Tab D. Project Understanding Page 17 of 37
4.2.2 Weather Driven Stochastics
cQuant captures weather-driven stochastics when simulating historical observed data as a risk factor within the CORE simulation. The model uses empirical distributions derived from the data provided for each risk factor to simulate seasonality, time series dynamics, cross-variable correlation, and the shape of the uncertainty in each specific risk factor. As a result, weather is a variable that is simulated forward to capture the uncertainty around the expected forecast in relation to other risk factors. If the user directly models (for example) hourly historical temperatures, cQuant will include the hourly temperature forecast as an output of the simulation.
4.2.3 Dashboard/Reporting
The cQuant platform has many built-in reports. Currently,the number of reports is roughly thirty-seven. All reports are interactive and display charts alongside data tables representing the same data. They allow you to select the granularity (monthly, daily, annual, and month-hour), attribute (product/commodity to display, e.g., energy, capacity, etc.), variable (volume, cash flow, revenue, etc.), aggregation level and sub-portfolio filters to view the portfolio at various levels.
The pre-built reports are grouped into several categories. The list below is a partial list of reports, and some bullets represent more than one specific report.
• Net Position at Risk
o Confidence Intervals (for Volumes, Revenue, Cash Flow, etc.) o Portfolio Components (to assess sub-portfolio contributions to Portfolio outcomes) o Attribute Components (to assess the contributions of various commodities, such as energy, capacity, RECs, etc., to Portfolio outcomes)
o Portfolio Density (to view the distribution of portfolio outcomes across simulations) o Risk Factors (to view the distributions of key drivers of portfolio value) • Energy Storage
o Margin Reports (Waterfall, Violin Distribution, Components) to understand the Net Revenue of storage projects
o Hourly Energy and AS Revenue components
o Dispatch vs. Load
o Green Energy Charging
o Dispatch vs. Price
• Risk Factor Simulations
o Variable Distributions
o Time Series Plots (Historical vs. Simulated)
o Correlation (Matrix and Historical vs. Simulated)
o Shaping
o Confidence Intervals
o Historical Data Dashboards
• Diversification Dashboard (to see diversification benefits in the portfolio) • Extrinsic Value (to highlight the difference between deterministic and stochastic modeling) • Hedge Evaluation
o Hedge Optimization Summary
o Hedge Effectiveness
o Hedge Builder
• Renewable Value (a collection of 10 reports related to renewable project valuation) • Profit and Loss (PnL)
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab D. Project Understanding Page 18 of 37
Roseville Electric can choose to use one of cQuant’s standard report templates or easily create your custom reports in the tool of your choice. Customers can even integrate custom reports into the cQuant application for easy viewing directly within the web platform.
4.2.4 Run Times
A key benefit of cQuant, by comparison to all other vendors, is the balance that it strikes between rapid analysis and full-featured simulation. Many of our customers find that they have radically improved simulation times in comparison to the products from other vendors. The cQuant advantage is a combination of an analytics workflow that you can tailor to your needs, a cloud infrastructure that is flexible and scalable, and a highly parallelizable simulation approach. We constantly improve our simulation performance by updating the cloud infrastructure, improving our code, and leveraging computing tools that are designed for peak analytics performance. Just in the last three years, simulation performance on cQuant has nearly doubled. Some customers have reported spending less than a tenth as much time on simulation using cQuant than other tools they have used previously.
4.2.5 Market Participation
cQuant is neutral to which markets our customers participate in, which allows us to serve customers on three continents with excellent energy analytics and energy risk analytics capabilities. Many cQuant customers participate in CAISO markets.
This capability includes the potential to evaluate the benefit of future participation in markets that presently exist, or that will exist in the future. cQuant is also a suitable platform for counterfactual analysis wherein the value of having decided to participate in WEIM or EDAM is compared to the alternative where the City of Roseville must satisfy the resources obtained through WEIM or EDAM versus alternative methods of procuring the same energy (including transactions with CAISO).
4.2.6 Future Proof
As noted above, cQuant is ready to model CAISO EDAM participation or the evaluation of prospective participation. cQuant currently has a Slice of Day model for evaluating compliance with the Slice of Day rules in CAISO. cQuant has the facility to model additional commodities, such as capacity/RA markets.
4.2.7 Forecast Energy Prices
cQuant offers a Fundamental Forward Curve (FFC) model that leverages a powerful hybrid approach to energy price forecasting, which combines the rigor of power market fundamentals with lightning-fast AI capabilities to generate precise, hourly 20-year forward price curves for power trading hubs across all ISO/RTO markets in the U.S. In addition to providing a forecast of power prices, the FFC model is user-configurable, meaning that Roseville Electric can adjust many assumptions about the underlying economic forecasts that produce a price forecast consistent with Roseville Electric’s goals. FFC uses U.S. Energy Information Administration assumptions from the Annual Energy Outlook and Short Term Energy Outlooks, including scenarios, to generate its default forecast.
However, if Roseville Electric feels that it is necessary to adjust certain forecasts, this is easy to do and provides a customized view of power prices.
4.2.8 Congestion Revenue Rights
cQuant can include Congestion Revenue Rights (CRR) as part of a total energy portfolio. Most cQuant users who model CRRs or similar instruments in other markets do so as a hedge against basis risk. As such, this can play a key role in a well-balanced energy portfolio.
cQuant’s Congestion model estimates the congestion component of locational marginal prices. Congestion prices are estimated using the following methodology: For each node, historical loss prices are regressed against Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab D. Project Understanding Page 19 of 37
historical LMP data for the corresponding hub. This regression is performed for each combination of month, year, and peak period. This means that the user needs to supply historical loss price data that covers the same date range as the historical spot price data. The results of the regression are used to calculate the expected loss components based on the simulated hub prices. The congestion is estimated by taking the simulated node prices and subtracting the loss components calculated from the regression model and the simulated hub price. This calculated congestion component can be used for valuing CRR contracts.
4.2.9 Rates
cQuant’s Retail Valuation model allows Roseville Electric to model your retail energy portfolio and apply your energy and demand rates to your customer classes by time-of-use period. The model is general and userconfigurable in that it handles energy, variable, fixed, and demand charges across any time-of-use period as defined by you. Uncertainty in customer demand comes from CORE's robust simulations of hourly load based on historical load settlements. The Retail Valuation model uses the same set of load simulations from CORE and applies load loss factors and customer segmentation factors to calculate customer demand at the meter to value against the user-defined energy and demand rate schedules. As a result, Roseville Electric will receive insight into the value, risk, seasonality, and uncertainty of the retail revenue associated with your customer classes.
Many products available in the marketplace today focus either on the wholesale or retail side of the energy economy. cQuant is unique in its ability to view both the wholesale and retail components of a utility portfolio in one software.
4.2.10 Market Knowledge
Roseville Electric describes several types of data that would be potentially useful during capacity expansion planning. Some of these items are computed as outputs by the cQuant platform, such as the Levelized Cost of Energy and Capacity Factor. Some are – in principle – possible to compute in cQuant given an appropriate methodology, such as Planning Reserve Margin and Effective Load Carrying Capacity. cQuant does not currently offer this as a product feature, however, the stochastic approach that cQuant takes is uniquely well-suited to this type of analysis. PRM and ELCC are heavily dependent on the portfolio and project, respectively, and as such, are not data that cQuant or any other vendor could supply without targeted analysis except in the roughest form. A credible analysis of either would depend heavily on the Roseville Electric load curve. cQuant can assist with project-specific renewable resource output curves. We have data that directly supports this as part of our PinDrop product.
4.2.11 Data
cQuant is a SaaS application that has extensive APIs. cQuant APIs cover every action in the cQuant platform, especially importing and exporting data and launching model runs. The cQuant APIs are full-featured. Every action that can be accomplished in the cQuant user interface can also be accomplished via API’s. cQuant is fully API driven. Many of our users have analytics workflows in cQuant that require manual data entry very rarely due to the level of operationalization of analytics workflow that those users have implemented in cQuant. In some cases, the cQuant team assistsin operationalizing users’ analytics workflow through API scripting. cQuant’s API is well-documented and full-featured. All actions that a user can accomplish through the cQuant user interface can also be automated through API calls. cQuant’s easy-to-use user interface allows users to upload and edit all data directly in the web application as needed, but some customers prefer to automate repeated actions via our API. Many of our customers load data into cQuant through either or both methods.
4.2.12 Report History
Within the cQuant application, all inputs, parameters, model results, and reporting can be saved in the application Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab D. Project Understanding Page 20 of 37
for later use. All data is retained indefinitely unless otherwise specified. You can use reporting history for comparison or future analysis.
4.2.13 Report Comparisons
Yes, cQuant has what is called a PnL (Profit and Loss) Explained report. The cQuant Profit and Loss Dashboard can be used to compare the ANPR results from multiple scenarios. This is useful if Roseville Electric wants to see how specific changes, such as updating input data or adding new assets, affect the value of a portfolio. It can be utilized when two model runs are being compared, but it is possible to include more than two model runs in the dashboard.
4.2.14 Hedge Effectiveness Analytics
cQuant is uniquely well-positioned for analyzing hedge effectiveness. As discussed in 4.1.8, cQuant’s ANPR dashboard allows Roseville Electric to create user-defined sub-portfolios. This gives you the ability to view the impact of a potential hedge on a portfolio or a sub-portfolio. Essentially, this allows you to analyze hedge effectiveness over a set period of time, particularly focusing on how well hedges have mitigated risk in your current position.
cQuant’s Hedge model provides an automated recommendation of hedge products, locations, and associated volumes to optimally reduce risk within a portfolio of physical and financial energy assets. Within the Hedge dashboard, Roseville Electric can view the optimal hedges depending on the available budget, metrics that quantify the effectiveness of the optimal hedging strategy, and how the optimal hedges affect the distribution of net cash flow for a portfolio and even try out custom hedging volumes.
4.2.15 Backtesting for risk mitigation decisions
As noted above, cQuant’s powerful scenario analysis capabilities make it very suitable for backtesting and counterfactual analysis on a wide range of configurable parameters. The cQuant application was very much designed with this use case in mind. The PnL Explained dashboard described in 4.2.13 would be especially helpful for this purpose since it works just as well for alternative business models as for individual portfolio actions.
4.2.16 Financial and operational risk consolidation
cQuant has all of the respective features to address financial risk metrics and operational risk metrics in one platform, as noted throughout the rest of this response. The cQuant platform is efficient at handling scenario analysis of a portfolio to quantify the response to market or portfolio scenarios. cQuant can accommodate users who want to utilize the platform to view how changes in operational risk impact and are impacted by market risk.
The individual modular run design of the platform allows you to adjust and analyze various scenarios and view the impact on your entire portfolio’s risk.
4.2.17 Scenario Comparison
The cQuant Energy Analytics Platform provides Roseville Electric with the ability to create and manage analytic model runs where data is retained indefinitely for each modular run. When setting up and running specific scenarios, you can easily share model inputs, configurations, and outputs across different groups or restrict it to a specific team to leverage existing models for scenario analysis and stress testing. All inputs, parameters, model results, and reporting can be saved in the application for later use. This allows Roseville Electric to copy a particular run, make a few changes, and compare two separate scenarios with as little or as many changes as the user specifies.
4.2.18 Constraints
These “nice to have” constraints are part of the standard cQuant Plant Dispatch Optimization model. As discussed Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab D. Project Understanding Page 21 of 37
in 4.1.2, one of the many resources available to model is natural gas with the Plant Dispatch Optimization (PDO) model. It optimizes hourly plant dispatch against fuel and power price signals to maximize profit. The model can also account for emissions costs and blended fuel prices. The model parameterizes a physical power plant via multiple input files, allowing Roseville Electric to specify heat rates, plant operating hours, ramp rates, variable operations, and maintenance cost, expected forced outage rate, maximum number of starts, and minimum downtimes, among many other fields. This is to closely match the operation of merchant thermal assets. Our extensive documentation details all of the available constraints. This model is only one of the many models that parameterizes around user-defined constraints. The platform can constrain many of our valuation models to more accurately match operations to optimize performance and valuation assets.
4.2.19 Market Sales
The ability to value market sales is a central capability of cQuant’s valuation models. Those models utilize the risk factor simulations from the CORE simulation engine and optimize/value physical or financial assets at the hourly (or sub-hourly) level. As mentioned above, when paired with a forecast, you can track and assess the mark-tomarket value of your energy and fuel positions, non-energy attributes, retail, capacity, ancillary services, and many more.
4.2.20 Risk Mitigation Strategy
cQuant offers models that suggest mitigation strategies (such as hedge optimization) based on current market positions. As mentioned in 4.2.14, cQuant’s Hedge model allows Roseville Electric to analyze the optimality of various hedging strategies and design an optimal set of hedges to optimally achieve a user-defined portfolio level objective, such as risk reduction and subject to user-defined constraints.
As mentioned in 4.2.1, the PORT model identifies portfolios of assets that best meet the objective or objectives specified by the user for a given use case. PORT is highly flexible, capable of optimizing to a wide variety of objective functions, and can consider sub-portfolios containing any assets, physical or financial, that are valued across the cQuant platform. PORT can be used to optimize various objective functions, including maximum portfolio value, minimum portfolio risk, or any other metric that is reported by the ANPR model.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab E. Project Plan Page 22 of 37
Tab E. Project Plan
Provide a detailed discussion of your firm’s approach to the successful implementation of this project. Include thorough discussions of methodologies you believe are essential to accomplishing this project. Include a proposed work schedule to accomplish all the required tasks within the desired timeline. Identify the staff who would be assigned to each task, including sub-consultants and sub-contractors. List any necessary equipment, training or installation services required.
cQuant will approach the implementation of the Roseville Electric Production Cost Modeling/Portfolio Management system in several phases to provide a turnkey software solution. In the initial phases of the project, cQuant expects to work very closely with the Roseville Electric staff. We recommend starting with a requirements phase where we meet (either face to face or virtually- depending on Roseville Electric’s preference) to review the Roseville Electric requirements in detail and to document the technical aspects and dimensionality specific to the portfolio assets and components to be modeled. From these meetings, cQuant will develop a detailed project plan, including a schedule of milestones to guide the steps and keep the project on track between kick-off and golive.
The next key phase is the input data collection and curation process. Based on the outcome of the initial discovery phase, cQuant will generate a detailed data request outlining all data sources needed for the portfolio modeling effort. cQuant has also built a series of data templates that help the client input the data into the platform and will provide these along with the data request.
cQuant will assign a specific project team to work alongside the Roseville Electric team to help minimize errors and explain how each file will be used in the portfolio modeling process and to create the outputs and reports that Roseville Electric desires. cQuant’s experience has shown that a strong effort here will shorten the time frame to a successful transition and hand-off to Roseville Electric.
Once required input data has been collected, the next phase consists of model configuration, calibration, and validation. Portions of this phase may begin in parallel with the data collection phase as data related to the initial models becomes available. cQuant staff will take the lead in generating initial model configurations and calibrations and will present the results to Roseville Electric for a joint review as they become available. As each component model in the portfolio modeling workflow is configured and validated, cQuant staff will provide the final set of inputs to Roseville Electric and will also provide training on how to run the model within the cQuant Analytics Platform. In addition to simply running the model, cQuant will train Roseville Electric in how to make configuration adjustments and validate updated results so Roseville Electric staff will be able to make future modeling adjustments themselves. The goal of platform training during this phase is to provide Roseville Electric staff with some degree of initial hands-on exposure to the cQuant Analytics Platform without obstructing momentum when setting up the customer’s portfolio. The final phase, described below, will provide additional training to ensure that Roseville Electric staff is comfortable and self-sufficient with the modeling workflows.
The final phase is to train the Roseville Electric team on the platform and model execution. The goal of this final phase is for Roseville Electric staff to feel capable and confident in their use of the cQuant platform to satisfy the portfolio and risk management needs outlined in this RFP. With the models configured and validated, we will work with Roseville Electric to finalize the service workflow and platform access (setting up user groups and analytics collaboration workspaces).
It is also important to know that cQuant will be providing unlimited customer support both during the Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab E. Project Plan Page 23 of 37
implementation and once the project is handed over to Roseville Electric. Such customer support includes assistance with diagnosing model run failures, training additional staff as appropriate, and discussions about modeling methodology or functionality. This continued support is a commitment we make to every client to ensure they are getting everything they need out of our solution.
The implementation project plan will require a detailed conversation between cQuant.io and the Roseville Electric team. However, we estimate the major tasks and timeline (subject to variation per the requirements conversation described above) in the following table. Implementations are typically complete within 2-3 months of beginning. # Stage Name Description Business Days Responsible Parties 1 Requirements Identify implementation requirements,
portfolio asset list, data sources, modeling
requirements.
10 Roseville, cQuant
2 Data Collection Data request, collection, and formatting. cQuant will organize the data request and
assist in formatting and identifying data
sources for any data not readily available to
Roseville Electric. Roseville Electric will identify
and collect the required data that is accessible.
15 Roseville, cQuant
3 Data
Implementation
Model configuration, calibration, and
validation. cQuant will assemble the modeling
data, create modeling cases that implement
Roseville Electric’s primary use cases as
determined in the Requirements phase, and
render in the Roseville Electric environment of
the cQuant software.
20 cQuant
4 Training Roseville Electric team learns the cQuant
platform and the details of the portfolio model
as implemented. This training time is a
window of the project plan that has some
formal training activities as well as time for the
Roseville Electric team to engage in wellsupported navigation of the platform. Usually training activities are “peppered” into the
overall project to encourage customers to
have early engagement on the software.
Training also includes guidance for any
extensions to the implementation that
Roseville Electric’s team intends to implement.
15 cQuant
5 Sign-off and Go-live Roseville Electric accepts the implementation and takes full control of the system.
1 Roseville
Total 61
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab F. Cost Proposal Page 24 of 37
Tab F. Cost Proposal
Provide a total cost proposal for all products and services to be delivered and a breakdown of costs delineated by tasks as described in your project plan. Include a schedule of hourly rates for all proposed staff and the amount of time each person will be devoted to this project. Define any reimbursable expenses requested to be paid by the City.
The cQuant platform is cloud-based Software as a Service (SaaS) with an annual subscription fee that includes software access, cloud infrastructure, and unlimited standard product support. User licenses are of two types:
- “Super users” have full access to load data, configure & execute runs, view results, etc. - “Report users” have access to view reports and dashboards. The cQuant report dashboards are interactive, allowing report users to query or reconfigure the results across many dimensions so that the results can be sliced and diced in any way that suits the user.
The cQuant platform is also modular, such that a customer may tailor the subscription and user interface to show only the models and capabilities that are needed. Some module capabilities straddle the base and desired functionality. Where this has occurred, cQuant has included the module in the base requirements proposal. The subscription fee in the desired functionality line represents incremental software capabilities that would be required to satisfy all the additional desired functionality. Year 1 of the desired functionality line includes an additional $15,000 fixed fee for implementation of the additional capability if selected. cQuant provides implementation services on a fixed-fee basis, minimizing risk for the City of Roseville. The fixed fee implementation is proposed at $45,000 and is expected to require less than 200 hours of cQuant analyst time.
It is anticipated that all implementation services can be completed remotely. Once the project implementation is complete, the City of Roseville will enjoy unlimited standard product support at no additional cost. In the event that the City of Roseville wants to engage cQuant in bespoke training, traditional consulting, software customization work, etc., that work may be completed at an hourly rate ranging from $275 to $375 per hour.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab G. Required Statements/Documents Page 25 of 37
Tab G. Required Statements/Documents
Include statements of assurance regarding the following requirements in the proposal:
Non-substitution for the designated members of the team without approval by City staff (Section 5.0) Proposer shall assure that the designated project team, including sub-consultants or sub-contractors (if any), is used for this project. Departure or reassignment of, or substitution for, any member of the designated project team, sub-consultant(s,) or sub-contractor(s) shall not be made without the prior written approval of the City.
See the Attached letter from Neil Nordby within Tab G.
The absence of a conflict of interest (Section 10.4)
The Contractor shall warrant that no official or employee of the City has an interest, has been employed or retained to solicit or aid in the procuring of the resulting contract, nor that any such person will be employed in the performance of such contract without immediate divulgence of such fact to the City. Contractors submitting a proposal in response to this RFP must disclose any actual, apparent, direct, indirect, or potential conflicts of interest that may exist with respect to the Contractor or the Contractor’s management or employees relative to the services to be provided to the City. Conflict of interest issues may require consultation with legal counsel. If a Contractor has no conflicts of interest, a statement to that effect must be included in the proposal. Violation of this section shall be a material breach of the contract entitling the City to any and all remedies by law or in equity.
See the Attached letter from Neil Nordby within Tab G.
Indicate your ability and agreement to fulfill the indemnification and insurance requirements contained in the sample contract (Section 10.7). (Please note that actual certificates of insurance are not required as part of your submittal.)
The City’s standard indemnification and insurance requirements are provided in the sample contract. All costs of complying with the insurance requirements shall be as included in your pricing. The selected Contractor shall provide complete and valid insurance certificates within ten (10) days of the City’s written request. Failure to provide the documents within the time stated may result in rejection of the Contractor’s proposal. If a proposer takes exception to the indemnification and insurance requirements, then the nature and scope of the proposed exceptions may negatively affect the evaluation of that proposer’s submittal and the City’s determination of whether it is possible to successfully negotiate a contract with that firm. Submitting exceptions are at the proposer’s own risk.
See the Attached letter from Neil Nordby within Tab G.
A statement that nothing contained in the submitted proposal will be proprietary. (Section 10.23) Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab G. Required Statements/Documents Page 26 of 37
Proposers submitting a proposal in response to this RFP must provide a statement that nothing contained in the submitted proposal will be proprietary. However, if a proposer desires to claim a privilege against public disclosure for a trade secret or other proprietary information, such information must be submitted with the proposal in a separate envelope marked “confidential.” The City Attorney’s Office will determine if the information is in fact proprietary, based on state and federal law. Note that under California law, a price proposal to a public agency is not a trade secret. The Contractor shall defend, indemnify and hold harmless the City regarding any claim by any third party for the public disclosure of the “confidential” portion of the proposal.
See the Attached letter from Neil Nordby within Tab G.
Submit the following documents with proposal:
Proof of registration with California Secretary of State. Note: All proposers must be registered with the Secretary of State or have a valid exemption by the time of award.
Included herein
Executed copy of Proposer’s Certification (Attachment A) Included herein
Levine Act Disclosure Statement Form (Attachment B)
Included herein
Executed copy of Non-collusion Declaration (Attachment D) Included herein
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab G. Required Statements/Documents Page 27 of 37
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab G. Required Statements/Documents Page 28 of 37
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab G. Required Statements/Documents Page 29 of 37
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab G. Required Statements/Documents Page 30 of 37
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab G. Required Statements/Documents Page 31 of 37
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab G. Required Statements/Documents Page 32 of 37
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab G. Required Statements/Documents Page 33 of 37
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab G. Required Statements/Documents Page 34 of 37
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab G. Required Statements/Documents Page 35 of 37
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab. H Exceptions Page 36 of 37
Tab. H Exceptions
Describe any and all proposed exceptions, alterations or amendments to the Scope of Services or other requirements of this RFP. The nature and scope of your proposed exceptions may negatively affect the evaluation of your submittal and the City’s determination of whether it is possible to successfully negotiate a contract with your firm. cQuant is fully compliant with all RFP requirements and has no exceptions to note.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab I. Competency of Proposers Page 37 of 37
Tab I. Competency of Proposers
The City wants to ensure that the successful Consultants has the necessary facilities, ability, experience, and financial resources to provide the services specified herein in a satisfactory and timely manner. Please list and explain any pending bankruptcies, liens, stop payment notices, judgments, lawsuits, arbitrations, mediations, foreclosures, and any similar actions filed or resolved in the past seven (7) years. Please indicate whether a client has ever terminated a contract with your firm for breach, and if so, please explain. cQuant.io hereby declares that:
1. There are no pending bankruptcies involving our company.
2. There are no current liens against our company or its assets.
3. We have not received any stop payment notices.
4. There are no judgments against our company.
5. We are not involved in any ongoing lawsuits, arbitrations, or mediations.
6. We have not been subject to any foreclosures.
7. In the past seven (7) years, we have not been involved in any of these actions, nor have any such actions been filed against us or resolved.
8. No client has ever terminated a contract with our firm for breach. cQuant.io affirms that we have the necessary facilities, ability, experience, and financial resources to provide the services specified in this proposal in a satisfactory and timely manner.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
1 CQUANT.IO ORDER FORM
Customer Information:
Company Name City of Roseville
Division or Department
Billing Address
License Administrator Name
License Administrator Email
License Administrator Phone
Billing Contact Name
Billing Contact Email
Billing Contact Phone
License & Services
Initial License Term In Months 60 (5 years)
Total Contracted Superusers 3
Total Contracted Reporting Users 7
Additional Terms
Additional Terms and Comments If the City of Roseville wants to engage cQuant in bespoke training, traditional consulting, software
customization work, etc., that work may be
completed at the then current annual consulting
rate.
311 Vernon St. Roseville, CA 95678
Long Zhang
[email protected]
(916) 774-5652
Accounts Payable
[email protected]
(916) 774-5488
Electric Department
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
2 Licensed Products Quantity
cQuant Base Bundle
Includes cQuant's Analytic Platform and Cloud Infrastructure, Core Risk Factor Simulation, Custom Formulas, Advanced Net Position at Risk Model, Component GMaR, Contract Valuation Model, Congestion Price Estimation Model, One Report User, One Super User, and Data Storage (1TB). 1 Renewable Bundle
Includes Advanced Battery Storage Optimization Model, ReAssure PPA Valuation Model, Renewable Value Dashboard, and Renewable Value Breakout Model.
1 Outage Bundle
Includes Plant Dispatch Optimization Model and Outage Cost Analysis Model.
1 Super User
A full-access user within the cQuant Analytics Platform that can create, view, modify, and delete model runs and all associated inputs/outputs.
Modify/delete permissions can be further provisioned on a per-super-user basis separately within each collaboration workspace.
2 Report User
A "read only" user within the cQuant Analytics Platform that can view inputs, parameters, outputs, and reports associated with model runs but cannot create, modify, or delete any analysis.
6 Retail Valuation
Calculates the revenue from retail demand relative to simulated hourly demand and a variety of common retail rate structures including time of use rates, demand charges, index rates, fixed and variable energy charges, and others.
1 Potential Future Exposure
Calculates the potential for future cash flow exposure to counterparties within the portfolio relative to forward and spot market dynamics and the nature of contractual timing within the portfolio itself. 1 Implementation Services 1
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
3 A suite of services offered to customers to facilitate use of the cQuant platform including portfolio set-up and validation, training, data/workflow automation, and more. Services and associated cost will vary depending on project needs and allocated budget.
Fundamental Forward Curve
Generates a 20-year hourly fundamental price forecast for market hubs across the ISO/RTO markets within the continental US. Allows users to tune assumptions around forecasted fundamental drivers (supply stack evolution, load growth, gas price, battery adoption, etc.) and view the resulting changes to the hourly price forecast.
1 Portfolio Optimization
Optimizes the addition of contracts, assets, and/or structured transactions to a portfolio to achieve some user-specified portfolio-level objective, subject to user-specified constraints. May be used to optimize a portfolio-level hedging strategy, optimally select from responses to a request for offers (RFO) process, or explore the efficient frontier between risk and expected value, among many other use cases.
1 PnL Explained 1
Hedge Vision
Automatically computes hedge volumes to maximally reduce gross margin at risk (GMaR) using linear instruments across market trading hubs associated with a particular Advanced Net Position at Risk (ANPR) model run.
1 Payment Schedule As Follows:
Year 1 $190,000.00
Year 2 $193,800.00
Year 3 $197,676.00
Year 4 $201,630.00
Year 5 $205,662.00
This Order Form, when signed by the Customer and accepted by cQuant.IO, Inc. below, is a legally binding contract between cQuant.IO, Inc. and the Customer. The terms of the contract include (as applicable to the items ordered) the “Standard Terms and Conditions” as follows. cQuant.IO
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
4 Standard Terms and Conditions
These Standard Terms and Conditions (“Terms and Conditions”) apply to, and are incorporated by reference into, an order form (“Order Form”) that has been signed by cQuant.IO, Inc. (“cQuant”) and the cQuant customer identified in the Order Form (“Customer”). The signed Order Form, together with these Terms and Conditions, state the terms of a binding contract (this “Service Contract”) under which cQuant shall provide, and Customer shall purchase and pay for, the services described in the Order Form (the “Services”).
ARTICLE 1: INTRODUCTORY PROVISIONS
Services may consist of the following:
(a) access to the hosted cQuant Analytics Platform (“Hosted Analytics Services”), which enable Customers to access and use a variety of models, including econometric, statistical, mathematical, problem solving, and logistical models (each a “Model”), that are hosted by or on behalf of cQuant in a proprietary web application; and (b) professional services (“Professional Services”), which are custom software development services or data-related services that have been negotiated by cQuant and Customer and have been specified in an Order Form.
ARTICLE 2: DEFINITIONS
The definitions stated in this Article will apply throughout this Service Contract. Other definitions are stated elsewhere in this Service Contract.
“Content” means, without limitation, any and all information, data, results, ideas, plans, sketches, texts, files, links, images, photos, video, sound, inventions (whether or not patentable), notes, works of authorship, articles, feedback, or other materials. Models are not included in “Content”.
“cQuant Technology” means: (a) Intellectual Property contained in or otherwise related to one or more Models, to any Hosted Analytics Services, or to any other information or materials provided by cQuant to Customer; (b) Intellectual Property and proprietary technology owned by cQuant or its suppliers before the Effective Date; and (c) cQuant Work Product. For clarity, cQuant Technology does not include Customer Data.
“cQuant Work Product” means all work product, including Models (but excluding Customer Data incorporated into any Models), and all Intellectual Property embodied therein, that was created or developed by cQuant, alone or in concert with others, in the course of performing Professional Services.
“Customer Data” means Content provided for, imported into, or uploaded to the Site by Customer or on Customer’s behalf, in the course of Customer’s proper use of Hosted Analytics Services.
“Customer Work Product” means all work product, and the Intellectual Property therein, that was created or developed solely by Customer, including such work product that was created or developed by using Hosted Analytics Services.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
5 “Documentation” means all specifications, user manuals, and other technical materials relating to the Services.
“Effective Date” of this Service Contract means the date on which the Order Form has been signed by cQuant and Customer.
“Intellectual Property” means (a) copyrights, mask work rights, and moral rights; (b) patents, patent applications, invention disclosures, and industrial property rights; (c) trade secrets and know-how; (d) trademarks, tradenames, service marks, domain names, and URLs; (e) trade dress, industrial design rights, and other design rights; (f) all other items commonly regarded as intellectual property anywhere in the world; (g) all registrations, applications, renewals, extensions, or reissues of any of the foregoing; and (h) all rights in, to, or under any of the foregoing arising under a license, lease, or other legal instrument. “License Term”, for a Hosted Analytics Services specified in the Order Form, if any, means the period during which a specified number of Users are permitted and licensed to use that Hosted Analytics Services. The License Term for any Hosted Analytics Services is stated in the Order Form.
“person”, whether or not capitalized, means any natural person and any corporation, limited liability company, government or governmental agency, or other legal entity. “Site” means the cQuant website through which Hosted Analytics Services are provided. “third party” means any person other than cQuant or Customer. “User” is a person authorized in accordance with this Service Contract to access, use, and execute Hosted Analytics Services.
ARTICLE 3: HOSTED ANALYTICS SERVICES
3.1 License Grant. cQuant hereby grants to Customer a non-exclusive, non-transferable, non-sublicensable license (the “License”), which (a) permits Customer and Users to access, use, and execute the Hosted Analytics Services specified in the Order Form, and (b) is subject in all respects to the limitations stated in Section 3.2 and all other provisions of this Service Contract.
3.2 Limitations on the License
(a) All rights not expressly granted to Customer are reserved to cQuant. Except as expressly stated to the contrary in this Service Contract, no express or implied license or right of any kind is granted to Customer regarding any Hosted Analytics Services, cQuant Technology, or any part of the foregoing, including the right to obtain possession of any source code, data, or Documentation relating to cQuant Technology. The Parties disclaim the existence or granting of any implied licenses. (b) The License permits access to and use of the Hosted Analytics Services ordered by Customer (i) only during the License Term, and (ii) only for Customer’s internal business purposes.
Any other access or use is prohibited. Without limiting the generality of the foregoing, Customer may use, reproduce, distribute, create derivative works of, perform, display, or execute a Model solely in the course of Customer using the Hosted Analytics Services over the Internet, in the manner in which it was intended to be used, and not otherwise.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
6 (c) Customer will not remove any copyright or other proprietary notice applicable to any Model or Hosted Analytics Services. Nothing in this Service Contract restricts Customer’s use, distribution, or creation of derivative works with respect to any Customer Data.
3.3 Other Prohibited Acts. Customer shall not: (a) permit or suffer any person to access or use Hosted Analytics Services ordered by Customer, other than the specific Users for whom Customer has paid a fee and has received unique login credentials; (b) rent, lease, loan, or sell access to Hosted Analytics Services to any third party; (c) interfere with, disrupt, alter, translate, or modify any Hosted Analytics Services or any part thereof; (d) reverse engineer or access any Hosted Analytics Services in order to (i) build a competitive product or service, (ii) build a product using similar ideas, features, functions, or graphics of any Hosted Analytics Services; or (iii) copy any of the ideas, features, functions, or graphics embodied in any Hosted Analytics Services; (e) without cQuant’s express written permission, introduce software or automated agents or scripts to any Hosted Analytics Services so as (A) to produce multiple accounts, generate automated searches, requests, and queries, or (B) to strip or mine data from any Hosted Analytics Services; (f) publish any performance or benchmark tests or analyses relating to any Hosted Analytics Services or the use thereof; or (g) cover or obscure any page or part of any Hosted Analytics Services via HTML/CSS, scripting, or any other means, if any.
3.4 Usernames and Passwords. cQuant shall furnish to each User (or shall allow each User to specify) a unique username and password to enable such User to access any Hosted Analytics Services specified in the Order Form. Customer will ensure that each username and password will be used only by the specific, named User to whom it was issued, i.e., this is not a software license of the type commonly referred to as a “concurrent use license”. Customer is responsible for maintaining the confidentiality of all Users’ usernames and passwords, and is solely responsible for all activities that occur under those usernames. Customer agrees (a) not to allow a third party to use Customer’s account, usernames or passwords at any time; and (b) to notify cQuant promptly of any actual or suspected (i) unauthorized use of Customer’s account, usernames or passwords, or (ii) other breach or suspected breach of this Service Contract. cQuant reserves the right to terminate any username and password, which cQuant reasonably determines may have been used by an unauthorized third party. A User license may not be shared or used by more than one User. Customer, upon notification to cQuant, may reassign a particular User’s rights with regard to the Hosted Analytics Services specified in the Order Form, if that User no longer requires access to the Hosted Analytics Services specified in the Order Form, e.g., because he or she has been reassigned to a different position within Customer’s organization or because his or her employment with Customer has terminated; such reassignment must include all the rights of the User in question.
3.5 Not a Sale. This is not an agreement of purchase or sale; computer software and other cQuant Technology involved in the provision of Hosted Analytics Services is not offered for sale to cQuant customers in the ordinary course of cQuant’s business.
ARTICLE 4: INTELLECTUAL PROPERTY
4.1 cQuant Technology. cQuant Technology, which term includes cQuant Work Product, is the exclusive property of cQuant or its suppliers. Customer shall assign and hereby does assign, convey, and quitclaim unto cQuant all Customer’s right, title, and interest in, to, and under cQuant Technology.
Customer hereby assigns to cQuant any suggestions, ideas, enhancement requests, feedback, and recommendations, and all other Content provided by Customer, related to any Models, Hosted Analytics Services, or other cQuant Technology, except for Customer Data.
4.2 Customer Work Product. Customer Work Product is the sole and exclusive property of Customer.
4.3 Commingling of Work Product. The incorporation of any Customer Work Product into cQuant Work Product will not affect the ownership of such Customer Work Product or the cQuant Work Product.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
7 4.4 Assistance in Perfecting Rights. Customer will perform all acts that are reasonably necessary or desirable to permit and assist cQuant in obtaining, perfecting, and enforcing cQuant’s rights and benefits in, to, and under Intellectual Property embodied in cQuant Technology. If cQuant is unable for any reason to secure the signature of Customer or any of Customer’s employees or contractors on any document necessary or desirable in connection with the filing, prosecution, registration, or memorialization of cQuant’s rights in any cQuant Technology, Customer hereby irrevocably designates and appoints cQuant and cQuant’s duly authorized officers and agents as Customer’s agents and attorneys-in-fact to do so in the name, place, and stead of Customer, all with the same legal force and effect as if the document or instrument in question were executed by Customer. The foregoing is deemed a power coupled with an interest and is irrevocable.
ARTICLE 5: PROFESSIONAL SERVICES
5.1 Fees and Expense Reimbursement. cQuant’s fees and other charges for Professional Services will be as stated in the applicable Order Form. Unless otherwise stated in an Order Form, Customer will reimburse cQuant for all reasonable out-of-pocket expenses actually incurred by cQuant in performing Professional Services. cQuant will seek Customer approval before incurring reimbursable expenses. cQuant is solely responsible for, and must maintain adequate records of, expenses incurred in the course of performing Professional Services.
5.2 Work Orders. Each Order Form for Professional Services will contain, as an attachment, a full description of the Professional Services to be rendered by cQuant thereunder, which attachment is referred to in this Service Contract as a “Work Order”. Each Work Order will be deemed an integral part of the Order Form to which it is attached. Work Orders will include all material information regarding the Professional Services project, including, but not limited to: a reasonably detailed description of the Professional Services to be rendered; the price or compensation to be paid by Customer for the Professional Services, itemized in reasonable detail; any applicable deadlines, milestones, or special requirements; and any other material terms negotiated by the Parties.
5.3 Independent Contractor. With respect to the provision of Professional Services, cQuant is an independent contractor of Customer. Nothing in this Service Contract or any Order Form creates a partnership, agency, joint venture, employment, or similar relationship. cQuant will not be entitled to any of the benefits that Customer may make available to its employees, including, but not limited to, group health or life insurance, profit-sharing, or retirement benefits. cQuant is not authorized to make any representation, contract, or commitment on behalf of Customer unless specifically requested or authorized in writing to do so by a Customer manager.
ARTICLE 6: CUSTOMER DATA
6.1 Customer’s Data Warranty. Customer represents and warrants that the use of Customer Data by Customer or cQuant will not violate the Intellectual Property, contractual, or other rights of any third party and will not contain any virus, worm or other malicious computer programming code capable of damaging any Hosted Analytics Services or the systems that provide the same (“Customer’s Data Warranty”).
6.2 Systems Use and Security. cQuant shall provide reasonable logical and physical security for Customer Data, which will include, but will not be limited to: (a) a defined security administration practice and process including account and password administration; and (b) ensuring that only cQuant employees and contractors who need to access Customer Data for cQuant to provide Hosted Analytics Services will have such access. cQuant may modify its security systems and procedures from time to time, in its discretion. Notwithstanding the foregoing provisions of this paragraph, cQuant may delegate any or all its obligations under this Section 6.2 to a reputable professional hosting provider, and cQuant will be deemed released from performing any of the obligations so delegated.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
8 6.3 Data Loss. cQuant endeavors to employ best industry practices, including backing up Customer Data, to avoid loss, corruption, or destruction of Customer Data (“Data Loss”). Customer shall archive, keep, and maintain a current copy of all Customer Data, at Customer’s sole cost and expense. If a Data Loss occurs because of cQuant’s negligence or greater fault, cQuant will engage a professional data recovery expert or firm, at cQuant’s expense, in an effort to recover the Customer Data; provided, however, that cQuant will not be required to expend more than $10,000 in such recovery efforts for any single Data Loss or series of related Data Losses. If a Data Loss occurs as the result of any cause other than cQuant’s negligence or greater fault, and Customer requests cQuant to perform recovery services with respect to that Data Loss: (a) Customer shall pay cQuant for such recovery services at cQuant’s then-current time and materials rates, regardless of whether cQuant’s recovery services are successful; and (b) cQuant’s recovery services will be without warranty of any kind. Except as expressly stated above in this paragraph, cQuant will incur no liability or obligation as a result of any Data Loss, regardless of whether the Data Loss results from the negligence or greater fault of cQuant.
6.4 Access to Customer Data On Termination
(a) Except as provided in subsection “(b)”, if Customer’s access to or subscription for Hosted Analytics Services is terminated, and if Customer requests an electronic copy of its Customer Data in writing within 30 days after such termination, cQuant shall comply with the request. cQuant may delete permanently all Customer Data at any time more than 30 days after Customer’s access to or subscription for Hosted Analytics Services is terminated, regardless of the circumstances of termination. (b) cQuant may suspend Customer’s access to Customer Data throughout any period during which Customer is delinquent in paying any amount owing to cQuant for Hosted Analytics Services. If Customer remains delinquent for 10 days or more after receiving written notice of the delinquency from cQuant, cQuant in its discretion may delete all Customer Data and will not be required to retain or provide a copy of the Customer Data so deleted.
6.5 cQuant’s Collection and Use of Customer Data and Usage Data. cQuant will not disclose Customer Data to any third party except in anonymized and aggregated form and will not knowingly and intentionally use Customer Data for any purpose other than rendering Services to Customer. cQuant collects data regarding the usage of Hosted Analytics Services; the usage data so collected may include, without limitation, data set sizes, Model run-times, and frequency of Model runs.
Customer hereby grants cQuant permission to disclose such usage data to third parties in anonymized and aggregated form.
ARTICLE 7: PAYMENT
7.1 Charges. Customer shall pay all fees to Customer’s account in accordance with the billing terms in effect at the time a fee is due and payable. Unless mutually agreed otherwise, payments must be made in advance. All payment obligations are non-cancelable, and all amounts paid or prepaid are nonrefundable. cQuant may require a valid credit card as a condition to signing up for a Hosted Analytics Services. An individual who is authorized to act as license administrator on behalf of Customer (“License Administrator”) may add license rights by executing an additional or supplemental Order Form and paying the applicable fees. cQuant reserves the right to modify its fees and charges and to introduce new charges at any time, upon 30 days’ prior notice to Customer, which notice may be provided by email, except that cQuant may not modify the fees applicable to any period for which Customer has prepaid with cQuant’s consent.
7.2 Billing
(a) cQuant charges and collects in advance for Hosted Analytics Services.
Professional Services will be billed annually as stated in the applicable Order Form or Work Order.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
9 (b) Any amounts not paid to cQuant when due will bear interest at the lesser of 1.5% per month or the maximum legal rate. cQuant may suspend its performance and discontinue all services to Customer, including Services under this Service Contract and other services, until Customer’s account is brought current.
(c) Customer shall provide cQuant with complete and accurate billing and contact information. This information includes Customer’s legal company name, street address, email address, and the name and telephone number of an authorized billing contact and License Administrator. Customer shall update its billing and contact information within 30 days after any change occurs. Customer’s furnishing of false billing or contact information constitutes grounds for cQuant’s termination of Services.
7.3 Taxes
(a) cQuant’s fees are exclusive of all taxes, levies, or duties imposed by taxing authorities, and Customer shall be responsible for the payment of all such taxes, levies, or duties, excluding only United States taxes based solely on cQuant’s income. (b) No part of cQuant’s compensation will be subject to withholding by Customer for the payment of any taxes, including, without limitation, social security, federal, state, local, and payroll. Customer will regularly report all payments made to cQuant to the appropriate federal, state, and local agencies, if and as required by law.
(c) cQuant is solely responsible for filing all tax returns and making all tax payments required in connection with the performance of Services.
ARTICLE 8: CQUANT’S WARRANTIES AND DISCLAIMERS
8.1 cQuant’s Limited Warranties, including Uptime Warranty. Subject to the disclaimers, limitations, and restrictions stated in this Service Contract, cQuant provides the following limited warranties: (a) that cQuant will provide Hosted Analytics Services in a manner consistent with general industry standards applicable to technical subscription services similar to the Hosted Analytics Services; and that the Hosted Analytics Services will materially conform to cQuant’s then-current Documentation when used under normal circumstances and in accordance with cQuant’s recommendations; (b) cQuant will perform Professional Services in a good and workmanlike manner; and (c) that Customer’s use of any cQuant Work Product or Hosted Analytics Services in a manner expressly authorized by cQuant in this Service Contract will not infringe the Intellectual Property rights of any third party (the limited warranty stated in subsection “(c)” being the “Noninfringement Warranty”). In addition to the warranties stated above in this paragraph, with respect to Hosted Analytics Services, cQuant provides the Uptime Warranty, as defined in cQuant’s standard Service Level Agreement, Exhibit A.
8.2 Disclaimers. The limited warranties stated in Section 8.1 (collectively, “cQuant’s Limited Warranties”) are the sole and exclusive warranties made with respect to any Services and are made to Customer only; no other person may assert a claim for the breach of any of cQuant’s Limited Warranties. EXCEPT FOR CQUANT’S LIMITED WARRANTIES, THE SERVICES ARE PROVIDED “AS-IS” AND WITHOUT ANY WARRANTY WHATSOEVER. CQUANT DISCLAIMS ALL OTHER WARRANTIES,
WHETHER WRITTEN, ORAL, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING, WITHOUT LIMITATION,
THE IMPLIED WARRANTIES OF MERCHANTABILITY, TITLE, NONINFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING: CQUANT DOES NOT WARRANT THAT ANY SERVICE, INCLUDING ANY MODELS, WILL BE ERROR-FREE; AND EXCEPT
AS EXPRESSLY STATED IN THE UPTIME WARRANTY, CQUANT DOES NOT WARRANT THAT ANY HOSTED ANALYTICS SERVICES WILL BE CONTINUOUS OR UNINTERRUPTED. ALL SERVICES MAY BE
SUBJECT TO LIMITATIONS, DELAYS, AND OTHER PROBLEMS INHERENT IN THE USE OF THE INTERNET AND ELECTRONIC COMMUNICATIONS. CQUANT IS NOT RESPONSIBLE FOR, AND CQUANT’S LIMITED Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
10 WARRANTIES DO NOT COVER, ANY DELAYS, DELIVERY FAILURES, OR OTHER DAMAGES RESULTING FROM SUCH PROBLEMS.
ARTICLE 9: INDEMNIFICATION
9.1 By cQuant, for breach of the Noninfringement Warranty (a) Subject to Section 9.3, cQuant will indemnify, defend, and hold harmless Customer from and against any third party claim, demand, suit, proceeding, or cause of action (“Claim”) asserted against Customer, alleging facts that, if true, establish a breach of the Noninfringement Warranty (“Infringement Claim”).
(b) If any portion of the Services becomes, or in cQuant’s opinion is likely to become, the subject of an Infringement Claim, cQuant may, at cQuant’s option, do any or all the following:
procure for Customer the right to continue using the allegedly infringing Services; replace the allegedly infringing Services with non-infringing services that do not materially impair the functionality of the Services;
modify the allegedly infringing Services so that they become non-infringing; or terminate the allegedly infringing Services, and refund to Customer any fees actually prepaid by Customer with respect to the unexpired portion of the License Term.
If cQuant chooses the option stated in clause “(iv)”, then upon such termination, Customer will immediately cease all use of the allegedly infringing Services. (c) Notwithstanding any other provision of this Service Contract, cQuant shall have no obligation under this Section 9.1 or otherwise with respect to any Infringement Claim to the extent it is based upon or results from: (i) any use of the Services that is not in accordance with this Service Contract or the Documentation; (ii) any use of the Services in combination with other products, equipment, software, or Content not supplied by cQuant; (iii) cQuant’s conformance to Customer’s specifications; or (iv) any modification of the Services by a person other than cQuant or its authorized agents. (d) This Section 9.1 states the sole and exclusive remedies of Customer for breach of the Noninfringement Warranty. If cQuant chooses to take any of the actions described in clauses “(i)” through “(iv)” of Section 9.1(b), such action will be deemed to satisfy any indemnification obligations of cQuant arising after the date on which such action is taken but shall be without prejudice to Customer’s indemnification rights arising under this Section 9.1 before such action is taken.
9.2 By Customer. Customer will indemnify, defend, and hold harmless cQuant from and against any third party Claim asserted against cQuant alleging facts that, if true, establish that (a) Customer used the Services in an unlawful, improper, or unauthorized manner; or (b) breached the Customer’s Data Warranty stated in Section 6.1.
9.3 Procedure. Each indemnifying party’s obligations as set forth above, with respect to any particular Claim, are conditioned upon each of the following: (a) the indemnified party shall promptly notify the indemnifying party in writing of the Claim; (b) the indemnifying party shall have sole control of the defense or settlement of the Claim; and (c) the indemnified party shall cooperate with the indemnifying party to facilitate the settlement or defense of the Claim; provided, however, that an indemnified party’s failure to notify an indemnifying party of a Claim promptly shall not relieve the indemnifying party of its indemnification obligations except to the extent that such failure caused actual prejudice or damage to the indemnifying party. An indemnifying party’s obligations under this Article include, without limitation, the payment of all damages, costs, and attorneys’ and experts’ fees, whether incurred in satisfaction of a judgment or in settlement; provided, however, that an indemnifying Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
11 party will not be required to indemnify for any amount paid in settlement unless the settlement disposes of all Claims against the indemnifying party.
ARTICLE 10: LIMITATIONS ON DAMAGES
10.1 EXCLUSION OF CERTAIN TYPES OF DAMAGES. TO THE EXTENT PERMITTED UNDER
APPLICABLE LAW, IN NO EVENT SHALL CQUANT, OR ITS SUPPLIERS OR LICENSORS, BE LIABLE TO
CUSTOMER FOR ANY INDIRECT, CONSEQUENTIAL, INCIDENTAL, SPECIAL, OR PUNITIVE OR
EXEMPLARY DAMAGES, INCLUDING DAMAGES FOR LOST PROFITS, DATA LOSS, LOSS OF USE, DIMINISHED GOODWILL OR REPUTATION, OR REPLACEMENT. IN NO EVENT WILL CQUANT BE LIABLE FOR THE COST OF PROCURING OR USING SUBSTITUTE PRODUCTS OR SERVICES, I.E., “COVER”. TO
THE EXTENT PERMITTED UNDER APPLICABLE LAW, CQUANT WILL NOT BE LIABLE FOR PERSONAL
INJURY, BODILY INJURY, OR PROPERTY DAMAGE RESULTING FROM THE PROVISION, PERFORMANCE, USE, INABILITY TO USE, OR MISUSE OF THE SERVICES. THE LIMITATIONS STATED ABOVE IN THIS
PARAGRAPH APPLY REGARDLESS OF THE CAUSE OF ACTION OR THE THEORY OF LIABILITY,
WHETHER IN TORT, CONTRACT, OR OTHERWISE, EVEN IF CQUANT HAS BEEN NOTIFIED OF THE LIKELIHOOD OF SUCH DAMAGES.
10.2 CUSTOMER’S ASSUMPTION OF RISK. CUSTOMER ASSUMES ALL RISK OF DAMAGE, EXPENSE, OR LOSS RESULTING FROM ITS USE OF THE SERVICES. WITHOUT LIMITING THE
GENERALITY OF THE FOREGOING, CQUANT WILL NOT BE LIABLE UNDER ANY THEORY FOR
DAMAGES, EXPENSES, OR LOSSES INCURRED OR SUSTAINED AS A RESULT OF ITS USE OF OR RELIANCE ON THE SERVICES, E.G., TRADING OR HEDGING LOSSES. THE FOREGOING WILL APPLY REGARDLESS
OF WHETHER THE DAMAGES, EXPENSES, OR LOSSES IN QUESTION WERE CAUSED BY DEFECTS OR ERRORS IN THE SERVICES.
10.3 Certain Persons not Liable. In addition to the limitations stated elsewhere in this Article, in no event shall cQuant’s suppliers have any liability arising out of or in connection with any Service.
10.4 LIMITATION AS TO AMOUNT OF DAMAGES. THE MAXIMUM LIABILITY OF CQUANT OR
ANY OF ITS SUPPLIERS OR LICENSORS ARISING OUT OF OR IN CONNECTION WITH ANY SERVICES MAY NOT EXCEED THE FEES PAID BY CUSTOMER TO CQUANT FOR ANY SERVICES DURING THE 12 MONTHS IMMEDIATELY PRECEDING THE DATE ON WHICH THE CLAIM AROSE. THE EXISTENCE OF MULTIPLE CLAIMS WILL NOT INCREASE THE AFOREMENTIONED LIABILITY LIMIT.
10.5 Basis of the Bargain. The limitations and exclusions stated in this Article will survive and continue in full force and effect despite any failure of consideration or failure of an exclusive remedy.
Both parties acknowledge that this Service Contract has been entered into in reliance upon these limitations of liability, which form an essential basis of the bargain between the parties.
ARTICLE 11: CONFIDENTIALITY
11.1 Definition of Customer Confidential Information. “Customer Confidential Information” means (a) all technical and non-technical information related to the Customer’s business or its current, future, and proposed products or services, including trade secrets, financial results, and plans, marketing plans, and customer and vendor data; and (b) any information that Customer has received from others and is obligated by contract or otherwise by law to treat as confidential or proprietary.
Notwithstanding the foregoing, “Customer Confidential Information” does not include any information that: (i) is or becomes known to members of the public, through no fault of cQuant; (ii) is provided to cQuant by a third party who, to cQuant’s actual knowledge, did not commit a breach of duty or other wrongful act in doing so; (iii) is independently developed by cQuant or is previously known to cQuant; (iv) is required to be disclosed by court order or legal process, but only if cQuant makes commercially reasonable efforts to inform Customer of such order or process in advance of disclosure.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
12 11.2 Nondisclosure and Nonuse of Customer Confidential Information. cQuant shall not use, disseminate, or disclose Customer Confidential Information to any third party without the consent of Customer. cQuant shall use Customer Confidential Information solely to perform Work and otherwise to perform its obligations under this Service Contract. cQuant shall treat all Customer Confidential Information with the same degree of care as cQuant accords cQuant’s own confidential information, but in no case shall cQuant use less than reasonable care. cQuant shall disclose Customer Confidential Information only to those of cQuant’s employees and contractors who have a need to know such information in performing their employment or contracting responsibilities. Each such employee or contractor will have agreed to be bound by terms and conditions that at least as protective of Customer Confidential Information as the terms and conditions applicable to cQuant under this Article. cQuant shall return all Customer Confidential Information to Customer on demand at such time as it is no longer needed to perform Work; provided, however, that cQuant may retain a copy solely for archival purposes, for use or production pursuant to court order or legal process.
11.3 Confidentiality of cQuant Work Product. All cQuant Work Product is proprietary and confidential to cQuant. Except as expressly stated in the applicable Work Order or as required by law, Customer shall not disclose cQuant Work Product to any third party or use it for any purpose other than the approved purposes stated in the applicable Work Order.
11.4 Prohibition against Reverse Engineering. Customer shall not reverse engineer any Hosted Analytics Services or cQuant Work Product. If Customer does so: (a) cQuant will own all rights in and to the results of such reverse engineering, including all Intellectual Property embodied therein; (b) all such results will be deemed cQuant Work Product; and (c) Customer will assign and transfer to cQuant, and hereby does assign and transfer to cQuant, all right, title, and interest in and to such results.
ARTICLE 12: TERMINATION
12.1 Term
(a) Hosted Analytics Services. The terms and conditions of this Service Contract will apply, as to any Hosted Analytics Services, throughout the applicable License Term, unless terminated earlier under another provision of this Service Contract. (b) Professional Services. The terms and conditions of this Service Contract will apply, as to any Professional Services, until the final completion and acceptance of such Professional Services or until terminated under the terms of an applicable Order Form or Work Order. (c) Effect of Termination; Survival. Upon and after termination, cQuant will cease rendering Services under this Service Contract. Except as stated in the preceding sentence, the terms and conditions of this Service Contract will survive termination for so long as necessary to carry out the intent of the parties.
12.2 Termination of Hosted Analytics Services
(a) By Customer. If the Customer deems that the Hosted Analytics Service does not materially conform to the product documentation or commitments in cQuant’s response document, Customer must provide written notice to cQuant describing the non-conforming issue. cQuant will be provided thirty (30) days to resolve the non-conformance. If the issue is not resolved within the thirty (30) day period to cure, Customer may terminate the Hosted Analytics Service, for cause, before its scheduled termination date, by so notifying cQuant in writing. Termination will become effective three business days after notice, subject to any contrary provision stated in the applicable Order Form. If this agreement is cancelled for cause, any unused amounts prepaid by Customer will be refunded on a pro-rata basis upon termination under this paragraph.
(b) By cQuant. cQuant may terminate any Hosted Analytics Service before its scheduled termination date if (a) Customer has breached any provision of this Service Contract and has Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
13 failed to cure such breach within 10 calendar days after cQuant notifies Customer of the breach in writing; (b) cQuant is required to do so by law and has notified Customer of the reasons why in writing; (c) cQuant’s provision of the Hosted Analytics Services to Customer is, in cQuant’s opinion, no longer commercially viable and cQuant has provided Customer with at least sixty (60) days prior written notice; or (d) cQuant has elected to discontinue the Hosted Analytics Service and cQuant has provided Customer with at least sixty (60) days prior written notice.
(c) Procedures upon Termination of Hosted Analytics Services. Upon termination of any Hosted Analytics Service: Customer will no longer have access to the terminated service and shall not attempt to access or use it; the terminated service will be deactivated; and the provisions of Section 6.4 regarding Customer Data will apply.
ARTICLE 13: CONTRACT FORMATION; CHANGES; PRECEDENCE
13.1 Acceptance by Customer. Customer will be deemed to have accepted this Service Contract and to have signed the Order Form if Customer receives and accepts any Services. Order Forms may be signed by electronic or digital means or by email correspondence indicating that assent or acceptance was intended.
13.2 Customer Responsible for Acts of Users. Customer is responsible for the acts or omissions of its Users and other employees and contractors occurring in connection with this Service Contract. This Service Contract will apply to all Users; provided, however, that Users’ rights derive entirely from Customer’s rights; Users have no independent rights to use or access any Services.
13.3 Representation of Authority to Bind Customer. An individual who signs the Order Form on behalf of Customer represents that he or she has the authority to do so.
13.4 Changes, Modifications, Amendments, and Waivers
(a) By Mutual Consent; Precedence of Order Form. Any provision of this Service Contract may be modified by mutual, written consent of the Parties. The Order Form may contain a modification of this Service Contract, and in such case the parties’ signatures on the Order Form will constitute their written consent to modify this Service Contract accordingly. In case of any inconsistency between this Service Contract and the Order Form, the Order Form will control and take precedence. No waiver of a breach of any provision of this Service Contract shall constitute a waiver of any other or subsequent breach.
ARTICLE 14: GENERAL
14.1 Governing Law and Venue. This Service Contract will be governed by and interpreted under the laws of the State of California, without giving effect to any conflict of laws principles that require the application of the law of a different jurisdiction, except that the laws of the United States will apply to questions of copyright, patents, and other exclusively federal matters. Customer hereby consents to the exclusive personal jurisdiction and venue of the state and federal courts located in the State of California. The United Nations Convention on Contracts for the International Sale of Goods does not apply to this Service Contract. Customer shall comply at all times with all applicable laws, ordinances, regulations, and statutes, whether foreign or domestic. Without limiting the generality of the foregoing, Customer will not export, reexport, or transfer, directly or indirectly, any United States technical data acquired from cQuant, or any products utilizing such data, in violation of the United States export laws or regulations.
14.2 Local Laws. cQuant and its suppliers make no representation that any Hosted Analytics Services is appropriate or available for use in countries other than the United States. If Customer uses any Hosted Analytics Services from outside the United States, Customer is solely responsible for compliance Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
14 with all applicable laws, including without limitation export and import regulations of other countries.
Neither party shall distribute or use any Content in a manner that violates United States law.
14.3 Certain Rules of Construction. Headings and titles in these Terms and Conditions are for reference only and will be ignored for purposes of construing and applying the terms hereof. The word “including” will be construed as though it is followed by the words “without limitation”. References to this Service Contract will be deemed to include and constitute references to all related Order Forms and Work Orders. References to an article or section of this Service Contract will be construed as references to that article or section and all its parts and subparts.
14.4 Successors and Assigns. cQuant may not subcontract or otherwise delegate cQuant’s Professional Services obligations under this Service Contract without Customer’s prior written consent.
This Service Contract will inure to the benefit of, and will be binding upon, the heirs, successors, and permitted assigns of the parties, respectively.
14.5 Injunctive Relief. Injunctive relief will be available to either Party to prevent or stop a breach by the other Party of its confidentiality or nonsolicitation obligations, if any, or in any other appropriate circumstances.
14.6 Notices. Any required or permitted notice must be in writing, which includes email.
Notice will be deemed given when it is actually received and will be presumed received and read within three (3) business days after it is sent. Notice to cQuant must be sent to: [email protected]. Notice to Customer must be sent to Customer’s email addresses stated in the applicable Order Form or Work Order.
Either party may change its email address for notice purposes by giving written notice of the change to the other party.
14.7 Severability. If any provision of this Service Contract is held invalid or unenforceable, the other provisions of this Service Contract will remain valid and enforceable, and the invalid or unenforceable provision will be deemed modified insofar as it necessary to render it valid, enforceable and conforming as closely as possible to the intent of the parties. The court is hereby given the authority to modify this Service Contract to effectuate the preceding sentence.
14.8 Entire Agreement. The City’s Contract Purchase Agreement, as well as these Terms and Conditions and all related Order Forms and Work Orders, which together comprise this Service Contract, constitute the entire agreement between the parties relating to its subject matter and supersede all prior and contemporaneous agreements concerning such subject matter, whether written or oral.
14.9 Effectiveness. This Service Contract will be effective from and after the Effective Date and will continue in effect as stated in Section 12.1.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
15 EXHIBIT A
SERVICE LEVEL AGREEMENT
Uptime Warranty
cQuant warrants that the Uptime percentage, as defined below, will equal or exceed 99.5% in each month throughout the Term (“Uptime Warranty”). The “Uptime Percentage”, during any calendar month, is equal to (x) the number of minutes that Customer is able to access the Service on a continuous basis during that calendar month divided by (y) the total number of available minutes during the same month. For purposes of the foregoing, the Customer will be considered able to access the Service on a continuous basis, and the Uptime calculation will not be affected, during any and all of the following circumstances; (a) planned outages outside of normal business hours where cQuant has provided Customer with a timely Notice of Downtime as described below ; or (b) any interruption in the ability of Customer to access the Service that continues for less than 10 minutes or results from causes beyond cQuant’s control, including, but not limited to (i) any failure in Customer’s own computer systems, telephone equipment, hardware, software or other equipment, (ii) a Force Majeure event due to acts beyond either party's reasonable control, including but not limited to acts of God, government orders, pandemics, natural disasters, war, terrorism, strikes, labor disputes, power failures, or supply chain disruptions; (iii) any act or omission by Customer or any of its users; and (iv) outage or downtime of the services of cQuant’s hosting provider, Amazon Web Service. For purposes of this definition the Service includes the complete operating environment, including the applications, data center and data network, as well as all integrated telecommunications equipment. Service does not include any of the following, if owned or operated by Customer: the data network, any data processing equipment, any telecommunications equipment or services, Internet or broadband service, or any other publicly available data communications facilities utilized by Customer.
Customer shall use, and shall provide to cQuant on demand, all log files, database records, audit logs, and other information reasonably available to enable cQuant to investigate fully all claims for breach of the Uptime Warranty (“Warranty Claims”) and to make a reasonably accurate, good faith judgment regarding the Customer’s due remedy, if any. At Customer’s request cQuant will make available to Customer all information used by cQuant in evaluating Customer’s Warranty Claims. cQuant may establish, and may modify from time to time, reasonable procedures for the submission of Warranty Claims.
NOTICE OF DOWNTIME. cQuant will use commercially reasonable efforts to provide Customer at least 48 hours’ notice of the date, start time, and completion time of any regularly scheduled data center downtime. cQuant will provide notification of downtime by email to Customer’s designated application administrators, and, if requested, to other users within Customer’s organization, provided that Customer has maintained a current email address for each such user in accordance with cQuant’s instructions.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
16 Remedies
Customer’s sole and exclusive remedies for breach of the Uptime Warranty will be as stated below in this section.
If Customer submits a valid Warranty Claim, cQuant will provide Customer with a refund of a portion of the subscription fees, calculated in accordance with the table below.
Uptime in any Calendar Month Remedy
Less than 99.5% but equal to or greater than 95.0% Refund or credit of 10% of one month’s subscription fee
Less than 95.0% but equal to or greater than 90.0% Refund or credit of 15% of one month’s subscription fee
Less than 90.0% Refund or credit of 25% of one month’s
subscription fee
If Customer submits one or more valid Warranty Claims for incidents occurring in each of three consecutive calendar months, then in lieu of the remedies stated in the above table, Customer may terminate its subscription for the Service on 30 days’ written notice, in which event Company will pay Customer a pro-rated refund of the fees paid but not yet earned, within 10 days after Company receives Customer’s demand for the same; provided, however, that any refunds previously paid under the above table will be credited in favor of cQuant.
Support
Severity Levels – Definitions
Severity
Level
Definition
1 System is completely unavailable or is inoperable; i.e. users cannot log into the system or the system performance is degraded such that users are unable to use the system. 2 System is available, but critical business processes and multiple users are substantially impacted. Some business operations can proceed.
3 System is available, but business processes and multiple users are moderately impacted. Severity 3 will also cover situations where a suitable workaround has been established for a Severity 1 or Severity 2 incident. Example: A user’s model run is not completing or is failing. 4 System is available, and a fault is identified that has minor or no business impact. Example: usability issue, cosmetic fault, etc.
Severity Response Times
cQuant will manage incidents to the following severity timing and activity levels:
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
17 Severity Level Response Resolution
1 30 minutes Three Hours
2 Two hours 24 Hours
3 Four hours Five business days. If new code is required, code fix may be scheduled for next monthly release.
4 Within one business day Will be scheduled into a following major software release.
Support Procedures
Requests must be submitted during cQuant’s normal business hours, which are Monday through Friday, 7 AM – 5 PM Mountain Time, excluding bank holidays. cQuant’s standard support procedures are as follows:
a. Requests for support may be submitted by any of the following methods:
Via a dedicated customer support email, provided to customers during their service, or
Via telephone at the number listed on the cQuant website, or Via mail sent to the address listed on the cQuant website. b. cQuant will provide support for certain users via E-mail only, as specified in the appropriate Description of Service.
c. All requests for support must be submitted by one of the specific named users who is licensed to access the Service.
d. Support requests should include as much detail as possible in order to facilitate the resolution process. Required detail includes such items as user name, issue description and urgency, application page being used, document and vendor numbers, number of users affected, date/time, etc.
e. Customer’s application administrator or other contact must be available to assist with further information gathering or resolution testing.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
18 The person signing for the Customer below represents that he or she is duly authorized to sign this document on behalf of the Customer.
Accepted by Customer:
Company Name City of Roseville
Signatory Name (printed) Dominick Casey
Signatory Title City Manager
Signature
Date
Accepted by cQuant.IO, Inc.:
By:
David Leevan, CEO
Date:
cQuant.IO, Inc.
357 South McCaslin Blvd., Suite 200,
Louisville CO 80027
www.cQuant.IO
(The rest of this page is intentionally left blank.)
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
City Council
Communication
Meeting Date: 6/18/2025
Item #: VII.8
File #: 0800-03 & 0201-01
Item ID: 2025-192
Title: American Public Power Association / Department of Energy Cybersecurity Grant Award - Approval of New Capital Improvement Project, Subaward Agreement, Sole Source Vendor Agreement, and Budget Adjustment
Contact: Tom Pontes 916-774-5550 [email protected]
SUMMARY
Staff recommends approval of the establishment of a new Capital Improvement Project (CIP) called the Electric Industrial Control Systems Cybersecurity Technologies Project; approval of an agreement with the American Public Power Association (APPA) for a $174,255 Department of Energy (DOE) grant subaward and a two-year sole-source vendor agreement with Dragos, Inc. for Industrial Control Systems (ICS) Cybersecurity Technologies, including network hardware, support, and maintenance. As an APPA member, Roseville Electric Utility has the opportunity to acquire a Dragos cybersecurity appliance selfcontained computing system at a minimal cost, enhancing the resilience of its critical infrastructure against evolving cyber threats. Staff also recommends approval of a $255,000 budget adjustment to fund the CIP.
The total cost of the CIP will not exceed $255,000. Funding for the budget adjustment for this CIP is available in the Electric Fund. A total of $174,255 will be reimbursed to the CIP from the APPA/DOE grant revenue. There is no fiscal impact on the General Fund.
RECOMMENDATION
Staff recommends that the City Council:
• Approve the establishment of a new Capital Improvement Project (CIP) called the Electric Industrial Control Systems Cybersecurity Technologies Project; • Adopt a resolution to authorize the City Manager to execute an agreement with the American Public Power Association (APPA) for a $174,255 Department of Energy (DOE) grant subaward as well as a two-year sole-source vendor agreement with Dragos, Inc. for Industrial Control Systems (ICS) Cybersecurity Technologies, including network hardware, support, and maintenance; and • Adopt an ordinance approving a $255,000 budget adjustment to fund the Electric Industrial Controls Systems Cybersecurity Technologies Project CIP.
BACKGROUND
Roseville Electric Utility (REU) operates a power system Operational Technology Network, which is critical infrastructure for managing, monitoring, and controlling power generation, distribution, and maintenance.
The security of this network is paramount to maintaining REU's operations and ensuring the reliable delivery of electricity to the community. In September 2022, the DOE and APPA entered into a cooperative agreement to expedite the adoption and deployment of cybersecurity technologies for municipal utilities.
This initiative aims to address key cybersecurity challenges and maximize the effectiveness of deployed solutions for the benefit of the electric industry. As an APPA member, REU has the opportunity to acquire a Dragos cybersecurity appliance self-contained computing system at a minimal cost, enhancing the resilience of its critical infrastructure against evolving cyber threats.
To participate in this initiative, REU proposes to establish a $255,000 Electric Industrial Control Systems Cybersecurity Technologies Project CIP and implement a two-year vendor agreement with Dragos, Inc. in the amount of $174,255 to support the work activities associated with the APPA/DOE grant. The remaining funds will be utilized for additional network infrastructure needed to support project implementation.
FISCAL IMPACT
The total cost of the Electric Industrial Controls Systems Cybersecurity Technologies Project CIP will not exceed $255,000. Funding for the budget adjustment for this CIP is available in the Electric Fund. A total of $174,255 will be reimbursed to the CIP from the APPA/DOE grant revenue. There is no fiscal impact on the General Fund.
ENVIRONMENTAL REVIEW
The California Environmental Quality Act (CEQA) does not apply to activities that will not result in a direct or reasonably foreseeable indirect physical change in the environment, or is otherwise not considered a project as defined by CEQA Statute §21065 and CEQA State Guidelines §15060(c)(3) and §15378. The work associated with the Electric Industrial Controls Systems Cybersecurity Technologies Project CIP meets the above criteria and is not subject to CEQA. No additional environmental review is required.
CITY COUNCIL STRATEGIC PLAN/OVERARCHING GOALS
1. Ensure a safe and healthy community
2. Remain fiscally responsible in a changing world
4. Invest in well-planned infrastructure and growth
Respectfully Submitted,
Tom Pontes, Assistant Electric Utility Director
Daniel Beans, Electric Utility Director
ATTACHMENTS:
1. Resolution 25-202
2. Roseville Subaward
3. Dragos Vendor Agreement
4. Quote
5. Ordinance 6960
REVIEWERS:
Tom Pontes, Electric Department - All Created/Initiated - 5/29/2025 Tom Pontes, Electric Department - All Approved - 5/29/2025 Shawn Matchim, Electric Department - All Approved - 5/29/2025 Daniel Beans, Electric Department - All Approved - 5/29/2025 Gretchen Hakala, City Attorney Department Approved - 6/2/2025 Katrina Six, City Clerk Department Approved - 6/4/2025
Dennis Kauffman, City Manager Department - Assistant City Manager Approved - 6/4/2025 Michelle Sheidenberger, City Attorney Department Approved - 6/6/2025
Dominick Casey, City Manager Department - City Manager Approved - 6/6/2025 Katrina Six, City Clerk Department Final Approval - 6/6/2025
RESOLUTION NO. 25-202
APPROVING A SUBAWARD AGREEMENT, BY AND BETWEEN THE CITY OF
ROSEVILLE AND THE AMERICAN PUBLIC POWER ASSOCIATION, AND A VENDOR AGREEMENT BY AND BETWEEN THE CITY OF ROSEVILLE AND DRAGOS, INC.,
AND AUTHORIZING THE CITY MANAGER TO EXECUTE THE AGREEMENTS
ON BEHALF OF THE CITY OF ROSEVILLE
WHEREAS, a Subaward Agreement (known as DOE Cooperative Agreement DECR0000015 or “CR15-025 V15.5c”) by and between the City of Roseville and the American Public Power Association, has been reviewed by the City Council to receive grant funds from the United States Department of Energy for the purpose of facilitating the rapid adoption and deployment of industrial control systems cybersecurity technologies for distribution and municipal utilities; and
WHEREAS, a Vendor Agreement in Support of American Public Power Association and Department of Energy Cooperative Agreement DE-CR0000015 by and between the City of Roseville and Dragos, Inc., a Delaware corporation, has been reviewed by the City Council; and NOW, THEREFORE, BE IT RESOLVED by the City Council of the City of Roseville that the City of Roseville accepts the United States Department of Energy grant award through the American Public Power Association, and the City Manager is hereby authorized to execute the aforementioned Subaward Agreement and any subsequent revisions that effectuate the overall purpose of the agreement, so long as any such revisions are non-substantive or ministerial in nature and have been approved by the City Attorney’s Office.
BE IT FURTHER RESOLVED by the City Council of the City of Roseville that the City Manager is hereby authorized to execute the aforementioned Vendor Agreement with Dragos, Inc. and any subsequent revisions that effectuate the overall purpose of the agreement, so long as any such revisions are non-substantive or ministerial in nature and have been approved by the City Attorney’s Office.
BE IT FURTHER RESOLVED that as the grant recipient, the City of Roseville agrees to comply with all conditions and requirements related to the award.
PASSED AND ADOPTED by the Council of the City of Roseville this ___ day of ______________, 2025, by the following vote on roll call:
AYES COUNCILMEMBERS:
NOES COUNCILMEMBERS:
ABSENT COUNCILMEMBERS:
______________________________
MAYOR
ATTEST:
________________________
City Clerk
DOE Cooperative Agreement
DE-CR0000015
Subaward to Facilitate the Rapid Adoption and Deployment of Industrial Control Systems Cybersecurity Technologies for Distribution and Municipal Utilities
City of Roseville
CR15-025
Revision 0
_____________
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
2 Table of Contents
1. Subaward Summary.................................................................................................................4
1.1. Introduction .........................................................................................................................4
1.2. City Developing and Deploying Cybersecurity Defense......................................................4
1.3. Project Purpose....................................................................................................................4
1.4. Project Objectives for APPA and City ..................................................................................4
2. Project Execution.....................................................................................................................5
2.1. Scope of Project Funding.....................................................................................................5
2.2. Project Schedule ..................................................................................................................5
2.3. Payments..............................................................................................................................5
2.4. Cost Sharing .........................................................................................................................6
2.5. Data Collection and Sharing ................................................................................................7
2.6. Reporting..............................................................................................................................7
2.7. Confidentiality......................................................................................................................8
3. APPA Requirements................................................................................................................8
3.1. APPA Role.............................................................................................................................8
3.2. Data Collection and Sharing ................................................................................................8
4. City Requirements ...................................................................................................................9
4.1. City Role ...............................................................................................................................9
4.2. Data Collection and Sharing ..............................................................................................11
4.3. Reporting ...........................................................................................................................11
4.4. Invoicing .............................................................................................................................12
4.5. Certificate of Assurance and Attestation ..........................................................................13
4.6. News Releases, Publications, Marketing, Advertising ......................................................14
4.7. Foreign National Access.....................................................................................................15
4.8. Export Controls ..................................................................................................................15
5. City Imposed Vendor Requirements .....................................................................................15
5.1. City agrees to require the following from Vendor(s) in each Vendor Agreement:..........15
5.2. Vendor Role .......................................................................................................................15
5.3. Data Collection and Sharing ..............................................................................................16
5.4. Reporting ...........................................................................................................................16
5.5. Invoicing .............................................................................................................................16
5.6. News Releases, Publications, Marketing, Advertising ......................................................17
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
3 5.7. Foreign National Access.....................................................................................................17
5.8. Anti-Lobbying.....................................................................................................................18
5.9. Domestic Preference for Procurements ...........................................................................18
5.10. Termination of Vendor Agreements .................................................................................18
6. Miscellaneous ........................................................................................................................19
6.1. Language of Agreement. ...................................................................................................19
6.2. Limitation of Liability. ........................................................................................................19
6.3. Entire Agreement. .............................................................................................................19
6.4. Counterparts......................................................................................................................19
6.5. No Construction Against Drafter .......................................................................................19
6.6. Assignment. .......................................................................................................................20
6.7. Severability.........................................................................................................................20
6.8. No Waiver. .........................................................................................................................20
6.9. Headings. ...........................................................................................................................20
6.10. Force Majeure....................................................................................................................20
6.11. Binding Effect.....................................................................................................................20
6.12. Termination........................................................................................................................20
6.13. Insurance............................................................................................................................21
6.14. Notice.................................................................................................................................21
7. Revision Controls ..................................................................................................................22
7.1. Changes, Modifications, Amendments. ............................................................................22
7.2. Revision Control Log ..........................................................................................................22
8. References and Attachments..................................................................................................22
8.1. Incorporated by reference into this Subaward.................................................................22
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
4 1. Subaward Summary
1.1. Introduction
1.1.1. This Subaward is made and entered into by and between the American Public Power Association (“APPA”) and the City of Roseville - City of Roseville City, a Municipal Electric City (“City”). APPA and City are referred to herein individually as “Party” and collectively as “Parties.”
1.2. City Developing and Deploying Cybersecurity Defense
1.2.1. Name of Organization: City of Roseville
1.2.2. Address: 2090 Hilltop Cir, Roseville, CA, 95747
1.2.3. Number of meters impacted by the technology deployment: 69,767
1.2.4. Unique Entity ID assigned by SAM.gov: W49TKZLUYCJ3
1.2.5. Tax Exempt: No
1.3. Project Purpose
1.3.1. The Department of Energy (“DOE”) entered into a cooperative agreement with APPA, Award Number DE-CR0000015, dated September 28, 2022, to facilitate the rapid adoption and deployment of Industrial Control Systems (“ICS”) Cybersecurity Technologies for Distribution and Municipal Utilities (the “Cooperative Agreement”), a copy of the Cooperative Agreement Terms and Conditions is referenced as “Exhibit 7” “Subaward Business Confidential and Proprietary Information.”
1.3.2. APPA contracts with City through this subaward (“Subaward”) to help the City address and overcome key cybersecurity challenges and maximize the longterm robustness and overall effectiveness of deployed solutions for the benefit of the whole electric industry.
1.4. Project Objectives for APPA and City
1.4.1. Implement measures or technologies that enhance City’s detection, mitigation, and forensic capabilities.
1.4.2. Identify and deploy technologies and systems that enable near real time situational awareness and response capabilities in critical ICS and Operational Technology (“OT”) networks.
1.4.3. Reinforce and enhance the cybersecurity posture of critical infrastructure Information Technology (“IT”) networks.
1.4.4. Deploy technologies to increase visibility of threats in ICS and OT systems.
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
5 2. Project Execution
2.1. Scope of Project Funding
2.1.1. “Exhibit 7,” which is referenced and incorporated herein, sets forth the Scope(s) of Work (“Scope of Work”) for the Project.
2.1.2. City agrees to include language substantially similar to that of Exhibit 7 in each agreement executed between City and an entity providing services to City pursuant to a Scope of Work (each a “Vendor” and each agreement a “Vendor Agreement”), which APPA recognizes is subject to Vendor Agreement(s).
2.2. Project Schedule
2.2.1. Dates covered under this Subaward: from the last date signed below ("Effective Date”) until Project End Date, unless terminated early as permitted herein ("Term”).
2.2.2. The Project shall commence on the Effective Date.
2.2.3. The Project End Date is the earlier of March 31, 2028, or the latest date on which any Vendor Agreement expires or is terminated early as permitted therein ("Project End Date”).
2.2.4. The schedules of all Vendor Agreement(s) shall comport with Section 2.2 of this Subaward.
2.3. Payments
2.3.1. Vendor shall furnish through one or more Vendor Agreements the Products and Services described in Exhibit 7 “Scope(s) of Work”.
2.3.2. City shall comply with the "Payments” terms contained in Exhibit 7 Section 3.3.
2.3.3. The total amount to be paid by APPA shall not exceed the total contract value as set forth in the Vendor Agreement(s) (“Not to Exceed Value”). The Not to Exceed Value shall include the total amount to be paid by APPA for reimbursable out-of-pocket or incidental expenses as set forth in the Vendor Agreement(s) (“Maximum Incidental Reimbursement”).
2.3.4. Any variance that would result in an amount to be paid in excess of the Not to Exceed Value under the respective Vendor Agreement shall require an amendment to this Subaward.
2.3.5. All reasonable efforts shall be made by APPA and its representatives to review and ensure timely payments are made.
2.3.6. Where APPA cannot verify invoices, for example due to the absence or deficiency of proof of purchase, third-party invoice, or other forms of receipts, payment shall be withheld until such verification can be made.
2.3.7. APPA shall reimburse Vendor(s) and/or City as described in Exhibit 7 for the costs incurred under any Vendor Agreement(s) based on the actual costs incurred by City under such Vendor Agreement(s) in an amount not to exceed
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
6 the “Total Project Subaward Amount” of $174,720.
2.3.7.1 Fees or profits, including foregone fees or profits are not allowable as Project costs under any resulting award. The Project may only incur such costs that are allowable and allocable to the Project as determined in accordance with the applicable cost principles prescribed in FAR Part 31 for For-Profit entities and 2 C.F.R. Part 200 Subpart E – Cost Principles for all other non-Federal entities.
2.3.7.2 APPA shall not reimburse City for Cost Share Funds (defined below).
Cost Share Funds are not allowable as Project costs under any resulting award.
2.3.8. APPA reserves the right in its sole and absolute discretion to withhold or deny payment for any Vendor invoice that does not comply, in all material respects, with the requirements of this Subaward. APPA shall withhold payment in full for any partially disputed invoice.
2.3.9. If Vendor brings a claim for services it has rendered for City but was denied payment, either by City or by APPA, because the Vendor’s invoice does not comply with the requirements of the Subaward, City agrees to reimburse APPA for costs it incurred in resolving the disputed invoice with Vendor.
2.4. Cost Sharing
2.4.1. For each Subaward, City shall contribute Cash Cost Share, and/or In-Kind Cost Share (as defined below, and collectively “Cost Share Funds”) in an amount not less than the percentage specified of 10%. City shall maintain records of all costs incurred under a Vendor Agreement that City claims qualify as Cost Share Funds. APPA reserves the right to conduct periodic audits of all such records. APPA reserves the right to reduce the Cost Share Percentage at its sole discretion.
2.4.2. Cost Share Funds are subject to the following conditions:
2.4.2.1 All Cost Share Funds must be reasonable and necessary for the performance of the Project.
2.4.2.2 Cost Share Funds shall not be reimbursed by APPA.
2.4.2.3 Funds from any Federal sources (which includes federally funded research and development center sub-recipients) are not permitted to be Cost Share Funds and Cost Share Funds shall be provided by nonFederal sources (which include any source not originally derived from Federal funds) unless otherwise authorized by statute.
2.4.2.4 Calculations of non-Federal funds shall comply with 2 C.F.R. 910.122 Cost Sharing (EPACT).
2.4.2.5 “Cash Cost Share” shall refer to all contributions to the Project made by APPA, City, Vendor(s), and third parties for costs incurred and paid
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
7 for during the Project, including but not limited to payments for personnel, supplies, and equipment using a Party’s own resources. All items or services subject to reimbursement are Cash Cost Share.
2.4.2.6 “In Kind Cost Share” shall refer to all contributions to the project made by APPA, City, Vendor(s) or third parties where a value of the contribution can be readily determined, verified, and justified but where no actual cash is transacted in securing the good or service comprising the contribution, including but not limited to volunteer personnel hours, the donation of space, and donation of equipment.
The cash value and calculation for all In Kind Cost Share contributions must be justified and explained in writing by City.
2.5. Data Collection and Sharing
2.5.1. No party (including other City(s), APPA, Vendor(s), DOE, and the general public, collectively, “Outside Parties”) may have access to City’s raw data as a result of this Project without City’s written approval.
2.5.2. City shall exercise reasonable efforts in safeguarding its raw data and preventing unauthorized access of raw data by Outside Parties.
2.5.3. City may elect to share raw or anonymized data with APPA through this agreement. No data will be shared from City without the written consent of City.
2.5.4. Any data generated and shared pursuant to Section 2.5.3 as a result of this Project shall be anonymized and de-identified (“Anonymized Data”), before such data is shared with Outside Parties and may only be used in ways that do not reveal City’s identity or any identifiable portions of its facilities or systems.
2.5.5. Subject to Section 2.5.3, once the data generated as a result of this Project becomes Anonymized Data, Outside Parties, except the general public, may access such data without additional requirements, tools, or applications.
2.5.6. Subject to Section 2.5.3, APPA may share Anonymized Data with Outside Parties and other organizations or entities at the discretion of APPA through a license or other appropriate methods.
2.6. Reporting
2.6.1. Upon APPA’s request, City and Vendor(s) shall submit to APPA reports that include, but are not limited to progress towards defined acceptance criteria under the applicable Scope of Work.
2.6.2. If APPA requires City and Vendor(s) to submit a reporting or disclosure pursuant to Section 2.6.1, City shall not be identified in such reporting or disclosure or in any data files. Such reports, disclosures, or files shall be anonymized and
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
8 aggregated to the extent possible.
2.6.3. If APPA is required to disclose non-anonymous and/or non-aggregated data that may specifically identify Utilities to DOE, City and APPA shall expend best efforts to satisfy these requirements in good faith.
2.7. Confidentiality
2.7.1. In the event that business proprietary and/or confidential information needs to be disclosed as part of a reporting or disclosure, the disclosing party shall inform the recipient in writing that the shared information constitutes business proprietary and/or confidential information and shall only be shared with individuals who have the need-to-know for the sole purpose of fulfilling the obligations of this Project.
3. APPA Requirements
3.1. APPA Role
3.1.1. Present materials to DOE, APPA leadership, and APPA members. City and Vendor(s) may be included in meetings and presentations at APPA's discretion.
APPA shall keep City apprised of meetings with DOE.
3.1.2. Assign various APPA staff and/or contracted technical consultants to work with City and/or Vendor(s). APPA staff representative shall review documents developed by the City and/or Vendor(s) in sufficient detail to confirm understanding by others of any purpose, timing, and deliverables.
3.1.3. Provide edits to APPA deliverables to be submitted to DOE, APPA leadership, and APPA members.
3.1.4. Provide appropriate and timely access to systems, staff, and facilities that are essential to completing the Project successfully.
3.1.5. Designate one (1) employee to serve as a primary point of contact.
3.1.6. Serve as the first point of escalation for any Project-related requests or issues.
3.1.7. Provide access to all necessary (as per mutual agreement between APPA and City) proprietary information, applications, and systems.
3.1.8. Provide a central repository, such as a SharePoint or other secure site, to allow for data, drawings, and reports to be uploaded and to maintain such central repository and provide access to City and its employees and agents to such central repository.
3.1.9. Provide copies of available information and drawings pertinent to the Project.
3.2. Data Collection and Sharing
3.2.1. All data maintained by APPA, including raw or Anonymized Data, because of Project efforts, are subject to APPA’s existing cybersecurity plans, addendums,
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
9 and policies as described in Exhibit 7 as the APPA Data Management Plan.
3.2.2. APPA shall treat any raw data that it may receive or to which APPA is granted access under this Subaward as confidential and may make such data available only to those individuals that have a need-to-know and are bound by obligations of confidentiality and non-use described herein and as set forth in “Exhibit 2”, the APPA-Member executed Non-Disclosure Agreement.
3.2.3. APPA shall hold all intellectual property rights and ownership of Anonymized Data generated and shared by City pursuant to Section 2.5.3, and materials resulting from efforts during this Project and as a result of the analysis and assessments conducted by City.
3.2.4. APPA may validate, assess, or analyze the Anonymized Data obtained as a result of the Project through independent review by third parties external to the Project.
3.2.5. APPA shall mark data or other documents that are business proprietary and/or confidential to APPA with the following marking: “APPA Confidential Information – Internal Use Only” when shared with APPA members, DOE, or other individuals or entities that have the need-to-know, as determined by APPA.
4. City Requirements
4.1. City Role
4.1.1. City shall provide APPA confirmation of City’s registration and active status in System for Award Management (“SAM”).
4.1.2. City shall work with APPA and its representatives to develop and deploy cybersecurity defense.
4.1.3. City shall actively participate with APPA and its representatives in developing and deploying cybersecurity defense with Vendor(s) listed in Exhibit 7, Table 2.
4.1.4. City shall actively participate as a member of a working group to provide feedback on possible future deployments.
4.1.5. City shall provide feedback to APPA about the efficacy of the chosen technologies and/or services in meeting the acceptance criteria described in Exhibit 7.
4.1.6. City shall work with Vendor(s) to decide on required architecture and design elements.
4.1.7. City shall be a member of the Cybersecurity Defense Community (“CDC”).
4.1.8. City agrees to provide feedback on any barriers or pitfalls encountered in the procurement, deployment, and implementation processes, as well as steps taken to address such barriers or pitfalls. Feedback may be provided through
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
10 participation in the applicable CDC Working Group (which consists of various APPA members) via meetings, phone calls, emails, web-based forms, or a combination thereof.
4.1.9. City shall use the following guidance and standards in performing its obligations under this Subaward:
4.1.9.1 DOE’s Cybersecurity Capability Maturity Model (Version 2.1 or a successor version); and
4.1.9.2 Framework for Improving Critical Infrastructure Cybersecurity of the National Institute of Standards and Technology (Version 1.1 or any successor version).
4.1.10. City shall designate at least one (1) employee to serve as a primary point of contact under this Subaward.
4.1.11. City shall provide DOE authorized representatives reasonable access to facilities, office space, resources, and assistance for the safety and convenience of the government representatives in the performance of their duties.
4.1.12. DOE authorized representatives have the right to make site visits, at mutually acceptable times between DOE and City, to review Project accomplishments and management control systems and to provide technical assistance, if required.
4.1.13. All site visits and evaluations shall be performed in a manner that does not unduly interfere with or delay the work and in accordance with City policies and procedures identified in “Exhibit 1”, City Special Clauses.
4.1.14. City and its representatives shall make all reasonable effort to assist APPA in verifying and demonstrating compliance with all applicable DOE requirements, including but not limited to, those that require certificates of assurance as set forth in Section 4.4 below.
4.1.15. City shall inform its Vendor(s) of the obligation to comply with all applicable requirements set forth in Section 5 by specifying such requirements in the Vendor Agreement(s).
4.1.16. City may only assign, delegate, or subcontract in whole or in part, by operation of law or otherwise, with advance written notice to APPA. Any attempt to assign without APPA’s written consent shall be null and void.
4.1.17. City shall notify APPA prior to any execution, modification, or amendment to a Vendor Agreement(s) and any exhibits that are incorporated into the Vendor Agreement(s). Such notification shall include written confirmation that for each execution, modification or amendment to a Vendor Agreement(s) or any exhibits incorporated into such Vendor Agreement(s), City has flowed down to Vendors(s) all provisions in the Subaward that impose obligations or requirements on vendor(s), including applicable incorporations by reference
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
11 thereto. All notifications pursuant to this Section 4.1.17 shall include the following statement: “City of Roseville confirms in writing that it has flowed down to [Vendor] through [City-Vendor] Agreement all provisions in the Subaward that impose obligations or requirements on [Vendor], including applicable incorporations by reference thereto.”
4.1.18. City shall execute Exhibit 2, the APPA-Member executed Non-Disclosure Agreement directly with APPA.
4.2. Data Collection and Sharing
4.2.1. City may voluntarily make data in its raw format and/or with identifiable information and elements available to Vendor(s), APPA, or DOE with City’s written approval.
4.2.2. If City chooses to share any data in its raw format and/or with member/personally identifiable information and elements, City shall exercise reasonable safeguards to prevent unauthorized disclosure or sharing.
4.2.3. Upon notice to APPA, City may destroy its own raw, individual, identifiable data during the execution of this Project.
4.2.4. City may make available Anonymized Data to other entities that are not listed in Section 4.2.1 above only with APPA’s consent in writing.
4.3. Reporting
4.3.1. City shall provide a “Quarterly Progress Report” to APPA identifying progress towards defined acceptance criteria under the applicable Scope of Work, to include any reports it may have received from Vendor, as defined in Exhibit 7.
4.3.2. City shall provide a Quarterly Progress Report to APPA identifying all Cost Share Funds contributed to date to the Cost Share Amount identified in Exhibit 7. City shall provide such Quarterly Progress Report no later than fifteen (15) days after the end of the quarter or the project conclusion, as defined in Exhibit 7.
4.3.3. City shall provide “Exhibit 3”, the Tangible Personal Property Report SF-428 at the conclusion of the project.
4.3.4. Unless the City provides documentation showing that it is exempt as provided in accordance with Exhibit 7, Amendment 0002, Section d. “Exemptions,” or provides documentation that none of the conditions specified in Exhibit 7, Amendment 0002, Section c.1 are met, City shall report subrecipient executive total compensation by the end of the month following the month during which the subaward is executed in accordance with Exhibit 7, Amendment 0002, Section c. “Reporting of Total Compensation of Subrecipient Executives.”
4.3.5. City may share raw and Anonymized Data in accordance with this Subaward.
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
12 4.3.6. City shall include the proper citation for any sharing of data or reporting that contains the following:
4.3.6.1 Acknowledgment: “This material is based upon work supported by the Department of Energy under Award Number(s) DE-CR0000015.”
4.3.6.2 Disclaimer: “This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or any agency thereof.
The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or any agency thereof.”
4.4. Invoicing
4.4.1. If City is required to submit invoices to APPA pursuant to Section 2.3 and Exhibit 7, City shall:
4.4.1.1 Require Vendor to submit invoices to City in accordance with Exhibit 7, Table 3.
4.4.1.2 As applicable, provide sufficient time under this Subaward and the Vendor Agreement(s) to allow APPA to review invoices.
4.4.1.3 As applicable, indicate the time spent and services rendered, together with such supporting documentation as APPA reasonably requires.
4.4.1.4 As applicable, include a description of activities during the period being invoiced, including lists of tasks accomplished.
4.4.1.5 Provide copies of receipts to APPA for approval in writing to get reimbursement.
4.4.1.6 Include the following information in all invoices:
4.4.1.6.1 Bill to: APPA as addressee
4.4.1.6.2 City name: City of Roseville
4.4.1.6.3 City address
4.4.1.6.4 City Subaward Unique Identifier
4.4.1.6.5 DOE Cooperative Agreement number: DE-CR0000015
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
13 4.4.1.6.6 DOE Cooperative Agreement Task number: See Exhibit 7 Tables 2 and 3
4.4.1.6.7 Vendor Name
4.4.1.6.8 Vendor Agreement amount
4.4.1.6.9 Vendor Agreement duration (MM/YY – MM/YY)
4.4.1.6.10 Subaward Year-to-Date invoiced amount
4.4.1.6.11 Agreement-to-Date invoiced amount for Vendor identified in Section 4.4.1.6.8 above.
4.4.1.6.12 Current invoice number
4.4.1.6.13 Invoice amount
4.4.1.6.14 Period services were rendered
4.4.1.6.15 Vendor Invoice
4.4.1.7 Submit invoices no later than fifteen (15) days after each month’s end or when work is completed, and acknowledge invoices submitted more than ninety (90) days late to APPA are subject to possible rejection/non-payment as set forth in the Vendor Agreement.
4.5. Certificate of Assurance and Attestation
4.5.1. Upon APPA request, City shall provide assurance that the process City has undertaken to solicit the subaward/subcontract complies with City’s written procurement procedures as set forth in 2 C.F.R. 200.318, using the Certificate of Assurance form provided in “Exhibit 4.”
4.5.2. Upon APPA request, City shall provide assurance that no planned, actual, or apparent conflict of interest exists between APPA and City and City is in compliance with APPA’s written standards of conduct, using the Certificate of Assurance form provided in Exhibit 4.
4.5.3. Upon APPA request, City shall provide assurance that City and Vendor(s) are not designated by any federal or state entity as debarred or suspended entities, using the Certificate of Assurance form provided in Exhibit 4.
4.5.4. Upon APPA request, City shall provide assurance that City has flowed down to Vendor(s) through the respective Vendor Agreement(s) (i.e., subaward(s)/subcontract(s)) all award provisions in the Subaward, including applicable incorporations by reference thereto, that impose obligations or requirements on Vendor(s), using the Certificate of Assurance form provided in Exhibit 4.
4.5.5. Upon APPA request, City shall provide assurance that the process City has undertaken for equipment and other capital expenditures complies with City’s written procurement procedures as set forth in 2 C.F.R. 200.313, using the Certificate of Assurance form provided in Exhibit 4.
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
14 4.5.6. City shall demonstrate desired maturity of its Cybersecurity Program in accordance with APPA CDC defined methodology to vet possible candidates based on various criteria and ability to deploy, operate, and maintain OT security solutions successfully, as described in Exhibit 4.
4.5.7. City shall demonstrate, by completing the APPA Cybersecurity Scorecard or comparable capability measure, a determined level of capability prior to deployment of sensors, as described in Exhibit 4.
4.5.8. City has selected a vendor to provide operational technology cybersecurity as part of and consistent with the terms and conditions of its subaward (Subaward) with APPA, which is made pursuant to and consistent with APPA’s DOE Cooperative Agreement DE-CR0000015, as described in Exhibit 4.
4.5.9. City is: (1) an independent entity; (2) governed by an independent board of directors; and (3) is not subject to direction or oversight by APPA. For these reasons, City makes independent decisions and investments based upon its individual needs, desires, and constraints. As such, City affirms that the technology identified in Exhibit 7 was selected solely based on its independent selection criteria for the Subaward, as described in Exhibit 4.
4.5.10. City affirms that APPA advised that the selection of the vendor was to be made independently and that APPA was technology-neutral with respect to the choice of vendor for the Subaward, as described in Exhibit 4.
4.5.11. City affirms that, in addition to APPA’s advisement of its technology neutralposition, APPA did not act or provide financial incentives inconsistent with the technology-neutral approach to the selection of the Vendor, as described in Exhibit 4.
4.6. News Releases, Publications, Marketing, Advertising
4.6.1. Only with APPA prior approval does APPA consent to the City’s use of APPA name in marketing and advertising materials, including the City’s website.
4.6.2. APPA shall not use City’s name, logo, or trademark in any publication or press release without City’s prior written consent.
4.6.3. News releases pertaining to the selection of Vendor(s) shall not be made without prior approval by APPA and City; provided, that for avoidance of doubt, disclosure to City’s City Council or Board shall not constitute a news release, publication, marketing, or advertising so long as such disclosure is not made in a public forum where members of the public may be in attendance.
4.7. Foreign National Access
4.7.1. If the City (including any of its subrecipients and contractors) anticipates involving foreign nationals in the performance of this award, the City will be
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
15 required to provide DOE with specific information about each foreign national to satisfy requirements for foreign national participation. A “foreign national” is defined as any person who is not a United States citizen by birth or naturalization. The volume and type of information collected may depend on various factors associated with the award. DOE concurrence may be required before a foreign national can participate in the performance of any work under this award. Approval for foreign nationals from countries identified on the U.S.
Department of State’s list of State Sponsors of Terrorism must be obtained from DOE before they can participate in the performance of any work under this award. City must include this term in any subaward and in any applicable contractual agreement(s) associated with this Subaward and in accordance with Exhibit 7 Cooperative Agreement Terms and Conditions, “Foreign National Participation.”
4.8. Export Controls
4.8.1. City shall maintain formal export control management programs sufficient to support all activities throughout the Scope of Work period of performance for each Scope of Work executed under this Subaward. City shall be responsible for oversight of all Vendor(s) to assure the adequacy of their formal export control management programs.
5. City Imposed Vendor Requirements
5.1. City agrees to require the following from Vendor(s) in each Vendor Agreement:
5.2. Vendor Role
5.2.1. Vendor(s) shall comply with the requirements of 2 C.F.R. part 200 and 2 C.F.R.
Part 200 Appendix II, as modified by 2 C.F.R. 910, to the extent applicable to Vendor(s).
5.2.2. Vendor(s) shall provide City confirmation of Vendor’s registration and active status in SAM.
5.2.3. Vendor(s) providing technology solutions shall provide City answers to the North American Transmission Forum Supply Chain Questionnaire or similar industry accepted questionnaire.
5.2.4. Vendor(s) shall execute a Non-Disclosure Agreement consistent with the “Exhibit 5” Non-Disclosure Agreement Template.
5.3. Data Collection and Sharing
5.3.1. Vendor(s) identified in Exhibit 7, Table 2 for tasks under this Subaward shall be responsible for data collection and sharing during the Term of this Project.
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
16 5.3.2. Vendor(s) shall make available and grant exclusive control of Anonymized Data that is not identifiable or attributable to City from the deployed sensors to APPA.
5.3.3. Vendor(s) may make Anonymized Data available to APPA members as determined by APPA within a period deemed reasonable but no later than the Project End Date.
5.4. Reporting
5.4.1. Vendor(s) shall provide a Quarterly Progress Report to City identifying progress towards defined acceptance criteria under the applicable Scope of Work.
5.4.2. Vendor(s) shall include the proper citation for any sharing of data or reporting that contains the following:
5.4.2.1 Acknowledgment: "This material is based upon work supported by the Department of Energy under Award Number(s) DE-CR0000015."
5.4.2.2 Disclaimer: "This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or any agency thereof.
The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or any agency thereof."
5.5. Invoicing
5.5.1. Vendor(s) shall:
5.5.1.1 Submit invoices to City as required pursuant to Section 2.3 and Exhibit
7. 5.5.1.2 As applicable, provide sufficient time under this Subaward and the Vendor Agreement(s) to allow City and APPA to review invoices.
5.5.1.3 As applicable, indicate the time spent and services rendered, together with such supporting documentation as APPA reasonably requires.
5.5.1.4 As applicable, include a description of activities during the period being invoiced, including lists of tasks accomplished.
5.5.1.5 Provide copies of receipts to City and APPA for approval in writing to
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
17 get reimbursement.
5.5.1.6 Include the following information in all invoices:
5.5.1.6.1 Bill to: City of Roseville] as addressee
5.5.1.6.2 Ship to: City of Roseville, as applicable
5.5.1.6.3 City name: City of Roseville
5.5.1.6.4 Vendor name
5.5.1.6.5 Vendor address
5.5.1.6.6 Unique contract identifier
5.5.1.6.7 DOE Cooperative Agreement number: DE-CR0000015
5.5.1.6.8 DOE Cooperative Agreement Task number: See Exhibit 7 Tables 2 and 3
5.5.1.6.9 Vendor Agreement amount
5.5.1.6.10 Vendor Agreement duration (MM/YY – MM/YY)
5.5.1.6.11 Agreement-to-Date invoiced amount
5.5.1.6.12 Current invoice number
5.5.1.6.13 invoice amount
5.5.1.6.14 Period services were rendered
5.5.1.6.15 Detailed list of charges
5.5.1.7 Submit invoices no later than fifteen (15) days after each month’s end or when work is completed, and acknowledge invoices submitted more than ninety (90) days late to City and APPA are subject to possible rejection/non-payment as set forth in the Vendor Agreement.
5.6. News Releases, Publications, Marketing, Advertising
5.6.1. Only with APPA prior approval does APPA consent to Vendor(s)’s use of APPA name in marketing and advertising materials, including the Vendor(s)’s website.
5.6.2. APPA shall not use Vendor(s)’s name, logo, or trademark in any publication or press release without Vendor(s)’s prior, written consent.
5.6.3. News releases pertaining to the selection of Vendor(s) shall not be made without prior written approval by APPA and City.
5.7. Foreign National Access
5.7.1. If the City (including any of its subrecipients and contractors) anticipates involving foreign nationals in the performance of this award, the City will be required to provide DOE with specific information about each foreign national to satisfy requirements for foreign national participation. A “foreign national” is defined as any person who is not a United States citizen by birth or naturalization. The volume and type of information collected may depend on
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
18 various factors associated with the award. DOE concurrence may be required before a foreign national can participate in the performance of any work under this award. Approval for foreign nationals from countries identified on the U.S.
Department of State’s list of State Sponsors of Terrorism must be obtained from DOE before they can participate in the performance of any work under this award. City must include this term in any subaward and in any applicable contractual agreement(s) associated with this Subaward and in accordance with Exhibit 7 Cooperative Agreement Terms and Conditions, “Foreign National Participation.”
5.8. Anti-Lobbying
5.8.1. Vendor shall certify to City that it will not and has not used Federal appropriated funds to pay any person or organization for influencing or attempting to influence an officer or employee of any agency, a member of Congress, officer or employee of Congress, or an employee of a member of Congress in connection with obtaining any Federal contract, grant or any other award covered by 31 U.S.C. 1352.
5.9. Domestic Preference for Procurements
5.9.1. As appropriate and to the extent consistent with law, Vendor should, to the greatest extent practicable, provide a preference for the purchase, acquisition, or use of goods, products, or materials produced in the United States (including but not limited to iron, aluminum, steel, cement, and other manufactured products).
5.10. Termination of Vendor Agreements
5.10.1. The termination of a Vendor Agreement by either Party shall release APPA from the obligation to make payments for Products and Services incurred since the date of termination.
5.10.2. City may terminate a Vendor Agreement for convenience if it believes, in its sole discretion that it is in the best interest of the City to do so, by providing thirty (30) day advance written notice to Vendor according to the procedures established in the Vendor Agreement.
5.10.3. Either Party may terminate a Vendor Agreement for cause as the result of a material breach of the Agreement by the other Party. Termination for cause shall be effective immediately upon receipt of written notice to the other Party according to the procedures established in the Vendor Agreement.
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
19 6. Miscellaneous
6.1. Language of Agreement.
6.1.1. All communications, correspondences, and notices provided or to be provided pursuant to this Subaward, shall be made in the English language.
6.2. Limitation of Liability.
6.2.1. Except for third party indemnity obligations described in this Subaward, neither party shall be liable (whether in contract, tort, negligence, strict liability, statutory liability, or otherwise) to the other for incidental, consequential, or indirect damages, including lost profits, lost revenue(s), or lost goodwill, whether or not the possibility of such damages has been disclosed or could have been reasonably foreseen.
6.2.2. Nothing in this Subaward or any Exhibits hereto shall be construed to: (i) to abrogate the full scope of the limits on DOE’s liability available under all applicable law, or (ii) to constitute any agreement on behalf of DOE to any joint and several liability whatsoever.
6.3. Entire Agreement.
6.3.1. This Subaward, including without limitation any Exhibits hereto that are incorporated by reference herein, shall constitute the entire agreement between City and APPA and shall supersede any other agreements, either oral or written, between City and APPA.
6.4. Counterparts
6.4.1. This Subaward may be executed in one or more counterparts, each of which shall constitute an original, and all of which shall together constitute only one agreement between the Parties. The signatures of all Parties need not be on the same counterpart for valid execution.
6.5. No Construction Against Drafter
6.5.1. This Subaward was drafted and reviewed jointly by the Parties and, in construing and interpreting this Agreement, no provision of this Agreement shall be construed or interpreted against any Party based upon the contention that this Agreement or a portion of it was purportedly drafted or prepared by that Party.
6.6. Assignment.
6.6.1. This Subaward may not be assigned by either City or APPA. Neither City nor APPA may delegate any of its obligations under this Subaward without the prior
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
20 written consent of the other.
6.6.2. Nothing in this Subaward (whether express or implied) is intended to confer upon any person or entity other than APPA and City and their respective successors and permitted assigns, any rights or remedies under or by reason of this Subaward.
6.7. Severability.
6.7.1. If any provision of this Subaward is held invalid or unenforceable by a court of law or competent arbitrator, the remaining provision(s) will be enforced to the maximum extent possible. In such event, the remainder of this Subaward shall continue in full force and effect.
6.8. No Waiver.
6.8.1. In the event that City or APPA fails to enforce any provision of this Subaward, the failure shall not constitute a waiver of any future enforcement of that provision or of any other provision. Waiver of any part or sub-part of this Subaward will not constitute a waiver of any other part or sub-part. Any waiver made hereunder shall only be valid if set forth in a writing signed by the Parties hereto.
6.9. Headings.
6.9.1. Headings under this Subaward are for convenience and organization, only.
Headings shall not affect the meaning of any provisions of this Subaward.
6.10. Force Majeure.
6.10.1. Neither City or APPA shall be liable for any failure to perform due to causes beyond its reasonable control including, but not limited to, acts of God, epidemic, pandemic, acts of civil authorities, acts of military authorities, terrorism, cyberattacks, riots, embargoes, acts of nature, and natural disasters.
6.11. Binding Effect.
6.11.1. City and APPA each warrant that its signatory of this Subaward has the unencumbered right to enter into this Subaward on its behalf. This Subaward shall be binding upon and shall inure to the benefit of City and APPA and their respective successors and permitted assigns.
6.12. Termination
6.12.1. City may terminate this Subaward prior to City executing any contract with Vendor(s) relating to Scopes of Work identified in Section 2.1 by written notice to APPA.
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
21 6.12.2. If City terminates this Subaward after APPA distributes funds for services under the Scope of Work, City shall be responsible for repayment of any or all funds City has received from APPA except for Legal Services relating to City’s execution of applicable contracts under the Scope of Work.
6.12.3. If APPA terminates this Subaward before the scheduled Project End Date through no fault of City, APPA shall pay for costs incurred by Vendor(s) for services that Vendor(s) provided under the Scope of Work before the termination date.
6.12.4. APPA shall maintain the ownership of Anonymized Data up to the date of termination in the event that this Subaward is terminated by either APPA or City pursuant to Sections 6.12.1, 6.12.2, and 6.12.3 above.
6.13. Insurance.
6.13.1. City must, at a minimum, provide the equivalent insurance coverage for real property and equipment acquired with Federal funds as provided to property owned by the recipient.
6.14. Notice.
6.14.1. Any notice, demand, or request provided for in this Subaward shall be in writing and shall be deemed properly served, given, or made if delivered in person or sent by courier service providing next-day delivery or sent by United States mail, registered or certified, postage paid, to the person and to the address specified below:
If to City of Roseville: Leonard Ladd
City of Roseville
2090 Hilltop Cir
Roseville, CA 95747
If to APPA: Richard Condello
American Public Power Association
2451 Crystal Drive, Suite 1000, Arlington VA 22202
[email protected]
If sent by mail, notices shall be effective three (3) business days after deposit in the mail. If hand-delivered, notices shall be effective upon delivery. Either APPA or City may, at any time, by notice to the other pursuant to this section, change the designation or address of the person specified as the one to receive notices.
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
22 7. Revision Controls
7.1. Changes, Modifications, Amendments.
7.1.1. This Subaward may only be changed, modified, and/or amended by the signed written consent of both Parties. To the extent any part or sub-part of such a modified Subaward is held ineffective or invalid by a court of law or competent arbitrator, both Parties agree that the prior, effective revision of this Subaward shall be considered enforceable and valid to the fullest extent, subject to Section 6.5.1 of this Subaward.
7.2. Revision Control Log
7.2.1. Any changes, modifications, and/or amendments to this Subaward shall be memorialized below in “Exhibit 6” (“Revision Control Log”).
8. References and Attachments
8.1. Incorporated by reference into this Subaward
8.1.1. Special Clauses (“Exhibit 1”)
8.1.2. APPA–Member executed Non-Disclosure Agreement (“Exhibit 2”)
8.1.3. SF-428 Tangible Personal Property Report 06/30/20 (“Exhibit 3”)
8.1.4. Certificate of Assurance (“Exhibit 4”)
8.1.5. APPA Non-Disclosure Agreement Template (“Exhibit 5”)
8.1.6. Revision Control Log (“Exhibit 6”)
8.1.7. Exhibit 7 Legal Protection of Confidential Business Data and Proprietary Information. The information presented in Exhibit 7 is considered confidential and proprietary business information and/or trade secret under applicable California law. This exhibit shall be maintained under seal and shall not be disclosed except if mandated by court order or upon explicit written authorization from the City Attorney.
8.1.8. The provisions of 2 C.F.R. Part 200 and 2 C.F.R. Part 200 Appendix II, as modified by 2 C.F.R. 910, to the extent applicable to APPA, City, and/or Vendor. ***SIGNATURE PAGE FOLLOWS***
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
23 American Public Power Association
By:_____________________________
Name: Scott Corwin
Title: President and CEO
Date: ___________
City of Roseville
By:_____________________________
Name:
Title:
Date:
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
24 Exhibit 1
DE-CR0000015
Special Clauses
City of Roseville
City Special Clauses are incorporated as Exhibit 1 to the Subaward between American Public Power Association (“APPA”) and City of Roseville (“City”).
1. Indemnification
1.1 Indemnification by City. To the fullest extent permitted by law, City shall indemnify, defend, and hold harmless APPA and its trustees, members, officers, employees, agents, and their subsidiaries and affiliates, and the Department of Energy (“DOE”) (collectively “APPA Indemnified Parties”) from and against all claims, damages, losses, fines, penalties, and expenses (including but not limited to all fees and charges of attorneys, and other professionals and all court, arbitration, or other dispute resolution costs) arising out of or in connection with this Subaward, provided that any such claim, cost, damage, loss, fine, penalty, or expense is attributable to: (i) bodily injury, sickness, disease, or death, or to injury to or destruction of tangible property but only to the extent caused by the negligent acts, errors, or omissions of City, DOE, a subcontractor, or a person or entity for whom City, DOE, or a subcontractor may be liable; (ii) actual or alleged intellectual property rights, including, without limitation, patents, trademarks, copyrights or corresponding rights; (iii) breach of contract, cyber or physical security incident, including without limitation any data breach, or inadvertent or intentional release of secret, confidential, and/or proprietary information; or (iv) a violation of law but only to the extent attributable to City, DOE, a subcontractor, or a person or entity for whom City, DOE, or a subcontractor may be liable. City’s indemnification obligation exists regardless of whether the claim, damage, loss, fine, penalty, or expense is caused in part by one or more of the APPA Indemnified Parties. But this section does not obligate APPA to indemnify any individual or entity from and against the consequences of that individual's or entity's own negligence. In claims against one or more of the APPA Indemnified Parties by any direct or indirect employee (or the survivor or personal representative of such employee) of City, DOE, a subcontractor, or a person or entity for whom City, DOE, or a subcontractor may be liable, the indemnification obligation under this Subaward will not be limited by a limitation on the amount or type of damages, compensation, or benefits payable under workers’ compensation acts, disability benefit acts, or other employee benefit acts. City’s indemnification obligation will not be limited by any insurance policy. City ‘s indemnification obligation will survive termination of this Subaward.
1.2 Indemnification by Vendor. City shall flow down the following clause in each Vendor Agreement: “Vendor shall indemnify, defend, and hold harmless APPA, and all its officers, directors, managers, agents, and representatives, and DOE with respect to accidents, bodily injury, illness, breach of contract, cyber or physical security incident, including without limitation any data
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
25 breach, or inadvertent or intentional release of secret, confidential, and/or proprietary information, or any other damages or loss, or with respect to any claims arising out of any activities undertaken with the financial support of the APPA or DOE subsidy using Cooperative Agreement funds, whether with respect to persons or property of Vendor or third parties.”
1.3. Indemnification for Non-Payment. City shall flow down the following clause in each Vendor Agreement: “In the event that Vendor disputes APPA’s determination of nonpayment of a Vendor invoice and files a claim against APPA for payment, if APPA succeeds in such claim, City agrees to indemnify and hold harmless APPA and all its officers, directors, managers, agents, and representatives from such Vendor claim.”
2. Jurisdiction, Venue, and Choice of Law. This Subaward shall be governed by federal law, without regard to any state’s conflict of laws provisions. Any dispute arising out of this Subaward shall be heard by the United States District Court for the Eastern District of California, to the extent allowed by the Federal Rules of Civil Procedure. If Federal Courts do not have jurisdiction, disputes shall be heard by Placer County Superior Court under the laws of the State of California. City hereby waives the right to any objection of venue, including assertion of the doctrine of forum nonconveniens or similar doctrine. Nothing in this provision shall bind nor limit the rights of DOE regarding governing law and venue, in the event of a dispute with DOE, and DOE reserves all its rights with respect to these matters under all applicable laws.
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
26 Exhibit 2
DE-CR0000015
APPA City of Roseville executed APPA Non-Disclosure Agreement This Agreement is made and entered into as of ________________, by and between the American Public Power Association (“APPA”) and City of Roseville (“Participant”)
Confidentiality: Except as otherwise set forth herein, you agree that any American Public Power Association (“APPA”) software, services, and/or hardware (including related documentation and materials) provided to you under this Agreement, and any information disclosed by APPA to you in connection with this Agreement will be considered and referred to as “APPA Confidential Information."
Notwithstanding the foregoing, APPA Confidential Information will not include: (a) information that is generally and legitimately available to the public through no fault or breach of yours; (b) information that is generally made available to the public by APPA; (c) information that is independently developed by you without the use of any APPA Confidential Information; (d) information that was rightfully obtained from a third party who had the right to transfer or disclose it to you without limitation; or (e) any thirdparty software and/or documentation provided to you by APPA and accompanied by licensing terms that do not impose confidentiality obligations on the use or disclosure of such software and/or documentation.
Sharing APPA Confidential Information: APPA wishes to share APPA Confidential Information under Cooperative Agreement Award Number(s):
DE-CR0000007 and DE-CR0000015 (hereafter “CA”) including all related materials with the Participant for the purpose of developing and deploying Cybersecurity Defense for Public Power, facilitating the Rapid Adoption and Deployment of Industrial Control Systems Cybersecurity Technologies for Distribution and Municipal Utilities and reviewing and assisting with other work products specific to CA tasks for submission to the Department of Energy.
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
27 Nondisclosure and Nonuse of APPA Confidential Information: Unless otherwise expressly agreed or permitted in writing by APPA, you agree not to disclose, publish, or disseminate any APPA Confidential Information to anyone other than to employees and contractors working for the same entity as you and then only to the extent that APPA does not otherwise prohibit such disclosure. You further agree to take reasonable precautions to prevent any unauthorized use, disclosure, publication, or dissemination of APPA Confidential Information. You acknowledge that unauthorized disclosure or use of APPA Confidential Information could cause irreparable harm and significant injury to APPA that may be difficult to ascertain.
Accordingly, you agree that APPA will have the right to seek immediate injunctive relief to enforce your obligations under this Agreement in addition to any other rights and remedies it may have. If you are required by law, regulation, or pursuant to the valid binding order of a court of competent jurisdiction to disclose APPA Confidential Information, you may make such disclosure notwithstanding anything else in this agreement, but only if you have notified APPA before making such disclosure and have used commercially reasonable efforts, to the extent permissible by governing law applicable to Participant to limit the disclosure and to seek confidential, protective treatment of such information. A disclosure pursuant to the previous sentence will not relieve you of your obligations to hold such information as APPA Confidential Information.
Removal of Participants: APPA, at its discretion, will remove any Participant from the CA program if the Participant willfully violates this Agreement.
Return or Destruction of Confidential Information: Promptly upon written request of APPA, the Receiving Party shall, and shall cause its Representatives to return to the Disclosing Party or destroy all Confidential Information in tangible form (whether in written form, electronically stored or otherwise), and neither the Receiving Party nor any of its Representatives shall retain any copies or extracts thereof.
Information Security:
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
28 Without limiting Participant’s obligation of confidentiality as further described in the Agreement and herein, Participant will be responsible for establishing and maintaining an information security program that is designed to: (i) ensure the security and confidentiality of APPA Data; (ii) protect against any anticipated threats or hazards to the security or integrity of the APPA Data; (iii) protect against unauthorized access to or use of the APPA Data; (iv) ensure the proper disposal of APAA Data; and (v) ensure that all subcontractors of Contractor, if any, comply with all of the foregoing.
Participant will designate an individual to be responsible for the information security program. Such individual will respond to APPA inquiries regarding computer security and to be responsible for notifying APPA-designated contact(s) if a breach occurs.
Upon becoming aware of a breach affecting APPA Data, Participant will immediately commence all reasonable efforts to investigate and correct the causes and remediate the results thereof. Participant shall without undue delay (and in no event later than seventy-two (72) hours of becoming aware of such breach) inform APPA and provide written details of the breach, including the type of data and systems affected, the likely consequences of the breach, any other relevant information for APPA to understand the nature of the breach, and the measures taken or proposed to be taken to address it, as soon as such information becomes known or available to Participant.
Participant agrees that any and all transmission or exchange of system application data with APPA and other parties shall take place via secure means, e.g., HTTPS, FTPS, SFTP, or equivalent means.
DOE Required Assurances:
a. These provisions are consistent with and do not supersede, conflict with, or otherwise alter the employee obligations, rights, or liabilities created by existing statute or Executive order relating to (1) classified information, (2) communications to Congress, (3) the reporting to an Inspector General of a violation of any law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety, or (4) any other whistleblower protection. The definitions, requirements, obligations, rights, sanctions, and liabilities created by controlling Executive orders and statutory provisions are incorporated into this agreement and are controlling.’’ b. The limitation above shall not contravene requirements applicable to Standard Form 312, Form 4414, or any other form issued by a Federal department or agency governing the nondisclosure of classified information.
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
29 c. Notwithstanding provision listed in paragraph (a), a nondisclosure or confidentiality policy form or agreement that is to be executed by a person connected with the conduct of an intelligence or intelligence related activity, other than an employee or officer of the United States Government, may contain provisions appropriate to the particular activity for which such document is to be used. Such form or agreement shall, at a minimum, require that the person will not disclose any classified information received in the course of such activity unless specifically authorized to do so by the United States Government. Such nondisclosure or confidentiality forms shall also make it clear that they do not bar disclosures to Congress, or to an authorized official of an executive agency or the Department of Justice, that are essential to reporting a substantial violation of law.
IN WITNESS WHEREOF, the parties have executed this Agreement as of the date first above written.
APPA Organization: City of Roseville
By: By:
Name: Name:
Date: Date:
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
30 Exhibit 3
DE-CR0000015
Form SF-428
06-30-20
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
31 TANGIBLE PERSONAL PROPERTY REPORT
Expiration Date: 6/30/2020
OMB Number: 4040-0018
SF- 428
Instructions for Tangible Personal Property Report: SF-428
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
32 The estimated annual public reporting burden for the collection of information on this form and its attachments is estimated to average 1 hour per respondent, including time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding the burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to the Office of Management and Budget, Paperwork Reduction Project (4040- 0018), Washington, DC 20503.
This is a standard form to be used by awarding agencies to collect information related to tangible personal property (equipment and supplies) when required by a Federal financial assistance award.
The form consists of the cover sheet (SF-428) and three attachments to be used as required: Annual Report, SF428-A; Final (Award Closeout) Report, SF-428-B; and a Disposition Request/Report, SF-428-C. A Supplemental Sheet, SF-428S, may be used to provide detailed individual item information. A. General Instructions:
Tangible personal property means property of any kind, except real property, that has physical existence. It includes equipment and supplies. It does not include copyrights, patents or securities. For convenience, throughout this form and its attachments, the term property will be synonymous with tangible personal property. The terms equipment and supplies will be used when referring to specific requirements.
Property may be provided by the awarding agency or acquired by the recipient with award funds.
Federally-owned property consists of items that were furnished by the Federal government.
Recipients of Federal assistance awards may be required to provide Federal awarding agencies with information concerning property in their custody annually, at award closeout or when the property is no longer needed. Specific requirements will vary based on award provisions, the type of property (equipment or supplies) and whether the property is Federally-owned. This reporting form and its attachments are intended to assist recipients to provide necessary information when it is required.
1. Federal Agency and Organizational Element to Which Report is Submitted.
Enter the name of the Federal agency and the agency organization element identified in the award document or as otherwise instructed by the agency. The organizational element is a subagency within a Federal agency. For example, the Air Force Office of Scientific Research (AFOSR) is an organizational element within the Department of Defense.
2. Federal Grant or Other Identifying Number Assigned by Federal Agency.
Enter the Federal grant, cooperative agreement or other Federal financial assistance award instrument number or other identifying number assigned to the Federal financial assistance award.
3a. DUNS. Enter the recipient organization’s Data Universal Numbering System (DUNS) number or Central Contract Registry extended DUNS number. The DUNS number is also referred to as the Universal Identifier.
3b. EIN. Enter the recipient organization’s Employer Identification Number (EIN) as assigned by the Internal Revenue Service.
4. Recipient Organization. Enter the name and complete address, including zip code, of the recipient organization.
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
33 5. Recipient Account or Identifying Number. Enter the account number or other identifying number assigned to the award by the recipient. This number is for the recipient’s use and is not required by the Federal agency.
6. Attachment. Check the applicable line to indicate the type of attachment being submitted.
Use the Annual Report, SF-428-A, when required to provide annual inventory listings of Federally-owned property. Use the Final Report, SF-428-B, when required to provide property information in connection with the closeout of an award. Use the Disposition Request/Report, SF-428-C, when required to request disposition instructions for or to report the disposal of Federally-owned property or acquired equipment, at any time other than award closeout (i.e., during the award period or after award closeout as long as the Federal government retains an interest in the item).
7. Supplemental Sheet. Check the applicable block to indicate whether a Supplemental Sheet is attached. Recipients may use the SF-428S or equivalent document such as a computer print out to provide required detailed individual item information.
8. Comments. Provide any explanations or additional information in this block. Attach additional sheets if necessary.
9a. Typed or Printed Name and Title of Authorized Certifying Official. Enter the full name and title of the recipient representative authorized to sign this report. b. Signature of Authorized Certifying Official. Original signature of the recipient’s authorized certifying official.
c. Telephone. Enter the telephone number of the individual listed in Line 9a. d. E-Mail Address. Enter the e-mail address of the individual listed in 9a. e. Date report submitted. Enter the date the report is submitted to the Federal agency.
10. Agency use only. This section is reserved for Federal agency use only.
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
34 Exhibit 4
DE-CR0000015
Certificate of Assurance Form
City of Roseville
This Certificate of Assurance Form is incorporated as Exhibit 4 to the Subaward between American Public Power Association (“APPA”) and City of Roseville (“City”).
City hereby confirms and certifies that:
1. The process undertaken by the City to solicit the subaward/subcontract with vendors identified in Exhibit 7 (if one (1) entity, “Vendor,” or if more than one entity, collectively “Vendors”) is in compliance with the City’s written procurement procedures as set forth in 2 CFR 200.318.
2. No planned, actual, or apparent conflict of interest exists between APPA and City or City and Vendor(s) and City and Vendor(s) are in compliance with APPA’s written standards of conduct.
3. City and Vendor(s) are not designated by any federal or state entity as debarred or suspended entities.
4. City has flowed down to Vendor(s) through the respective Vendor Agreement(s) (i.e., subaward(s)/subcontract(s)) all award provisions in the Subaward, including applicable incorporations by reference thereto, that impose obligations or requirements on Vendor(s).
5. City demonstrates desired maturity of its Cybersecurity Program in accordance with APPA CDC defined methodology to vet possible candidates based on various criteria and ability to deploy, operate, and maintain operational technology (“OT”) security solutions successfully.
6. City demonstrates by completing the APPA Cybersecurity Scorecard or comparable capability measure, a determined level of capability prior to deployment of sensors.
7. The process undertaken by the City for equipment is in compliance with 2 CFR 200.313.
8. City has selected a vendor to provide operational technology cybersecurity as part of and consistent with the terms and conditions of its subaward (Subaward) with APPA, which is made pursuant to and consistent with APPA’s DOE Cooperative Agreement DECR0000015.
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
35 9. City is: (1) an independent entity; (2) governed by an independent board of directors; and (3) is not subject to direction or oversight by APPA. For these reasons, City makes independent decisions and investments based upon its individual needs, desires, and constraints. As such, City certifies that the technology identified in “Exhibit 7” was selected solely based on its independent selection criteria for the Subaward.
10. City certifies that APPA advised that the selection of the vendor was to be made independently and that APPA was technology-neutral with respect to the choice of vendor for the Subaward.
11. City certifies that, in addition to APPA’s advisement of its technology neutral-position, APPA did not act or provide financial incentives inconsistent with the technology-neutral approach to the selection of the Vendor.
City of Roseville
By:_____________________________
Name:
Title:
Date:
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
36 Exhibit 5
DE-CR0000015
APPA Non-Disclosure Agreement Template
APPA Confidentiality and Nondisclosure Agreement
This Agreement is made and entered into as of [Date], by and between the American Public Power Association (“APPA”) and [Participant] (“Participant”)
Confidentiality: Except as otherwise set forth herein, you agree that any American Public Power Association (“APPA”) software, services, and/or hardware (including related documentation and materials) provided to you under this Agreement, and any information disclosed by APPA to you in connection with this Agreement will be considered and referred to as “APPA Confidential Information."
Notwithstanding the foregoing, APPA Confidential Information will not include: (a) information that is generally and legitimately available to the public through no fault or breach of yours; (b) information that is generally made available to the public by APPA; (c) information that is independently developed by you without the use of any APPA Confidential Information; (d) information that was rightfully obtained from a third party who had the right to transfer or disclose it to you without limitation; or (e) any thirdparty software and/or documentation provided to you by APPA and accompanied by licensing terms that do not impose confidentiality obligations on the use or disclosure of such software and/or documentation.
Sharing APPA Confidential Information: APPA wishes to share APPA Confidential Information under Cooperative Agreement Award Number(s):
DE-CR0000007 and DE-CR0000015 (hereafter “CA”) including all related materials with the Participant for the purpose of developing and deploying Cybersecurity Defense for Public Power, facilitating the Rapid Adoption and Deployment of Industrial Control Systems Cybersecurity Technologies for Distribution and Municipal Utilities and reviewing and assisting with other
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
37 work products specific to CA tasks for submission to the Department of Energy.
Nondisclosure and Nonuse of APPA Confidential Information: Unless otherwise expressly agreed or permitted in writing by APPA, you agree not to disclose, publish, or disseminate any APPA Confidential Information to anyone other than to employees and contractors working for the same entity as you and then only to the extent that APPA does not otherwise prohibit such disclosure. You further agree to take reasonable precautions to prevent any unauthorized use, disclosure, publication, or dissemination of APPA Confidential Information. You acknowledge that unauthorized disclosure or use of APPA Confidential Information could cause irreparable harm and significant injury to APPA that may be difficult to ascertain.
Accordingly, you agree that APPA will have the right to seek immediate injunctive relief to enforce your obligations under this Agreement in addition to any other rights and remedies it may have. If you are required by law, regulation, or pursuant to the valid binding order of a court of competent jurisdiction to disclose APPA Confidential Information, you may make such disclosure notwithstanding anything else in this agreement, but only if you have notified APPA before making such disclosure and have used commercially reasonable efforts, to the extent permissible by governing law applicable to Participant to limit the disclosure and to seek confidential, protective treatment of such information. A disclosure pursuant to the previous sentence will not relieve you of your obligations to hold such information as APPA Confidential Information.
Removal of Participants: APPA, at its discretion, will remove any Participant from the CA program if the Participant willfully violates this Agreement.
Return or Destruction of Confidential Information: Promptly upon written request of APPA, the Receiving Party shall, and shall cause its Representatives to return to the Disclosing Party or destroy all Confidential Information in tangible form (whether in written form, electronically stored or otherwise), and neither the Receiving Party nor any of its Representatives shall retain any copies or extracts thereof.
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
38 Information Security:
Without limiting Participant’s obligation of confidentiality as further described in the Agreement and herein, Participant will be responsible for establishing and maintaining an information security program that is designed to: (i) ensure the security and confidentiality of APPA Data; (ii) protect against any anticipated threats or hazards to the security or integrity of the APPA Data; (iii) protect against unauthorized access to or use of the APPA Data; (iv) ensure the proper disposal of APPA Data; and (v) ensure that all subcontractors of Contractor, if any, comply with all of the foregoing.
Participant will designate an individual to be responsible for the information security program. Such individual will respond to APPA inquiries regarding computer security and to be responsible for notifying APPA-designated contact(s) if a breach occurs.
Upon becoming aware of a breach affecting APPA Data, Participant will immediately commence all reasonable efforts to investigate and correct the causes and remediate the results thereof. Participant shall without undue delay (and in no event later than seventy-two (72) hours of becoming aware of such breach) inform APPA and provide written details of the breach, including the type of data and systems affected, the likely consequences of the breach, any other relevant information for APPA to understand the nature of the breach, and the measures taken or proposed to be taken to address it, as soon as such information becomes known or available to Participant.
Participant agrees that any and all transmission or exchange of system application data with APPA and other parties shall take place via secure means, e.g., HTTPS, FTPS, SFTP, or equivalent means.
DOE Required Assurances:
a. These provisions are consistent with and do not supersede, conflict with, or otherwise alter the employee obligations, rights, or liabilities created by existing statute or Executive order relating to (1) classified information, (2) communications to Congress, (3) the reporting to an Inspector General of a violation of any law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety, or (4) any other whistleblower protection. The definitions, requirements, obligations, rights, sanctions, and liabilities created by controlling Executive orders and statutory provisions are incorporated into this agreement and are controlling.’’ b. The limitation above shall not contravene requirements applicable to Standard
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
39 Form 312, Form 4414, or any other form issued by a Federal department or agency governing the nondisclosure of classified information.
c. Notwithstanding provision listed in paragraph (a), a nondisclosure or confidentiality policy form or agreement that is to be executed by a person connected with the conduct of an intelligence or intelligence related activity, other than an employee or officer of the United States Government, may contain provisions appropriate to the particular activity for which such document is to be used. Such form or agreement shall, at a minimum, require that the person will not disclose any classified information received in the course of such activity unless specifically authorized to do so by the United States Government. Such nondisclosure or confidentiality forms shall also make it clear that they do not bar disclosures to Congress, or to an authorized official of an executive agency or the Department of Justice, that are essential to reporting a substantial violation of law.
IN WITNESS WHEREOF, the parties have executed this Agreement as of the date first above written.
APPA Organization: City of Roseville
By: By:
Name: Name:
Date: Date:
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
40 Exhibit 6
DE-CR0000015
Revision Control Log
City of Roseville
This Revision Control Log is incorporated as Exhibit 6 to the Subaward between American Public Power Association (“APPA”) and City of Roseville (“City”).
Revision
No.
Purpose of Revision Description of Revision Date
0 Original Issue Original Issue
1 2
City of Roseville American Public Power Association
Subaward CR15-025 V15.5c DE-CR0000015
41 Exhibit 7
DE-CR0000015
Subaward Business Confidential and Proprietary
Information
Legal Protection of Confidential Business Data and Proprietary Information. The information presented in Exhibit 7 is considered confidential and proprietary business information and/or trade secret under applicable California law. This exhibit shall be maintained under seal and shall not be disclosed except if mandated by court order or upon explicit written authorization from the City Attorney.
1 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
VENDOR AGREEMENT IN SUPPORT OF
AMERICAN PUBLIC POWER ASSOCIATION AND DEPARTMENT OF ENERGY COOPERATIVE AGREEMENT DE-CR0000015
This agreement for vendor services (“Agreement”), dated May 22nd, 2025 (“Effective Date”), is between City of Roseville, having its principal place of business at Utility (“Customer” or “Utility”), and Dragos, Inc., a Delaware corporation, on behalf of itself and any affiliates performing hereunder, with its principal place of business located at 1745 Dorsey Rd., Suite R, Hanover, MD 21076 (“Dragos” or “Vendor”). Customer and Dragos are referred to herein individually as “Party” and collectively as “Parties.”
RECITALS
WHEREAS, the Department of Energy (“DOE”) awarded the American Public Power Association (“APPA”) a contract, Award Number DE-CR0000015 (“Award”), to facilitate the rapid adoption and deployment of Industrial Control Systems (“ICS”) Cybersecurity Technologies for distribution and municipal utilities (the “Cooperative Agreement”); WHEREAS, through a participation agreement, APPA has contracted with Utility as a subrecipient and subawardee of the Cooperative Agreement to develop and deploy Utility’s ICS cybersecurity technology solution (“Participation Agreement”); and WHEREAS, in furtherance of the Participation Agreement, Utility seeks the services of Vendor to develop and deploy Utility’s ICS cybersecurity technology solution subject to the non-negotiable terms and conditions of this Vendor Agreement.
NOW, THEREFORE, in consideration of the representations herein, as well as other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties agree to the following terms:
TABLE OF CONTENTS
TERMS AND CONDITIONS FOR DRAGOS OFFERINGS
Schedule 1 DEFINITIONS
Schedule 2 SERVICES
Schedule 3 SOFTWARE
Schedule 3A LOCAL SOFTWARE
Schedule 3B HOSTED SOFTWARE
Schedule 4 OT WATCH
Schedule 5 NEIGHBORHOOD KEEPER
Schedule 6 DRAGOS THREAT INTELLIGENCE OR WORLDVIEW
Schedule 7 TERMS SPECIFIC TO THE COOPERATIVE AGREEMENT
GENERAL TERMS AND CONDITIONS
1. STRUCTURE AND ORDER OF PRECEDENCE
Dragos Terms and Conditions (“General Terms”) provides the terms under which the Customer may use Dragos’s various Offerings. The specific rights applicable to Customer’s access to or use of each specific Offering are set forth in the relevant Schedule (“Offering Terms”) and will apply only to Customer’s access to or use of that Offering. In the event of conflict between any of the General Terms and a Schedule, the Schedule will govern with respect to that Offering or the subject of the Schedule. Capitalized terms will have the meaning set forth in the Definitions at Schedule 1. Headings under this Vendor Agreement are for convenience and organization, only. Headings shall not affect the meaning of any provisions of this Vendor Agreement.
2. ORDERS AND STATEMENTS OF WORK
2.1. Orders. Customer may purchase Offerings by submitting an Order. All Orders for Offerings fully incorporate and are subject to the terms of this Agreement. Dragos will not be obligated to provide any product or services until the applicable Order for those Offerings has been accepted by Dragos. The Subscription Term start date for select Offerings will be set out in the Order. Orders are non-cancellable.
2.2. Customer’s Purchase Order. In the event that a purchase order (“PO”) is required by a Customer to be issued prior to invoicing, Customer shall provide the PO to Dragos in a timely manner; otherwise, Customer agrees to pay an invoice without a PO reference. Any terms or conditions in Customer’s PO or any other related documentation submitted by or on
2 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
behalf of Customer to Dragos do not form part of this Agreement and are void.
2.3. Statements of Work. All Statements of Work fully incorporate and are subject to the terms of this Agreement. Dragos will not be obligated to perform any Services until a SOW describing those Services has been executed by both parties.
2.4. Affiliates. The term “Customer” shall include an Affiliate placing the Order. Customer shall be responsible for compliance by its Affiliates with the Agreement unless the Affiliate has entered into an Affiliate participation agreement with Dragos.
2.5. Any Order for a Customer through a Reseller is subject to, and Dragos’s obligations and liabilities to Customer are governed by, this Agreement, with the exception of those set forth in Sections 3 (Fees and Payment) and 4 (Title and Risk of Loss, Delivery, Inspection).
3. FEES AND PAYMENT
(NOT APPLICABLE FOR ORDERS SUBMITTED VIA A RESELLER)
3.1. Fees. Customer agrees to pay all undisputed fees set forth in the applicable Order. Except as otherwise expressly provided in this Agreement, all fees and other amounts are non-refundable. All prices are in U.S. Dollars.
3.2. All payments of amounts not in dispute are due within sixty (60) days of issuance of the invoice. Late payments will bear interest at the rate of one and one-half percent (1%) per month, or at the highest rate allowed by law, whichever is less. If Customer’s account is thirty (30) days or more overdue, in addition to any of its other rights or remedies, Dragos reserves the right to suspend services to Customer, without liability to Customer, until such amounts are paid in full.
3.3. Vendor shall submit invoices to Customer on a monthly basis and no later than 15 days after each month on which Offerings are provided. Vendor acknowledges that the submission of significantly late invoices may subject such invoices to possible rejection and/or non-payment.
3.4. Taxes. Prices do not include, and Customer shall pay all such taxes levied or imposed by reason of Customer’s purchase of the Offerings and the transactions hereunder, except for taxes based on Dragos’s income. If Dragos has the legal obligation to pay or collect taxes for which Customer is responsible under this section, the appropriate amount shall be invoiced to and paid by Customer unless Customer provides Dragos with a valid tax exemption certificate or direct-pay letter authorized by the appropriate taxing authority prior to Order fulfillment. If applicable Law requires Customer to withhold any taxes levied by any country on payments to be made pursuant to this Agreement, Customer shall (i) effect such withholding, remit such amounts to the appropriate taxing authorities and promptly furnish Dragos with tax receipts evidencing the payments of such amounts, and (ii) ensure that the sum payable by Customer upon which the deduction or withholding is based is increased to the extent necessary to ensure that, after such deduction or withholding, Dragos receives and retains, free from liability for such deduction or withholding, a net amount equal to the amount Dragos would have received and retained in the absence of such required deduction or withholding.
3.5. Renewal Pricing. Dragos reserves the right to modify prices and fees at any time, although such changes will not go into effect during an active Subscription or an active Services retainer. Renewal pricing will be implemented only when a Subscription Term is renewed. Except as otherwise specified in an Order, for all Dragos Offerings that have a Subscription Term, on expiration of the current Subscription Term specified on an Order, Customer has the option to renew for a subsequent Subscription Term of equal duration (a “Renewal Term”). Each Renewal Term will be offered for a fee equal to the fee for the prior, expiring term license (which will not account for any transaction incentives included on a prior order), increased by the greater of the United States Consumer Price Index or five percent (5%). “CPI” shall mean the US Consumer Price Index: Information Technology, Hardware and Services for the 12 months preceding the renewal date.
4. TITLE AND RISK OF LOSS, DELIVERY, INSPECTION
4.1. All Appliances are shipped ExWorks (Incoterms 2010) to Dragos’s designated point of origin. Title and risk of loss to such Appliance (excluding any Software) shall pass per the Incoterm. Dragos will designate a carrier unless Customer specifies in the Order. Upon request by Customer, Dragos may prepay such shipping and insurance charges on behalf of Customer and add them to Customer’s invoice. Customer must provide written notice to Dragos within five (5) business days of delivery of any non-conformity with the Order, e.g., delivery of the wrong product or incorrect quantities.
4.2. Dragos will use commercially reasonable efforts to ship the Appliances and/or Software (or make the Software available for download or access) at the times requested on Orders (in partial or full shipments); provided, however, that Dragos shall not be liable for any delay in delivery, which is not the fault of Dragos, or for failure to give notice of delay. Without liability to any person and without prejudice to any other remedy, Dragos may withhold or delay shipment of any Order if Customer is late in payment or is otherwise in default under this Agreement.
3 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
5. PROPRIETARY RIGHTS
5.1. With the exception of Appliances, all intellectual property rights in and to the Offerings, Dragos Technology, Dragos Works, and Dragos Data, and any copy thereof, and in any ideas, know-how, and programs that may be developed by Dragos in the course of providing the Offerings, including any enhancements, derivative works, or modifications thereof (other than Customer Data), remain with Dragos. Dragos Works comprise: (a) works of original authorship, including compiled content containing Dragos’s, its Affiliates’ or its licensors’ selection, arrangement, coordination, and expression of such content or pre-existing material it has created, gathered, or assembled; and (b) information that has been created, developed, and maintained by Dragos, its Affiliates or its licensors at great expense of time and money such that misappropriation or unauthorized use by others for commercial gain may unfairly and irreparably harm Dragos, its Affiliates or its licensors.
5.2. With the exception of Appliances, Customer is aware that this Agreement confers only the right to license or use the Offerings during an applicable Subscription Term, this Agreement does not convey any rights of ownership in or to the Offerings, and all of Customer’s rights are expressly stated herein, without any implied rights. Customer hereby acknowledges that the Offerings are protected by laws pertaining to intellectual property and proprietary rights in the United States and other countries. Dragos reserves all rights not expressly granted in this Agreement.
5.3. Customer will not remove, obscure, or alter Dragos’s copyright notices, trademarks, or other proprietary rights notices and shall not commit or permit any act or omission that would impair Dragos’s, its Affiliates’ or its licensors’ proprietary and intellectual property rights in Dragos Works.
5.4. Feedback. From time-to-time Customer may provide Dragos with suggestions, comments and feedback with regard to the Offerings (collectively, “Feedback”). Customer hereby grants Dragos a non-exclusive, worldwide, perpetual, irrevocable, royalty-free and fully-paid up license (with the right to sublicense) to use and disclose the Feedback in any manner and to display, perform, copy, make, have made, use, sell, offer to sell, import, and otherwise dispose of products embodying the Feedback in any manner and via any media, without reference to the source, including, without limitation, the testing, development, maintenance and improvement of the Offerings.
5.5. Customer Materials. Customer owns all right, title and interest in all Customer Data. Customer grants Dragos and its Affiliates a worldwide, non-exclusive, limited-term license to use, host, copy, transmit, modify, display, perform and make derivative works of the Customer Data in connection with the performance of Dragos’s obligations under the Agreement and the operation, maintenance and improvement of the Offerings (including the creation of Aggregated Data).
5.6. Dragos Offerings may operate by forwarding certain portions of the Customer Data (“Forwarded Data”) to Dragos owned or controlled servers in the United States or other countries where Dragos has Affiliates. Customer represents and warrants that Customer: (i) is legally permitted and authorized to access, and to provide Dragos with access to, the Forwarded Data; (ii) is responsible for deciding if and how Customer uses the Offerings; and (iii) will use the Offerings only in a legal manner. In the event of any breach of this representation and warranty, Dragos may, without prejudice to its other rights, disallow any Forwarded Data or use of an Offering until Customer can show to Dragos’s reasonable satisfaction, that any such breach has been cured. In addition, specific Offerings such as OT Watch or Neighborhood Keeper may require Customer to execute an “Opt-In” form permitting additional Customer Data to be forwarded to Dragos for processing.
5.7. No Source Code. Nothing in this Agreement will be construed to give Customer a right to use, or otherwise obtain access to, any source code from which the Offerings or any portion thereof is compiled or interpreted.
5.8. Data.
5.8.1. Dragos Data. Dragos may use Dragos Data for the purpose of: (i) analyzing, characterizing, attributing, warning of, and/or responding to threats against Customer and others, (ii) analyzing trends or benchmarking system performance, (iii) providing, maintaining or improving Dragos Offerings; and (iv) any other purposes consistent with applicable Laws, provided, however, that in all of the foregoing use cases, data is used in a way that does not identify Customer or any Authorized User.
5.8.2. Privacy. Details about how Dragos processes, stores, or transmits data, including Personal Data, are included in our Privacy Policy which may be accessed at www.dragos.com/privacy.
5.8.3. Security. Details about the Dragos security program at Dragos may be accessed at www.dragos.com/securityprogram.
5.8.4. NERC CIP-13. To the extent that Customer is subject to NERC CIP-13 and Customer’s access to or use of a specific
4 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
Offering requires that Dragos access Bulk Electric System Cyber Assets and Critical Energy Infrastructure Information, the Dragos NERC CIP-13 Addendum found at www.dragos.com/NERC-CIP13 shall apply.
5.8.5. The Parties shall comply with all applicable data protection laws and regulations regarding the collection, processing, and use of any personal identifiable information (“PII”) that may be sent or received under this Vendor Agreement.
5.9. Restrictions. Except as this Agreement expressly permits, Customer shall not, and shall not permit any other party to: (i) reproduce, modify, correct, adapt, translate, enhance, or otherwise prepare derivative works or improvements of the Offerings; (ii) rent, lease, lend, sell, sublicense, assign, distribute, publish, or otherwise transfer or make available the Offerings to any third party; (iii) reverse engineer, disassemble, decompile, decode, or adapt the Offerings, or otherwise attempt to derive or gain access to the source code of an Offering or any software used by Dragos in providing the Offerings, in whole or in part; (iv) collect any information from or through the Dragos Portal using any automated means, including without limitation any scraping, data harvesting, web crawlers, or other data extraction methods to extract data from a Dragos Offering or the Dragos Portal except via a Dragos API (use of Dragos APIs are subject to the terms and conditions which may be accessed at www.dragos.com/API-terms); (v) bypass or breach any security device or protection used for or contained in the Offerings or allow unauthorized access to the Offering; (vi) access, tamper with, or use non-public areas of the Dragos Portal, Dragos’s computer systems, or the technical delivery systems of Dragos’s providers, or attempt to probe, scan or test the vulnerability of any Dragos system or network; (vii) alter, remove or obscure any copyright notices, trademark notices, or other proprietary or confidentiality notices that are: (a) placed or embedded in or on the Offerings, (b)displayed when the Offerings are run, or (c) applied to the Offerings, their packaging, labels, Documentation or any other materials provided under this Agreement; (viii) use the Offerings in any manner or for any purpose that infringes, misappropriates, or otherwise violates any Intellectual Property Right or other right of any third party or that violates applicable Law; (ix) use the Offerings for purposes of benchmarking or competitive analysis, developing, using, or providing a competing software product or service, or any other purpose that is to Dragos’s detriment or commercial disadvantage; (x) use the Offerings in any unlawful manner, for any unlawful purpose or in any manner inconsistent with this Agreement.
6. CONFIDENTIAL INFORMATION
6.1. General. “Confidential Information” means any non-public oral, written, graphic or machine-readable information or material disclosed by a party, its employees, contractors or Affiliates (“Discloser”) to the other party (“Recipient”), either directly or indirectly, in writing, orally or by permitting access to or inspection of tangible or intangible objects where such information is (i) marked or otherwise communicated as being “proprietary” or “confidential” or the like or (ii) where such information should, by its nature or circumstances of disclosure, be reasonably considered to be confidential and/or proprietary, including, but not limited to, the terms of this Agreement, information or material which relates to such party’s customers, intellectual property, research, product plans, products, developments, inventions, processes, designs, drawings, engineering, formulae, markets, software (including source and object code), computer programs, algorithms, trade secrets, business plans, agreements with third parties, customer lists, or finances. The Offerings, Dragos Technology, Dragos Works, Documentation, and Dragos Data shall be deemed Confidential Information of Dragos regardless of marking. Except as specified for Aggregated Data, Customer Data shall be deemed the Confidential Information of Customer, regardless of marking.
6.2. Except as otherwise expressly authorized herein, Recipient agrees to (a) maintain Discloser’s Confidential Information in strict confidence, not use Discloser’s Confidential Information except as necessary to perform its obligations or enforce its rights under this Agreement, (b) treat all Confidential Information of Discloser in the same manner as it treats its own similar proprietary information, but in no case will the degree of care be less than reasonable care; and (c) disclose Discloser’s Confidential Information only to those employees, contractors and other agents of Recipient and its Affiliates who have a need to know such information for the purposes of this Agreement, provided that any such employee, contractor or other agent shall be subject to obligations of non-use and confidentiality with respect to such Confidential Information at least as restrictive as the terms of this Agreement, and Recipient shall remain liable for any non-compliance of such employee, contractor or other agent with the terms of this Agreement. Notwithstanding the provisions of this Agreement, Recipient may disclose Discloser’s Confidential Information as required by any court or other governmental body or as otherwise required by Law or regulation, provided, however, that Recipient shall (i) to the extent permitted by Law, provide prompt notice of such court order or requirement to Discloser to enable Discloser to seek a protective order or otherwise prevent or restrict such disclosure; and (ii) disclose the minimum amount of Confidential Information needed in order to be
5 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
compliant with such order or legal requirement.
6.3. Exclusions. Nothing in this Agreement will prohibit or limit either Party’s use of information that (i) is already known to the Recipient without restriction as to disclosure prior to disclosure by the Discloser; (ii) becomes publicly available without fault of the Receiving Party; (iii) is rightfully obtained by the Receiving Party from a third party without restriction as to disclosure, or is approved for release by written authorization of the Disclosing Party; or (iv) is independently developed or created by the Receiving Party without use of or access to the Disclosing Party’s Confidential Information as evidenced by contemporaneous written records.
6.4. Survival. Recipient’s obligations under this Section 6 shall survive for period of five (5) years after the expiration or termination of this Agreement, provided, however, that (i) trade secret information will be maintained in confidence for as long as such information remains a trade secret and (ii) any Personal Data shall be maintained in confidence for the period specified by Privacy Laws.
6.5. Equitable Relief. The Parties agree that a material breach of this Section 6 may cause irreparable injury to Discloser for which monetary damages would not be an adequate remedy and Discloser shall be entitled to seek equitable relief (without a requirement to post a bond) in addition to any remedies it may have hereunder or at law.
7. REPRESENTATIONS AND WARRANTIES
7.1. General.
Each Party hereby represents and warrants to the other Party, as of the Effective Date, that: (i) it has obtained all necessary approvals, consents, and authorizations to enter into this Agreement and to perform and carry out its obligations under this Agreement; (ii) the person accepting or executing this Agreement on the Party’s behalf has express authority to do so and to bind the Party; and (iii) this Agreement is a valid and binding obligation of the Party.
7.2. Dragos Warranty.
7.2.1. Appliances. Dragos warrants that any Appliance, as delivered, will perform substantially in accordance with the applicable Documentation for a period of three years from Delivery, provided Customer has an active Software subscription for Software that is embedded, available or in communication with that Appliance. In the event that the Appliance does not conform to the above warranty, Dragos’s entire liability and Customers sole remedy shall be for Dragos to: (i) use its reasonable efforts to correct any Error confirmed by Dragos; or (ii) repair or replace the nonconforming Appliance with a conforming Appliance or a substantially similar model conforming Appliance.
7.2.2. Other Offerings. Warranties specific to an Offering are found in the applicable Offering Schedule.
7.2.3. Exceptions. Dragos’s warranties shall not extend to errors that result from: (i) use of the Offerings other than in accordance with the Documentation; (ii) any alterations of or additions to the Offerings performed by parties other than Dragos or its authorized suppliers; (iii) use of the Offerings in a manner for which it was not designed or outside of the scope of this Agreement; (iv) Customer’s failure to implement any Patch Updates that are made available by Dragos; (v) accident, negligence, or misuse of the Offering by any party other than Dragos; or (vi) a combination of the Offerings with other products not supplied by Dragos.
7.3. Customer Warranty. Customer represents and warrants that: (i) neither it, nor any of its Affiliates or owners, is a Prohibited Party, and it shall not, in connection with this Agreement, give access to, transact with or act on behalf of any Prohibited Party; (ii) it owns or has a right of use from a third party, and controls, directly or indirectly, all of the software, hardware and computer systems (collectively, “Systems”) where the Software will be installed, (iii) it has a lawful basis in having the Dragos Offerings operate on the Systems, and collect and process Customer Data; and (iv) when required for Customer use of the Dragos Offerings or when requested by Customer, Customer authorizes Dragos to provide access to and use of the Dragos Offerings and Customer Data to Third Party Providers.
7.4. Customer remains responsible for (i) any Customer Data made available to Dragos in connection with this Agreement, (ii) the selection and implementation of procedures and controls regarding access, security, encryption, use, and transmission of data, (iii) backup and recovery of any database and any stored data; and (iv) the acts and omissions of its Authorized Users and Affiliates.
7.5. Customer acknowledges and agrees that in the course of providing certain services or Offerings, Dragos may become aware of data breaches, network intrusions, or the presence of malware in Customer’s environment, and the discovery of such issue may give rise to regulatory reporting obligations to which Customer is subject in one or more territories in which Customer operates. Customer shall remain solely responsible for all such reporting requirements, and Dragos shall have no liability for
6 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
failure to report the same.
7.6. Customer agrees that Customer’s purchase of any Offering is not contingent upon the delivery of any future functionality or features or dependent upon any oral or written public comments made by Dragos with respect to future functionality or features.
8. DISCLAIMER
EXCEPT AS EXPRESSLY PROVIDED IN THIS AGREEMENT OR SCHEDULES SPECIFIC TO AN OFFERING, ALL
DRAGOS OFFERINGS, DRAGOS TECHNOLOGY, DRAGOS DATA, DRAGOS WORKS, AND ANY OTHER
MATERIALS, SOFTWARE, DATA, HARDWARE, APPLIANCE, EQUIPMENT AND/OR SERVICES PROVIDED OR LICENSED BY DRAGOS HEREUNDER ARE PROVIDED “AS IS” AND “WITH ALL FAULTS,” AND TO THE
MAXIMUM EXTENT PERMITTED BY LAW, DRAGOS EXPRESSLY DISCLAIMS ALL OTHER WARRANTIES, TERMS,
OR CONDITIONS OF ANY KIND OR NATURE, WHETHER EXPRESS, IMPLIED OR STATUTORY INCLUDING, ANY
WARRANTIES, TERMS, OR CONDITIONS OF MERCHANTABILITY, ACCURACY, PERFORMANCE, FITNESS FOR A
PARTICULAR PURPOSE AND NON-INFRINGEMENT , OR ARISING FROM COURSE OF PERFORMANCE, DEALING, USAGE OR TRADE. DRAGOS DOES NOT WARRANT THAT THE FOREGOING WILL MEET CUSTOMER’S
REQUIREMENTS, THAT THE OPERATION THEREOF WILL BE UNINTERRUPTED OR ERROR-FREE, THAT ALL
ERRORS WILL BE CORRECTED OR THAT AN OFFERING WILL OPERATE IN COMBINATION WITH HARDWARE OR SOFTWARE NOT PROVIDED BY DRAGOS. DRAGOS DOES NOT GUARANTEE OR OTHERWISE WARRANT
THAT ANY OFFERING WILL RESULT IN THE IDENTIFICATION, DETECTION, CONTAINMENT, ERADICATION OF, OR RECOVERY FROM CUSTOMER’S SYSTEM THREATS, VULNERABILITIES, MALWARE, MALICIOUS SOFTWARE, OR OTHER MALICIOUS THREATS.
9. INDEMNIFICATION
9.1. General Indemnity. To the fullest extent permitted by law, Dragos shall at its sole cost and expense indemnify, defend, and hold harmless Customer and its trustees, members, officers, employees, agents, and their subsidiaries and affiliates (collectively “Indemnified Parties”) from and against all third party claims, damages, losses, fines, penalties, and expenses (including but not limited to all fees and charges of engineers, architects, attorneys, and other professionals and all court, arbitration, or other dispute resolution costs) arising out of or in connection with this Purchase Order, provided that any such claim, cost, damage, loss, fine, penalty, or expense is attributable to: (i) bodily injury, sickness, disease, or death, or to injury to or destruction of tangible property but only to the extent caused by the grossly negligent or willful acts, errors, or omissions of Dragos. But this section does not obligate Dragos to indemnify any individual or entity from and against the consequences of that individual's or entity's own negligence. In claims against one or more of the Indemnified Parties by any direct or indirect employee (or the survivor or personal representative of such employee) of Dragos, the indemnification obligation under this Agreement will not be limited by a limitation on the amount or type of damages, compensation, or benefits payable under workers’ compensation acts, disability benefit acts, or other employee benefit acts. Dragos’s indemnification obligation will not be limited by any insurance policy provided or required in connection with the Project.
Dragos’s indemnification obligation will survive termination of this Agreement.
9.2. Infringement Indemnity. To the fullest extent permitted by law , Dragos shall at its sole cost and expense: (i) defend any claim brought against Customer and its Affiliates by an unaffiliated third party alleging that an Offering infringes the third party’s U.S or European Union patent, copyright or trademark and (ii) pay any settlement of such claim or any damages finally awarded to such third party by a court of competent jurisdiction as a result of such claim; provided, that Customer:
(a) gives Dragos prompt written notice of such claim; (b) permits Dragos to reasonably control and direct the defense or settlement of such claim (however, Dragos will not settle any claim in a manner that requires Customer to admit fault for attributes liability to Customer without Customer’s prior written consent); and (c) provides Dragos all reasonable assistance in connection with the defense or settlement of such claim. In addition, Customer may, at Customer’s own expense, participate in defense of any claim.
9.3. Remedies. If a claim covered under Section 9.1 occurs or in Dragos’s opinion is reasonably likely to occur, Dragos will at its expense and sole discretion: (i) procure the right to allow Customer to continue using the applicable Offering; (ii) modify or replace the applicable Offering to become non-infringing and substantially equivalent in functionality; or (iii) if neither (i) nor (ii) is commercially practicable, terminate Customer’s license or access to the affected portion of the applicable Offering and refund a pro rata portion of the pre-paid, unused fees paid by Customer corresponding to the unused period of the
7 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
Subscription Term. THE REMEDIES SPECIFIED IN THIS SECTION CONSTITUTE CUSTOMER’S SOLE AND EXCLUSIVE REMEDIES, AND DRAGOS’S ENTIRE LIABILITY, WITH RESPECT TO ANY INFRINGEMENT OF THIRD-PARTY INTELLECTUAL PROPERTY RIGHTS.
9.4. Exclusions. Dragos shall have no obligations under this Section to the extent the claim is based upon or arises out of: (i) any modification to the applicable Offering not made by Dragos; (ii) any combination or use of the applicable Offering with or in any third party software, hardware, process, firmware, or data, to the extent that such claim is based on such combination or use; (iii) Customer’s continued use of the allegedly infringing Offering after being notified of the infringement claim; (iv) Customer’s failure to use the Offering in accordance with the applicable Documentation; (v) Customer’s use of the Offering outside the scope of the rights granted under this Agreement; (vi) a failure to install or utilize the latest updated version of Software; and/or (vii) Customer Data.
10. LIMITATIONS OF LIABILITY
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EXCEPT FOR LIABILITY ARISING OUT OF: (i) PERSONAL INJURY OR DEATH; (ii) MISUSE OR VIOLATION OF DRAGOS’S INTELLECTUAL PROPERTY RIGHTS BY CUSTOMER; (iii) PAYMENT OBLIGATIONS FOR OFFERINGS; (iv) WILLFUL MISCONDUCT OR FRAUD BY A PARTY; AND/OR (v) AMOUNTS PAYABLE TO THIRD PARTIES UNDER SECTION 9 (INDEMNIFICATION), IN NO EVENT WILL: (a): EITHER PARTY BE LIABLE FOR ANY CONSEQUENTIAL, SPECIAL, INDIRECT, INCIDENTAL, OR
PUNITIVE DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, LOSS OF PROFITS, DATA OR
INFORMATION, COSTS OF PROCUREMENT OF SUBSTITUTE PRODUCTS OR SERVICES, OR BUSINESS
INTERRUPTION) ARISING OUT OF OR RELATED TO THIS AGREEMENT AND ANY PRODUCTS OR SERVICES, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES; AND (b) EITHER PARTY’S
AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT AND ANY OFFERINGS EXCEED
TWO TIMES THE FEES PAID OR PAYABLE BY CUSTOMER FOR THE APPLICABLE OFFERING WHICH IS THE SUBJECT OF SUCH CLAIM IN THE TWELVE (12) MONTHS PERIOD BEFORE THE EVENT GIVING RISE TO SUCH LIABILITY OR ONE MILLION DOLLARS ($1,000,000),WHICHEVER IS HIGHER. THESE LIMITATIONS WILL APPLY
NOTWITHSTANDING ANY FAILURE OF THE ESSENTIAL PURPOSE OF ANY REMEDY SPECIFIED IN THIS AGREEMENT. MULTIPLE CLAIMS SHALL NOT EXPAND THE LIMITATIONS SPECIFIED IN THIS SECTION.
11. TERM AND TERMINATION
11.1.Term. The term of this Agreement begins on the Effective Date and will remain in force and effect until it is terminated in accordance with the terms of this Agreement (the “Term”). Certain Offerings will have a separate Subscription Term. In the event the Subscription Term for a specific Offering has lapsed, continued use or access of the Offering will constitute authorization of a one-year renewal term subject to the terms and conditions of the Agreement and at the then-current standard pricing for such Offering.
11.2.Termination for Cause. This Agreement or any Order may be terminated at any time: (i) by Dragos, effective on written notice to Customer, if Customer fails to pay any amount when due, where such failure continues more than thirty (30) days after Dragos’s delivery of written notice thereof (“Payment Failure”); (ii) by Dragos, immediately on written notice to Customer if two or more Payment Failures occur in any six (6) month period; (iii) by either Party, effective on written notice to the other Party, if the other Party materially breaches this Agreement and the breach remains uncured thirty (30) days after the non-breaching Party provides the breaching Party with written notice of such breach; (iv) by either Party, effective immediately, if the other Party: (a) is dissolved or liquidated or takes any corporate action for such purpose; (b) becomes insolvent or is generally unable to pay its debts as they become due; (c) becomes the subject of any voluntary or involuntary bankruptcy proceeding under any domestic or foreign bankruptcy or insolvency Law which remains undismissed after sixty (60) days; (d) makes or seeks to make a general assignment for the benefit of its creditors; or (e) applies for, or consents to, the appointment of a trustee, receiver or custodian for a substantial part of its property.
11.3.Termination for Convenience. Either Party may terminate this Agreement upon thirty (30) days’ prior written notice to the other Party, however the terms of this Agreement will continue to apply to any active Subscriptions until they terminate.
11.4.Effect of Termination. Upon expiration or termination of this Agreement or any Order: (i) the rights and licenses granted to Customer hereunder will terminate automatically except to the extent such rights are expressly stated to survive beyond the Term; (ii) Customer will return or destroy all Dragos Technology, including permanent removal of such Dragos Technology (consistent with customary industry practice for data destruction) from any storage devices or other hosting environments
8 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
that are in Customer’s possession or under Customer’s control, (iii) either Party may request that the other Party return or destroy its Confidential Information in the other Party’s possession or control, and either Party may request confirmation in writing of compliance with the provisions of this Section 11.4; and (iv) for clarity, Customer will pay all previously accrued and undisputed amounts due to Dragos hereunder in accordance with Section 3. If Customer sells, leases, lends, rents, distributes or otherwise transfers any Appliance to any third party then Customer will erase all Dragos Technology and Dragos Data from such Appliance.
11.5. Survival. This Section 11.5 and Sections 5 (Proprietary Rights), 6 (Confidential Information), 7 (Representations and Warranties), 8 (Disclaimer), 9 (Indemnification), 10 (Limitations of Liability), 11.4 (Effect of Termination) and 16 (Miscellaneous) survive any termination or expiration of this Agreement in accordance with their respective terms.
12. TRADEMARKS
With written permission from the Customer, Dragos may display Customer’s company name and logo (in accordance with any trademark guidelines provided by Customer) and may identify Customer as a Dragos customer in a manner that does not suggest Consumer’s use or endorsement of any specific Dragos Offering.
13. COMPLIANCE WITH LAWS
13.1. Each Party agrees to comply with all Laws directly applicable to such Party in the performance of this Agreement, including but not limited to, applicable export and import, anti-corruption, data protection and employment laws, including the U.S.
Export Administration Regulations (“EAR”), International Traffic in Arms Regulations (ITAR”), Office of Foreign Assets Control (“OFAC”) restrictions, and the U.S. Foreign Corrupt Practices Act (“FCPA”).
13.2.Customer acknowledges and agrees the Offerings shall not be used, transferred, or otherwise exported or re-exported to: (a) regions that the United States and/or the European Union maintains an embargo or comprehensive sanctions (collectively, “Embargoed Countries”), or a national or resident thereof to the extent prohibited by U.S. or E.U. laws; (b) a Prohibited Party; or (c) for any purpose prohibited by Export Administration Regulations (15 CFR Part 730 et seq.), the International Traffic in Arms Regulations (22 CFR Part 120 et seq.), the sanctions programs administered by the Office of Foreign Assets Control, and statutes, rules and executive orders affecting sanctions or international trade, including nuclear, chemical, or biological weapons proliferation or development of missile technology.
14. U.S. GOVERNMENT END USERS
14.1. Commercial Items. The following applies to all acquisitions by or for any agency, department, division, or component of or within the U.S. Government (“Government End Users”) under any U.S. Government contract, grant, other transaction agreement, or other funding agreement. The Offerings are “commercial items,” as that term is defined in Federal Acquisition Regulation (“FAR”) § 2.101, and depending on the Offering, may consist of “commercial computer software” and “commercial computer software documentation,” as such terms are used in FAR § 12.211 and §12.212. In addition, Department of Defense FAR Supplement (“DFARS”) 252.227-7015 (Technical Data – Commercial Items) applies to technical data acquired by Department of Defense agencies. Consistent with FAR § 12.211 and § 12.212 and DFARS § 227.7202-1 through § 227.7202-4, the Offerings are being licensed to Government End Users pursuant to the terms of this license(s) as customarily provided to the public and as set forth in this Agreement, unless such terms are inconsistent with United States federal law. Any use, modification, reproduction, release, performance, display, or disclosure of the Offerings by the U.S. Government must be in accordance with the license rights and restrictions described in this Agreement.
15. EVALUATIONS, FREE OFFERINGS, PREVIEW FEATURES, BETA FEATURES
15.1.If Customer receives an Offering for evaluation purposes (“Evaluation Offerings”) then Customer may use the Evaluation Offering for its own internal evaluation purposes for a period of up to thirty (30) days from the date of receipt of the Evaluation Offering (the “Evaluation Period”). Customer and Dragos may, upon mutual written agreement (including via email), extend the Evaluation Period. If the Evaluation Offering includes hardware components, Customer will return the hardware within ten (10) business days of the end of the Evaluation Period, and if Customer does not return the hardware within this period, Customer shall be invoiced for the then-current list price for the applicable Evaluation Offering.
Customer acknowledges that title to hardware components of Evaluation Offering remains with Dragos at all times, and that
9 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
Evaluation Offering may be used and/or refurbished units. Customer must delete all Software and other components (including Documentation) related to the Evaluation Offering at the end of the Evaluation Period, and confirm those deletions in writing to Dragos, or Customer will be invoiced for the then-current list price for the Evaluation Offering. If the Evaluation Offering is a Subscription, Customer understands that Dragos may disable access to the Subscription automatically at the end of the Evaluation Period, without notice to Customer.
15.2. Free offerings, preview features and beta features or products may be provided with respect to an existing Offering or on a stand-alone basis, for a limited time, at no additional charge but then licensed for an additional fee at a later date. All such free, preview and beta features or products are considered “Unpaid Offerings,” and Dragos may discontinue providing such Unpaid Offerings at any time.
15.3. Any Evaluation Offerings or Unpaid Offerings are subject to the Dragos Terms and Conditions for Products & Services Provided Free of Charge found here: www.dragos.com/freeofferings-terms-conditions.
16. MISCELLANEOUS
16.1. Subcontracting. Dragos may use subcontractors, vendors and other third-party providers in the performance of its obligations hereunder as it deems appropriate; provided that Dragos remains responsible for the performance of each such subcontractor, vendor or third-party provider and its compliance with the terms of this Agreement. Dragos’s use of subcontractors, vendors and other third-party providers for the provision of its hosting environment, network, hosting infrastructure and certain software development related to Offerings is not subject to Customer’s approval.
16.2.Entire Agreement. This Agreement, together with all Orders, Schedules and any other documents incorporated herein by reference, constitutes the sole and entire agreement of the Parties with respect to the subject matter of this Agreement and supersedes all prior and contemporaneous understandings, agreements, and representations and warranties, both written and oral, with respect to such subject matter. It is expressly agreed that the terms of this Agreement shall supersede any Customer terms in any purchase order, procurement portal documentation or other similar non-Dragos documents and no such terms shall apply to the Offerings. Any Order through a Reseller is subject to, and Dragos’s obligations and liabilities to Customer are governed by, this Agreement.
16.3. Notices. Except as otherwise expressly permitted herein, all notices required or permitted to be given hereunder will be in writing and will be deemed effective when personally delivered, when received by electronic mail to the address listed below (when confirmed by the other party), or when delivered by overnight courier or five (5) days after being deposited in the United States mail, with postage prepaid thereon, certified or registered mail, return receipt requested, addressed as follows:
To Customer: City of Roseville – Roseville
Electric Utility
Contact Name: Leonard Ladd
Phone: 916-774-5699
Email: [email protected]
cc:
To Dragos:
Dragos Inc.
1745 Dorsey Road, Suite R
Hanover, MD 21076
Attention: Betsy Guarnieri, General Counsel
Email: [email protected]
cc: [email protected]
Notice may be given to such other address or number, and to the attention of such other person or officer, as any Party may designate, at any time, in writing in conformity with these notice provisions.
16.4. Amendment and Modification; Waiver.
16.4.1. No amendment to or modification of this Agreement is effective unless it is in writing and signed by an authorized representative of each party. No waiver by any Party of any of the provisions hereof will be effective unless explicitly set forth in writing and signed by the Party so waiving. Except as otherwise set forth in this Agreement, (i) no failure to exercise, or delay in exercising, any rights, remedy, power or privilege arising from this Agreement will operate or be construed as a waiver thereof and (ii) no single or partial exercise of any right, remedy, power, or privilege hereunder will preclude any other or further exercise thereof or the exercise of any other right, remedy, power, or privilege.
16.5. Severability. If any provision of this Agreement is invalid, illegal, or unenforceable in any jurisdiction, such invalidity, illegality, or unenforceability will not affect any other term or provision of this Agreement or invalidate or render unenforceable such term or provision in any other jurisdiction. If any provision of this Vendor Agreement is held
10 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
invalid or unenforceable by a court of law or competent arbitrator, the remaining provision(s) will be enforced to the maximum extent possible. In such event, the remainder of this Vendor Agreement shall continue in full force and effect.
16.6.Governing Law; Jurisdiction. This Agreement will be governed by, construed, and enforced in accordance with the laws of the State of Delaware, excluding its conflicts-of-law principles, with the exception of Customers with principal offices located outside of North America, for which Dispute Resolution will be governed by the terms that may be accessed at www.dragos.com/international-dispute-resolution. The sole and exclusive jurisdiction and venue for actions arising under this Agreement shall be state and federal courts in Wilmington, Delaware, and the parties agree to service of process in accordance with the rules of such courts. The Uniform Computer Information Transactions Act and the United Nations Convention on the International Sale of Goods shall not apply. Notwithstanding the foregoing, each party reserves the right to file suit or action in any court of competent jurisdiction as such party deems necessary to protect its intellectual property rights and, in Dragos’s case, to recoup any payments due.
16.7. Assignment.
16.7.1. Neither party may assign this Agreement without the prior written consent of the other party, except to an Affiliate, or in connection with a merger, acquisition, or sale of all or substantially all of the party’s business and/or assets.
Any assignment in violation of this Section shall be void. Subject to the foregoing, all rights and obligations of the parties under this Agreement shall be binding upon and inure to the benefit of and be enforceable by and against the successors and permitted assigns.
16.7.2. With the exception of any rights or remedies noted in Schedule 7: Terms Specific to the Cooperative Agreement, nothing in this Vendor Agreement (whether express or implied) is intended to confer upon any person or entity other than Customer and Vendor and their respective successors and permitted assigns, any rights or remedies under or by reason of this Vendor Agreement.
16.8. Relationship of Parties.
16.8.1. The parties agree and acknowledge that the relationship of the parties is in the nature of an independent contractor.
This Agreement shall not be deemed to create a partnership or joint venture and neither party is the other’s agent, partner, employee, or representative. Neither party shall have the right to obligate or bind the other party in any manner whatsoever and nothing herein shall give or is intended to give any rights of any kind to third persons
16.9.Equitable Relief. Each Party hereby acknowledges and agrees that a breach or threatened breach by such Party of any of its obligations hereunder could cause the other Party irreparable harm for which monetary damages may not be an adequate remedy and agrees that, in the event of such breach or threatened breach, the other Party may be entitled to seek equitable relief, including a restraining order, an injunction, specific performance and any other relief that may be available from any court, without any requirement to post a bond or other security, or to prove actual damages or that monetary damages are not an adequate remedy. Such remedies are not exclusive and are in addition to all other remedies that may be available at law, in equity or otherwise.
16.10. Force Majeure. Neither Party will be responsible for any failure or delay in its performance under this Agreement (except for any payment obligations) due to causes beyond its reasonable control, including, but not limited to, epidemic, pandemic, quarantines, embargoes, travel restrictions and other similar unusual governmental action including acts of civil or military authorities, embargoes, labor disputes, strikes, lockouts, shortages of or inability to obtain energy, raw materials or supplies, denial of service, cyberattacks or other malicious attacks, communications failure or degradation, ordinary course mechanical or electrical degradation and/or failure, material changes in law, war, terrorism, riot, acts of nature or natural disasters, or acts of God.
16.11. Audit. In instances in which Dragos has reasonable belief that Customer’s use of an Offering materially exceeds the license or grant of usage provided, Dragos shall have the right, upon reasonable prior notice to conduct and/or direct an independent accounting firm to conduct, an audit of Customer’s facilities, computers and records during normal business hours to confirm Customer’s use of an Offering is in compliance with this Agreement. Customer shall provide reasonable cooperation with any such audit. Any such audit shall be performed by Dragos or its authorized representative, shall not take place more than once per calendar year, and shall be done in a manner to minimize disruption to Customer’s business. In the event that any audit reveals noncompliance with this Agreement, including but not limited to use of an Offering other than as specified herein, Customer shall promptly pay Dragos any shortfall plus accrued interest at Dragos’s current rates and shall reimburse Dragos for the reasonable cost of such audit. This does not limit any other remedies that Dragos may have under this Agreement or otherwise.
11 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
16.12. Insurance. Dragos upon request shall provide an insurance industry standard certificate of insurance as evidence of the following coverage and minimum limits: (a) Commercial General Liability Insurance of not less than $1,000,000 each occurrence and $2,000,000 in aggregate; (b) Professional Liability Insurance (“Errors & Omissions”) with limits of no less than $2,000,000 in aggregate covering losses from any act, errors, omissions or negligence related to Dragos’s obligations under this Agreement (each such coverage shall be maintained for at least two years after termination or expiration of this Agreement); (c) Workers Compensation Insurance covering Dragos’s employees as required by any applicable state Law and at the statutory limits required for each such jurisdiction, and Employer’s Liability Insurance with limits; (d) Business Auto Liability Insurance, but only applicable if automobiles or other vehicles are used in connection with Dragos’s performance of its obligations hereunder, including coverage on hired and non-owned automobiles with bodily injury and property damage limits of not less than $1,000,000 combined single limit; and (e) Umbrella/Excess Liability Insurance providing excess liability coverage with limits no less than $5,000,000 per occurrence in excess of the primary coverage limits for Commercial General Liability, Automobile Liability and Employers Liability, with Customer named as an additional insured on the General Liability. The Errors & Omissions insurance policy shall include Cyber Liability, Network Security and Privacy Liability coverage and shall cover claims arising from operations or acts performed by, and materials, equipment or products used or supplied by Dragos.
16.13. No Third-Party Beneficiaries. Subject to Section 16.7 (Assignment), no provision of this Agreement is intended to confer any rights, benefits, remedies, obligations, or liabilities hereunder upon any Person other than the Parties and their respective successors and assigns.
16.14. Controlling Language. This Agreement was negotiated and executed in English, and if it is translated into other languages, the original English language version shall be controlling, notwithstanding either Party’s signature on or acknowledgement of such translations. Customer waives any right to have this Agreement written in any other language.
16.15. Counterparts. This agreement may be executed in one or more counterparts, each of which shall constitute an original, and all of which shall together constitute only one agreement between the Parties. The signatures of all Parties need not be on the same counterpart for valid execution.
The Parties have caused their duly authorized representatives to execute this Agreement as of the dates set forth below. [CUSTOMER]:
By (Signature):
Name (Printed): [
Title: [
Date: [
DRAGOS, INC.
By (Signature):
Name (Printed): [
Title: [
Date: [
12 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
SCHEDULE 1: DEFINITIONS
“Affiliate” means, with respect to either Party, any company, corporation, partnership or other entity, directly or indirectly, controlling, controlled by, or under common control with, such Party where “control” is defined as having rights to more than 50% of the equity, ownership or voting rights for such entity. “Aggregated Data” means any data that has been aggregated so that it is not identifiable or attributable to Customer or any of its Authorized Users and may include data based on Customer’s use of the Offerings. “Analytics Data” means any technical, statistical or analytical data; correlative and/or contextual data; output from analytics and detections which are periodically gathered or aggregated in connection with Customer use of an Offering, including but not limited to data generated in connection with Customer's access, use and configuration of the Offerings and data derived from it (e.g., interacting with the Offerings), but which excludes any data that could be used to identify Customer or any of its Authorized Users. “Appliance” means Dragos-supplied hardware devices that may be purchased by Customer, including sensors and any devices onto which the Software may be pre-installed as specified in an Order. “Authorized User” means employees, agents, consultants, or contractors of the Customer or its Affiliates who are authorized by Customer to access and/or use the Offerings subject to the terms and conditions of this Agreement. “Catalog Updates” means routine updates released by Dragos containing the latest protocol support, threat detections, indicators, vulnerability detections, and other updatable content included as part of Support. “Customer” means the entity entering into this Agreement, or the Customer Affiliate that places an Order under this Agreement. “Customer Data” means all data, information, records and other content provided, uploaded, transmitted, inputted, edited, authored, or otherwise submitted by Customer or its Authorized Users under this Agreement in connection with the Offerings. “Documentation” means Dragos’s standard published documentation normally supplied with or made available to its Customers to aid in the use, support and/or operation of the Offerings and any updates thereto, in any form, media or language provided. “Dragos APIs” means the Dragos-provided application program (or programming) interface. “Dragos Competitor” means a person or entity in the business of developing, distributing, or commercializing products or services substantially similar to or competitive with Dragos’s Offerings. “Dragos Data” means (i) any Dragos Confidential Information; (ii) Analytics Data, (iii) Aggregated Data; (iv) Machine-Generated Data; (v) Threat Data; (vi) Neighborhood Keeper Data; and (vii) all intellectual property rights in the foregoing. “Dragos Platform” refers to the combination of Offerings (typically Software and an Appliance) that passively identifies Industrial Control Systems (“ICS”) network assets and potential threats, and provides step-by-step guidance to investigate incidents and respond.
“Dragos Portal” means the password-protected website where Customers may access Confidential Information in connection with the license or use of certain Dragos Offerings.
“Dragos Technology” means (i) Software; (ii) Dragos’s know-how, proprietary tools and data, trade secrets and other technologies embodied in the Offerings, or otherwise used by or on behalf of Dragos to provide the Offerings, including Dragos Tools; (iii) all updates, improvements, modifications and derivative works of any of the foregoing; and (vi) all intellectual property rights in the foregoing.
“Dragos Threat Intelligence” or “WorldView” is a subscription-based collection of reports and webinars that provide detailed information about threat activity groups targeting ICS environments globally and may include WorldView concierge services if designated in an Order.
“Dragos Tools” means Dragos proprietary Software, hardware, tests, programs, or other tools that Dragos uses in performing Services, which may be specified in an applicable SOW.
“Dragos Works” means (i) Dragos Threat Intelligence or WorldView, (ii) Dragos authored, created or developed research reports, spreadsheets, graphics, tables, charts, compilations of data, and assessment tools, formulas, and algorithms and all other Dragos proprietary content and material that Dragos has developed prior to or independently of this Agreement; and (iii) Dragos’s research methodologies, including but not limited to Dragos’s analysis methodology. “Error” means a reproducible failure of an Offering to perform in substantial conformity with its applicable Documentation. “General Terms” means the Terms and Conditions Applicable to all Offerings which operates as a framework agreement and provides the terms under which the Customer may use Dragos’s various Offerings. “Hosted Software” means Dragos’s commercially available, internet-delivered, cloud-hosted software-as-a-service Offerings.
13 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
“Laws” mean all applicable federal, international, state, provincial, and local laws, statutes, acts, ordinances, rules, codes and regulations, executive orders and other official releases of or by any government, or any authority, court, department or agency thereof, including those in any jurisdiction from or in which the Offerings are provided or received, including Privacy Laws. “Local Software” means Dragos's commercially available proprietary software Offerings made available to Customer for installation at Customer’s premises or at/on other Customer-controlled environments or systems as specified in the Order. Local Software may be provided via download or physical media or may be embedded on an Appliance. “Machine-Generated Data” means any machine-generated data, such as metadata derived from tasks, file execution, commands, resources, network telemetry, executable binary files, macros, scripts, and processes, code, system files, log files, dll files, login data, binary files, tasks, resource information, commands, protocol identifiers, URLs, network data which may be periodically gathered or aggregated in connection with Customer use of an Offering but which excludes any data that could be used to identify Customer or any of its Authorized Users.
“Neighborhood Keeper Analytics Framework” or “Neighborhood Keeper” means the secure cloud infrastructure and the analytics framework developed by Dragos that receives specifically designated types of pseudonymized telemetry data from participants and makes that data available to Neighborhood Keeper Program participants. “Neighborhood Keeper Data” means all data that is transmitted to the Neighborhood Keeper Analytics Framework from any source which may include Aggregated Data, Machine-Generated Data and/or Threat Data. “Neighborhood Keeper Program” means the collective defense and community-wide visibility solution that enables OT threat intelligence sharing at machine-speed among participants. “Offerings” means any product, service, subscription service or training offered by Dragos, including Software, OT Watch, Neighborhood Keeper and WorldView.
“Order” means (i) an accepted quote, purchase order, invoice or another mutually agreed upon order form accepted by Dragos or a Reseller, which sets forth a description of specific Offerings to be purchased or licensed and the Subscription Term, if any; or (ii) an executed Statement of Work.
“OT Watch” is an add-on available to current subscribers of the Dragos Platform Software that provides asset visibility, vulnerability management, and threat detection and response via an experienced team of Dragos ICS/OT cybersecurity professionals. “Party” or “Parties” means Dragos, Inc. and Customer (individually or collectively as applicable). “Patch Updates” means maintenance releases and error corrections and software security patches released by Dragos that are provided at no additional charge by Dragos to Customers receiving Support. “Personal Data” means information provided by or for Customer to Dragos or collected by Dragos from Customer used to distinguish or trace a natural person’s identity, either alone or when combined with other personal or identifying information that is linked or linkable by Dragos to a specific natural person. Personal Data also includes such other information about a specific natural person to the extent that the data protection laws applicable in the jurisdictions in which such person resides define such information as Personal Data.
“Privacy Laws” means U.S. federal, state and local and non-U.S. laws, including those of the European Union, that regulate the privacy or security of Personal Data and that are directly applicable to Dragos. “Prohibited Party” shall mean any list of prohibited parties or parties subject to sanctions imposed by U.S. E.U., U.N., or other countries, including, but not limited to, the Specially Designated Nationals and Blocked Persons List maintained by the OFAC of the US Department of Treasury, the Entity List and Denied Persons List maintained by the Bureau of Industry and Security of the U.S.
Department of Commerce, the list of statutorily or administratively debarred parties maintained by the Directorate of Defense Trade Controls of the US Department of State, and the Consolidated list of persons, groups and entities subject to EU financial sanction, as amended from time to time, and entities owned 50% or more or otherwise controlled by such parties, as applicable.. “Report Deliverable” means a written report or written assessment prepared by Dragos for Customer pursuant to a Services engagement.
“Reseller” means a partner that has a valid agreement with Dragos for the resale of the Offerings and is designated by Dragos as a “Reseller.”
“Schedule” means the specific terms and conditions applicable to the Offering identified in an Order which supersede the General Terms in the event of a conflict.
“Services” means any professional services performed by Dragos for Customer pursuant to an SOW or other Order, which may
14 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
include incident response, architecture assessments, vulnerability assessments, tabletop exercises, threat hunting, penetration testing or readiness assessments.
“Software” means Dragos’s proprietary Local Software or Hosted Software. “Statement of Work” or “SOW” means a mutually agreed executed written document describing the Services to be performed by Dragos for Customer.
“Subscription Term” means the period of time set forth in the applicable Order during which Customer is authorized by Dragos to access and use the Offerings or during which Services will be performed. “Support” means Dragos’s standard Software support services as described www.dragos.com/software-support-maintenance. “Term” means the term of this Agreement as specified in Section 11.1 of the General Terms. “Third-Party Provider” means any individual or entity (other than a Dragos Competitor) that: (i) has access to or use of the Offerings as an Authorized User under these Terms solely on behalf of and for Customer’s internal use or under a separate valid agreement with Dragos, (ii) has an agreement to provide Customer services, and (iii) is subject to confidentiality obligations covering Dragos’s Confidential Information. Examples of Third-Party Providers are managed services providers, consultants or consulting firms.
“Threat Data” means any malware, spyware, virus, worm, Trojan horse, indicators of compromise, threat behaviors or other potentially malicious or harmful code or files, URLs, DNS data, network telemetry, commands, processes or techniques, metadata, or other information or data that is related to potentially unauthorized third parties associated with the Threat Data and is collected or discovered during the course of using or receiving Dragos Offerings, excluding any such information or data that identifies Customer or to the extent that it includes Personal Data.
“Upgrades” are releases, improvements, or enhancements to Offerings for which Dragos charges separately or extra as determined by Dragos in its sole discretion.
15 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
SCHEDULE 2: SERVICES
A. PROFESSIONAL SERVICES
In addition to the General Terms the following terms apply to Dragos Services Offerings (the “Services Terms”).
1. FEES & DELIVERY
1.1. Services will commence on a mutually agreed upon date as set forth in an Order.
1.2. Fees may be based on a time and materials or fixed fee basis as specified in the SOW.
1.3. The ability of Dragos to render Services outside of the United States may be limited for security, export control, and visa or immigration reasons, as well as country-specific travel restrictions. Certain destinations will be limited to remote Services only. The location of the Services will be set forth in the applicable SOW.
2. WARRANTY
Dragos warrants that Services shall be performed in a professional manner. Customer must notify Dragos of any warranty claim for Services during the period the Services are being performed or within thirty (30) days after the conclusion of the Services.
Customer’s sole and exclusive remedy and the entire liability of Dragos for its breach of this warranty will be for Dragos, at its expense and option, to reperform the Services which do not conform to this warranty or provide a refund for the portion of the fees attributable to non-conforming Services.
3. OWNERSHIP
3.1. The results of any Services and any Report Deliverables do not constitute “works for hire,” “works made in the course of duty,” or similar terms under laws where the transfer of intellectual property to Customer occurs on the performance of Services.
3.2. Subject to payment of all applicable fees for the Services, Dragos hereby assigns all right, title and interest in and to each Report Deliverable specified in the SOW (excluding any Dragos Technology, Dragos Works or Dragos Data (“Dragos Materials”) contained or incorporated therein) to Customer. To the extent the Dragos Materials are incorporated into the Report Deliverable(s), Customer shall have a perpetual, non-transferable (except as expressly provided in Section 16.7 of the General Terms re Assignment), non-exclusive license to use the Dragos Materials solely as a part of the Report Deliverable(s) for internal use.
3.3. With the exception of any Report Deliverable, materials created by Dragos in connection with Services and all intellectual property rights therein shall be the sole property of Dragos (excluding any Customer Confidential Information).
4. SERVICES TEAM
4.1. Dragos will assign personnel with qualifications suitable for the Services described in the relevant Order and may replace or change personnel, in its sole discretion, with other qualified employees or subcontractors.
4.2. Dragos personnel who will be performing Services at Customer’s premises will, as permitted by federal, state and local law, have undergone background checks and drug testing as per Dragos policies re same. Dragos will, upon Customer’s request, attest that such background check and drug testing has been performed. Customer acknowledges and agrees that the background check and drug testing described in this section is sufficient and Customer will neither require Dragos to perform any additional checks or testing, nor perform, or engage any third party to perform, any background check or drug testing on any Dragos personnel.
4.3. Customer acknowledges that in the normal course of business, Dragos should not have unescorted access to Customer’s premises or access to any Personal Data. In the event that such access is deemed necessary, the Parties may negotiate additional security procedures applicable to such access and include them in the relevant Order.
5. PREMISES REQUIREMENTS.
5.1. When accessing Customer’s premises, Dragos authorized representatives shall adhere to Customer site restrictions or regulations as provided in advance to Dragos in writing, provided that such restrictions do not unreasonably inhibit Dragos’s ability to provide Offerings. Customer must provide any restrictions or requirements related to Dragos’ non-U.S. citizen personnel with sufficient advance written notice for Dragos to provide either the information requested to allow such personnel to access the premises or to designate alternative U.S. citizen personnel to cover on site work.
6. CUSTOMER RESPONSIBILITIES
6.1. Customer will promptly cooperate with and assist Dragos during the performance of the Services, including by making available in a timely manner, at no charge to Dragos, all technical data, computer facilities, programs, files, documentation, test data, sample output, and other information and resources of Customer specified in any applicable Order or otherwise
16 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
reasonably required by Dragos for the performance of the Services.
6.2. Customer will be responsible for, and assumes the risk of, any problems or delays resulting from, the content, accuracy, completeness and consistency of all data, materials and information supplied by Customer. Customer agrees that Dragos is not responsible for delays attributable to Customer and that any delay caused by Customer actions or omissions will automatically extend the time for Dragos’s performance of the Services.
7. LITIGATION SUPPORT
7.1. Dragos does not offer litigation support as a professional service.
B. PENETRATION TESTING SERVICES
In addition to the General Terms and the Services Terms, the following terms apply to Dragos Penetration Testing Services (the “Penetration Testing Terms”).
1. CUSTOMER REQUIREMENTS FOR PENETRATION TESTING
1.1. Customer must comply with and provide the information requested in the Dragos Penetration Testing rules of engagement documentation.
1.2. Customer agrees to have a person available at all times during the penetration testing engagement to restore, as soon as possible, any service or server that becomes unavailable.
1.3. In the event that any or all of the penetration testing services require Dragos to be present on-site at Customer’s location, Customer agrees that it will provide Dragos’s penetration testing team (“PTT”) all necessary access to Customer’s site and network in order to provide the Services, and will provide Dragos in writing, in advance, any applicable restrictions for PTT presence on Customer’s site if not already covered in the rules of engagement documentation. Dragos will comply with any reasonable restrictions for PTT access to Customer’s site, provided that such restrictions do not unreasonably inhibit Dragos’s ability to provide the Services.
2. ACKNOWLEDGMENT
Customer acknowledges, understands, and agrees that there is an element of risk associated with penetration testing activities, especially to the systems tested in a live environment, and that unauthorized access to computer systems or data or intrusion into hosts and network access points may be prohibited by law. Risks include the potential that some services on Customer’s system may be rendered unavailable during the test process. It is further understood and agreed by Customer that there is no guarantee that vulnerability in its systems will be identified during the test.
C. DRAGOS ACADEMY & TRAINING
In addition to the General Terms, the following terms apply to Dragos educational offerings and training services (the “Training Terms”).
1. Fees. Customers may purchase credits to be used for any Dragos educational offering, including Dragos instructor-led courses (either public or privately held) (“Training”), or access to the Dragos on-demand course catalog (“Dragos Academy”). Credits will expire two years after they are issued.
2. Rescheduling or Cancellation.
2.1. If Customer schedules a user to attend public Training, Customer must notify Dragos of a cancellation no later than ten (10) business days before the date of the public class in order to receive a refund of credits applied toward that class. If Customer timely notifies Dragos of the cancellation, Dragos will reissue the credits that were applied to the public Training class, however, the time to use the credits will not be extended beyond the original two (2) year time-period.
2.2. Customer must request rescheduling of private Training no less than two (2) months in advance of the date the class is scheduled to begin in order to receive a refund of credits applied toward that class. If Customer timely notifies Dragos of the cancellation, Dragos will reissue the credits that were applied to the private Training class, however, the time to use the credits will not be extended beyond the original two (2) year time-period. If Customer cancels within the two (2) month period prior to the start of the class, Dragos will not issue a refund and may at its discretion also charge Customer any expenses associated with the rescheduling, including any expenses associated with cancelling or changing travel plans.
2.3. Dragos does not refund or credit Fees paid for attendees who do not cancel Training in writing within the time frame specified above and do not attend the Training session, or who leave before Training concludes.
2.4. Dragos reserves the right to cancel public Training classes for any reason and will provide a full refund of credits.
3. Credits may be used for access to the Dragos Academy, which will be provided to one Authorized User during the time of the Dragos Academy Subscription Term described in an Order.
17 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
4. Dragos reserves the right to refuse admittance to public Training classes to any person, for any reason, and if Dragos refuses admittance, Dragos will refund the amount paid for that person’s attendance at the public Training class.
5. Unless explicitly authorized by Dragos in writing, Training may not be recorded, and no information, documentation or other Dragos Works provided in connection with the Training, may be copied, distributed, or otherwise used/disseminated without our authorization. All intellectual property rights in and to information and documentation or other Dragos Works provided during Training and any ideas, know-how, and programs that may be developed by Dragos in the course of providing Training, including any enhancements, derivative works, or modifications and all intellectual property rights embodied therein (other than Customer’s Confidential Information), remain with Dragos.
18 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
SCHEDULE 3: SOFTWARE
A. LOCAL SOFTWARE
In addition to the General Terms the following terms apply to the Local Software Offering (“Local Software Terms”).
1. ORDERING AND PROVISIONING
Dragos will deliver the Local Software to the location set forth in the applicable Order or shall deliver the Local Software by making it available for downloading on the Dragos Portal. Delivery will be deemed complete and Local Software accepted upon receipt by Customer or when made available for download (“Delivery”).
2. SOFTWARE LICENSE GRANT
Subject to Customer’s compliance with the terms of the Agreement, Dragos grants to Customer and Authorized Users during the Subscription Term a non-exclusive, non-transferable, non-sublicensable, revocable license to install and operate the Local Software and to use the Documentation in connection with such Local Software for Customer’s internal use.
3. LOCAL SOFTWARE SUPPORT & MAINTENANCE
Subject to Customer’s payment of all undisputed fees, Dragos agrees to support the proper functioning of the Software during the Subscription Term as set forth at www.dragos.com/software-support-maintenance.
4. WARRANTY
4.1. Dragos warrants that Local Software, as delivered, will perform substantially in accordance with the applicable Documentation for a period of sixty (60) days from the Delivery date. In the event that the Local Software does not conform to the above warranty, Dragos’s entire liability and Customer’s sole remedy shall be for Dragos at Dragos’s option to: (i) use its reasonable efforts to correct any Error confirmed by Dragos; (ii) repair or replace the non-conforming Local Software with conforming Software; or (iii) refund to Customer the fees paid for same.
4.2. Dragos’s warranty shall not extend to errors that result from: (i) use of the Local Software other than in accordance with the Documentation; (ii) any alterations of or additions to the Local Software performed by parties other than Dragos or its authorized suppliers; (iii) use of the Local Software in a manner for which it was not designed or outside of the scope of this Agreement; (iv) Customer’s failure to implement any Patch Updates that are made available by Dragos; (v) accident, negligence, or misuse of the Local Software by any party other than Dragos; (vi) combination of the Local Software with other products not supplied by Dragos; (vii) third party software, hardware or network infrastructure outside of the direct control of Dragos, including Appliance firmware updates unless done in consultation with Dragos; (viii) electrical or internet access disruptions; or (ix) attacks (i.e. hacks, malicious introduction of viruses and disabling devices) caused by third parties.
5. CUSTOMER REQUIREMENTS & LIMITATIONS
5.1. Customer shall provide Dragos with all information and access reasonably required by Dragos to configure the Local Software. Customer’s failure to: (i) provide the information reasonably necessary for Dragos to configure the Local Software, or (ii) provide the connectivity and materials required for its use of the Local Software shall not delay the start of the Subscription Term.
5.2. Customer is solely responsible for any materials, equipment or conditions required to meet the minimum technical requirements set forth in the Documentation in order to operate the Local Software, and for ensuring the continued compatibility of the Local Software within its own operating environment. Dragos will have no liability under this Agreement for any damages arising, in whole or in part, from Customer’s non-compliance with the minimum technical requirements.
19 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
SCHEDULE 3: SOFTWARE
B. HOSTED SOFTWARE
In addition to the General Terms the following terms apply to the Hosted Software Offering (“Hosted Software Terms”).
1. ORDERING & PROVISIONING
Dragos will provide access to the Hosted Software as set forth in the applicable Order. Delivery will be deemed complete and Hosted Software accepted when access to the Hosted Software is made available (“Delivery”).
2. ACCESS AND USE
Subject to Customer’s compliance with the terms of the Agreement, Dragos grants to Customer and its Authorized Users during the Subscription Term a non-exclusive, non-transferable, non-sublicensable, revocable right to access and use the Hosted Software for Customer’s internal use.
3. HOSTED SOFTWARE SUPPORT & MAINTENANCE
Subject to Customer’s payment of all applicable fees, Dragos agrees to support the proper functioning of the Software during the Subscription Term as set forth at www.dragos.com/software-support-maintenance.
4. WARRANTY AND SERVICE LEVEL
4.1. Dragos represents and warrants that during the Subscription Term, the Hosted Software will conform to the description set forth in the applicable Documentation in all material respects and Dragos shall use commercially reasonable efforts so that System Availability equals or exceeds 99.95% during each calendar month (the “Service Level”) during the Subscription Term.
4.2. Dragos’s warranty shall not extend to errors or disruptions in service that result from: (i)use of the Hosted Software other than in accordance with the Documentation; (ii) any alterations of or additions to the Local Software performed by parties other than Dragos or its authorized suppliers; (iii) use of the Hosted Software in a manner for which it was not designed or outside of the scope of this Agreement; (iv) accident, negligence, or misuse of the Hosted Software by any party other than Dragos; (v) combination of the Hosted Software with other products not supplied by Dragos; (vi) third party software, hardware or network infrastructure outside of the direct control of Dragos, including Appliance firmware updates unless done in consultation with Dragos; (vii) electrical or internet access disruptions; or (viii) attacks (i.e. hacks, malicious introduction of viruses and disabling devices) caused by third parties.
4.3. Reporting of Unscheduled Downtime: Customer must report Unscheduled Downtime by emailing Dragos at [email protected] to promptly notify Dragos in the event Unscheduled Downtime occurs. Unscheduled Downtime will be deemed to begin when Dragos receives accurate notification thereof from Customer, or when Dragos first becomes aware of such Unscheduled Downtime, whichever first occurs.
4.4. SERVICE LEVEL OBJECTIVES DEFINITIONS
4.4.1. “System Uptime” means the total amount of time during any calendar month, measured in minutes, during which Customer has the ability to access the features and functions of the Hosted Software.
4.4.2. “Scheduled Downtime” means the total amount of time during any calendar month, measured in minutes, during which Customer is not able to access the Hosted Software, due to planned system maintenance performed by Dragos.
Dragos will use commercially reasonable efforts to provide advanced notice to Customer prior to any scheduled maintenance.
4.4.3. “System Availability” means, with respect to any particular calendar month, the ratio obtained by subtracting Unscheduled Downtime during such month from the Total Monthly Time during such month, and thereafter dividing the difference so obtained by the Total Monthly Time during such month. NOTE: “Total Monthly Time” is deemed to include all minutes in the relevant calendar month during a Subscription Term.
4.4.4. “Unscheduled Downtime” will mean the total amount of time during any calendar month, measured in minutes, during which Customer is not able to access the features and functions of the Hosted Software, other than Scheduled Downtime.
5. CUSTOMER REQUIREMENTS & LIMITATIONS
5.1. Customer shall provide Dragos with all information and access reasonably required by Dragos to configure the Hosted Software. Customer’s failure to: (i) provide the information reasonably necessary for Dragos to configure the Hosted Software, or (ii) provide the connectivity and materials required for its use of the Hosted Software shall not delay the start of the Subscription Term.
20 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
5.2. Customer is solely responsible for any materials or conditions required to meet the minimum technical requirements set forth in the Documentation in order to operate the Hosted Software, and for ensuring the continued compatibility of the Hosted Software within its own operating environment. Customer shall use all reasonable efforts to resolve any issues associated with operation of the Hosted Software within its operating environment. Dragos will have no liability under this Agreement for any damages arising, in whole or in part, from Customer’s non-compliance with the minimum technical requirements.
6. MISCELLANEOUS
6.1. Suspension. Notwithstanding anything to the contrary in the Agreement, Dragos may terminate Customer’s and any Authorized User’s access to all or any portion of the Hosted Software if: (i) Dragos reasonably determines that (a) there is a threat to or attack on the Hosted Software; (ii) Customer’s or any Authorized User’s use of the Hosted Software disrupts or poses a security risk to the Hosted Software or any other customer or vendor of Dragos; (iii) Customer or any Authorized User is using the Hosted Software for fraudulent or illegal activities; or (iv) Dragos’s provision of the Hosted Software to Customer or any Authorized User is prohibited by applicable Law.
21 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
SCHEDULE 4: OT WATCH
OT Watch is an add-on available to current subscribers of Dragos Software. In addition to the General Terms the following terms apply to the OT Watch solution (the “OT Watch Terms”).
1. ORDERING & PROVISIONING
Dragos will provide access to OT Watch as set forth in the applicable Order.
2. SUBSCRIPTION TERM
Unless otherwise agreed to in writing by Dragos, the Subscription Term will be the term of the active Local or Hosted Software Subscription Term that facilitates access to OT Watch.
3. CUSTOMER REQUIREMENTS & LIMITATIONS
3.1. Customer must have a valid current Subscription to either Local or Hosted Software.
3.2. All of the restrictions that apply to the Local or Hosted Software used to access OT Watch apply to the use of OT Watch.
3.3. Customer must meet the additional technical requirements for OT Watch as set forth in the OT Watch documentation. If Customer is not already an active participant in Neighborhood Keeper, Customer will be automatically enrolled to participate in Neighborhood Keeper unless the Customer specifically declines to participate by submitting written notice to Dragos.
4. ACCESS AND USE
Subject to Customer’s compliance with the terms of the Agreement, Dragos grants Customer during the Subscription Term a nonexclusive right to access and use OT Watch solely for the benefit of Customer’s internal security purposes.
5. SUPPORT & MAINTENANCE
In addition to the Support provided for the Dragos Software that is required to access OT Watch (support offering found here:
www.dragos.com/software-support-maintenance), specific OT Watch support details are set forth in the OT Watch documentation.
6. NO WARRANTY
6.1. THE OT WATCH OFFERING IS PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTY OF ANY KIND. CUSTOMER ACKNOWLEDGES AND AGREES THAT IT IS SOLELY RESPONSIBLE FOR DETERMINING WHETHER CUSTOMER’S EXERCISE OF THE RIGHTS GRANTED UNDER THIS AGREEMENT COMPLIES WITH APPLICABLE LAWS.
6.2. While Dragos uses reasonable efforts to identify threats to a Customer’s ICS environment, given the nature and volume of malicious and unwanted electronic content or activities, Dragos cannot guarantee that OT Watch will find, locate, discover, prevent or warn of Customer’s system threats or vulnerabilities, and Customer will not hold Dragos responsible forsame.
7. ACKNOWLEDGEMENT & AUTHORIZATION
By accessing OT Watch, Customer is: (i) explicitly confirming to Dragos that it has obtained all applicable consents and authority for Dragos to provide OT Watch; (ii) giving Dragos explicit permission to access and process any and all Customer Data necessary for OT Watch and Neighborhood Keeper, including without limitation, if applicable, consent to analyze host forensics including but not limited to, memory, disk, logs, data, network traffic in real time to detect evidence of known malicious communication patterns and traffic containing unrecognized malicious code (malware), connect to Customer’s computer network, archive and retain all host forensics data including but not limited to, memory, disk, logs, data, network traffic captured as part of Offerings (including to store any malware and metadata supplied by Customer, or anyone else working with or for Customer), (iii) representing that such access and processing by Dragos does not violate any applicable law or any obligation Customer owes to a third party; and (iv) accepting sole responsibility and liability with respect to the implementation and use of OT Watch.
8. OUT OF SCOPE
Professional services, including incident response, advisory, or other consulting services are not included in the OT Watch solution, but are offered by Dragos as separate service offerings.
22 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
SCHEDULE 5: NEIGHBORHOOD KEEPER
Neighborhood Keeper is an add-on available to current subscribers of Dragos Software. In addition to the General Terms the following terms apply to participation in the Neighborhood Keeper Program (“Neighborhood Keeper Terms”).
1. ORDERING AND PROVISIONING
Dragos will provide access to Neighborhood Keeper as set forth in the applicable Order.
2. SUBSCRIPTION TERM
Unless otherwise agreed to in writing by Dragos, the Subscription Term will be the term of the active Software Subscription Term that facilitates access to Neighborhood Keeper.
3. CUSTOMER REQUIREMENTS & LIMITATIONS
3.1. Customer must have a valid current Subscription to either Local or Hosted Software in order to opt-in to the Neighborhood Keeper Program.
3.2. Customer shall have internet access to connect to Neighborhood Keeper.
3.3. Customer must transmit base telemetry data as set forth in the Neighborhood Keeper Program documentation.
4. ACCESS AND USE
Subject to Customer’s compliance with the terms of the Agreement, Dragos grants Customer during the Subscription Term a nonexclusive right to access and use Neighborhood Keeper via the Dragos Portal solely for the benefit of Customer’s internal security purposes.
5. NO WARRANTY
THE NEIGHBORHOOD KEEPER OFFERING IS PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTY OF ANY KIND. CUSTOMER ACKNOWLEDGES AND AGREES THAT IT IS SOLELY RESPONSIBLE FOR DETERMINING WHETHER CUSTOMER’S EXERCISE OF THE RIGHTS GRANTED UNDER THIS AGREEMENT COMPLIES WITH APPLICABLE LAWS.
6. RESTRICTIONS
Neighborhood Keeper Program participants must not (and must not allow any other person or entity to): (a) attempt to identify the source of any unattributed data from Neighborhood Keeper, including the identity of the party or parties from which such data came; (b) distribute, sell, offer to sell, lease, commercialize or otherwise transfer Neighborhood Keeper technology or Neighborhood Keeper Data (wholly or in part) to any third parties; (c) share insights from its access to confidential information associated with Neighborhood Keeper publicly; (d) interfere with, bypass or disable any features or functionality that are embedded in or included with Neighborhood Keeper; (e) use any scraping, data harvesting, web crawlers, or other data extraction methods to extract data from Neighborhood Keeper, including Dragos APIs which may not be used in connection with Neighborhood Keeper; or (f) avoid, bypass, remove, deactivate, impair, descramble or otherwise circumvent any technological measure implemented by Dragos or any of Dragos’s providers to protect Neighborhood Keeper.
7. PROPRIETARY RIGHTS
All intellectual property rights in and to Neighborhood Keeper, Neighborhood Keeper Data, other Dragos Offerings, Dragos Technology, Dragos Works, and Dragos Data, and any copy thereof, and in any ideas, know-how, and programs that may be developed by Dragos in the course of providing Neighborhood Keeper, including any enhancements, derivative works, or modifications thereof, remain with Dragos. Dragos may share Neighborhood Keeper Data, Dragos Data or related data in any manner, including with governments or government entities. Dragos hereby reserves all rights not expressly granted hereunder. If you provide Dragos with comments, suggestions or feedback regarding Neighborhood Keeper you agree that Dragos will be free to use, disclose, reproduce, license or otherwise exploit such comments, suggestions or feedback as it sees fit, without obligation or restriction of any kind.
8. ABOUT NEIGHBORHOOD KEEPER
8.1. Data. No personal, sensitive or customer-identifiable data will be transmitted to the Neighborhood Keeper Analytics Framework. Customer’s base telemetry data will be de-identified and pseudonymized before the data is uploaded to the Neighborhood Keeper Analytics Framework, with the only key capable of identifying the Customer being under the exclusive control of the Customer. In order to provision access to the Neighborhood Keeper Program, Dragos receives the identity of participants and authorized users.
8.2. Targeted Disclosures. Neighborhood Keeper Program participants may receive relevant analytic alerts or be made aware of threats in Customer’s environment. Participants will not receive specific alerts or outputs from other participants’ platforms.
23 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
Certain analytics in Neighborhood Keeper may aggregate and summarize threat behavior across industry sector, technology vendor type or asset type for distribution to all participants.
8.3. Request for Assistance.
8.3.1. The Request for Assistance (“RFA”) function in Neighborhood Keeper allows a Neighborhood Keeper participant to submit a request to other participants for help or to view and respond to other participant’s requests. Responses to an RFA identify the respondent’s organization.
8.3.2. Dragos is not liable for any information provided via RFA, including any information provided by Customer that might identify Customer as the requesting participant. Dragos is not liable for participant advice provided through RFA.
24 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
SCHEDULE 6: DRAGOS THREAT INTELLIGENCE OR WORLDVIEW
In addition to the General Terms the following terms apply to Dragos Threat Intelligence or WorldView (the “WorldView Terms”).
1. ORDERING & PROVISIONING
Dragos will provide access to WorldView as set forth in the applicable Order. Delivery will be deemed complete when access to WorldView is made available (“Delivery”).
2. SUBSCRIPTION TERM
The Subscription Term will be designated in the Order.
3. ACCESS AND USE
3.1. Access to WorldView. Subject to Customer’s compliance with the terms of the Agreement, Dragos grants to Customer and its Authorized Users during the Subscription Term a non-exclusive, non-transferable, nonsublicensable, revocable right to access and use WorldView, through the Dragos Portal for Customer’s internal use.
3.2. To access the Dragos Portal, you must have a Dragos account associated with a valid Customer email address. Only one account per email address may be created.
3.3. Use Limitations. Unless otherwise indicated in an Order, Customer may appoint up to ten (10) Authorized Users of the Intelligence Portal at any time. Dragos may implement restrictions on the number of requests within a given period of time.
4. WARRANTY
DRAGOS WARRANTS THAT WORLDVIEW IS BASED ON DRAGOS’S REASONABLE EFFORTS TO COMPILE AND ANALYZE THE BEST SOURCES REASONABLY AVAILABLE TO DRAGOS AT ANY GIVEN TIME; HOWEVER, ANY OPINIONS REFLECT DRAGOS’S JUDGMENT AT THE TIME AND ARE SUBJECT TO CHANGE. DRAGOS ALSO
WARRANTS THAT IT HAS THE REQUISITE SKILL, KNOWLEDGE AND AUTHORITY TO PROVIDE THE
WORLDVIEW OFFERING AND SHALL PROVIDE THE WORLDVIEW OFFERING IN ACCORDANCE WITH APPLICABLE INDUSTRY STANDARDS. THE FOREGOING WARRANTIES ARE PROVIDED IN LIEU OF ALL
WARRANTIES, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY
IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, AND WARRANTIES AS TO ACCURACY, COMPLETENESS, OR ADEQUACY OF INFORMATION. CUSTOMER ACKNOWLEDGES AND
AGREES THAT CUSTOMER IS SOLELY RESPONSIBLE FOR DETERMINING WHETHER THE EXERCISE OF THE RIGHTS GRANTED TO CUSTOMER UNDER THIS SCHEDULE COMPLIES WITH APPLICABLE LAWS. CUSTOMER IS
SOLELY RESPONSIBLE FOR ALL ACTS AND OMISSIONS TAKEN IN RELIANCE ON THIS INFORMATION, AND DRAGOS WILL NOT HAVE ANY LIABILITY FOR ANY SUCH ACTS OR OMISSIONS.
5. RESTRICTIONS
Customer shall not, and shall not permit any other Person to: (i) access the Dragos Portal by any means other than through the interface that is provided or approved by Dragos; (ii) collect any information from or through the Dragos Portal using any automated means, including without limitation any scraping, data harvesting, web crawlers, or other data extraction methods to extract data from WorldView or the Dragos Portal except via a Dragos API (use of Dragos APIs are subject to the terms and conditions which may be accessed here www.dragos.com/API-terms); (iii) share, publish or otherwise release to any third party any information accessed through WorldView; (iv) damage, disable, overburden, or impair the Dragos Portal or interfere with any other party’s use and enjoyment of the Dragos Portal.
6. PROPRIETARY RIGHTS
The WorldView Offering is the property of Dragos, its Affiliates or its licensors and is protected by copyright and other intellectual property laws. The WorldView Offering comprises: (a) works of original authorship, including compiled content containing Dragos’s, its Affiliates’ or its licensors’ selection, arrangement, coordination, and expression of such content or preexisting material it has created, gathered, or assembled; and (b) information that has been created, developed, and maintained by Dragos, its Affiliates or its licensors at great expense of time and money such that misappropriation or unauthorized use by others for commercial gain may unfairly and irreparably harm Dragos, its Affiliates or its licensors. Customer shall not commit or permit any act or omission that would impair Dragos’s, its Affiliates’ or its licensors’ proprietary and intellectual property rights in the WorldView Offering. All of Customer’s right to use the WorldView Offering are expressly stated herein; there are no implied rights, and Dragos reserves all rights not expressly granted to Customer.
25 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
7. UPDATES AND REVISIONS TO DRAGOS PORTAL
Dragos may update or revise the Dragos Portal from time to time and such updates and revisions may adversely affect the manner in which you access or communicate with the Dragos Portal. Dragos will use commercially reasonable efforts to provide advance notice of any updates or revisions to the Dragos Portal that are not backward compatible or significantly change its functionality by posting such notice on the Dragos Portal.
8. WORLDVIEW CONCIERGE OFFERING
If specified in an Order, Dragos may provide WorldView Concierge. WorldView Concierge delivers tailored threat intelligence which may include research reports on a particular OT security topic, responses to ad hoc security inquiries and/or periodic intelligence reports tailored to a particular industry, as set forth in a given SOW.
9. EXPORT CONTROL RESTRICTIONS
Content accessible in WorldView may be subject to enhanced export control restrictions. Unless Customer has received an Export Control Waiver from Dragos, Customer agrees: (i) the content will not be shared with any party located in, or with any government (or agent of a government) of, a country listed in Country Group E or D at Supplement No. 1 to 15 CFR Part 740, except for an agency of the U.S. Government or a foreign branch or subsidiary of a U.S. company; and (ii) the content will not be shared outside of the United States or with a non-U.S. national with a purpose to affect the confidentiality, integrity, or availability of any information or information systems, without authorization by the owner, operator, or administrator of the information system (including the information and processes within such systems). Contact [email protected] to request an Export Control Waiver.
26 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
SCHEDULE 7: TERMS SPECIFIC TO THE COOPERATIVE AGREEMENT
1. RECITALS
1.1. WHEREAS, the Department of Energy (“DOE”) awarded the American Public Power Association (“APPA”) a contract, Award Number DE-CR0000015, to facilitate the rapid adoption and deployment of Industrial Control Systems (“ICS”) Cybersecurity Technologies for distribution and municipal utilities (the “Cooperative Agreement”);
1.2. NOW, THEREFORE, in consideration of the representations herein, as well as other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties agree to the following terms in this Schedule 7:
2. VENDOR OBLIGATIONS
2.1. Vendor shall comply with the requirements of 2 C.F.R. part 200 and 2 C.F.R. Part 200 Appendix II, as modified by 2 C.F.R. 910, to the extent applicable to Vendor(s);
2.2. Vendor shall provide Utility confirmation of either Vendor’s registration or active status in the System for Award Management (“SAM”);
2.3. Vendor will assign personnel with qualifications suitable for the Offerings. If Vendor anticipates involving foreign nationals (i.e., non-U.S. citizens or non-lawful permanent residents of the U.S.) in the performance of the Vendor Agreement, Vendor must provide specific information about each such foreign national to Utility for review and consideration through the submission of NETL Foreign National Participation Document, a copy of which is attached hereto (Form “Foreign National Participation Document”). Vendor must provide this information for any foreign national who will be exposed to business sensitive information, or information or technology developed under the Vendor Agreement that may be included under any category of national or state security. The Secretary of Energy or the Secretary’s assigned approval authority must approve foreign national participation before any foreign national may gain access to DOE sites, information, technologies, equipment, programs, or personnel or begin performance of any work under this Vendor Agreement. If Vendor anticipates using a foreign national in the performance of this Vendor Agreement, then Vendor shall coordinate with Utility to comply with the requirements of this Section 2.6;
2.4. Vendor shall provide a Quarterly Progress Report within 15 days of the last day of each calendar quarter to the Utility reflecting the current position of the Vendor's offering compared to the following evaluation criteria for OT Cybersecurity Technology. The Vendor is not responsible for meeting all of the criteria, but will make a best effort to meet those which align with the intended use of the Vendor's offering:
1. Technology built for ICS networks with integration compatibility with ICS protocols and communications.
2. Technology provides sensor-based continuous network cybersecurity monitoring, detection, and facilitate response capabilities for ICS/OT (i.e., the technology is ICS-focused and already understands ICS communications, such as deep packet inspection capabilities for ICS protocols).
3. Technology software has a collective-defense capability/framework to allow the sharing of insights and detections rapidly with the Federal government, participants, and trusted organizations such as relevant information sharing and analysis centers (ISACs)/information sharing and analysis organizations (ISAOs). Data and insights collected must be sharable across the Federal government, to the greatest extent possible, and should be compatible with other sector sensing partnerships.
4. Technology does not collect or store sensitive data off the participants’ site (e.g., perform analysis at the edge); however, certain insights or analysis outputs, such as whether a threat was present and relevant indicators of compromise, may be stored off premises.
5. Technology protects or anonymizes participant identity and ensure that risks and vulnerability information is not inadvertently disclosed between participants unless explicitly authorized by the participating entity.
6. Technology allows for centralized queries and correlation. Sensitive information that contextualizes anomalies that may indicate adversary presence may be stored off premises for analysis.
7. Technology allows for short-term (minimum of one year) on-site storage of raw data so new insights or detections can be retroactively applied to full data sets as needed.
8. Technology is passive in its deployment, using isolation technologies to ensure that the technology itself cannot be used as a vector for adversaries to gain access into sensitive ICS networks.
9. The ICS sensing technology is capable of working with correlation and aggregation technologies to allow for OT/IT sensing cross correlation and analysis.
27 Dragos Terms and Conditions for Offerings
Form DE-CR0000015VendorAgreement20240126
10. Technology has the capability of baselining normal ICS operations and can compare/detect abnormal operations from a known good baseline.
11. Data at rest is cryptographically protected, (e.g., leverage NIST FIPS 140-3 certified cryptology to protect the data).
12. Technology has the capability to detect known unauthorized remote access operations.
13. Technology has the capability to detect unauthorized movement from the IT to the OT environment including via non-Internet Protocol (IP) communication pathways.
14. Technology has the capability to detect unauthorized network activity and actions consistent with the MITRE ATT&CK for ICS framework including detecting potential tactics that may be used for disruptive or destructive actions.
15. Technology has analytic and detection capabilities, which are dynamically updatable leveraging timely, validated, and trusted external or internal threat intelligence.
16. Technology has the capability to detect access credential misuse.
17. Technology to identify violations of implemented application allow listing policies enforced on IT and OT systems.
18. The system shall Utilize artificial intelligence to identify anomalies, reduce false positives, and update OT assets.
19. The system shall Provide for advanced analytics to enable the user to identify the systems when and where compromised.
20. The system shall Employ autonomous defense solutions at remote endpoints to protect against in-band and out-ofband attacks. This includes hardware, firmware, or software that protects, defends, or hardens deployed OT.
2.5. Vendor shall not use Utility’s or APPA’s name, logo, or trademark in marketing and advertising materials, including on the Vendor’s website, without Utility’s and APPA’s prior written consent, respectively. News releases by Vendor pertaining to its selection for work subject to this Vendor Agreement require prior written approval by Utility and APPA.
2.6. Vendor(s) shall include the following citation on the Quarterly Progress Reports required under this Agreement: "This material is based upon work supported by the Department of Energy under Award Number(s) DE-CR0000015." Disclaimer:
"This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or any agency thereof. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or any agency thereof."
3. CUSTOMER REQUIREMENTS
3.1. Customer agrees to cooperate as necessary with Dragos to deploy and operationalize the Dragos Offerings.
3.2. Dragos will have no liability for failure to perform under this Agreement to the extent such failure to perform results from Customer’s breach of Section 3.1.
4. COOPERATIVE AGREEMENT FEES, EXPENSES, AND PAYMENTS
4.1. APPA and Utility shall inform Vendor in writing whether APPA or Utility shall be primarily responsible for payment.
4.2. Utility shall review all Vendor invoices and confirm in writing to APPA that the invoices are correct.
4.3. If APPA is responsible for the payment of Vendor fees for Orders created under the Vendor Agreement and APPA fails to make payment, Customer shall be responsible for the payment of Vendor fees.
4.4. The total amount to be paid by APPA on behalf of Customer to Vendor shall not exceed the total contract value as set forth in the Vendor Agreement Order (“Not to Exceed Value”). The Not to Exceed Value shall include the total amount to be paid by APPA on behalf of Customer to Vendors for reimbursable out-of-pocket or incidental expenses as set forth in the Vendor Agreement (“Maximum Incidental Reimbursement”).
4.5. Vendor shall submit invoices to Utility on a monthly basis for Time and Material services or when work is completed.
4.6. Vendor shall provide sufficient time under this Agreement to allow Utility and APPA to review invoices.
4.7. Vendor shall indicate the time spent and services rendered, together with such supporting documentation as APPA reasonably requires, as applicable.
4.8. Vendor shall include a description of activities during the period being invoiced, including lists of tasks accomplished.