Agreement with Guidehouse, Inc. Page 1 of 35
Rev. 07-01-18
EBIX Insurance No. S200000175
AGREEMENT FOR SERVICES
BETWEEN THE
CITY OF SANTA CLARA, CALIFORNIA,
AND
GUIDEHOUSE INC.
FOR
CONSULTING SERVICES FOR NORTH AMERICAN
ELECTRIC RELIABILITY CORPORATION COMPLIANCE
AND WESTERN ELECTRICITY COORDINATING COUNCIL REGULATORY
COMPLIANCE
PREAMBLE
This Agreement is entered into between the City of Santa Clara, California, a chartered California municipal corporation (City), and Guidehouse Inc., a Delaware corporation (Contractor). City and Contractor may be referred to individually as a “Party”, or collectively as the “Parties” or the “Parties to this Agreement.”
RECITALS
A. City desires to secure the services more fully described in this Agreement, at Exhibit A, entitled “Scope of Services”;
B. Contractor represents that it, and its subcontractors, if any, have the professional qualifications, expertise, necessary licenses and desire to provide certain goods and/or required services of the quality and type which meet objectives and requirements of City; and
C. The Parties have specified herein the terms and conditions under which such services will be provided and paid for.
The Parties agree as follows:
AGREEMENT TERMS AND CONDITIONS
1. AGREEMENT DOCUMENTS
The documents forming the entire Agreement between City and Contractor shall consist of these Terms and Conditions and the following Exhibits, which are hereby incorporated into this Agreement by this reference:
Exhibit A – Scope of Services
Exhibit B – Schedule of Fees
Exhibit C – Insurance Requirements
Agreement with Guidehouse, Inc. Page 2 of 35
Rev. 07-01-18
This Agreement, including the Exhibits set forth above, contains all the agreements, representations and understandings of the Parties, and supersedes and replaces any previous agreements, representations and understandings, whether oral or written. In the event of any inconsistency between the provisions of any of the Exhibits and the Terms and Conditions, the Terms and Conditions shall govern and control.
2. TERM OF AGREEMENT
Unless otherwise set forth in this Agreement or unless this paragraph is subsequently modified by a written amendment to this Agreement, the term of this Agreement shall begin on October 1, 2022, and terminate on September 30, 2027.
After the Initial Term, City reserves the right, at City’s sole discretion, to extend the term of this Agreement for up to five (5) years through August 31, 2028 (“Option Periods”), and such extensions may be in one-year periods or multiple years as may be mutually agreed between the Parties. If the Parties agree to extend the term, the Parties shall execute an Amendment to extend the term.
3. SCOPE OF SERVICES & PERFORMANCE SCHEDULE
Contractor shall perform those Services specified in Exhibit A within the time stated in Exhibit A. Time is of the essence.
4. WARRANTY
Contractor expressly warrants that all materials and services covered by this Agreement shall be fit for the purpose intended, shall be free from defect and shall conform to the specifications, requirements and instructions upon which this Agreement is based. Contractor agrees to promptly replace or correct any incomplete, inaccurate or defective Services at no further cost to City when defects are due to the negligence, errors or omissions of Contractor. If Contractor fails to promptly correct or replace materials or services, City may make corrections or replace materials or services and charge Contractor for the cost incurred by City.
5. QUALIFICATIONS OF CONTRACTOR - STANDARD OF CARE
Contractor represents and maintains that it has the expertise in the professional calling necessary to perform the Services, and its duties and obligations, expressed and implied, contained herein, and City expressly relies upon Contractor’s representations regarding its skills and knowledge. Contractor shall perform such Services and duties in conformance to and consistent with the professional standards of a specialist in the same discipline in the State of California.
Agreement with Guidehouse, Inc. Page 3 of 35
Rev. 07-01-18
City acknowledges that Contractor is serving in an advisory capacity hereunder and does not practice professional engineering, architecture, finance, accounting, law or offer legal opinions even if Contractor personnel may maintain such professional licenses and/or credentials (e.g. CPA, CFA or JD). Further, Contractor is not a certified public accounting firm and does not provide audit, attest, or public accounting services. If the provision of Services hereunder includes work product prepared by persons or firms other than Contractor, Contractor shall not be responsible for the completeness, adequacy and coordination of the work product prepared by others and/or the professionals of record, and/or parties providing services to City other than Contractor.
6. COMPENSATION AND PAYMENT
In consideration for Contractor’s complete performance of Services, City shall pay Contractor for all materials provided and Services rendered by Contractor in accordance with Exhibit B, entitled “SCHEDULE OF FEES AND PAYMENT PROVISIONS.” The maximum compensation of this Agreement is seven hundred thousand dollars ($700,000), subject to budget appropriations, which includes all payments that may be authorized for Services and for expenses, supplies, materials and equipment required to perform the Services. All work performed or materials provided in excess of the maximum compensation shall be at Contractor’s expense. Contractor shall not be entitled to any payment above the maximum compensation under any circumstance.
7. TERMINATION
A. Termination for Convenience. City shall have the right to terminate this Agreement, without cause or penalty, by giving not less than Thirty (30) days’ prior written notice to Contractor.
B. Termination for Default. If Contractor fails to perform any of its material obligations under this Agreement, in addition to all other remedies provided by law, City may terminate this Agreement immediately upon written notice to Contractor.
C. Upon termination, each Party shall assist the other in arranging an orderly transfer and close-out of services. As soon as possible following the notice of termination, but no later than ten (10) days after the notice of termination, Contractor will deliver to City all City information or material that Contractor has in its possession.
8. ASSIGNMENT AND SUBCONTRACTING
City and Contractor bind themselves, their successors and assigns to all covenants of this Agreement. This Agreement shall not be assigned or transferred without the prior written approval of City. Contractor shall not hire subcontractors without express written permission from City.
Agreement with Guidehouse, Inc. Page 4 of 35
Rev. 07-01-18
Contractor shall be as fully responsible to City for the acts and omissions of its subcontractors, and of persons either directly or indirectly employed by them, as Contractor is for the acts and omissions of persons directly employed by it.
9. NO THIRD-PARTY BENEFICIARY
This Agreement shall not be construed to be an agreement for the benefit of any third party or parties and no third party or parties shall have any claim or right of action under this Agreement for any cause whatsoever.
10. INDEPENDENT CONTRACTOR
Contractor and all person(s) employed by or contracted with Contractor to furnish labor and/or materials under this Agreement are independent contractors and do not act as agent(s) or employee(s) of City. Contractor has full rights to manage its employees in their performance of Services under this Agreement.
11. CONFIDENTIALITY OF MATERIAL
All ideas, memoranda, specifications, plans, manufacturing procedures, data, drawings, descriptions, documents, discussions or other information developed or received by or for Contractor and all other written information submitted to Contractor in connection with the performance of this Agreement shall be held confidential by Contractor and shall not, without the prior written consent of City, be used for any purposes other than the performance of the Services nor be disclosed to an entity not connected with performance of the Services. Nothing furnished to Contractor which is otherwise known to Contractor or becomes generally known to the related industry shall be deemed confidential.
12. OWNERSHIP OF MATERIAL
All material, which shall include, but not be limited to, data, sketches, tracings, drawings, plans, diagrams, quantities, estimates, specifications, proposals, tests, maps, calculations, photographs, reports, designs, technology, programming, works of authorship and other material developed, collected, prepared or caused to be prepared under this Agreement shall be the property of City but Contractor may retain and use copies thereof. However, Contractor shall not be responsible for damages resulting from the use of said material for work other than Project, including, but not limited to, the release of this material to third parties.
Notwithstanding the foregoing, all work product and other deliverables provided by Contractor shall be for solely for use by City for its internal business purposes and any other specific purposes set forth in this Agreement, and for no other purposes without the prior written consent of Contractor. Contractor shall have no liability to any third parties in connection with any publication of its work product or other deliverables provided hereunder, and shall have no obligation to update any deliverables following acceptance by City hereunder. Contractor shall retain sole and exclusive ownership of all rights, title and interest in its work
Agreement with Guidehouse, Inc. Page 5 of 35
Rev. 07-01-18
papers, proprietary information, processes, methodologies, know-how and software, including such information as existed prior to the delivery of the Services and, to the extent such information is of general application, anything that Contractor may discover, create or develop during its provision of its Services (“Contractor Knowledge”). To the extent any Contractor Knowledge is embodied in any deliverables provided hereunder, Contractor grants City a non- exclusive, royalty-free, non-assignable license to use such Contractor Knowledge solely for the purpose set forth in this Agreement.
13. RIGHT OF CITY TO INSPECT RECORDS OF CONTRACTOR
City, through its authorized employees, representatives or agents shall have the right during the term of this Agreement and for four (4) years from the date of final payment for goods or services provided under this Agreement, to audit the books and records of Contractor for the purpose of verifying any and all charges made by Contractor in connection with Contractor compensation under this Agreement, including termination of Contractor. Contractor agrees to maintain sufficient books and records in accordance with generally accepted accounting principles to establish the correctness of all charges submitted to City. Any expenses not so recorded shall be disallowed by City. Contractor shall bear the cost of the audit if the audit determines that there has been a substantial billing deviation in excess of five (5) percent adverse to the City.
Contractor shall submit to City any and all reports concerning its performance under this Agreement that may be requested by City in writing. Contractor agrees to assist City in meeting City’s reporting requirements to the State and other agencies with respect to Contractor’s Services hereunder.
14. HOLD HARMLESS/INDEMNIFICATION
A. To the extent permitted by law, Contractor agrees to protect, defend, hold harmless and indemnify City, its City Council, commissions, officers, employees, volunteers and agents from and against any third-party claim, injury, liability, loss, cost, and/or expense or damage, including all costs and attorney’s fees in providing a defense to any such claim or other action arising from Contractor’s negligent acts or omissions or willful misconduct or fraud, and whether sounding in law, contract, tort, or equity, in any manner arising from, or alleged to arise in whole or in part from, or in any way connected with the Services performed by Contractor pursuant to this Agreement – including claims of any kind by Contractor’s employees or persons contracting with Contractor to perform any portion of the Scope of Services – and shall expressly include passive or active negligence by City connected with the Services. However, the obligation to indemnify shall not apply if such liability is ultimately adjudicated to have arisen through the sole active negligence or sole willful misconduct of City; the obligation to defend is not similarly limited.
Agreement with Guidehouse, Inc. Page 6 of 35
Rev. 07-01-18
B. Contractor’s obligation to protect, defend, indemnify, and hold harmless in full City and City’s employees, shall specifically extend to any and all employment-related claims of any type brought by employees, contractors, subcontractors or other agents of Contractor, against City (either alone, or jointly with Contractor), regardless of venue/jurisdiction in which the claim is brought and the manner of relief sought.
C. To the extent Contractor is obligated to provide health insurance coverage to its employees pursuant to the Affordable Care Act (“Act”) and/or any other similar federal or state law, Contractor warrants that it is meeting its obligations under the Act and will fully indemnify and hold harmless City for any penalties, fines, adverse rulings, or tax payments associated with Contractor’s responsibilities under the Act.
15. INSURANCE REQUIREMENTS
During the term of this Agreement, and for any time period set forth in Exhibit C, Contractor shall provide and maintain in full force and effect, at no cost to City, insurance policies as set forth in Exhibit C.
16. WAIVER
Contractor agrees that waiver by City of any one or more of the conditions of performance under this Agreement shall not be construed as waiver(s) of any other condition of performance under this Agreement. Neither City’s review, acceptance nor payments for any of the Services required under this Agreement shall be constructed to operate as a waiver of any rights under this Agreement or of any cause of action arising out of the performance of this Agreement.
17. NOTICES
All notices to the Parties shall, unless otherwise requested in writing, be sent to City addressed as follows:
City of Santa Clara
Attention: Silicon Valley Power
1500 Warburton Avenue
Santa Clara, CA 95050
and by e-mail at [email protected] and
[email protected]
And to Contractor addressed as follows:
Guidehouse Inc.
35 Iron Point Circle, Suite 225
Folsom, CA 95630
Office: 916.631.3245
Fax: 213.559.9718
Agreement with Guidehouse, Inc. Page 7 of 35
Rev. 07-01-18
and by e-mail at [email protected]
The workday the e-mail was sent shall control the date notice was deemed given.
An e-mail transmitted after 1:00 p.m. on a Friday shall be deemed to have been transmitted on the following business day.
18. COMPLIANCE WITH LAWS
Contractor shall comply with all applicable laws and regulations of the federal, state and local government, including but not limited to “The Code of the City of Santa Clara, California” (“SCCC”). In particular, Contractor’s attention is called to the regulations regarding Campaign Contributions (SCCC Chapter 2.130), Lobbying (SCCC Chapter 2.155), Minimum Wage (SCCC Chapter 3.20), Business Tax Certificate (SCCC section 3.40.060), and Food and Beverage Service Worker Retention (SCCC Chapter 9.60), as such Chapters or Sections may be amended from time to time or renumbered. Additionally Contractor has read and agrees to comply with City’s Ethical Standards (http://santaclaraca.gov/home/showdocument?id=58299).
19. CONFLICTS OF INTEREST
Contractor certifies that to the best of its knowledge, no City officer, employee or authorized representative has any financial interest in the business of Contractor and that no person associated with Contractor has any interest, direct or indirect, which could conflict with the faithful performance of this Agreement. Contractor is familiar with the provisions of California Government Code section 87100 and following, and certifies that it does not know of any facts which would violate these code provisions. Contractor will advise City if a conflict arises.
20. FAIR EMPLOYMENT
Contractor shall not discriminate against any employee or applicant for employment because of race, sex, color, religion, religious creed, national origin, ancestry, age, gender, marital status, physical disability, mental disability, medical condition, genetic information, sexual orientation, gender expression, gender identity, military and veteran status, or ethnic background, in violation of federal, state or local law.
21. NO USE OF CITY NAME OR EMBLEM
Contractor shall not use City’s name, insignia, or emblem, or distribute any information related to services under this Agreement in any magazine, trade paper, newspaper or other medium without express written consent of City.
22. GOVERNING LAW AND VENUE
This Agreement shall be governed and construed in accordance with the statutes and laws of the State of California. The venue of any suit filed by either Party
Agreement with Guidehouse, Inc. Page 8 of 35
Rev. 07-01-18
shall be vested in the state courts of the County of Santa Clara, or if appropriate, in the United States District Court, Northern District of California, San Jose, California.
23. SEVERABILITY CLAUSE
In case any one or more of the provisions in this Agreement shall, for any reason, be held invalid, illegal or unenforceable in any respect, it shall not affect the validity of the other provisions, which shall remain in full force and effect.
24. AMENDMENTS
This Agreement may only be modified by a written amendment duly authorized and executed by the Parties to this Agreement.
[Section 25 and signatures continue on next page.]
Agreement with Guidehouse, Inc. Page 9 of 35
Rev. 07-01-18
25. COUNTERPARTS
This Agreement may be executed in counterparts, each of which shall be deemed to be an original, but both of which shall constitute one and the same instrument.
The Parties acknowledge and accept the terms and conditions of this Agreement as evidenced by the following signatures of their duly authorized representatives.
CITY OF SANTA CLARA, CALIFORNIA
a chartered California municipal corporation
Approved as to Form: Dated:
Office of the City Attorney
City of Santa Clara
Rajeev Batra
City Manager
1500 Warburton Avenue
Santa Clara, CA 95050
Telephone: (408) 615-2210
Fax: (408) 241-6771
“CITY”
GUIDEHOUSE INC.
a Delaware corporation
Dated:
By (Signature):
Name: Chris Luras
Title: Partner
Principal Place of
Business Address:
35 Iron Point Circle Suite 225
Folsom, CA 95630
Email Address:
Telephone: (916)631-3245
Fax: (213)559-9718
“CONTRACTOR”
Agreement with Guidehouse, Inc./Exhibit A Page 10 of 35 Rev. 07-01-18
EXHIBIT A
SCOPE OF SERVICES
1. Background:
1.1. Silicon Valley Power (SVP) the Electric Utility for the City of Santa Clara is a North American Electric Reliability Corporation (NERC) Registered Entity subject to compliance with NERC Reliability Standards established under Federal Energy Regulatory Commission (FERC) Order 693 and FERC Order 706.
1.2. SVP is registered as a Generator Owner, Generator Operator, Transmission Owner, Transmission Operator, Transmission Planner, and Distribution Provider on the NERC Compliance Registry.
1.3. As a Transmission Operator, SVP is subject to a triennial on-site audit. The next audit is expected to take place in the Spring of 2023 and will be a combination 693 and 706 audit.
1.4. This scope of work focuses on the Critical Infrastructure Protection (CIP) 706 component.
1.5. SVP does not meet the applicability criteria of CIP-014-1, “Physical Security,” but it does operate what is considered a medium impact control Center under the current version of CIP-002.
1.6. Work will generally be performed at SVP’s Administrative Office located at 881 Martin Ave, Santa Clara, CA 95050, with occasional re-locations to 1705 Martin Ave., Santa Clara, CA 95050.
2. Services to be performed by Contractor may include, but are not limited to:
2.1. Deliver a sustainable NERC compliance approach that will instill and further engrain strong principles throughout SVP’s organization.
2.2. Provide on-going support for SVP’s regulatory compliance, security, and operational practices for NERC reliability standards with an emphasis on CIP.
2.3. Support SVP’s risk-based strategies in scoping, scaling, and assessing compliance including:
2.3.1. Effectively translate SVP’s compliance assessments into effective compliance, oversight, and operational strategies.
2.3.2. Instill risk-based oversight principles into each review, and thereby assist SVP's compliance team and Subject Matter Experts (SME) to think like - and anticipate - Western Electricity Coordinating Council (WECC) auditors.
Agreement with Guidehouse, Inc./Exhibit A Page 11 of 35 Rev. 07-01-18
2.3.3. Support continued implementation of WECC's risk-based processes and continuous risk management process by providing a solid understanding and analysis of SVP’s inherent risks and identifying any associated internal controls;
2.3.4. Support development, implementation, dissemination, and training of SVP staff on all reports, policies, procedures, and processes that arise as part of Contractor’s compliance and risk assessments; and
2.3.5. Assess and make recommendations to:
2.3.5.1. Strengthen processes and procedures to correct reliability, security, and compliance issues;.
2.3.5.2. Strengthen compliance documentation and evidence; and
2.3.5.3. Translate SVP’s compliance assessments into effective compliance, oversight, and operational strategies.
2.4. NERC Audit Support:
2.4.1. Contractor will support In-person audits that are performed every 3 years, for a minimum of 2 weeks on-site including the WECC - NERC Audit, anticipated to take place in Spring 2023 and any other audits throughout the term of the Agreement as amended.
2.4.2. Audit Support includes, but is not limited to:
2.4.2.1. Support development of efficient processes to manage WECC audits, Compliance Oversight Plans, and post-Audit activities;
2.4.2.2. Perform an assessment of SVP’s audit preparedness for its next on-site audit;
2.4.2.3. Assist with reviewing the City’s responses to the pre-audit survey which is released by WECC typically a year in advance of the audit;
2.4.2.4. Support preparation and responses to NERC audits such as mock audit, interview preparation, preparation and review of documentation including applicable Reliability Standard Audit Worksheets (RSAWs), pre-audit evidence preparation, policy and procedure review, and evidentiary reviews modeled after the approach, criteria and schedule used by the region
(WECC) including high risk and recently effective NERC
Standards;
Agreement with Guidehouse, Inc./Exhibit A Page 12 of 35 Rev. 07-01-18
2.4.2.5. Assist SVP with preparing/reviewing the City’s responses to RSAW, which are due to WECC typically 3 months before the in-person audit engagement. Review the RSAWs and
documentation provided for the identified requirements.
2.4.2.6. Support audit engagement and post-audit mitigation efforts.
2.4.2.7. Conduct a mock audit including on-site station visits, control room observations, and interviews with SME’s.
2.4.2.8. Perform a gap analysis of the evidence and provide recommendations for improvements to the evidence package.
2.4.2.9. Provide SMEs with feedback during interviews to improve effectiveness in addressing the evidence and responding to interview questions.
2.4.2.10. Assess findings for each requirement and rate the findings to indicate positive observations and areas for improvement.
2.4.2.11. Deliver a final report detailing the audit findings and providing specific recommendations for improvements to the RSAW and evidence package.
2.4.3. Support annual paper audits (called “Self-Certifications”).
2.4.4. Ongoing support to address and resolve potential non-compliance either through audit findings, self-certifications, or self-reports such as support SVP in the event SVP discovers, suspects, or has a finding of potential non-compliance discovered through its internal compliance program, self-certifications, mock audits, or a compliance audit.
2.4.5. Assist with any investigation, determination to self-report (if needed), and mitigation plans.
2.5. Compliance Support
As requested by City, Contractor will support the CIP or other compliance programs implemented by the City. Support will include but is not limited to:
2.5.1. On-going compliance support including identification and management of risks to reliability, security, and compliance.
2.5.2. Technical writing services to develop new, or update existing, SVP’s NERC internal policies and procedures.
2.5.3. Guidance for applying new or revised NERC Standards to SVP’s Program.
Agreement with Guidehouse, Inc./Exhibit A Page 13 of 35 Rev. 07-01-18
2.5.4. Develop or update internal compliance policies and procedures to comply with new/revised NERC Standards as they are approved by industry. The policies and procedures may also necessitate the creation of documents such as charts, workflows, diagrams.
2.5.5. Provide creative solutions to assist SVP with meeting the compliance standards requirements within the utility’s existing NERC compliance program framework, while minimizing the utility’s cyber security risk and non-compliance risk.
2.5.6. Analyze the impact of current and future projects on SVP’s NERC compliance program, such as:
2.5.6.1. Proposed Battery Energy Storage System (BESS).
2.5.6.2. Bulk Electric System (BES) expansion, and protection system changes.
2.5.6.3. SVP’s Supervisory Control and Data Acquisition (SCADA) system which is currently being upgraded. Contractor may be asked to help troubleshoot and/or address unanticipated issues as they arise.
2.6. All support activities to assist SVP in developing and maintaining an effective NERC compliance program that minimizes compliance and security risks to SVP’s BES Cyber Systems and associated CIP-protected devices including, but not limited to:
2.6.1. Policy and procedure improvement; tool development and improvement; compliance guidance; internal control identification and evaluation; self- report guidance; and mitigation plan development.
2.6.2. Recommend security controls for supply chain risk management, develop and recommend strategies to manage identified cyber security risks, BES cyber asset / system identification.
2.6.3. Application security: Contractor will assess applications running on City’s Information Technology (IT) and Operations Technology (OT) infrastructure to ensure they are configured to run in a secure manner.
2.6.4. Cyber security awareness and training: Contractor will provide security awareness training and security awareness programs for SVP’s IT, OT and cybersecurity awareness professionals as required by CIP-003 and CIP-004. Contractor offers the following:
2.6.4.1. Security controls and framework assessment –Contractor can help SVP identify cyber security risks based on industry leading security, risk, and resilience frameworks such NIST
Agreement with Guidehouse, Inc./Exhibit A Page 14 of 35 Rev. 07-01-18
Cyber Security Framework, ES-C2M2, ISO 27001, CMMI, and CERT-RMM.
2.6.4.2. Cyber Vulnerability Assessments: Contractor will perform Cyber Vulnerability Assessments. Contractor has substantial technical expertise and experience in conducting Cyber
Vulnerability Assessments in accordance with CIP-010 and other industry practices.
2.6.4.3. Penetration Testing: Contractor will perform Penetration Testing.
2.6.4.3.1. A typical penetration test is performed as a “point in time” engagement, and incorporates
preparation, fieldwork, and delivery activities.
Contractor’s approach uses various techniques
such as exploitation of host operating systems and
network devices, via buffer overflow and code
injection.
2.6.4.3.2. Additionally, Contractor will perform penetration testing via web application or social engineering
methods with the intention of helping participants
understand and utilize the “kill chain” approach
that describes each of the steps used by an
attacker. During these exercises’ participants will
be trained and familiarized with the Kali-Linux
hacking and Metasploit toolkits.
2.6.4.3.3. Sample Penetration Testing Flow:
2.6.4.3.3.1. Penetration Testing Planning:
Contractor will work with SVP to
develop a schedule and scope of
testing.
2.6.4.3.3.2. Conduct Penetration Testing:
Depending on scope of testing,
Contractor will identify changes,
freezes to changes, and testing
involving multiple phases. This is
typically completed within 2 – 4
weeks.
2.6.4.3.3.3. Issue Test Notification: Contractor
will issue a test notification as each
test shift is started. Contractor will
Agreement with Guidehouse, Inc./Exhibit A Page 15 of 35 Rev. 07-01-18
issue a stop notification at the at the
end of each test shift.
2.6.4.3.3.4. Conduct Test Quality Analysis:
Contractor team will perform regular
reviews to verify all aspects of the
test scope and schedule are on track
for completion as planned.
2.6.4.3.3.5. Complete Test: All testing concludes
and Contractor will issue a final stop
notification.
2.6.4.3.3.6. Deliver Test Report: Contractor will
develop a findings report including
recommendation and supporting
evidence.
2.7. NERC Reliability Standards
2.7.1. Notify SVP of new or revised NERC Reliability Standards, provide guidance, and interpretations and advise SVP on how the new or changed standards impacts SVP and how to prepare for the change in a timely and effective manner. Contractor will:
2.7.1.1. Help SVP identify and implement new Reliability Standards or requirements.
2.7.1.2. Prioritize new and revised standards by applicability in the context of SVP’s existing state of operations.
2.7.1.3. Support recording and disseminating NERC Alert information internally to SVP allowing SVP stakeholders, as identified in a quick risk assessment and summarization to take coordinated internal action on the alerts.
2.7.1.4. Develop or identify priorities, initiatives, and goals to address identified gaps and weaknesses and provide a tentative
project plan (to address any gaps, including potential
compliance gaps).
2.7.1.5. Develop and implement procedural controls to track and manage NERC Alert information comprised of recommended:
2.7.1.5.1. Timelines and triggers for assigning an SME prior to the effective date of the standard.
Agreement with Guidehouse, Inc./Exhibit A Page 16 of 35 Rev. 07-01-18
2.7.1.5.2. Steps to review and keep apprised of new
standards Including roles and responsibilities.
2.7.1.5.3. Targets and triggers for implementing compliance plan for new standards (from preliminary
assessment).
2.7.1.5.4. Target compliance dates – such as three months prior to effective date.
2.7.1.5.5. Periodic touchpoints with reliability compliance to validate progress such as every three months.
2.7.2. Develop compliance processes for each standard, creating an RSAW, and establishing evidence requirements.
2.7.3. Help implement processes for conducting a spot check within 30 months of the standard’s effective date.
2.7.4. Develop, refine, and improve SVP’s internal controls program in support of NERC compliance and other regulatory needs as well as support sharing of controls with auditors to demonstrate that SVP has managed these risks.
2.8. Assist with Operations and Planning Reliability Standards such as, but not limited to: PRC-005, FAC-008, PER-005, TOP-001.
2.9. Provide a system that maintains records and will be made available to SVP if required to support an audit inquiry or other SVP needs. Develop tool(s) to organize compliance evidence, automate workflows, enable automated task reminders, and improve visibility across business units in a user-friendly format.
2.10. Recommend and support implementation of strategies to address incident management such as, but not limited to investigation, self-report, or mitigation plan.
3. Approach
3.1. Contractor will provide status reports including progress on work scope according to the timeline requested by SVP.
3.2. Contractor will review results of work performed and involve SVP in all significant decisions before proceeding with the next step.
3.3. Using Contractor’s active experience and work in the field, Contractor will proactively alert SVP of issues and potential difficulties as early as possible.
3.4. Contractor shall employ project management techniques including:
Agreement with Guidehouse, Inc./Exhibit A Page 17 of 35 Rev. 07-01-18
3.4.1. Work collaboratively with City to define and develop scope for each project or assignment.
3.4.2. Develop workplan in collaboration with SVP staff including critical timelines to meet compliance or audit deadlines.
3.4.3. Use a multi-phase process that includes assessment of options, development of plans, execution of work, and delivery of thorough, but concise, work product at the end of each phase.
3.4.4. Define and document communication channels including working with SVP to define the appropriate communication channels between Contractor and City, including project technical and managerial matters.
3.4.5. Identify the person(s) responsible and authorized for final decisions.
3.4.6. Development and use of work product approval and sign-off procedures.
3.4.7. Development and use of formal change management process including identifying individuals from Contractor and SVP with change management authority.
3.5. Communication and Coordination
3.5.1. Contractor shall coordinate regular status meetings or conference calls on a mutually scheduled basis.
3.5.2. At regular status meetings:
3.5.2.1. Contractor will support discussions of needs, projects, completed activities, ongoing activities, compliance issues, and upcoming activities within SVP’s compliance program.
3.5.2.2. Contractor will assess current and future compliance risk and recommend solutions and assistance to ensure SVP’s
compliance performance.
3.5.2.3. Contractor will tailor work such that SVP’s compliance objectives are conveyed with the appropriate context, including SVP’s past compliance experiences, the current risk-informed regulatory framework, and goals leading up to, during, and following future compliance audits.
3.6. Review and Approval of Deliverables:
3.6.1. Contractor will submit deliverables to the SVP project manager who will review for compliance with the assigned work. The SVP project manager shall notify Contractor of their approval or rejection of each deliverable.
Agreement with Guidehouse, Inc./Exhibit A Page 18 of 35 Rev. 07-01-18
3.6.2. If Contractor’s deliverable fails to conform to the assigned work, SVP will specify items that are not compliant.
3.6.3. Upon receipt of such notification, Contractor will correct any such issues within five (5) business days from the date notice by SVP or such date as SVP shall specify in its notice and Contractor shall resubmit the deliverable to the SVP Project Manager for re-evaluation.
3.6.4. If the deliverable continues to fail to confirm to the assigned work, SVP, at SVP’s sole discretion, may allow Contractor an additional opportunity to correct the deliverable.
3.6.5. Corrections to deliverables shall be at no additional cost to City.
3.6.6. Contractor will make any changes required to conform to the requirements of the assigned work, including changes to previously accepted deliverables that may require edits due to changes to new deliverables.
3.6.7. When SVP determines that all deliverables conform to assigned work, SVP will notify Contractor that final acceptance of all Deliverables has occurred.
3.7. Contractor will maintain appropriate levels of security and confidentiality.
3.8. Contractor shall perform work in a cost-efficient manner.
4. Staffing
4.1. Andy Dressel will be the primary contact throughout the course of the engagement.
4.2. Where needed, Contractor will make available staff with expertise in all aspects of utility operations. Contractor will present SVP with the resume of any personnel it plans to use on any job to SVP for approval.
4.3. Contractor shall be solely responsible for selecting, hiring, employing, paying, supervising, training, and discharging all personnel necessary to provide service outlined in this Exhibit.
4.4. Contractor shall engage resources with the most appropriate expertise based on work activity. Contractor staff assigned to provide services shall possess:
4.4.1. Extensive knowledge of applicable NERC Reliability Standards, particularly NERC CIP Standards.
4.4.2. Knowledge of electric utility operational technology, networks, cyber systems and physical/cyber security trends and issues.
Agreement with Guidehouse, Inc./Exhibit A Page 19 of 35 Rev. 07-01-18
4.4.3. Knowledge of the utility industry and its practices for generation, transmission, and operation of related facilities, including control systems.
4.4.4. Experience in providing similar services to NERC entities comparable to SVP in the WECC Region, or a strong history of assisting other utilities meet their NERC CIP medium-impact or high-impact regulatory obligations.
4.4.5. Experience working with WECC auditors and WECC utilities to develop or improve CIPv5 programs, and experience with WECC CIP audits.
5. Supply Chain Cyber Security Risk
5.1. Special Requirements
5.1.1. Definitions
5.1.1.1. Security Incident: A Security Incident means any breach event or known vulnerability or potential security flaw in the product delivered, or proposed to be delivered, to City. Any event perpetrated, or attempted, by any employee, contractor, or other provider working on behalf of Contractor delivering services to City. This shall include, but is not limited to, unauthorized disclosure of non-public information, unauthorized remote or local use of subject product, unauthorized changes to product or to any other City system, product crashing due to third-party interference, embedded malware, or opening of
unauthorized/undisclosed communication channels.
5.1.1.2. Banned Vendors or Product: Banned vendors or products are deemed to pose a threat to the U.S. bulk power system (BPS) or bulk electric system (BES) and are identified in U.S. executive orders or by federal government agencies including, but not limited to, the Department of Defense, Department of Energy, the Department of Homeland Security, the Federal Energy Regulatory Commission, or the North American Electric Reliability Corporation.
5.2. Contractor Notification of Security Incident
5.2.1. Contractor agrees to notify City immediately by email, whenever a Security Incident occurs.
5.2.1.1. Anytime Contractor becomes aware of a Security Incident, Contractor must provide notice by email to City contact person identified in this Agreement and the contacts in Exhibit A-1, as soon as possible, but no more than five (5) business days after
Agreement with Guidehouse, Inc./Exhibit A Page 20 of 35 Rev. 07-01-18
discovery. The notice shall include the date and time of the Security Incident occurrence (or the approximate date and time of the occurrence if the actual date and time of the occurrence is not precisely known) and a detailed summary of the facts and circumstances of the Security Incident, including a description of (a) how the Security Incident occurred (e.g., a precise description of the reason for the system failure (root cause analysis) to the extent known – interim reports are allowable), (b) the nature, type, and scope of the Security Incident including which products or system(s) that may be impacted (c) the scope of City Information known or reasonably believed to have been disclosed, and (d) the measures taken or planned to address and remedy the occurrence to prevent the same or a similar event from occurring in the future.
5.2.1.2. Contractor shall provide written updates of the notice to City addressing any new facts and circumstances learned after the initial written notice is provided and shall provide such updates within a reasonable time after learning of those new facts and circumstances. Contractor shall cooperate with City in City’s efforts to determine the risk, if any, to the Bulk Electric System (BES) posed by the Security Incident, including providing additional information regarding the Security Incident upon request from City.
5.2.2. Contractor shall ensure a confirmation of receipt is received for all initial and follow-up communication regarding the Security Incident.
5.3. Contractor Coordination of Responses related to Security Incident
5.3.1. Development and Implementation of a Security Incident Response Plan:
To the extent practicable, Contractor shall share any documentation (policies, plan, and procedures), and any updates to such documentation, to address Security Incidents (“Response Plan”) in place to mitigate the harmful effects of Security Incidents and addressing and remedying the occurrence to prevent the recurrence of Security Incidents in the future. Contractor shall provide City access to inspect its Response Plan, if available. The Response Plan should align with the best practices consistent with the contingency planning requirements of National Institute of Standards and Technology (NIST) Special Publication 800-61 Rev. 2, NIST Special Publication 800-53 Rev. 4, CP- 1 through CP-13 and the incident response requirements of NIST Special Publication 800-53 Rev. 4, IR-1 through IR-10 as those standards may be amended from time to time.
5.3.2. As soon as practicable, understanding time is of the essence, upon learning of a Security Incident related to the products and services
Agreement with Guidehouse, Inc./Exhibit A Page 21 of 35 Rev. 07-01-18
provided to City by Contractor, Contractor shall notify City of that implementation by notifying the contacts in Exhibit A-1.
5.3.3. Prevention of Recurrence: As soon as practicable, understanding time is of the essence, Contractor shall provide recommendations, action plans, and/or mitigating controls to City on actions that City may take to assist in the prevention of recurrence, as applicable or appropriate.
5.3.4. Notification to Affected Parties: Contractor will, at its sole cost and expense, assist and cooperate with City with respect to any investigation of a Security Incident, to the extent the Security Incident involves or arises from Contractor-provided products or services, disclosures to affected parties, and other remedial measures as requested by City in connection with a Security Incident or required under any applicable laws related to a Security Incident, to the extent necessary.
5.4. Verification of Software Integrity and Authenticity of Patches (if related services are provided)
5.4.1. Hardware, Firmware, Software, and Patch Integrity and Authenticity:
5.4.1.1. Contractor shall share its risk management practices for supply chain delivery of hardware, software (including patches), and firmware provided under this Agreement. Contractor
documentation should include: any chain-of-custody practices, inventory management program (including the location and protection of spare parts), information protection practices, integrity management program for components provided by sub- suppliers, instructions on how to request replacement parts, commitment to ensure that for [a negotiated time period], spare parts shall be made available by Contractor.
5.4.1.2. Contractor shall specify how digital delivery for procured products (e.g., software and data) including patches will be validated and monitored to ensure the digital delivery remains as specified. City and Contractor shall ensure appropriate security measures are employed to deliver and verify
authenticity of products and patches.
5.4.1.3. To the extent practicable, Contractor shall identify the country (or countries) of origin of the procured product and its programmable components (including hardware, software, and firmware). Contractor will identify the countries where the development, manufacturing, maintenance, and service for the product are provided.
5.4.1.4. Contractor shall disclose if its products or programmable components are known to be included on any Banned Vendor
Agreement with Guidehouse, Inc./Exhibit A Page 22 of 35 Rev. 07-01-18
or Products List. To the extent practicable, Contractor shall notify City if products or components are added to US
Government (e.g. Department of Defense, Department of
Homeland Security, Department of Energy) or the North
American Electric Reliability Corporation Banned Vendor or Products List following the initial procurement.
5.4.1.5. Contractor shall use trusted channels, such as U.S. registered mail, and require tamper-evident packaging for the delivery of procured products.
5.4.1.6. To the extent practicable, Contractor shall demonstrate chain- of-custody documentation for procured products.
5.4.2. Viruses, Firmware and Malware:
5.4.2.1. Contractor will make commercially reasonable efforts to investigate whether computer viruses or malware are present in any software or patches before providing such software or patches to City.
5.4.2.2. Contractor warrants that it has no knowledge of any computer viruses or malware coded or introduced into any software or patches, and Contractor will not insert any code which would have the effect of disabling or otherwise shutting down all or a portion of such software or damaging information or
functionality.
5.4.2.3. If a virus or other malware is found to have been coded or otherwise introduced as a result of Contractor’s product, service, actions, or negligence, Contractor shall immediately, and at its own cost take all necessary remedial action and provide assistance to City to eliminate the virus or other malware throughout City’s information networks, computer systems, and information systems, regardless of whether such systems or networks are operated by or on behalf of City; and restoring previous functionality of the affected device, system, or product.
5.4.3. Cryptographic Requirements:
5.4.3.1. Where applicable, Contractor shall document how the cryptographic system protects the confidentiality, data integrity, authentication, and non-repudiation of devices and data flows in the underlying system as specified by City. This documentation shall include, but not be limited to, the following:
Agreement with Guidehouse, Inc./Exhibit A Page 23 of 35 Rev. 07-01-18
5.4.3.1.1. The cryptographic methods (hash functions,
symmetric key algorithms, or asymmetric key
algorithms) and primitives (e.g., Secure Hash
Algorithm [SHA]- 256, Advanced Encryption
Standard [AES]-128, RSA, and Digital Signature
Algorithm [DSA]-2048) that are implemented in the
system, and how these methods are to be
implemented.
5.4.3.1.2. The preoperational and operational phases of key establishment, deployment, ongoing validation, and
revocation.
5.4.3.2. Contractor will use only “approved” cryptographic methods as defined in the FIPS 140-2 Standard when enabling encryption on its products.
5.4.3.2.1. Contractor shall provide an automated remote key- establishment (update) method that protects the
confidentiality and integrity of the cryptographic
keys.
5.4.3.2.2. Contractor shall ensure that:
5.4.3.2.2.1. The system implementation includes
the capability for configurable
cryptoperiods (the life span of
cryptographic key usage) in
accordance with the Suggested
Cryptoperiods for Key Types found in
Table 1 of NIST 800-57 Part 1, as may
be amended.
5.4.3.2.2.2. The key update method supports
remote re-keying of all devices within
[a negotiated time period(s)] as part of
normal system operations.
5.4.3.2.2.3. Emergency re-keying of all devices
can be remotely performed within [a
negotiated time period (e.g., 30 days)].
5.4.3.2.3. Contractor shall provide a method for updating cryptographic primitives or algorithms.
5.5. Controls for Remote Access
Agreement with Guidehouse, Inc./Exhibit A Page 24 of 35 Rev. 07-01-18
5.5.1. Contractors that directly, or through any of their affiliates, subcontractors or service providers, connect to City’s systems or networks agree to comply with the following protective measures:
5.5.1.1. In the course of furnishing products and services to City under this Agreement, Contractor shall not access, and shall not permit Contractor personnel to access, City property, systems, or networks or City Information without City’s prior express written authorization. Such written authorization may
subsequently be revoked by City at any time in its sole discretion. Further, any Contractor personnel access shall be consistent with, and in no case exceed the scope of, any such approval granted by City. All City authorized connectivity or attempted connectivity to City’s systems or networks shall be in conformity with City’s security policies, including, but not limited to, those policies used to address the NERC CIP reliability standards, as may be amended from time to time with notice to Contractor.
5.5.1.2. Contractor shall demonstrate controls designed to protect City- issued credentials and shall ensure that network devices have encryption enabled for network authentication to prevent possible exposure of City-issued credentials.
5.5.1.3. Prior to using any virtual private network or other device to simultaneously connect machines on any City system or
network to any machines on any Contractor or third-party systems, Contractor shall:
5.5.1.3.1. Provide City with the full name of each individual who uses any such remote access method and the
phone number and email address at which the
individual may be reached while using the remote
access method.
5.5.1.3.2. Agree that any computer used by Contractor
personnel to remotely access any City system or
network will not simultaneously access the Internet
or any other third-party system or network while
logged on to City systems or networks.
5.5.1.4. Contractor shall ensure that City-issued credentials issued to Contractor personnel for accessing City networks are not shared between Contractor personnel.
Agreement with Guidehouse, Inc./Exhibit A Page 25 of 35 Rev. 07-01-18
5.5.1.5. Contractor shall recommend any additional protective measures to address the security of remote and onsite access to City Information, City systems and networks, and City property.
5.5.2. Contractor Cybersecurity Policy: Contractor will provide Contractor’s cybersecurity policy to City, and Contractor agrees to implement and comply with that cybersecurity policy.
5.5.3. Return or Destruction of City Information: Upon completion of the delivery of the products and services to be provided under this Agreement, or at any time upon City’s request, Contractor will return to City all hardware and removable media provided by City containing City Information. If the hardware or removable media containing City Information is owned by Contractor or a third-party, a statement detailing the destruction method used and the data sets involved, the date of destruction, and the entity or individual who performed the destruction will be sent to a designated City security representative within fifteen (15) calendar days after completion of the delivery of the products and services to be provided under this Agreement, or at any time upon City’s request.
5.5.4. Audit Rights: City or its third-party designee may, but is not obligated to, perform audits and security tests of Contractor’s IT or systems environment and procedural controls to determine Contractor’s compliance with the system, network, data, and information security requirements of this Agreement. Contractor shall provide all information reasonably requested by City in connection with any such audits and shall provide reasonable access and assistance to City upon request.
Contractor will comply, within reasonable timeframes at its own cost and expense, with all reasonable recommendations that result from such inspections, tests, and audits.
5.5.5. Regulatory Examinations: Contractor agrees that any regulator or other governmental entity with jurisdiction over City and its affiliates, including but not limited to the North American Electric Reliability Corporation (NERC) and (WECC), may examine Contractor’s activities relating to the performance of its obligations under this Agreement to the extent such authority is granted to such entities under the law. Contractor shall promptly cooperate with and provide all information reasonably requested by the regulator or other governmental entity in connection with any such examination and provide reasonable assistance and access to all equipment, records, networks, and systems requested by the regulator or other governmental entity. Contractor agrees to comply with all reasonable recommendations that result from such regulatory examinations within reasonable timeframes at Contractor’s sole cost and expense. The foregoing cooperation and assistance will be rendered at
Agreement with Guidehouse, Inc./Exhibit A Page 26 of 35 Rev. 07-01-18
Contractor’s then-current time and materials rates, subject to City’s prior written authorization.
5.6. Contractor Notification of Remote or Onsite Access Revocation
5.6.1. Revocation: Contractor will immediately take all steps necessary to remove Contractor personnel’s access to any City Information, systems, networks, or property at such time when:
5.6.1.1. Any Contractor personnel no longer requires such access in order to furnish the services or products provided by Contractor under this Agreement.
5.6.1.2. Any Contractor personnel is terminated or suspended or his or her employment otherwise ends.
5.6.1.3. Contractor reasonably believes any Contractor personnel poses a threat to the safe working environment at or to any City property, including to employees, customers, buildings, assets, systems, networks, trade secrets, confidential data, and/or employee or City Information.
5.6.2. Notification: Contractor will notify City, no later than close of business on the same day as the day termination or change set forth in 5.6.1, above, occurs. Additionally, Contractor will notify City via e-mail to the contacts in Exhibit A-1, upon removal of access to City Information as well as City property, systems, and networks.
Agreement with Guidehouse, Inc./Exhibit A-1 Page 27 of 35 Rev. 07-01-18
EXHIBIT A-1
SCHEDULE OF FEES
CONTACT INFORMATION FOR NOTIFICATIONS OF CYBER SECURITY
INCIDENTS OR ACCESS REVOCATIONS
CIP Sr. Manager
Jeff Ipsaro
[email protected]
Office: (408) 615-5604
Cell: (408) 768-9841
NERC Compliance Manager
Val Guzman Ridad
[email protected]
Office: (408) 615-6633
Cell: (510) 697-1867
These contacts may be modified by written notice to the individuals listed in Section 17 of the Agreement.
Agreement with Guidehouse, Inc./Exhibit B Page 28 of 35 Rev. 07-01-18
EXHIBIT B
SCHEDULE OF FEES
1. MAXIMUM COMPENSATION
The maximum amount of compensation to be paid to Contractor during the Initial Term of this Agreement shall not exceed the amount specified in Section 6 (COMPENSATION AND PAYMENT) of the Agreement.
2. RATES
2.1. City shall pay Contractor in accordance with the rates in Table B-1 – Hourly Rates.
Labor Category Off-Site Hourly Rate On-Site Hourly Rate Director $345.00 $390.00
Associate Director $299.00 $344.00
Managing Consultant $265.00 $300.00
Senior Consultant $212.00 $257.00
Consultant $190.00 $235.00
2.2. The rates are inclusive of mark ups (profit, overhead, and general and administrative expenses).
2.3. Annual Budgets: Estimated annual budgets are outlined in Table B-2. Table B-2 is informational only and does not authorize any set of work. Table B02 includes the following assumptions: (1) continued compliance performance due to internal controls maturity, (2) continued rate increases of 3% per year, (3) a consistent rate of change to the NERC regulatory framework and SVP electric system, (4) a consistent level of support from SVP staff, and (5) SVP remains on a three-year audit cycle based on its status as a Transmission Operator. A change to any of these assumptions may result in additional cost. If changes will result in estimated total cost exceeding the Maximum Compensation set forth in Section 6 of the Agreement, the Parties may modify scope or execute an Agreement in advance of initiating additional work that would result in exceeding the Maximum Compensation. In no event shall the Contractor begin work exceeding the Maximum Compensation until an amendment has been executed between the Parties.
Agreement with Guidehouse, Inc./Exhibit B Page 29 of 35 Rev. 07-01-18
Period Expected Activities Estimated Annual Cost
October 2022 –
September 2023
Audit preparation (RSAW
review/revisions, mock audit,
Potential Non-Compliance
reporting / mitigation)
Audit support
General support (regular
meetings, new standard
review, new project review)
$145,000
October 2023 –
September 2024
Audit PNC mitigation, internal
controls program development
/ improvement
General support (regular
meetings, new standard
review, new project review)
$110,000
October 2024 –
September 2025
General support (regular
meetings, new standard
review, new project review)
$70,000
October 2025 –
September 2026
Audit preparation (RSAW
review/revisions, mock audit,
PNC reporting / mitigation)
Audit support
General support (regular
meetings, new standard
review, new project review)
$155,000
October 2026 –
September 2027
General support (regular
meetings, new standard
review, new project review)
$80,000
Additional
Services
Subject to approval process in
Section 3 of this Exhibit B.
$140,000
2.4. Rates shall remain fixed for through December 31, 2023. After December 31, 2023, Contractor may apply a three percent (3%) escalator to the rates annually unless otherwise agreed to between the Parties.
3. COST ESTIMATES:
3.1. For ongoing projects such as routine support described in Section 4 of Exhibit
Agreement with Guidehouse, Inc./Exhibit B Page 30 of 35 Rev. 07-01-18
A, Contractor may bill on a time and materials basis. For tasks which will require a commitment of over 4 weeks or $5,000 (Project Assignment), Contractor shall provide a quote which includes the following:
3.1.1. Detail of specific services to be performed. Detail of the services should have a level of detail reflective of the scope, timeline, and cost of the specific project.
3.1.2. Schedule of tasks.
3.1.3. Task duration and complete project schedule. The project schedule shall indicate any activities that may impact the project timeline.
3.1.4. Staff to be assigned to the project including resumes if staff have not previously worked on projects with SVP and indicating tasks to be performed by individuals and estimated level of effort (hours).
The project manager shall be specifically identified.
3.1.5. Estimated level of effort for each task.
3.1.6. Plan and schedule for each task.
3.1.7. Total Estimated Costs including, but not limited to: labor, applicable reimbursable expenses, taxes, and fees.
3.1.8. Items not specified in a quote are assumed to be included in the hourly rate.
3.2. The terms of the Agreement shall prevail over any and all Contractor terms and conditions including, but not limited to any terms listed on a quote.
3.3. The City will review the quote and, if there are no issues or concerns, City will approve the quote in writing (e-mail acceptable) authorizing the Contractor to begin work. At no time shall Contractor begin work before the City has issued written authorization. Quotes may be authorized by Compliance Manager, Division Manager, Senior Division Manager, Assistant Director of the Electric Utility, Electric Utility Chief Operating Officer, or Chief Electric Utility Officer.
3.4. Changes
3.4.1. Contractor shall notify the City immediately when a situation occurs that may result in a change to the quoted project cost. Contractor shall provide reason for the change specific to each Project Assignment.
3.4.2. Contractor shall submit to the City an updated quote for review and approval from the City in advance of performing the additional work.
Written authorization may only be provided by a Division Manager, Senior Division Manager, Assistant Director of the Electric Utility, Electric Utility Chief Operating Officer, or Chief Electric Utility Officer.
3.5. City shall not be required to pay a deposit or any other form of pre-payment
Agreement with Guidehouse, Inc./Exhibit B Page 31 of 35 Rev. 07-01-18
prior to the Contractor beginning work.
3.6. Contractor shall not initiate any Project Assignment that will result in costs exceeding the compensation in the Agreement or are anticipated to extend past the term of this Agreement.
4. REIMBURSABLE EXPENSES
4.1. Pass-Through Costs: In some cases, Contractor may pass-through costs such as, but not limited to: materials, printing, or shipping. Such Pass- Through Costs shall be included and approved in the applicable cost estimate for services.
4.2. When these Pass-Through Costs occur, Contractor will invoice City for these costs without markup.
4.3. Contractor shall provide supporting documentation such as invoices or receipts for all Pass-Through costs.
4.4. Reimbursement of expenses is subject to the following conditions.
4.4.1. Expenses shall be reimbursable only to the extent that the Contractor submits sufficient documentation to the City that the expenses were directly incurred in providing the requested services, that such expenses were included in the approved cost estimate, and that such costs are not already included in the fee or hourly rate.
4.4.2. City will not reimburse travel costs. Travel costs are included in the rates set forth in Table B-1.
5. INVOICING AND PAYMENTS
5.1. Contractor shall submit an invoice to City monthly, in arrears, for payment for services performed the previous month, pursuant to this Agreement.
5.2. Each invoice shall include the task costs for the previous month, shall include sufficient detail for the City to confirm that services were provided according to the rates in this Agreement, and (if applicable) shall only include only work associated with a single quote.
5.3. City shall review the invoice submitted by Contractor and shall notify Contractor of any discrepancies or deficiencies in said invoice.
5.4. If City disputes an expense in an invoice, City may deduct the disputed expense from the payment of that invoice, provided that City submits to Contractor a written explanation of why the expense is being disputed.
5.5. If there are no discrepancies or deficiencies in the submitted invoice and Contractor has submitted all required Certified Payroll, City shall process the invoice for payment within thirty (30) days of receipt.
Agreement with Guidehouse, Inc./Exhibit C Page 32 of 35 Rev. 07-01-18
EXHIBIT C
INSURANCE REQUIREMENTS
Without limiting the Contractor’s indemnification of the City, and prior to commencing any of the Services required under this Agreement, the Contractor shall provide and maintain in full force and effect during the period of performance of the Agreement and for twenty-four (24) months following acceptance by the City, at its sole cost and expense, the following insurance policies from insurance companies authorized to do business in the State of California. These policies shall be primary insurance as to the City of Santa Clara so that any other coverage held by the City shall not contribute to any loss under Contractor’s insurance. The minimum coverages, provisions and endorsements are as follows:
A. COMMERCIAL GENERAL LIABILITY INSURANCE
1. Commercial General Liability Insurance policy which provides coverage at least as broad as Insurance Services Office form CG 00 01. Policy limits are subject to review, but shall in no event be less than, the following:
$1,000,000 Each Occurrence
$2,000,000 General Aggregate
$2,000,000 Products/Completed Operations Aggregate
$1,000,000 Personal Injury
2. Exact structure and layering of the coverage shall be left to the discretion of Contractor; however, any excess or umbrella policies used to meet the required limits shall be at least as broad as the underlying coverage and shall otherwise follow form.
3. The following provisions shall apply to the Commercial Liability policy as well as any umbrella policy maintained by the Contractor to comply with the insurance requirements of this Agreement:
a. Coverage shall be on a “pay on behalf” basis with defense costs payable in addition to policy limits;
b. There shall be no cross liability exclusion which precludes coverage for claims or suits by one insured against another; and c. Coverage shall apply separately to each insured against whom a claim is made or a suit is brought, except with respect to the limits of liability.
B. BUSINESS AUTOMOBILE LIABILITY INSURANCE
Business automobile liability insurance policy which provides coverage at least as broad as ISO form CA 00 01 with policy limits a minimum limit of not less than one million dollars ($1,000,000) each accident using, or providing coverage at
Agreement with Guidehouse, Inc./Exhibit C Page 33 of 35 Rev. 07-01-18
least as broad as, Insurance Services Office form CA 00 01. Liability coverage shall apply to all owned (if any), non-owned and hired autos.
C. WORKERS’ COMPENSATION
1. Workers’ Compensation Insurance Policy as required by statute and employer’s liability with limits of at least one million dollars ($1,000,000) policy limit Bodily Injury by disease, one million dollars ($1,000,000) each accident/Bodily Injury and one million dollars ($1,000,000) each employee Bodily Injury by disease.
2. The indemnification and hold harmless obligations of Contractor included in this Agreement shall not be limited in any way by any limitation on the amount or type of damage, compensation or benefit payable by or for Contractor or any subcontractor under any Workers’ Compensation Act(s), Disability Benefits Act(s) or other employee benefits act(s).
3. This policy must include a Waiver of Subrogation in favor of the City of Santa Clara, its City Council, commissions, officers, employees, volunteers and agents.
D. PROFESSIONAL LIABILITY
Professional Liability or Errors and Omissions Insurance as appropriate shall be written on a policy form coverage specifically designed to protect against negligent acts, errors or omissions of the Contractor. Covered services as designated in the policy must specifically include work performed under this agreement. Coverage shall be in an amount of not less than one million dollars ($1,000,000) per claim or two million dollars ($2,000,000) aggregate. Any coverage containing a deductible or self-retention must first be approved in writing by the City Attorney’s Office.
E. COMPLIANCE WITH REQUIREMENTS
All of the following clauses and/or endorsements, or similar provisions, must be part of each commercial general liability policy, and each umbrella or excess policy.
1. Additional Insureds. City of Santa Clara, its City Council, commissions, officers, employees, volunteers and agents are hereby added as additional insureds in respect to liability arising out of Contractor’s work for City, using Insurance Services Office (ISO) Endorsement CG 20 10 11 85, or the combination of CG 20 10 03 97 and CG 20 37 10 01, or its equivalent.
2. Primary and non-contributing. Each insurance policy provided by Contractor shall contain language or be endorsed to contain wording making it primary insurance as respects to, and not requiring contribution
Agreement with Guidehouse, Inc./Exhibit C Page 34 of 35 Rev. 07-01-18
from, any other insurance which the indemnities may possess, including any self-insurance or self-insured retention they may have. Any other insurance indemnities may possess shall be considered excess insurance only and shall not be called upon to contribute with Contractor’s insurance.
3. Cancellation.
a. Each insurance policy shall contain language or be endorsed to reflect that no cancellation or modification of the coverage provided due to non-payment of premiums shall be effective until written notice has been given to City in accordance with the policy provisions. In the event of non-renewal, written notice shall be given in accordance with the policy provisions.
b. Each insurance policy shall contain language or be endorsed to reflect that no cancellation or modification of the coverage provided for any cause save and except non-payment of premiums shall be effective until written notice has been given to City in accordance with the policy provisions. In the event of non-renewal, written notice shall be given in accordance with the policy provisions.
4. Other Endorsements. Other endorsements may be required for policies other than the commercial general liability policy if specified in the description of required insurance set forth in Sections A through E of this Exhibit C, above.
F. ADDITIONAL INSURANCE RELATED PROVISIONS
Contractor and City agree as follows:
1. Contractor agrees to ensure that subcontractors, and any other party involved with the Services, who is brought onto or involved in the performance of the Services by Contractor, provide the same minimum insurance coverage required of Contractor, except as with respect to limits. Contractor agrees to monitor and review all such coverage and assumes all responsibility for ensuring that such coverage is provided in conformity with the requirements of this Agreement. Contractor agrees that upon request by City, all agreements with, and insurance compliance documents provided by, such subcontractors and others engaged in the project will be submitted to City for review.
2. Contractor agrees to be responsible for ensuring that no contract used by any party involved in any way with the project reserves the right to charge City or Contractor for the cost of additional insurance coverage required by this Agreement. Any such provisions are to be deleted with reference to City. It is not the intent of City to reimburse any third party for the cost of
Agreement with Guidehouse, Inc./Exhibit C Page 35 of 35 Rev. 07-01-18
complying with these requirements. There shall be no recourse against City for payment of premiums or other amounts with respect thereto.
3. The City reserves the right to withhold payments from the Contractor in the event of material noncompliance with the insurance requirements set forth in this Agreement.
G. EVIDENCE OF COVERAGE
Prior to commencement of any Services under this Agreement, Contractor, and each and every subcontractor (of every tier) shall, at its sole cost and expense, provide and maintain not less than the minimum insurance coverage with the endorsements and deductibles indicated in this Agreement. Such insurance coverage shall be maintained with insurers, and under forms of policies, satisfactory to City and as described in this Agreement. Contractor shall file with the City all certificates and endorsements for the required insurance policies for City’s approval as to adequacy of the insurance protection.
H. EVIDENCE OF COMPLIANCE
Contractor or its insurance broker shall provide the required proof of insurance compliance, consisting of Insurance Services Office (ISO) endorsement forms or their equivalent and the ACORD form 25-S certificate of insurance (or its equivalent), evidencing all required coverage shall be delivered to City, or its representative as set forth below, at or prior to execution of this Agreement.
Upon City’s request, Contractor shall submit to City copies of the actual insurance policies or renewals or replacements. Unless otherwise required by the terms of this Agreement, all certificates, endorsements, coverage verifications and other items required to be delivered to City pursuant to this Agreement shall be mailed to:
EBIX Inc.
City of Santa Clara | Silicon Valley Power
P.O. Box 100085 – S2 or 1 Ebix Way
Duluth, GA 30096 John’s Creek, GA 30097
Telephone number: 951-766-2280
Fax number: 770-325-0409
Email address: [email protected]
I. QUALIFYING INSURERS
All of the insurance companies providing insurance for Contractor shall have, and provide written proof of, an A. M. Best rating of at least A minus 6 (A- VI) or shall be an insurance company of equal financial stability that is approved by the City or its insurance compliance representatives.