Vigilant - L5Q_Public Safety_1.0 Page 1 of 13 ____________ ____________ VS Initials Agency Initials
Enterprise Service Agreement (ESA)
This Vigilant Solutions Enterprise Service Agreement (the “Agreement”) is made and entered into as of this ____ Day of __________, 2022 by and between Vigilant Solutions, LLC, a Delaware company, having its principal place of business at 1152 Stealth Street, Livermore, CA 94551 (“Vigilant”) and the City of Rialto Police Departm ent, a law enforcement agency (LEA) or other governmental agency, having its principal place of business at 128 N Willow Avenue, Rialto, CA 92376 (“Agency”).
WHEREAS, Vigilant designs, develops, licenses and services advanced video analysis software technologies for law enforcement and security markets;
WHEREAS, Agency desires to license from and receive service for the Har dware and Software Products
provided by Vigilant;
THEREFORE, In consideration of the mutual covenants contained herein this Agreement, Agency and Vigilant hereby agree as follows:
I. Definitions:
“CJIS Security Policy” means the FBI CJIS Security Policy document as published by the FBI CJIS Information Securi ty
Officer.
“CLK” or “Camera License Key” means an electronic key that will permit each license of Vigilant’s CarDetector brand LPR software (one CLK per camera) to be used with other Vigilant LPR Hardware Products and Software Products.
“Criminal Justice Information Services Division” or “CJIS” means the FBI division responsible for th e collection,
warehousing, and timely dissemination of relevant CJI to the FBI and to qualified law enforcement, criminal justice, civilian, academic, employment, and licensing agencies.
“Effective Date” means the date set forth in the first paragraph of this Agreement.
“Enterprise License” means a non‐exclusive, non‐transferable license to insta ll and operate the Software Products, on any applicable media, without quantity or limitation. This Enterprise Service Agreement allows Agency to install the Software Products on an unlimited number of devices in accordance with the selected Service Package, and allow benefits of all rights granted hereunder this Agreement.
“Hardware Produc
ts” means Vigilant’s Fixed License Plate Recognition Cameras, Camera Brackets and Solar Panels.
“LPR Data” refers to LPR data collected by the Agency and available on LEARN for use by the Agency.
“Service Fee” means the amount due from Agency prior to the renewal of this Agreement as consideration for the contin
ued use of the Software Products and Service Package benefits according to Section XIII of this Agreement.
“Service Package” means the Agency designated service option which defines the extent of use of the Software Products, in conjunction with any service and/or benefits therein granted as rights hereunder this Agreement.
Vigilant - L5Q_Public Safety_1.0 Page 2 of 13 ____________ ____________ VS Initials Agency Initials
“Service Period” has the meaning set forth in Section III (A) of this Agreement.
“Software Products” means Vigilant’s Software Suite including CarDetector, LEARN, and other software applications considered by Vigilant to be applicable for the benefit of security practices.
“Technical Support Agents” means Agency’s staff person responsible for administering the Software Products and acting as Agency’s Softwar
e Products support contact.
“User License” means a non‐exclusive, non‐transferable license to install and operate the Software Products, on any applicable media, limited to a single licensee.
“Users” refers to individuals who are agents of the Agency and who are authorized by the Agency to access LEARN on behalf of Ag
ency through login credentials provided by Agency.
II. Enterprise License Grant; Duplication and Distribution Rights:
Subject to the terms and conditions of this Agreement, Vigilant hereby grants Agency an Enterprise License to the Software Products for the Term provided in Section III below. Excep t as expressly permitted by this Agreement,
Agency or any third party acting on behalf of Agency shall not copy, modify, distribute, loan, lease, resell, sublicense or otherwise transfer any right in the Software Products. Except as expressly permitted by this Agreement, no other rights are granted by im plication, estoppels or otherwise. Agency shall not eliminate, bypass, or in any way alter the copyright screen (also known as the “splash” screen) that may appear when Software Products are first started on any computer. Any use or redistribution of Software Products in a manner not explicitly stated in this Agreement, or not agreed to in writing by Vigilant, is st
rictly prohibited.
III. Term; Termination.
A. Term. The term of this Agreement is five (5) years beginning on the Effective Date unless earlier terminated as provided herein. Vigilant will provide Agency with an invoice for the Service Fee due for the subsequent twelve (12) month period (each such period, a “Service Period”) 60 days prior to the end of the the n current Service Period. This Agreement and the Enterprise License granted under this Agreement will be extended for a Service Period upon Agency’s payment of that Service Period’s Service Fee, which is due 30 days prior to the expiration of the Service Period, as the case may be. Pursuant to Section VIII bel ow, Agency may also pay in advance for more than one Service Period.
B. Agency Termination. Agency may terminate this Agreement at any time by providing thirty (30) days written notice to Vigilant and deleting all copies of the Software Products. If Agency terminates this Agreement for no reason prior to the end of any Service Period, Vigilant will not refund or prorate any license fees paid by the Agency
. If Agency’s termination notice is based on an alleged breach by Vigilant, then Vigilant shall have thirty (30) days from the date of receipt of Agency’s notice of termination, which shall set forth in detail Vigilant’s purported breach of this Agreement, to cure the alleged breach. If within thirt y (30) days of written notice of violation from Agency Vigilant has not reasonably cured the described breach of this Agreement, Vigilant shall refund to Agency an amount calculated by multiplying the total amount of Service Fees paid by Agency for the then‐current Service Period by the percentage resulting from divid ing the number of days remaining in the then‐current Service Period, by 365.
Vigilant - L5Q_Public Safety_1.0 Page 3 of 13 ____________ ____________ VS Initials Agency Initials
Agency may also terminate this agreement by not paying an invoice for a subsequent year’s Service Fee within sixty (60) days of invoice issue date.
C. Vigilant Termination. Vigilant has the right to terminate this Agreement at any time by providing thirty (30) days written notice to Agency. If Vigilant’s termination notice is based on an alleged breach by Agency, then Agency shall have thirty (30) days from the date of its receipt of Vigilant’s notice of termination, wh ich shall set forth in detail Agency’s purported breach of this Agreement, to cure the alleged breach. If within thirty (30) days of written notice of violation from Vigilant Agency has not reasonably cured the described breach of this Agreement, Agency shall immediately discontinue all use of Hardware Products and Software Products an d certify to Vigilant that it has returned or destroyed all copies of Software Products in its possession or control. If Vigilant terminates this Agreement prior to the end of a Service Period for no reason, and not based on Agency’s failure to cure the breach of a material term or condi tion of this Agreement, Vigilant shall refund to Agency an amount calculated by multiplying the total amount of Service Fees paid by Agency for the then‐current Service Period by the percentage resulting from dividing the number of days remaining in the then‐current Service Period, by 365.
IV. Warranty and Di
sclaimer; Infringement Protection; Use of Software Products Interface.
A. Warranty and Disclaimer. Vigilant warrants that the Hardware Products and Software Products will be free from all Significant Defects (as defined below) during the term of this Agreement (the “Warranty Period”). “Significant Defect” means a defect in a Hardware Product or Software Product that impedes the primary function of the Hardware Product or Software Product. This wa rranty does not include products not manufactured by Vigilant.
Vigilant will repair or replace any Hardware Product or Software Product with a Significant Defect during the Warranty Period; provided, however, if Vigilant cannot substantially correct a Significant Defect in a commercially reasonable manner, Agency may terminate this A greement and Vigilant shall refund to Agency an amount calculated by multiplying the total amount of Service Fees paid by Agency for the then‐current Service Period by the percentage resulting from dividing the number of days remaining in the then‐current Service Period, by 365. The foregoing remedies are Agency’s exclusive remedy for defe cts in the Software Product. Vigilant shall not be responsible for labor charges for removal or reinstallation of defective Hardware Products or Software Products, charges for transportation, shipping or handling loss, unless such charges are due to Vigilant's gross negligence or intentional misconduct. Vigilant disclaims all warranties, expressed or impli ed, including but not limited to implied warranties of merchantability and fitness for a particular purpose. In no event shall Vigilant be liable for any damages whatsoever arising out of the use of, or inability to use, the Hardware Products and Software Products.
B. Infringement Protection. If an infringement claim is made against Agency by a third‐party in a court of competent jurisdiction regarding Agency’s use of any of the Hardware Products or Software Products, Vigilant shall indemnify Agency, and assume all legal responsibility and costs to contest any such claim. If Agency's use of any portion of the Hardware Products or Software Products or doc umentation provided to Agency by Vigilant in
connection with the Hardware Products or Software Products is enjoined by a court of competent jurisdiction, Vigilant shall do one of the following at its option and expense within sixty (60) days of such enjoinme nt: (1) Procure for Agency the right to use such infringing portion; (2) replace such infringing portion with a non‐infringing portion providing equivalent functionality; or (3) modify the infringing portion so as to eliminate the infringement while providing equivalent functionality.
C. Use of Software Products Interface. Under certain circumstances, it may be dangerous to operate a moving vehicle while attempting to operate a touch screen or laptop screen and any of their applications. It is agreed
Vigilant - L5Q_Public Safety_1.0 Page 4 of 13 ____________ ____________ VS Initials Agency Initials
by Agency that Agency’s users will be instructed to only utilize the interface to the Software Products at times when it is safe to do so. Vigilant is not liable for any accident caused by a result of distraction such as from viewing the screen while operating a moving vehicle.
V. Soft ware Support, Warranty and Maintenance.
Agency will receive technical support by submitting a support ticket to Vigilant’s company support website or by sending an email to Vigilant’s support team. Updates, patches and bug fixes of the Software Products will be made available to Agency at no additional charge, although charges may be assesse d if the Software Product is requested to be delivered on physical media. Vigilant will provide Software Products support to Agency’s Technical Support Agents through e‐mail, fax and telephone.
VI. Camera License Keys (CLKs).
Agency is entitled to use of the Software Products during the term of this Agreement to set up and install th e
Software Products on an unlimited number of media centers within Agency’s network in accordance with selected Service Options. As Agency installs additional units of the Hardware Products or Software Products, Agency is required to obtain a Camera License Key (CLK) for each camera in stalled and considered in active service. A CLK can be obtained by Agency by going to Vigilant’s company support website and completing the online request form to Vigilant technical support staff. Within two (2) business days of Agency’s application for a CLK, Agency’s Technical Support Agent will receive the requested CLK that is set to expire on the last day of the then‐current Servi ce Period.
VII. Ownership.
A. Ownership of Software Products
. The Software Products are copyrighted by Vigilant and remain the property of Vigilant. The license granted under this Agreement is not a sale of the Software Products or any copy.
Agency owns the physical media on which the Software Products are installed, but Vigilant retains title and ownership of the Software Products and all other materials incl uded as part of the Software Products.
B. Ownership of Hardware Products. The Hardware Products provided under this agreement remain the property of Vigilant. Agency has no ownership or rights to Hardware Products provided under this Agreement during or after the Term of this Agreement.
C. Rights in Software Products. Vigilant represents and warrants that: (1) it has title to the Software and the authority to grant license to use the Software Products; (2) it has the corporate power and authority and the legal right to grant the licenses contemplated by this Agreement; and (3) it has not and will not en ter into agreements and will not take or fail to take action that causes its legal right or ability to grant such licenses to be restricted.
VIII. Data Sharing.
If Agency is a generator of LPR Data, Agency at its option may share its LPR Data with Law Enforcement Agencies who contrac
t with Vigilant. Vigilant will not share any LPR Data generated by the Agency without the permission of the Agency.
Vigilant - L5Q_Public Safety_1.0 Page 5 of 13 ____________ ____________ VS Initials Agency Initials
IX. Ownership of LPR Data.
Agency retains all rights to LPR Data generated by the Agency. Should Agency terminate agreement with Vigilant, a copy of all LPR Data generated by the Agency will be created and provided to the Agency. After the copy is created, all LPR Data generated by the Agency will be deleted from LEARN at the written r equest of an authorized representative of the Agency.
X. Data Retention.
LPR Data is governed by the Agency’s retention policy. LPR Data that reaches its expiration date will be deleted from LEARN.
XI. Account Access.
A. Eligibility. Agency shall only authorize individuals who satisfy the eligibility requirements of “Users” to access LEARN. Vigilant in its sole discretion may deny access to LEARN to any individual based on such person’s failure to satisfy such eligibility requirements. User logins are restricted to employees of the Agency. No User logins may be provide d to non‐employees of the Agency without the express written consent of Vigilant.
B. Security. Agency shall be responsible for assigning an Agency Manager who in turn will be responsible for assigning to each of Agency’s Users a username and password (one per user account). A limited number of User accounts is provided. Agency will cause the Users to maintain username and password credentials confidential and will preve nt use of such username and password credentials by any unauthorized person(s). Agency shall notify Vigilant immediately if Agency believes the password of any of its Users has, or may have, been obtained or used by any unauthorized person(s). In addition, Agency must notify Vigilant immediately if Agency becomes aware of any other brea
ch or attempted breach of the security of any of its Users’ accounts.
C. CJIS Requirements. Agency certifies that its LEARN users shall comply with the CJIS requirements outlined in Exhibit A.
XII. Service Package, Fees and Payment Provisions.
A. Service Package.
This Enterprise License Agreement is based on the following Service Package:
Service Package ‐ Fixed Camera Subscription Service:
Fixed Camera with Camera Bracket
Solar Panel
Hardware warranty for manufacturer defect
Vigilant Managed/Hosted LPR server LEARN Account
Unlimited user licensing and upgrades for the following applications:
o LEARN and CarDetector
B. Service Fee. Payment of each Service Fee entitles Agency to all rights granted under this Agreement, including without limitation, use of the Hardware Products and Software Products for the relevant Service Period, replacement of CLKs, and access to the updates and releases of the Software Products and associated equipment driver software to allow the Hardwa re Products and Software Products to remain current and enable the best possible performance. The annual Service Fee due for a particular Service Period is based on the number of current
Vigilant - L5Q_Public Safety_1.0 Page 6 of 13 ____________ ____________ VS Initials Agency Initials
Vigilant issued CLK’s at the time of Service Fee invoicing, and which will be used by Agency in the upcoming Service Period. A schedule of Annual Service Fees for years after the first year of this Agreement is shown below:
Annual Service Fee Schedule (multiplied by number of CLK’s Issued) Annual Fee Per CLK $2,250.00
Payment of the Service Fee is due thirty (30) days prior to the renewal of the then‐current Service Period. All Service Fees are exclusive of any sales, use, value‐added or other federal, state or local taxes (excluding taxes based on Vigilant’s net income) and Agency agrees to pay any such tax .
C. Advanced Service Fee Payments. Vigilant will accept advanced Service Fee payment on a case by case basis for Agencys who wish to lock in the Service Fee rates for subsequent periods at the rates currently in effect, as listed in the table above. If Agency makes advanced Service Fee payments to Vigilant, advanced payments to Vigilant w ill be applied in full to each subsequent Service Period’s Service Fees until the balance of the credits is reduced to a zero balance. System based advanced credits shall be applied to subsequent Service Fees in the amount that entitles Agency continued operation of the designated camera unit systems for the following Servi ce Period until the credits are reduced to a zero balance.
D. Price Adjustment. Vigilant has the right to increase or decrease the annual Service Fee from one Service Period to another after the 5‐Year Term; provided, however, that in no event will a Service Fee be increased by more than 4% of the prior Service Period’s Service Fees. If Vigilant intends to adjust th e Service Fee for a subsequent Service Period, it must give Agency notice of the proposed increase on or before the date that Vigilant invoices Agency for the upcoming Service Period.
XIII. Miscellaneous.
A. Limitation of Liability
. IN NO EVENT SHALL VIGILANT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL DAMAGES INCLUDING DAMAGES FOR LOSS OF USE, DATA OR PROFIT, ARISING OUT OF OR CONNECTED WITH THE USE OF THE HARDWARE PRODUCTS AND SOFTWARE PRODUCTS, WHETHER BASED ON CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY OR OTHERWISE, EVEN IF VIGILA NT HAS BEEN ADVISED OF THE POSSIBILITY OF DAMAGES. IN NO EVENT WILL VIGILANT’S LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT EXCEED THE FEES PAID BY AGENCY TO VIGILANT FOR THE HARDWARE PRODUCTS AND SOFTWARE PRODUCTS LICENSED UNDER THIS AGREEMENT.
B. Confidentiality. Agency acknowledges that Hardware Products and Software Products contain valuable and proprietary information of Vigilant and Agency will not disassemble, decompile or reverse engineer any Hardware Products or Software Products to gain access to confidential information of Vigilant.
C. Assignment
. Neither Vigilant nor Agency is permitted to assign this Agreement without the prior written consent of the other party. Any attempted assignment without written consent is void.
D. Amendment; Choice of Law
. No amendment or modification of this Agreement shall be effective unless in writing and signed by authorized representatives of the parties. This Agreement shall be governed by the laws of the state of California without regard to its conflicts of law.
Vigilant - L5Q_Public Safety_1.0 Page 7 of 13 ____________ ____________ VS Initials Agency Initials
E. Complete Agreement. This Agreement constitutes the final and complete agreement between the parties with respect to the subject matter hereof, and supersedes any prior or contemporaneous agreements, written or oral, with respect to such subject matter.
F. Relationship. The relationship created hereby is that of contractor and Agency and of licensor and Agency. Nothing herein shall be construed to create a partnership, joint venture, or agency relationship between the parties hereto. Neither party shall have any authority to enter into agreements of any kind on behalf of the other an d shall have no power or authority to bind or obligate the other in any manner to any third party. The employees or agents of one party shall not be deemed or construed to be the employees or agents of the other party for any purpose whatsoever. Each party hereto represents that it is acting on its own behalf and is not acting as an agent for or on behalf of any thir
d party.
G. No Rights in Third Parties
. This agreement is entered into for the sole benefit of Vigilant and Agency and their permitted successors, executors, representatives, administrators and assigns. Nothing in this Agreement shall be construed as giving any benefits, rights, remedies or claims to any other person, firm, corporation or other entity, including, without limitation, the general pu blic or any member thereof, or to authorize anyone not a party to this Agreement to maintain a suit for personal injuries, property damage, or any other relief in law or equity in connection with this Agreement.
H. Construction
. The headings used in this Agreement are for convenience and ease of reference only, and do not define, limit, augment, or describe the scope, content or intent of this Agreement. Any term referencing time, days or period for performance shall be deemed calendar days and not business days, unless otherwise expressly pro
vided herein.
I. Severability. If any provision of this Agreement shall for any reason be held to be invalid, illegal, unenforceable, or in conflict with any law of a federal, state, or local government having jurisdiction over this Agreement, such provision shall be construed so as to make it enforceable to the greatest extent perm itted, such provision shall remain in effect to the greatest extent permitted and the remaining provisions of this Agreement shall remain in full force and effect.
J. Federal Government.
Any use, copy or disclosure of Software Products by the U.S. Government is subject to restrictions as set forth in this Agreement and as provided by DFARS 227.7202‐1(a) and 227.7202‐3(a) (1995), DFARS 252.227‐7013(c)(1)(ii) (Oct 1988), FAR 12.212(a)(1995), FAR 52.227‐19, or FAR 52.227 (ALT III), as applicable.
K. Righ
t to Audit. Agency, upon thirty (30) days advanced written request to Vigilant, shall have the right to investigate, examine, and audit any and all necessary non‐financial books, papers, documents, records and personnel that pertain to this Agreement and any other Sub Agreements.
L. Notices; Authorized Representatives; Technical Support Agents. All notices, requests, demands, or other communications required or permitted to be given hereunder must be in writing and must be addressed to the parties at their respective addresses set forth below and shall be deemed to have been duly given when (a) delivered in person; (b) sent by facsimile trans mission indicating receipt at the facsimile number where sent; (c) one (1) business day after being deposited with a reputable overnight air courier service; or (d) three (3) business days after being deposited with the United States Postal Service, for delivery by certified or registered mail, postage pre‐paid
Vigilant - L5Q_Public Safety_1.0 Page 8 of 13 ____________ ____________ VS Initials Agency Initials
and return receipt requested. All notices and communications regarding default or termination of this Agreement shall be delivered by hand or sent by certified mail, postage pre‐paid and return receipt requested. Either party may from time to time change the notice address set forth below by delivering 30 days advance notice to th e other party in accordance with this section setting forth the new address and the date on which it will become effective.
Vigilant Solutions, LLC
Attn: Sales Administration
1152 Stealth Street
Livermore, CA 94551
Agency: City of Rialto Police Department
Attn: Support Services Lieutenant
Address: 128 N Willow Avenue
Rialto, CA 92376
M. Authorized Representatives; Technical Support Agents. Agency’s Authorized Representative is responsible for administering this Agreement and Agency’s Technical Support Agents are responsible for administering the Hardware Products and Software Products and acting as Agency’s Hardware Products and Software Products support contact. Either party may from time to time change its Authorized Representative, and Agency may from time to time cha nge its Technical Support Agents, in each case, by delivering 30 days advance notice to the other party in accordance with the notice provisions of this Agreement.
Vigilant - L5Q_Public Safety_1.0 Page 9 of 13 IN WITNESS WHEREOF, the parties have executed the Agreement as of the Effective Date.
Manufacturer: Vigilant Solutions, LLC
Authorized Agent: Sean Heieck
Title: West Area Sales Manager
Date: ____________________________________________________
Signature: ____________________________________________________
Agency/City: CITY OF RIALTO, a municipal corporation
Authorized Agent: Marcus Fuller, City Manager
Date: ____________________________________________________
Signatur
e: ____________________________________________________
ATTEST:
By: Barbara A. McGee, City Clerk
Signature: ____________________________________________________
APPROVED AS TO FORM:
Burke, Williams & Sorensen, LLP
By: Eric S. Vail, City Attorney
Signature: ____________________________________________________
Vigilant - L5Q_Public Safety_1.0 Page 10 of 13
Exhibit A: CJIS Requirements
Vigilant and the Agency agree on the importance of data security, integrity and system availability and that these security objectives will only be achieved through shared responsibility. Vigilant and the Agency agree they will more likely be successful with information security by use of the Vigilant supplied technical con trols and client Agency use of those controls; in conjunction with agency and personnel policies to protect the systems, data and privacy.
Vigilant and the Agency agree that Agency owned and FBI‐CJIS supplied data in Vigilant systems does not meet the definition of FBI‐CJIS provided Criminal Justice Inf ormation (CJI). Regardless, Vigilant agrees to treat the Agency‐ supplied information in Vigilant systems as CJI. Vigilant will strive to meet those technical and administrative controls; ensuring the tools are in place for the proper protection of systems, information and privacy of individuals to the greatest degree possible.
Vigilant and the Agency agree that infor mation obtained or incorporated into Vigilant systems may be associated with records that are sensitive in nature having, tactical, investigative and Personally Identifiable Information. As such, that information will be treated in accordance with applicable laws, policies and regulations governing protection and privacy of this type of data .
Vigilant and the Agency agree that products and services offered by Vigilant are merely an investigative tool to aid the client in the course of their duties and that Vigilant make no claims that direct actions be initiated based solely upon the information responses or analytical results. Further, Vigilan t and the Agency agree that the Agency is ultimately
responsible for taking the appropriate actions from results, hits, etc. generated by Vigilant products and require ongoing training, human evaluation, verifying the accuracy and currency of the information, and appropriate analysis prior to taking any action.
As such, the parties agree to do the foll
owing:
Vigilant:
1. Vigilant has established the use of FBI‐CJIS Security Policy as guidance for implementing technical security controls in an effort to meet or exceed those Policy requirements.
2. Vigilant agrees to appoint a CJIS Information Security Officer to act as a conduit to the clien t Contracting
Government Agency, Agency Coordinator, to receive any security policy information and disseminate to the appropriate staff.
3. Vigilant agrees to adhere to FBI‐CJIS Security Policy Awareness Training and Personnel Screening standards as required by the Agency.
4. Vigilant agrees, by default, to classify all client supplied data and information related to client owned infrastructur
e, information systems or communications systems as “Criminal Justice Data”. All client information will be treated at the highest level of confidentiality by all Vigilant staff and authorized partners.
Vigilant has supporting guidance/policies for staff handling the full life cycle of information in physical or electroni
c form and has accompanying disciplinary procedures for unauthorized access, misuse or mishandling of that information.
5. Vigilant will not engage in data mining, commercial sale, unauthorized access and/or use of any of Agency owned data.
Vigilant - L5Q_Public Safety_1.0 Page 11 of 13
6. Vigilant and partners agree to use their formal cyber Incident Response Plan if such event occurs.
7. Vigilant agrees to immediately inform Agency of any cyber incident or data breach, to include DDoS, Malware, Virus, etc. that may impact or harm client data, systems or operations so proper analysis can be perfo rmed and client Incident Response Procedures can be initiated.
8. Vigilant will only allow authorized support staff to access the Agency’s account or Agency data in support of Agency as permitted by the terms of contracts.
9. Vigilant agrees to use training, policy and procedures to ensure support staff use proper h andling, processing, storing, and communication protocols for Agency data.
10. Vigilant agrees to protect client systems and data by monitoring and auditing staff user activity to ensure that it is only within the purview of system application development, system maintenance or the support roles assigned.
11. Vigilant agrees to inform the Agency of any unau thorized, inappropriate use of data or systems.
12. Vigilant will design software applications to facilitate FBI‐CJIS compliant information handling, processing, storing, and communication of Agency.
13. Vigilant will advise Agency when any software application or equipment technical controls are not consistent with meeting FBI‐CJIS Policy criteria for analysis and due consider ation.
14. Vigilant agrees to use the existing Change Management process to sufficiently plan for system or software changes and updates with Rollback Plans.
15. Vigilant agrees to provide technical security controls that only permit authorized user access to Agency owned data and Vigilant systems as inten ded by the Agency and data owners.
16. Vigilant agrees to meet or exceed the FBI‐CJIS Security Policy complex password construction and change rules.
17. Vigilant will only provide access to Vigilant systems and Agency owned information through Agency managed role‐based access and applied sharing rules configured by the Agency.
18. Vigilant ag
rees to provide technical controls with additional levels of user Advanced Authentication in Physically Non‐Secure Locations.
19. Vigilant agrees to provide compliant FIPS 140‐2 Certified 128‐bit encryption to Agency owned data during transport and storage (“data at rest”) while in the custody and cont rol of Vigilant.
20. Vigilant agrees to provide firewalls and virus protection to protect networks, storage devices and data.
21. Vigilant agrees to execute archival, purges and/or deletion of data as configured by the data owner.
22. Vigilant agrees to provide auditing and alerting tools within the software applications so Agency can mo nitor access and activity of Vigilant support staff and Agency users for unauthorized access, disclosure, alteration or misuse of Agency owned data. (Vigilant support staff will only have access when granted by the Agency.)
23. Vigilant will only perform direct support remote access to Agency systems/infrastructure when requested, authorized an
d physically granted access to the applications/systems by the Agency. This activity will be documented by both parties.
24. Vigilant creates and retains activity transaction logs to enable auditing by the Agency data owners and Vigilant staff.
25. Vigilant agrees to provide physical protection for the equipment‐storing Agency data along with additional tech
nical controls to protect physical and logical access to systems and data.
26. Vigilant agrees to participate in any Information or Technical Security Compliance Audit performed by the Agency, state CJIS System Agency or FBI‐CJIS Division.
27. Vigilant agrees to perform independent employment background screening for its’ staff and parti cipate in additional fingerprint background screening as required by Agency.
Vigilant - L5Q_Public Safety_1.0 Page 12 of 13
28. Vigilant agrees that the Agency owns all Agency contributed data to include “hot‐lists”, scans, user information etc., is only shared as designated by the client and remains the responsibility and property of the Agency.
Agency:
1. Agency agrees to appoint an Agency Coordinator as a central Point of Contact for all FBI‐CJIS Security P olicy related matters and to assign staff that are familiar with the contents of the FBI‐CJIS Security Policy.
2. Agency agrees to have the Agency Coordinator provide timely updates with specific information regarding any new FBI‐CJIS, state or local information security policy requirements that may impact Vigilant comp liance or system/application development and, to facilitate obtaining certifications, training, and fingerprint‐based background checks as required.
3. Agency agrees to inform Vigilant when any FBI‐CJIS Security Awareness Training, personnel background screening or execution of FBI‐CJIS Security Addendum Certifications are required.
4. Agency agrees to immediately inform Vigilant of any relevant data breach or cyber incid ent, to include DDoS, Malware, Virus, etc. that may impact or harm Vigilant systems, operations, business partners and/or other Agencies, so proper analysis can be performed, and Incident Response Procedures can be initiated.
5. Agency agrees that they are responsible for the legality and compli ance of information recorded, submitted or placed in Vigilant systems and use of that data.
6. Agency agrees that they are responsible for proper equipment operation and placement of equipment.
7. Agency agrees that they are responsible for vetting authorized user access to Vigilant systems with due consideration of providing potential access to non‐Agency informa tion.
8. Agency agrees that responsibility and control of persons granted access to purchased Vigilant systems, along with data stored and transmitted via Vigilant systems, is that of the Agency.
9. Agency agrees that they have responsibility for all data security, handling and data protection strategies from point of a
cquisition, during transport and until submission (“Hotlist upload”) into Vigilant systems.
10. Agency agrees to reinforce client staff policies and procedures for secure storage and protection of Vigilant system passwords.
11. Agency agrees to reinforce client staff policies for creating user accounts with only government domai n email addresses. Exceptions will be granted in writing.
12. Agency agrees to reinforce client staff policies for not sharing user accounts.
13. Agency agrees to use Vigilant role‐based access as designed to foster system security and integrity.
14. Agency agrees that they control, and are responsible for, appropriate use and data storage policies as we ll as procedures for the data maintained outside the Vigilant systems. This includes when any information is disseminated, extracted or exported out of Vigilant systems.
15. Agency agrees that they control and are responsible for developing policies, procedures and enforcement for applying deletion/purging and dissemination rules to information within and outside the Vig ilant systems.
16. Agency agrees that it is their responsibility to ensure data and system protection strategies are accomplished through the tools provided by Vigilant for account and user management features along with audit and alert threshold features.
17. Agency agrees to use the “virtual escorting” security tools provided for managing clie nt system remote access and monitor Vigilant support staff when authorized to assist the client.
18. Agency agrees that the Vigilant designed technical controls and tools will only be effective in conjunction with Agency created policies and procedures that guide user access and appropriate use of th e system.
Vigilant - L5Q_Public Safety_1.0 Page 13 of 13
19. Agency agrees that information and services provided through Vigilant products do not provide any actionable information, Agency users are responsible for the validity and accuracy of their data and developing procedures to verify information with the record owner and other systems (NCIC) based upon the potential lead generated.