 - Information System Component Inventory
• CM 10 - Software Usage Restrictions
• CM 11 - User Installed Software
• CM AA - Approved Applications,
• GD 03 - IT Assets
• SA 03 - SDLC - Change Management
2.6.1 Configuration of Systems and Applications
Network devices: Initial baseline configurations are deployed when the environment is set up based on industry best practices.
Servers and Databases: Baseline configurations for in scope servers and databases are set up by IT following industry standards.
Connectivity: NetFile configures systems and software processing and storing sensitive information following the "least functionality" principle
2.6.2 Least Functionality
NetFile configures systems and software processing and storing sensitive information following the "least functionality" principle.
NetFile: Security Confidential Uncontrolled if Printed Page 11 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
2.6.3 Information System Component Inventory
NetFile keeps an updated list of IT system components (see GD 03 - IT Assets). IT manager verifies and updates the list after changes to components and at least once a year.
2.6.4 Software Usage Restrictions
In general, software will be selected from an approved software list maintained by the Information Technology department. NetFile employees may not install software on NetFile's computing devices unless authorized by CTO and / or IT Manager.
2.7 CP - Contingency Planning
NetFile maintains basic measures that allow to recover from disaster in a time suitable for NetFile's business. NetFile has developed plans for Business Continuity and Disaster Recovery.
Information security is embedded into plans for backup, restore, business continuity and disaster recovery.
Relevant documentation:
• CP 01 - Contingency Planning Policy and Procedure
• CP 02 - Contingency Plan
• CP 03 - Contingency Training
• CP 04 - Contingency Plan Testing
2.7.1 Systems Backup and Restore
NetFile uses an enterprise grade backup product with a traditional backup schema. All backups are encrypted in-flight and at-rest. Storage Snapshots are leveraged to provide near instantaneous recoveries. Transactional database backups are leveraged to reduce recovery point objectives and provide redundancy.
Restores are performed incidentally, but at least once a year for parts of the systems.
Relevant documentation:
• CP 09 - Information System Backup
• CP 10 - Information System Recovery and Reconstitution NetFile: Security Confidential Uncontrolled if Printed Page 12 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
2.8 IA - Identification and Authentication
NetFile information systems are set up so that only authorized users are able to connect. Users need to identify and authenticate before access is granted. NetFile's information system uniquely identifies and authenticates organizational users or processes acting on behalf of non- organizational users.
NetFile ensures that authenticators have sufficient strength of mechanism for their intended use, establishes minimum and maximum lifetime restrictions and reuse conditions for authenticators, and operates administrative procedures for initial authenticator distribution.
NetFile changes default content of authenticators upon information system installation.
NetFile users are required to protect authenticators and devices are configured to sateguard authenticators. Passwords and PINs are encrypted when stored and transmitted.
Relevant documentation:
IA 01 - Identification and Authorization Policy and Procedures • IA 02 - Identification and Authorization - Organizational Users • IA 04 - Identifier Management
• IA 05 - Authenticator Management
• IA 06 - Authenticator Feedback
• IA 07 - Cryptographic Module Authentications
• IA 08 - Identification and Authorization - Non-Organizational Users
2.9 IR - Incident Response
NetFile aims to be prepared to respond to security incidents taking actions to prevent and respond properly if a security breach should occur
NetFile's system are monitored and alerts are setup to inform IT about potential problems or breaches. Incidents are reported and tracked using the Help Desk system.
If the incident cannot be addressed immediately or the incident is security related, IT Manager and / or executive management are informed and ensure that the incident is properly handled and resolved. If applicable IT coordinates response and assigns incident for resolution to qualified personnel. Once incident is resolved the ticket is updated and closed.
A formal incident response process is applied for security related incidents and described in NetFile's Incident Response Plan.
NetFile: Security Confidential Uncontrolled if Printed Page 13 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
Relevant document: IR - Incident Response
2.10 MA - System Maintenance
System components under direct control of NetFile are monitored and maintained by NetFile personnel. System components that are hosted in professional managed data center are also monitored and controlled by NetFile personnel; however environmental components are maintained by data center personnel.
Relevant documentation:
MA 01 - System Maintenance Policy and Procedures
• MA 02 - Controlled Maintenance
• MA 04 - Nonlocal Maintenance
• MA 05 - Maintenance Personnel
2.11 MP - Media Protection
NetFile prohibits the use of portable media devices (memory cards, USB sticks, other mobile storage devices) unless approved by management. If non authorized means of data storage are used, the responsibility to safeguard information falls to the data owner.
NetFile ensures that data and data media that is no longer needed or functional is disposed of in a way that sensitive information is irretrievable.
Relevant documentation:
• MP 01 - Media Protection Policy and Procedures
MP 02 - Media Access
• MP 06 - Media Sanitation
MP 07 - Media User
2.12 PE - Physical and Environmental Protection
NetFile operates physical office locations with standard environmental controls. NetFile's corporate facilities are physically and environmentally protected. NetFile's Access Control Plan lays out requirements and restrictions for access (refer to AC - Access Control).
NetFile: Security Confidential Uncontrolled if Printed Page 14 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
NetFile Offices: Physical access to non-public areas s restricted. Office typical environmental protections are in place.
Data Centers: Data Centers used by NetFile are professionally managed and operated. Data center operators are responsible for environmental protections.
Relevant documentation:
: AC- Access Control Annual SOC 2 Reports of service providers incl. data centers.
Other reports regarding security issued by service providers.
2.13 PL - Security Planning - System Security - Risk
Management Plan
NetFile improves system security based on an annually reviewed and updated system security - risk management plan which contains a prioritized action plan, and through ongoing activities based on external and internal information and ideas. IT prepares and runs this activity; the executive team decides about the risk management plan and its action plan.
Annually reviewed rules of behavior / acceptable use policy provide guidelines how NetFile systems are to be used and sets expectations and restrictions which are enforced by NetFile management.
These activities, taken together with other measures outlined in this ISMS ensure that risks to the organization are taken seriously and risks are addressed professionally considering threat levels, new technologies and best practices, and economic realities.
Relevant documentation:
• PL 02 - System Security - Risk Management Plan
PL 03 - Risk Assessment Checklist
PL 04 - Rules of Behavior
2.14 PS - Personnel Security
NetFile employs only personnel that are qualified in terms of skills and behaviors and are vetted by the organization regarding background and risks.
Relevant documentation:
NetFile: Security Confidential Uncontrolled if Printed Page 15 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
PS 01 - Personnel Security Policy and Procedures
PS 02 - Position Risk Designation
PS 03 - Personnel Screening
PS 04 - Personnel Termination
PS 05 - Personnel Transfer
• PS 06 - Access Agreements
• PS 07 - Third Party Personnel Security
• PS 08 - Personnel Sanctions
2.14.1 New Employees
The following checks need to be completed satisfactory before or when employment starts:
Reference checks (has to be completed before employment start date).
Formal background check (has to be completed no later than 4 weeks after employment start date).
Acknowledgments regarding security policies and procedures A simplified process is laid out for temps and interns.
2.14.2 Employee Review and Training Processes
Existing employees are trained in security issues and reviewed on an ongoing basis. In particular the following is done annually:
• Establish performance plan per employee
• Performance review
• Formal security training
Review of information security policies
2.14.3 Termination of Employment
In case of terminations Netfile ensures proper actions are taken based on procedures and checklists. In particular, it is ensured that employee's access to NetFile's systems and premises is revoked.
NetFile: Security Confidential Uncontrolled if Printed Page 16 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
2.15 RA - Risk Assessment
NetFile's executive risk management team reviews and updates the System Security - Risk Management Plan annually. In preparation for and as result of this annual review the following risk assessment measures are set:
Cyber Security Risk Assessment - formal external and / or internal risk assessment; Vulnerability Scanning and Penetration test - formal external and / or internal tests.
Additionally, cloud provider conducts ongoing vulnerability scans of its cloud-based infrastructure. Reports of these scans regarding the NetFile instances can be reviewed for risks to NetFile's system.
Relevant procedures:
• RA 01 - Risk Assessment Policy and Procedures
• RA 02 - Security Categorization
• RA 03 - Risk Assessment
• RA 05 - Vulnerability Scanning
• PL 02 - System Security - Risk Management Plan
• SI - System and Information Integrity
• IR - Incident Response
2.16 SA - System and Services Acquisition
NetFile considers system security when evaluating, reviewing and selecting technologies and vendors.
Refer to:
• SA 01 - System and Services Acquisition Policy and Procedures • SA 02 - Allocation of Resources
• SA 03 - SDLC - Change Management
• SA 04 - Acquisition Process
• SA 05 Information System Documentation
• SA 09 - External Information System Services
NetFile: Security Confidential Uncontrolled if Printed Page 17 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
2.16.1 Vendor Selection
NetFile classifies vendors depending on vendor's access to sensitive information. New vendors are assessed regarding their security posture before selected. Tier 1 vendors are reviewed annually regarding their security posture.
Refer to: SA 04CL - Vendor List
2.16.2 System Development Life Cycle - Change Management Change management is applied to NetFile's in scope systems and applications. Major control is a change approval before a change is implemented. An organization specific "Change Approval Matrix" is used to ensure that changes are approved by the right roles before they go into effect.
NetFile manages customer facing systems using a system development life cycle methodology that includes information security considerations in all phases of the life cycle. NetFile follows an agile development process methodology when developing its products and services. NetFile employs skilled developers whose credentials are checked before they are assigned to development tasks. In addition, NetFile deploys the following measures to ensure that code is well written and secure:
• Peer Code Review: Code is reviewed by second developer for major code submissions or major changes to code
• Automated source code analysis tools are integrated into our Continuous Integration and Delivery pipeline. Code is evaluated prior to release. • Security Design Meeting: For identified security designs a security design meeting is held where Engineering agrees on common security principles and approaches.
2.17 SC - System and Communications Protection
NetFile identifies sensitive information and takes appropriate precautions to protect sensitive information. NetFile protects systems and sensitive information against malicious and accidental breach and disclosure. NetFile monitors and controls communications at the external boundary of the system and at key internal boundaries within the system. NetFile deploys two authoritative domain name services (primary and fall back). NetFile uses a development environment that is closed off from the production system. Sensitive information is either stripped off or protected in this environment.
NetFile: Security Confidential Uncontrolled if Printed Page 18 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
File Encryption Standards:
NetFile uses encryption to protect sensitive information. NetFile follows industry best practices regarding encryption. Information is encrypted before transmission over unsecured links (i.e.
Internet). NetFile issued laptops have disc encryption enabled.
Relevant Procedure:
• SC 01 - System and Communications Protection Policy and Procedures • SC 05 - Denial of Service Protection
• SC 07 - Boundary Protection
• SC 12 - Cryptographic Key Establishment and Management • SC 13 - Cryptographic Protection
• SC 20 and SC 21 - Secure Name / Address Resolution Service • SC 22 - Architecture and Provisioning for Name / Address Resolution Service
2.18 SI - System and Information Integrity
NetFile monitors systems on an ongoing basis, is alerted about critical conditions outside of normal operations, and addresses issues that are found via monitoring. NetFile's network is secured with redundant next generation firewalls with deep packet inspection, intrusion prevention, gateway anti-virus, and network-based malware protection NetFile's in scope systems are continuously monitored for health, performance, and security related events:
• Malicious Code Protection: Malicious code protection for Server infrastructure is implemented. Windows based devices use an industry standard malware protection / anti-virus tool.
• Production Environment: Automated monitoring and alert tools are used to track performance and receive alerts about problems and suspicious activities. In case of problems IT is alerted and initiates corrective actions • Other environments: Depending on service provider alerts are sent or posted. NetFile IT monitors and reviews alerts and initiates appropriate corrective actions.
Relevant Procedure:
• SI 01 - System and Information Integrity Policy and Procedure • SI 02 - Flaw Remediation
• SI 03 - Malicious Code Protection
• SI 04 - Information Security Monitoring
• SI 05 - Security Alerts, Advisories and Directives
• SI 06 - Information Handling and Retention
NetFile: Security Confidential Uncontrolled if Printed Page 19 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx NetFile Information Security Management System ISMS
• IR 01 - Incident Response Policy and Procedure
NetFile: Security Confidential Uncontrolled if Printed Page 20 09/15/2024 MG 01 v1.4 Information Security Management System for NetFile.docx EXHIBIT " B"
TERM AND TIME FOR COMPLETION
TERM. The term of this Agreement shall commence October 15, 2024 and expire September 5, 2029, unless otherwise terminated as herein provided. 15 EXHIBIT " C"
COMPENSATION
Provided Contractor is not in default under this Agreement, Contractor shall be compensated as provided below.
AMOUNT. Contractor will be paid a total of $7,300 annually during the term of this Agreement, provided Contractor is not in default.
ll. METHOD OF PAYMENT. Contractor shall submit an annual invoice to City for the services rendered as outlined in Exhibit "A". Each invoice shall include the dates of services provided, a description of the services performed, and the amount billed.
Invoices must be adequately detailed, based on accurate records, and in a form reasonably satisfactory to City. Contractor may be required to provide back-up material upon request.
III. SCHEDULE FOR PAYMENT. City agrees to pay Contractor within forty-five (45) days of its receipt of the annual invoice; provided, however, that the services are completed to the City's full satisfaction and there is no dispute over the amount.
IV. NOTICE. Written notices to City and Consultant shall be given by registered or certified mail, postage prepaid, email, or personally served, and addressed to the following parties.
Contractor: NetFile
2707-A Aurora Road
Mariposa, CA 95338
Attention: Tom Dieburt, Vice President
Email: [email protected]
City: City of Redondo Beach
The City Clerk's Office
415 Diamond Street, Door 1
Redondo Beach, CA 90277
Attention. Eleanor Manzano, City Clerk
Email: [email protected]
All notices, including notices of address changes, provided under this Agreement are deemed received as follows: (1) on the second business day after emailing, provided that no "bounce-back" or similar message indicating non-delivery is received; (2) on the third day after mailing if sent by registered or certified mail; or (3) upon personal delivery. Changes in the respective address set forth above may be made from time to time by any party upon written notice to the other party in accordance with this section.
16 EXHIBIT "D"
INSURANCE REQUIREMENTS FOR CONTRACTORS
Without limiting Contractor's indemnification obligations under this Agreement, Contractor shall procure and maintain for the duration of the contract insurance against claims for injuries to persons or damages to property which may arise from or in connection with the performance of the work hereunder by the Contractor, its agents, representatives, or employees.
Minimum Scope of Insurance
Coverage shall be at least as broad as:
Insurance Services Office Commercial General Liability coverage (occurrence form CG 0001).
Insurance Services Office form number CA 0001 (Ed. 1/87) covering Automobile Liability, code 1 (any auto).
Workers' Compensation insurance as required by the State of California.
Employer's Liability Insurance.
Cyber Liability Insurance.
Minimum Limits of Insurance
Contractor shall maintain limits no less than:
General Liability: $2,000,000 per occurrence for bodily injury, personal injury and property damage. The general aggregate limit shall apply separately to this project.
Automobile Liability: $1,000,000 per accident for bodily injury and property damage.
Employer's Liability: $1,000,000 per accident for bodily injury or disease.
Cyber Liability Insurance: $2,000,000 per occurrence for data breaches, cyberattacks, and other cybersecurity risks
Deductibles and Self-Insured Retentions
Any deductibles or self-insured retentions must be declared to and approved by the City. At the option of the City, either: (1) the insurer shall reduce or eliminate such deductibles or self-insured retentions as respects the City, its officers, officials, employees and volunteers or (2) the Contractor shall provide a financial guarantee 17 satisfactory to the City guaranteeing payment of losses and related investigations, claim administration and defense expenses.
Other Insurance Provisions
The general liability and automobile liability policies are to contain, or be endorsed to contain, the following provisions:
Additional Insured Endorsement:
General Liability: The City, its officers, elected and appointed officials, employees, and volunteers shall be covered as insureds with respect to liability arising out of work performed by or on behalf of the Contractor. General liability coverage can be provided in the form of an endorsement to the Contractor's insurance, or as a separate owner's policy.
Automobile Liability: The City, its officers, elected and appointed officials, employees, and volunteers shall be covered as insureds with respect to liability arising out of automobiles owned, leased, hired or borrowed by or on behalf of the Contractor.
For any claims related to this project, the Contractor's insurance coverage shall be primary insurance as respects the City, its officers, elected and appointed officials, employees, and volunteers. Any insurance or self-insurance maintained by the City, its officers, officials, employees, or volunteers shall be excess of the Contractor's insurance and shall not contribute with it.
Each insurance policy required by this clause shall be endorsed to state that coverage shall not be canceled by either party, except after thirty (30) days prior written notice by certified mail, return receipt requested, has been given to the City.
Each insurance policy shall be endorsed to state that the inclusion of more than one insured shall not operate to impair the rights of one insured against another insured, and the coverages afforded shall apply as though separate policies had been issued to each insured.
Each insurance policy shall be in effect prior to awarding the contract and each insurance policy or a successor policy shall be in effect for the duration of the project.
The maintenance of proper insurance coverage is a material element of the contract and failure to maintain or renew coverage or to provide evidence of renewal may be treated by the City as a material breach of contract on the Contractor's part. 18 Acceptability of Insurers
Insurance shall be placed with insurers with a current A.M. Best's rating of no less than A:VII and which are authorized to transact insurance business in the State of California by the Department of Insurance.
Verification of Coverage
Contractor shall furnish the City with original certificates and amendatory endorsements effecting coverage required by this clause. The endorsements should be on the City authorized forms provided with the contract specifications. Standard ISO forms which shall be subject to City approval and amended to conform to the City's requirements may be acceptable in lieu of City authorized forms. All certificates and endorsements shall be received and approved by the City before the contract is awarded. The City reserves the right to require complete, certified copies of all required insurance policies, including endorsements effecting the coverage required by these specifications at any time.
Subcontractors
Contractor shall include all subcontractors as insured under its policies or shall furnish separate certificates and endorsements for each subcontractor. All coverages for subcontractors shall be subject to all of the requirements stated herein.
Risk Management
Contractor acknowledges that insurance underwriting standards and practices are subject to change, and the City reserves the right to make changes to these provisions in the reasonable discretion of its Risk Manager.
19