2. Appointment of Benchmarker
Customer shall have the right to conduct (or have conducted) a Benchmark under this Agreement to ensure that the Fees and/or Services (including Service Levels) are competitive with those charged or provided to the Comparators.
Customer shall have the right to appoint ISG, Gartner, Inc. or Avasant, LLC as the Benchmarker, and the appointment of any shall be deemed accepted by Service Provider. The Parties shall mutually agree to the appointment of any other Benchnnarker not listed in this section.
3. Scope of Benchmark
a. Benchmark of Fees. Customer may request a Benchmark for all or any portion of the Fees charged by Service Provider for all or any portion of the scope of Services under this Agreement.
b. Benchmark of Services. Customer may request a Benchmark for all or any portion of the Services used by Customer under the Agreement. Furthermore, Customer may define the scope of the Benchmarked Services to include any Service Tower, or any other granular subset of the Services.
4. Timing and Frequency of Benchmark
During the Term, Customer shall have the right to conduct a Benchmark of each Service Tower on an annual basis, but no more than one time per each rolling twelve (12) month cycle.
5. Benchmarking Methodology
The Benchmarker will normalize all data to obtain relevant comparisons with respect to the Comparators for purposes of the Benchmark. The Parties shall rely on the Benchmarker's standard Benchmark Process and methodology, including standard normalization criteria, as well as unique normalization criteria to the extent applicable, which shall include, but not be limited to, the following:
a. data from a statistically significant sample of the Comparators; b. geographic scope for the Fees and/or Service Levels that are the subject of the Benchmark;
c. the nature, type and volume of the services received and the respective service environments, including the hardware or software used to provide the subject Benchmarked Services
d. skill sets and experience levels of Service Provider Contract Staff providing the Services, including but not limited to Key Service Provider Personnel; and e. relevant contractual terms and conditions.
Each Party may provide reasonable suggestions to the Benchmarker regarding normalization and other relevant Benchmarking criteria that may comprise the Benchmark Process. The Benchmarker shall reasonably incorporate such suggestions with respect to the Benchmarking Process; and provided further that Benchmark Commencement Date shall not be adjusted or delayed unless Customer has agreed in writing.
6. Cooperation with Benchmarker
Service Provider agrees that it shall act in good faith and comply fully and promptly with requests by the Benchmarker relating to the Benchmarking Process, including requests for information, reports, data and access to personnel. Service Provider shall not delay, impede, obstruct or otherwise frustrate or prevent the Benchmarker from obtaining the information required to complete the analysis.
7. Costs of Benchmark
Customer and the Service Provider shall equally split all fees and charges reasonably owed to the Benchmarker, which fees and charges shall generally be determined and agreed in advance of the Benchmark. Service Provider shall participate and cooperate fully and promptly with the Benchmarker and shall pay its own costs, including without limitation the use of Service Provider and Service Provider's Subcontractors' labor, associated with such participation and cooperation.
8. Benchmark Process
a. During the Term of the Agreement, if Customer elects to conduct a Benchmark, Customer shall notify the Benchmarker and Service Provider in writing, and the date of such written notice shall be known as the Benchmark Notice Date. The Benchmarker shall commence the Benchmarking Process within thirty (30) days following the Benchmark Notice Date ("Benchmark Commencement Date"), unless otherwise agreed by the Parties. The Benchmarker shall notify Customer and Service Provider upon the completion of the Benchmark Report, and the Parties shall meet to discuss such report within ten (10) business days following its completion.
b. If the Benchmark Report indicates that the Fees charged to Customer are more than one hundred five percent (105%) of the average price point (i.e., 5% higher than the average fee charged to the Comparators), then Customer shall be entitled to an automatic adjustment of its Fees to a price that is within 5% of the average fees charged to the Comparators. Such adjustment of Fees shall be made within thirty (30) days following the completion of the Benchmark Report, and shall be made effective on a date that shall be no later than three (3) months following the Benchmark Notice Date (hereinafter the "Adjustment Date").
By way of example, assume there are 12 Comparators in a Benchmark study. For example, see the table below:
Comparator 1 $1 million
Comparator 2 $2 million
Comparator 3 $3 million
Comparator 4 $4 million
Comparator 5 $5 million
Comparator 6 $6 million
Comparator 7 $7 million
Comparator 8 $8 million
Comparator 9 $9 million
Comparator 10 $10 million
Comparator 11 $11 million
Comparator 12 $12 million
In this example, the average price point of the Comparators is $6.5 million. If Service Provider's price point exceeds the average price by more than 5% (i.e., greater than $6,825,000) then Service Provider will be required to adjust its fees to a price point that is less than or equal to $6,825,000 million.
c. If the Benchmark Report indicates that the Services (including Service Levels) provided to Customer do not meet the standard for the Comparators (e.g., the absence of Service Levels that are standard for the Comparators, or Service Level targets that are below the average threshold for the Comparators receiving similar Services), then the Parties shall discuss and agree upon an adjustment to the scope of Services (including the addition of Service Levels or adjustment to Service Level targets), and such adjustment shall be made within thirty (30) days following the completion of the Benchmark Report, and shall be made effective as of the Adjustment Date.
For clarity, if the Benchmark is not concluded and/or the Parties do not reach agreement on an adjustment to Fees and/or scope of Services (including Service Levels) until after Adjustment Date, all such changes shall be made retroactive to the Adjustment Date.
9. Remedies
a. Failure to Cooperate with Benchmarker. If the Service Provider fails to reasonably cooperate with the Benchmarker, including, without limitation, a failure to provide requested information, reports, data or access to personnel, and such acts or omissions result in a delay of the completion of the Benchmark that exceeds ninety (90) days following the Adjustment Date, the Service Provider shall be deemed to be in material default of the Agreement, and Customer shall, at its option, be entitled to (i) an automatic reduction in the Fees of ten percent (10%), which change shall be made retroactively effective to the Adjustment Date; or (ii) terminate the Agreement, either in whole or in part, or the affected scope of Services, in whole or in part, without liability and without the payment of any termination fees.
Reasonable cooperation with the Benchmarker shall not include a requirement of the Service Provider to disclose its costs and/or profits to provide the Services to the City or services to its other customers to the Bench marker. b. Failure to Agree to Fees or Service Level Adjustment. If, following the completion of the Benchmark Report, Service Provider refuses to make adjustments to Fees and/or Services (including Service Levels), or fails to reach agreement with Customer on such adjustments within ninety (90) days following the Adjustment Date, Service Provider shall be deemed to be in material default of the Agreement, and Customer shall be entitled to terminate the Agreement, either in whole or in part, or the affected scope of Services, in whole or in part, without liability and without the payment of any termination fees.
Schedule 7
Reports
City of Santa Clara
All reports to be reviewed, revised during
transition planning. Many will be incorporated
into other reports as applicable (i.e. monthly
ops) and as mutually agreed. Recognized that
reporting may change through the Continuous
Improvement processes.
Report Title Frequency Comments (e.g., level of effort to develop custom report, impact if not standard)
Prescribed Service Tower
Security Events and Response Summary Weekly
List of all the security events that have occurred, what actions where taken and next steps as applicable. Trends, top categories of exposure to include- URL lists, malicious content, phishing, malware/ransomware attacks. Category transaction counts: webmall, dev apps, streaming media/file sharing, collaboration apps, business apps, social media.
Enterprise Compute
Weekly Security Report Weekly
Vendor will work with the Customer to define the scope of this report and required information. List of all the security events that have occurred, what actions where taken and next steps as applicable. Trends, top categories of exposure to include URL lists, malicious content, phishing, malware/ransomware attacks. SIEM reporting.Category transaction counts: webmail, dev apes, streaming media/file sharing, collaboration apps, business apps, social media. -
Enterprise Compute
SOC 1 Type 2 Annual
Annual report covering Data Center operations. Audits for other service delivery areas on a project basis.
Enterprise Compute
SOC 2 Type 2 Annual • Annual report in accordance with Agreement Article 17 Enterprise Compute CMDB - SSL Cert Expiration Report a Monthly
A report available on the Customer web portal, produced every other month. Provides a report of SSL Certificate that are expiring in the coming months.
Enterprise Compute
Cisco Prime Infrastructure reports Monthly Network wireless, LAN utilization, trends and analysis. Enterprise Compute Data Center utilization, capacities Monthly
Storage trend usage, predictive analysis, capacity management, category of use. Enterprise Compute
Network PoE Monthly List of all devices and if they are PoE enabled or not. Enterprise Compute Major outages Monthly
List of all P1 and P2 outages, date and time of occurrence, impacts, root cause analysis, improvement plans and preventative next steps. Enterprise Compute Library Internet Monthly Usage trends, security patterns, access. Enterprise Compute Wi-Fl reports Monthly Utilization, capacity and trending. Enterprise Compute Zscaler reports Monthly Number of potential harmful activities prevented, trending. Enterprise Compute Asset Management Purchase Summary Weekly
Monthly report automatically generated by the asset management system listing authorized purchases made in the last month. Accessible on Customer web portal.
End-User
Asset Management Activity Summary Weekly
Monthly report automatically generated by the asset management system identifying Asset status changes (e.g., end of life, spare, operational) made as a result of IMACs, refreshes, and break-fix activities in the last month. This report is accessible on Customer web portal.
End-User
Asset Management Back Order Weekly
Monthly report automatically generated by the ticketing system listing authorized hardware and Software purchases In back-order status at the end of each month. Accessible on Customer web portal.
End-User
SCCM Hardware Report
Weekly
Weekly report automatically generated from SCCM standard tools and accessible in the customer web portal. See SCCM definitions on reporting for further details.
End-User
SUM Software Report
Weekly
Weekly report automatically generated from SCCM standard tools and accessible In the customer web portal. See SCCM definitions on reporting for further details.
End-User
ITSM Hardware Report Weekly
Weekly report automatically generated and accessible in the customer web portal. See 1TSM definition for additional details. End-User ITSM Software Report Weekly
Weekly report automatically generated and accessible in the customer web portal. See FTSM definition for additional details. End-User ITSM-SCCM Delta Report — Critical report
for tracking asset and resolving asset
discrepancies
Weekly
Custom report that requires 2 hours of effort every week. The report consists Of multiple worksheets. It has worksheets containing ITSM data & SCCM data. It has worksheets identifying the discrepancies between the ITSM and SCCM data and it contains comments describing why the discrepancies exists. It is the most valuable report in the asset management arsenal.
End-User
ITSM Software License Report
Weekly
Custom report automatically generated on a weekly basis and accessible in the customer web portal. The software licensing functionality available in ITSM Is not being used by the City.
End-User
ITSM Software Reclaim Report .
Weekly
Weekly report automatically generated and accessible in the customer web portal. The software licensing functionality available in ITSM Is not being used by the City.
End-User
1TSIVI Disposed Asset Report Weekly
Weekly report automatically generated and accessible in the customer web portal. End-User
Project stakeholder views - Excel Monthly
Custom report(s) that requires up to 4 hours to create. The reports consist of multiple Excel worksheets that provide a snapshot of the departments active and future projects, Cross Functional Project stakeholder views - PowerPoint Monthly
Custom report(s) that requires up to 2 hours to create. The reports consist of scatter diagrams and pivot tables that provide a snapshot of the departments active and future projects. Cross Functional Storage utilization Monthly Storage utilization trended. Enterprise Compute Storage reports Monthly Activity (10P) trends on each logical and physical. Enterprise Compute Srt LA Repo Per SLA Schedule
4 Monthly SLA performance report per the Customer final contract SLA Schedules. This report calculates performance by each Service Area, including cross-functional and PMO-provided services, using documented SLA calculation methodology and data collected and maintained predominantly within the ticketing system. This report is incorporated as part of the monthly account summary report.
Service Desk
CSAT Report — Monthly Monthly Results from surveys. How many, ranking of each question, comments. Service Desk Historic email/call trending Monthly Trend of number of calls by month and number of emalls. Service Desk First call, first contact resolution Monthly Number of first contacts that are resolved first time, trended each month. Service Desk Surveys Monthly Trend analysis of CSAT results, monthly basis. Service Desk Scheduled and Implemented Change
Report Weekly
Weekly report showing all board-approved and scheduled changes for the week to come and all implemented changes for the preceding week.
This is available on the Customer web portal.
Cross Functional
Year-in-Review Service Delivery Report Annual
A report available on the Customer web portal. It is produced annually and provides an operational summary of the environment by service tower.
Applications
Heat maps Bi-Weekly Application relationships Applications Application portfolio stats/info Weekly Application catalog characteristics Applications UMIS Stakeholder Review Semi-Annual Review and prioritization of UM projects, budget status Applications Public Safety Daily Standup Daily. Daily review of Public Safety Issues, project tasks Applications Public Safety Operations Meetings Monthly
Monthly meeting with Command Staff to review current status and upcoming requests Applications
UMIS PMO Status Bi-Weekly Bi-Weekly review of UMIS projects with stakeholders Applications UMIS ITD Status Bi-Weekly
Bi-Weekly review of UMIS operational issues and tasks with Stakeholders Applications
Application Portfolio review Bi-Weekly
Bi-Weekly review of application portfolio, steady state, project status, future projects Applications
Project Status Weekly
Weekly report available on Customer web portal in the projects portfolio.
This is a summary report, by active project, describing progress, schedule status, Impacts, issues, risks and a stoplight indicator: (Green) On Schedule, No Critical Issues; (Yellow) Problems Exist, But Workarounds Are Defined; (Red) Major Problems, No Recovery Plan Available.
Cross Functional
Monthly PM0 Summary Monthly
Monthly report available on Customer web portal Summarizes service delivery activities during the previous month across all Service Areas.
Composed of the monthly dashboard report and attachments for Incident and Problem activity and Resolutions, Root Cause Analyses (RCAs), Service Level Requirement (SLR) performance, and status of key issues, Problems, and actions.
Cross Functional
Work Order Summary Weekly
Weekly report available on Customer web portal in the projects portfolio.
This is a summary report, by active work order, describing progress, schedule status, impacts, issues, risks, and a stoplight indicator: (Green) On Schedule, No Critical Issues; (Yellow) Problems Exist But Workarounds Are Defined; (Red) Major Problems, No Recovery Plan Available. Note that work orders associated with projects are reported in the weekly project status report
Cross Functional
PM0 Methodology Weekly
PM team provides suggestions and recommendations to resolver groups and track the action items
Cross Functional
SIEM reports
Weekly
SIEM actions, issues found, proactive steps taken, executive overview, maturity model checklist and timeline/roadmap to complete each level. Enterprise Compute Maintenance Activity Weekly
Will be provided on a weekly basis showing all maintenance activities to be performed during the reporting period, which includes change request activities.
Cross Functional
TR&R Activity Monthly Monthly report providing information on planned technology refreshment and replenishment for the next 3-month period. Cross Functional Chargeback Report Monthly
Monthly report incorporated as part of the monthly account summary report, Vendor's standard invoice can be used as a chargeback mechanism by the Customer.
Cross Functional
Monthly Dashboard Report Monthly
Monthly executive summary view of the overall service delivery performance status. This is the Lead Ito the monthly PM0 status report, accessible through the Customer web portal.
Cross Functional
Weekly Customer Priority Report Weekly A weekly report available on the Customer web portal. Provides a priority list of Work Orders, ROMs and Requirements Documents. Cross Functional Governance reports
Weekly
Provides management action lists, organization highlights, overall objectives, discussion items, decision points and priorities for the team. Cross Functional On demand reports Various
Analytics to determine actions for continuous improvement outcomes or requests. Cross Functional
Financials, invoicing detail Monthly
Charges by category and resources by month with a running total of invoice amounts. Cross Functional
Antimalware and client checks Weekly
List of all clients with versions of antimalware, virus software installed.
Identifies gaps, issues. End-User
Server, laptop, End-User counts Weekly
Number of servers, laptops, and End-Users by department with model numbers. End-User
Problem Activity and Resolution Weekly, Monthly
Problem Ticket details, Problem summary, Incident resolution and details, Root cause summary(Root cause, Action taken, Solution) , Root cause elimination and preventive actons(suggestion, solution/outcome, .
Action plan) Lessons learned and Problem detection & details Cross Functional
RCA Summary Report Weekly
Weekly RCA tracker with details like Problem Reference number, associated Master incident number, priority , created/closed date, PBI ageing days, Approval, RCA details and RCA OLA status.
Cross Functional
Detailed List of Closed Incidents Monthly Tickets closed by service desk on monthly basis under the service category "User service restoration"
Service Desk
Detailed List of Closed Requests Monthly Tickets closed by service desk on monthly basis under the service category "User service request"
Service Desk
Detailed List of Closed Events Monthly Auto generated tickets closed on monthly basis under the service category "Infrastructure Events" & "Infrastructure Restoration" Enterprise Compute Detailed List of Created Incidents Monthly Tickets created by service desk on monthly basis under the service category "User service restoration" Service Desk
Detailed List of Created Requests Monthly Tickets created by service desk on monthly basis under the service category "User service request" Service Desk
Detailed List of Created Events Monthly Auto generated tickets created on monthly basis under the service category ''Infrastructure Events" & "Infrastructure Restoration" Enterprise Compute Detailed List of Open Incidents Weekly
All the tickets open (Irrespective of the dates when they were created) under the service type "User service restoration", "User service request" and "Infrastructure events & restoration"
Enterprise Compute
Detailed List of Problems Weekly Summary of all PBIs open, closed with history Cross Functional Detailed List of Resolved Incidents Monthly
Tickets Resolved by service desk on monthly basis under the service category "User service restoration", "User Service Request and "Infrastructure Events a& Restoration"
Cross Functional
Incident Aging Report Weekly Backlog of all tickets by their Assigned Owner group and of the service type " User Service Restoration" and "User Service Request" Cross Functional Incident Operational Report Weekly
All Incidents created & closed by priority with the trending, All Incidents created for that period with its current status and Priority.
All Incidents created for that period by Reported Source All Incidents created for that period by Impact
All Incidents created for that period by Site
All Incidents created for that period with current Assignment Groups All Incidents created for that period with its Operational Categories All Incidents created for that period with its Product Categories Incidents Resolved for that period and its Daily Mean Time to Resolve ( Resolved Time - Created Time)
Mean time to resolved with Incident Impact categorized In various time buckets.
All Incidents Resolved by Top 10 Resolver Groups
Cross Functional
Problem Management Summary Report Monthly Monthly FBI Trend showing created, closed and cancelled PBIs Cross Functional Events Analysis Report Monthly
Consolidating Incidents and Events data that are downloaded from City Portal. Data is uploaded by reporting team. In Enterprise computing, Events Trend, Frequent event generators, Top 5 event types are captured.
Cross Functional
Executive Problem Management Report Monthly
Monthly analysis report consists of Enterprise computing and End user computing. In End user computing, Tickets trend, Service Type split, Top 10 incidents, Department wise analysis, Deep dive on Top 5 products with problem types, Details of Recurring issues are shown. Monthly PBI's Trend & RCA Tracker
Cross Functional
Messaging work plans and issues Monthly
Monthly Exchange server report slides includes current On-Premises Exchange Environment, future planned work and issues remediated. Enterprise Compute Account Summary Monthly
Monthly account finance invoice listing resource units and rates, applicable Additional Resource Charges (ARCS) and Reduced Resource Credits (RRCs), Authorized project expenses, procurements, and other directly billable expenses. Note that this report will be provided In a standard invoice form that Customer can use as a chargeback mechanism.
Enterprise Compute
Service Area Capacity Status and
Trending
Monthly
Monthly status report on three areas of the IT environment sewers, storage, and network. This report addresses the impact of Customer business objectives on resource usage, results of system information analyses, actual workload versus forecast and predictive analyses of future needs based on historical data (trends). Attributes include View of cpu, memory, and other thresholds and trends of servers and virtual systems.
Enterprise Compute
Windows work plans and issues Weekly
List of work being performed with windows and any virtualized servers.
Describes next steps and outstanding issues. Enterprise Compute Renewals Monthly List of all software on maintenance with date of next renewal. Enterprise Compute Capacity management reports Monthly
View of cpu, memory, and other thresholds and trends of servers and virtual systems. Enterprise Compute
PM0 artifacts and metrics
Weekly
Project Artifacts (the relevant one's) gets updated by the Project Manager's on a daily basis. The metrics for the projects are submitted as part of the Project Status Report (4-up's) Cross Functional Project status reports
Weekly
Weekly report available on Customer web portal in the projects portfolio.
This Is a summary report, by active project, describing progress, schedule status, impacts, issues, risks and a stoplight indicator: (Green) On Schedule, No Critical Issues; (Yellow) Problems Exist, But Workarounds Are Defined; (Red) Major Problems, No Recovery Plan Available.
Cross Functional
Backup Schedule and Backups Performed Weekly, Monthly
Provide an OpsCenter list of backups performed for the month including their schedules and completion status.
indicate any issues that had significant impact on the provided list. Enterprise Compute Backup work plans and issues Weekly
Provide a fist of known upcoming changes to the backup infrastructure.
Denote any issues and planned remediation. Enterprise Compute MTTR Report—Monthly Monthly Mean Time to Resolve, Standard Cross Functional Open Incident Volume Dashboard —
Monthly
Monthly
Dashboard which provides details of incidents & Infrastructure events split into respective service streams(Deskside, SD, RM, etc) by its Priority (High, Medium & Low), and the respective statuses(Open or Resolved) as of the end of month each month
Cross Functional
Defect Report .•- Weekly Weekly
Weekly Defect management report is setup to govern & Improve incident coding quality for Incident Product Codes, Operational codes, Incident misroutes and Incidents with high Turn around time. This initiative Increases the overall problem and product tracking, which helps is generate close to accurate historical data of Product and Problem types for monthly, quarterly & annual reviews
Cross Functional
Operational Review Report— Monthly
(Volume trends of Created/Resolved,
Reported Source, Service Streams,
Assignments Groups & Products)
Monthly
Monthly Operational Review provide a 6 months trend analytics.
Examples below. 110 to 140 slides per month.
1. Volume trend of incidents, Requests & Events
2. Volume trend split by Reported Source (Email, Phone & Direct input)
3. Ticket created and resolved trend by respective service streams (Deskside, SD & Resolvers)
4. Resolved incidents by the top assignment groups
5. Resolved trend of top Products (SD & Deskside).
6. CSAT trend for SD & Deskside
7. CSAT response rate
8. Turn Around time trend for SD & Deskside
Cross Functional
Request Aging Report Weekly Backlog of all tickets by their Assigned Owner group and of the service type '' User Service Restoration" and "User Service Request" Cross Functional Request Operational Report Weekly
All Incidents created & closed by priority with the trending, All Incidents created for that period with its current status and Priority.
All Incidents created for that period by Reported Source All incidents created for that period by Impact
All Incidents created for that period by Site
All Incidents created for that period with current Assignment Groups All Incidents created for that period with its Operational Categories All Incidents created for that period with its Product Categories Incidents Resolved for that period and its Daily Mean Time to Resolve ( Resolved Time - Created Time)
Mean time to resolved with Incident Impact categorized in various time buckets.
All incidents Resolved by Top 10 Resolver Groups
Cross Functional
SCHEDULE 8
MANAGED AND ASSIGNED AGREEMENTS
TO
MASTER SERVICES AGREEMENT
BY AND BETWEEN
CITY OF SANTA CLARA
AND
UNISYS CORPORATION
Schedule 8 - Managed and Assigned Agreements
Schedule 8
Managed and Assigned Agreements
1. Managed Agreements
Organization Services
ABTECH Server repairs, maintenance.
Altiris Wise Package Studio / Wise Installation
Studio
AMS.net Cabling and electrical for data center
AT & T DATACOMM INC Network equipment maintenance
Bay Area Data Supply Desktop printer maintenance
Carahsoft Veritas backup licenses for servers
Center for Internet Security Albert IDS monitoring
Cogent Internet Service Provider
Com pucom Symantec Ghost Solution Maintenance
ZScaler Hosted Web Filtering
Presidio SmartNet Service and Network Equipment
Procurement
DELL PGP Whole Disk Encryption support
DLT Solutions Symantec NetBackup, Symantec Endpoint
Protection
Duo Security DuoSecurity 2FA software
Iron Mountain Off-site tape storage
KEMP Load Balancers
LC Networks Data Cabling outside of the data centers
Namescape Rdirectory
Eaton Power Solutions UPS Battery Backup maintenance
Nimble Network Attached Storage
ABTECH Tape library maintenance
Packet Fusion ShoreTel Software
Schedule 8 — Managed and Assigned Agreements
Organization Services
RadiolP MulitIP Software
Recall Destruction Services
Solar Winds Network IPMA, Bandwidth Monitor, and
VTools
Thermal Mechanical Parts & Service (HVAC)
VmWare Inc Server Virtualization Support
WebEx Conference call services
Windstream Vol P SIP Trunks
2. Assigned Agreements
None
SCHEDULE 9
KEY SERVICE PROVIDER PERSONNEL
TO
MASTER SERVICES AGREEMENT
BY AND BETWEEN
CITY OF SANTA CLARA
AND
SERVICE PROVIDER
CONFIDENTIAL
CONFIDENTIAL
SCHEDULE 10
SECURITY PROTOCOL
TO
MASTER SERVICES AGREEMENT
BY AND BETWEEN
CITY OF SANTA CLARA
AND
SERVICE PROVIDER
Schedule 10 - Security Protocol
Table of Contents
1. Goal 3
2. Risk Assessment 3
3. System Changes 3
4. Training and Education 4
5. Agents and Subcontractors 4
6. Regular Testing and Monitoring of Compliance 4
7. Incident Response 4
8. Periodic Adjustment 5
9. Review by Customer 5
10. Audits and Verification 5
11. Access to Documents 6
12. Use of Customer Resources, Non-confidential Nature of Information On Customer Equipment 6
Schedule 10- Security Protocol
Schedule 10
Security Protocol
1. Goal
a) The goal of all of Customer's security plans and procedures as available in respect of Customer's various operations ("Customer Security Plans") is to protect Customer's people and information assets in a safe, practical and cost-efficient manner, while not impeding the productivity or efficiency in the daily conduct of Customer's business processes. b) Customer Security Plans, as available and if and as revised from time to time, shall form a part of the Procedures Manual (which may be subject to Change Control Procedures). As set out in Section 5.5 of the Agreement, Service Provider shall comply with the Procedures Manual, including the Customer Security Plans, throughout the duration it provides Services to Customer. In pursuance of such compliance, Service Provider agrees and understands that if required, it shall apply the necessary controls to develop, modify or acquire systems to preserve the integrity of the information processed on its systems. c) Service Provider shall ensure compliance with the Customer Security Plans by all users of Customer information including, without limitation, Service Provider employees, officers, directors, agents, associates, consultants/contractors, temporary workers and any third-party processors of Customer Data.
2. Risk Assessment
Service Provider shall perform regular risk assessments ("Risk Assessments"), no less than annually, of its compliance with the Customer Security Plans to:
a) Identify foreseeable internal and external threats pursuant to Service Provider's operations that could result in unauthorized access, disclosure, misuse, alteration, or destruction of any of the Customer Data;
b) Assess the likelihood and potential damage of these threats, taking into consideration the sensitivity of the Customer Data (and any special risks or issues identified by Customer); and c) Assess the sufficiency of the policies, procedures, information systems, technology, and other arrangements that Service Provider has in place to control such risks.
If applicable, Service Provider shall, based on a mutually agreed timeline after completion of Risk Assessment, revise its own security plans and its operations, including its provision of the Services, to manage and control the risks identified during the Risk Assessment; provided however, any Customer specific controls required as a result of Customer's risk assessment shall be addressed pursuant to the terms of Schedule 27. Service Provider shall, immediately upon completion of such revision, provide a report to Customer detailing therein the outcome of the Risk Assessment and the revisions adopted pursuant to such a Risk Assessment.
3. System Changes
Service Provider shall make no system change, nor implement any modification of its own security plans, that (i) may adversely affect the security of the System or the security of the Customer Data or other data created, processed, or stored by Service Provider for Customer, (ii) requires Customer to install a new version, release or upgrade of, or replacement for, any hardware or software or to modify any hardware or
Schedule 10- Security Protocol
software, or (iii) requires Customer to pay any additional amount for the Services, in each case without first obtaining Customer's approval in accordance with, or as otherwise contemplated under, the Change Control Procedures set forth in Schedule 14.
4. Training and Education
Service Provider shall institute an appropriate training and education program designed to train its employees to implement and comply with the Customer Security Plans, and designed to ensure that they are adequately aware, of their responsibilities pursuant to Service Provider's compliance obligations with respect to the Customer Security Plans. Service Provider shall be responsible for training Service Provider's employees and subcontractors, of any tier, who have access to any Customer information technology system, in current Customer certification programs, which may be amended, revised, or replaced, from time to time, concerning Customer's information security policies.
5. Agents and Subcontractors
Whenever Service Provider is authorized by Customer to use agents or subcontractors to provide the Services under this Agreement, Service Provider shall:
a) Exercise appropriate due diligence in selecting its agents and contractors consistent with the requirements of the Customer Security Plans and this Schedule. b) Require its agents and subcontractors by contract to implement and regularly test appropriate measures designed to meet the objectives of the Customer Security Plans and this Schedule.
c) Monitor its agents and subcontractors to confirm that they have satisfied such obligations. d) Ensure that its agents and subcontractors comply with Section 11 below with respect to the portion of the Services that they perform on behalf of Service Provider, except as Customer may otherwise agree.
6. Regular Testing and Monitoring of Compliance
In addition to the requirements set forth in Section 10 below, Service Provider shall regularly test the key controls, systems, and procedures of its security plans and for its compliance with the Customer Security Plans (including as applicable to its subcontractors) to cause them to be properly implemented and effective in addressing the threats and risks identified. The frequency and nature of such tests should be determined by the Service Provider's Risk Assessment. Tests should be conducted or reviewed by staff independent of those that develop or maintain Service Provider's security plans and its compliance with the Customer Security Plans; provided however, any Customer specific controls required as a result of Customer's testing and monitoring of compliance shall be addressed pursuant to the terms of Schedule 27.
Service Provider shall also monitor compliance with its security plans and the Customer Security Plans, both internally and by its subcontractors.
7. Incident Response
Service Provider shall develop and implement (and require its subcontractors to develop and implement) appropriate incident response plans that specify actions to be taken when Service Provider, a Subcontractor or Customer suspects or detects that unauthorized individuals have gained access to Customer Data or Systems relating thereto, 'including appropriate reports to regulatory and law enforcement agencies to be made by Service Provider with Customer's consent or direction. Such incident
Schedule 10- Security Protocol
response plan shall include notification, management, and response procedures to be followed in case of any security incidents or any suspected unusual activity that may represent a potential security threat, such as virus activity, use of information systems in connection with a denial of service attack, system hacking, theft or destruction of data or other unusual activities or network traffic. In the event Service Provider or a Subcontractor discovers, suspects, or is notified of a breach, potential breach, or risk of breach of security relating to any Customer Data, Service Provider shall promptly notify Customer of such breach, potential breach, or risk of breach. Service Provider shall provide Customer all documents related to any breach of security promptly at Customer's request. Service Provider shall fully cooperate with any Customer investigation of such breach, potential breach or risk of breach. Service Provider shall immediately investigate and, at its sole cost, immediately cure any such breach that occurs within Service Provider's obligations under the Agreement. Customer will review the remediation by Service Provider.
8. Periodic Adjustment
Service Provider shall regularly monitor, evaluate, and adjust, as appropriate, its security plans and its compliance with Customer Security Plans in light of any relevant changes in applicable law and regulations, technology, the sensitivity of the Customer Data, internal or external threats to the Customer Data, requests from Customer, and Service Provider's own changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to information systems.
9. Review by Customer
Service Provider shall provide Customer the right to review its security plans, together with operating documentation and other relevant documentation, upon Customer's request.
10. Audits and Verification
a) Service Provider SSAE 16 Report. Service Provider shall have its security plans and its compliance with Customer Security Plans audited on an annual basis by a reputable and nationally recognized audit firm to review and test the design and operating effectiveness of the security measures adopted, identify any weaknesses or deficiencies of the security measures and alternative or additional measures that must be implemented, and determine whether Service Provider is achieving the control objectives of its security plans and the Customer Security Plans. Customer understands and accepts that Service Provider may (i) perform and report on such security audits in combination with and as part of the SSAE 16 control audits that Service Provider performs to satisfy its own Sarbanes- Oxley compliance requirements and (ii) provide such report to other customers as described in the Agreement.
No portion of this Schedule 10 shall be construed to preempt applicable Laws; rather, the requirements of this Schedule 10 and the Customer Security Plans are an additional layer of protection to Customer, and are to be administered in addition to the requirements of applicable Law.
b) Service Provider Certifications. Upon request, and at such reasonable intervals as Customer or its auditors may specify, but no less than quarterly, an appropriate officer of Service Provider will certify to Customer that, to the best of his or her knowledge, after reasonable inquiry: (i) Service Provider has reported all breaches of security, suspected fraud or other irregularities or reportable incidents that may constitute violations of its security plans, the Customer Security Plans and I or this Schedule; (ii) Service Provider has reported to Customer all apparent material weaknesses and deficiencies in the security measures contemplated under its own security plans, and in its compliance of the Customer Security
Schedule 10- Security Protocol
Plans and this Schedule; and (iii) make such other factual certifications concerning its security plans, the Security Integration Plan and this Schedule as Customer or its auditors may reasonably request.
c) Customer Audits.Upon forty-five (45) days' prior notice from Customer, unless shorter notice is required by exigent circumstances, and subject to all applicable confidentiality obligations agreed to by Customer and Service Provider, Service Provider will provide, and will cause its agents or subcontractors to provide, Customer or any Customer representative (other than a Service Provider competitor), with access to such facilities, records and supporting documentation as may be requested by Customer in order to audit Service Provider's compliance with its obligations under or related to the Customer Security Plans and / or this Schedule.
11. Access to Documents
Service Provider shall provide Customer with access to all documents and records maintained by Service Provider in relation to its security plans, this Schedule and its compliance with the Customer Security Plans on a mutually agreeable schedule and at a mutually agreeable location.
12. Use of Customer Resources, Non-confidential Nature of Information On Customer Equipment
All onsite Contract Staff will comply with the City Manager's Directive Procedure "CMD 116 Use of Resources, Non-Confidential Nature of Information".
SCHEDULE 11
ACCEPTANCE PROCEDURES
to the
IT MANAGED SERVICES AGREEMENT
between
THE CITY OF SANTA CLARA
and
UNISYS CORPORATION
Schedule 11 - Acceptance Procedures
Service Provider shall perform, complete, and deliver Deliverables and Milestones to Customer for Customer's acceptance, to include but not limited to Transition Deliverables and Milestones, in accordance with the terms and conditions of an applicable Statement of Work, Project Plan, Transition Plan, or other Agreement document pursuant to the PM0 methodology described on the IT InSite Portal (or as otherwise agreed) and the following procedure:
1. The Parties will mutually agree upon applicable, detailed acceptance criteria with respect to each Deliverable and Milestone as soon as practicably possible.
2. Upon receipt by Customer of a Deliverable or notice of completion of a Milestone from Service Provider, Customer will review the Deliverable or Milestone to verify that it complies with the applicable and previously agreed acceptance criteria.
3. If the Deliverable complies with the acceptance criteria, Customer shall provide notice of Customer's acceptance of the Deliverable or Milestone.
4. Customer will have the right to reject a Deliverable or Milestone that does not meet the applicable acceptance criteria. Customer shall inform Service Provider of such rejection in writing within ten (10) business days from the date of delivery thereof by Service Provider, or as mutually agreed to by the Parties, describing the deficiencies with respect to the applicable acceptance criteria in reasonably sufficient detail.
5. If Customer notifies Service Provider that a Deliverable or Milestone is not accepted, and Service Provider is able to identify or reproduce the stated deficiencies, Service Provider shall correct such deficiencies and redeliver the affected Deliverable or Milestone within five (5) business days from the date of Customer's notice unless the Parties mutually agree that such correction reasonably requires a longer timeframe.
6. Upon Service Provider's redelivery of the affected Deliverable or Milestone, Customer shall inform Service Provider of its acceptance or rejection with respect to Service Provider's correction of Customer's previously described deficiencies in writing within five (5) business days from the date of Service Provider's redelivery thereof.
7. Should Customer not accept a Deliverable or Milestone within the two (2) review periods described above, or within additional review periods as mutually agreed by the Parties, and Service Provider reasonably and in good faith believes that the finally delivered Deliverable or Milestone corrects the Customer's initially described deficiencies with respect to the applicable acceptance criteria, the Parties shall promptly escalate the matter for resolution in accordance with the dispute resolution procedure set forth in Schedule 17, Governance Model, and Article 21 of the Agreement.
8. Should Customer not provide its acceptance or rejection of a Deliverable or Milestone within the timeframes associated with a review period, or otherwise provide Service Provider with a reasonable rationale for an extended review period, the Deliverable or Milestone will be deemed accepted.
9. Should Customer not provide its acceptance or rejection of a Deliverable or Milestone within the timeframes associated with a review period, or otherwise provide Service Provider with a reasonable rationale for an extended review period the Parties shall promptly escalate the matter for resolution in accordance with the dispute resolution procedure set forth in Schedule 17, Governance Model, and Article 21 of the Agreement.
10. No such activities shall be deemed completed until all acceptance criteria, whether set forth in the Agreement or set forth in any Schedule thereto or otherwise mutually agreed upon by the Parties in writing, have been successfully met.
SCHEDULE 13
TRANSITION SERVICES AND DELIVERABLES
to the
IT MANAGED SERVICES AGREEMENT
between
THE CITY OF SANTA CLARA
and
SERVICE PROVIDER
TABLE OF CONTENTS
1. OVERVIEW 1
1.1 General. 1
1.2 Definitions. 1
1.3 References. 1
2. OVERVIEW OF TRANSITION SERVICES 1
3. TRANSITION MANAGEMENT 1
3.1 Transition Managers. 1
3.2 Transition Management Office. 2
3.3 Transition Planning and Kickoff 2
3.4 Transition Schedules. 3
3.5 Transition Deliverables and Milestones. 3
3.6 Transition Status Reporting. 3
3.7 Transition Team Meetings 4
4. TRANSITION MANAGEMENT PLANS AND TOOLS 4
4.1 Risk Management Plan. 4
4.2 Change Management Plan. 5
4.3 Quality Assurance Plan. 5
4.4 Communications Plan 5
4.5 Issue Management 6
4.6 Transition Management Tools 6
5. TRANSITION APPROACH AND METHODOLOGY 6
5.1 Knowledge Transfer Plan. 6
5.2 Service Tower Transition Approach and Methodology 7
6. ASSET INVENTORY 7
7. KEY TRANSITION ROLES AND RESPONSIBILITIES 7
7.1 Service Provider Roles and Responsibilities. 7
7.2 Third Party Provider Participation 10
8. KEY TRANSITION DELIVERABLES 10
8.1 Service Provider Key Transition Deliverables, Critical Transition Milestones and Corrective Assessments. 10
TABLE OF EXHIBITS
Exhibit 1 Transition Schedules
Schedule 13
Transition Services and Deliverables
1. OVERVIEW
1.1 General.
This Schedule sets forth the requirements applicable to each Transition and the Transition Schedules that will be subject to Acceptance by Customer.
1.2 Definitions.
Unless otherwise defined in this Schedule or an Exhibit to this Schedule, capitalized terms used in this Schedule and the Exhibits to this Schedule will have the meanings set forth the Agreement. Other terms used in this Schedule and the Exhibits to this Schedule are defined where they are used and have the meanings there indicated. Those terms, acronyms, phrases and abbreviations utilized in the IT services industry or other pertinent business context will be interpreted in accordance with their generally understood meaning in such industry or business context.
1.3 References.
Any reference herein to a particular Article or Section number or Exhibit or other attachment will mean that the reference is to the specified Article or Section in, or Exhibit or other attachment to, this Schedule, except to the extent that the cross-reference expressly refers to another document.
2. OVERVIEW OF TRANSITION SERVICES
Service Provider will conduct each Transition in accordance with the requirements of this Schedule and the Agreement. Service Provider will perform each Transition in such a manner so as to not disrupt or cause any unnecessary adverse impact on Customer's business and IT operations, cause any degradation of the Services then being received by Customer, or disrupt or interfere with Customer's ability to obtain the full benefit of the Services (except to the extent that Service Provider has provided Customer with reasonable advance notice of such disruption and Customer has agreed in writing that such disruption is acceptable).
3. TRANSITION MANAGEMENT
3.1 Transition Managers.
Service Provider will appoint a Service Provider Transition Manager, who will be responsible for managing the completion of each Transition. Customer will appoint a Customer Transition Manager who will be responsible for overseeing the completion of each Transition. The Transition Managers will (A) act as the single points of contact for their respective teams, (B) coordinate activities of their respective teams, (C) work together to facilitate the completion of each Transition in accordance with this Schedule, including the applicable Transition Schedule, and (D) ensure that their Transition team performs its respective roles and responsibilities. Unless otherwise approved by Customer, the Service Provider Transition Manager will be responsible for managing all Transition activities for each Service Tower, including consolidating reporting activities and overseeing all Service Provider team leads and sub-project managers, incumbent service provider transition managers and leads (if applicable) and Customer resources and activities. The Service Provider Transition Manager will be responsible for consolidating these activities from a project management perspective (e.g., planning, status reporting, issue and risk management, change management).
1 3.2 Transition Management Office.
(A) Service Provider and Customer will establish a Transition Management Office ("IMO") to manage the Transition. Within the first 15 days following the commencement of the first Transition, Service Provider will establish a charter that defines the mission and roles and responsibilities, of the TMO. The focus of the TMO's responsibilities will be managing risk, delivering timely and effective communications, and providing realistic assessments of the progress of the Transitions. (B) The TMO will consist of Service Provider's key relationship management personnel and their respective Customer counterparts. The TMO will be the focal point for all Transition activity.
(C) In addition to the TMO, a Joint Transition Management Office ("JTMO")will be established and will include transition managers and transition team members from Customer's new managed service provider, incumbent service provider and other parties involved in transition program activities. Service Provider will assist Customer with the following JTMO activities:
(1) Consolidate transition status information from Service Provider and third parties in a JTMO agreed format (e.g., schedule, issues list, Critical Milestones status) for review during JTMO meetings;
(2) Identify issues and risks impacting Service Provider's Transition Plans, Transition Schedules and transition tracks which will drive the overall transition program schedule; (3) Assist Customer with identification of transition program risks across transition participant work streams based on transition participant provided data; and (4) Provide general outsourcing transition program advice to Customer transition team that will serve as transition program integrator. (D) As part of the JTMO, a Transition Management Committee will be established to resolve escalated issues and make decisions as necessary during the Transitions. The Transition Management Committee will consist of Service Provider's key relationship management personnel and their respective Customer counterparts, the Transition Managers, and other members agreed by the Parties. The Transition Managers will bring escalated issues and status information to the Transition Management Committee regularly to have decisions made and to inform Customer IT leadership about the status of each Transition. The Transition Management Committee will meet bi-weekly or more frequently if required by Customer.
(E) Upon commencement of a Transition, the TMO will conduct detailed planning in accordance with this Schedule and the applicable Transition Schedule.
3.3 Transition Planning and Kickoff.
(A) Service Provider and Customer will participate in initial Transition project planning meetings as scheduled by Customer with members of the TMO/JTMO as required to conduct detailed planning for Transition activities. During these meetings, the Transition Plans will be reviewed, and Accepted or rejected, by Customer. If the changes in the Transition Plans result in additional effort or Transition duration for reasons attributed to Customer (e.g., unavailability of Customer SMEs), such changes will be managed through the change control procedure. Service Provider's Transition team will take the leadership role in the development, enhancement, maintenance and implementation of the Transition Plans and the Transition Schedules. Service Provider will provide the resources necessary to perform the responsibilities set forth in this Schedule and the applicable Transition Schedules, including the management activities required to manage, track status of and report on Transition tasks. 2 (B) The initial planning meetings will also include contingency and risk planning, resource planning, communications planning, and governance and relationship management planning in accordance with the Transition Plans. Following these initial planning activities, Service Provider will conduct a project kickoff meeting with members of the TMO, JTMO and other Customer stakeholders to socialize the Transition Plans and Transition Schedules.
3.4 Transition Schedules.
(A) The initial drafts of the Transition Schedules are set forth in Exhibit 1 of Schedule 13. Service Provider will develop further detailed Transition Schedules. (B) Service Provider will use the Transition Schedules as the basis for the development of individual action plans and Service Provider will monitor progress against each Transition Schedule to provide a continuously updated picture of the completed and planned activity. The Transition Schedules will be used to determine the status of the Transition efforts, to identify potential schedule slips, and to create recovery and contingency plans.
(C) Service Provider will plan Transition activities in order to avoid conflict with critical dates identified by Customer (e.g., fiscal year end reporting, freeze dates, restraint periods). (D) The Transition Schedules will be the baseline for the overall transition program schedule. Customer and third parties involved with the Transitions will integrate with Service Provider's Transition Plans, Transition Schedules and key Transition tracks (e.g., Cross-Functional process implementation).
3.5 Transition Deliverables and Milestones.
Certain Transition Deliverables and Transition Milestones are identified as Critical Deliverables and Critical Milestones, respectively. The consequences of Service Provider's failure to achieve timely Acceptance of such Transition Deliverables and Transition Milestones are described in Schedule 4.
Service Provider will provide all cooperation and assistance reasonably required and requested by Customer in connection with Customer's evaluation or testing of Transition Deliverables and confirmation that the Transition Milestones have been properly achieved by Service Provider. A Transition will not be considered to be complete until the final Transition Deliverable or Transition Milestone, as applicable, for the applicable Transition, has been Accepted by Customer.
3.6 Transition Status Reporting.
Service Provider will provide the TMO and Customer management with a weekly written report (the "Transition Status Report"), which will address the progress and status of each Transition, until all Transition activities are complete and Accepted by Customer. Service Provider will organize each Transition Status Report by Service Tower and they will include the following information:
(A) Transition status;
(B) Weekly highlights;
(C) Updated Transition Schedules;
(D) Four-week rolling Transition Milestones report, including:
(1) Completion status; and
(2) Percent complete;
3 (E) Risk matrix and critical path analysis, along with mitigation recommendations; and
(F) Key activities scheduled during the current and following agreed-upon reporting period, including:
(1) Key activities not completed as planned and the associated corrective action plan;
(2) Outstanding issues affecting the Transition progress; and (3) Change control activity, including current Change Requests under consideration, Changes in progress, and a cumulative record of approved Changes and rejected Changes.
The Service Provider Transition team will also identify and report to Customer Transition Manager any information that may have a material Service or financial impact.
3.7 Transition Team Meetings.
(A) At a minimum, the TMO and JTMO will meet on a weekly basis. During meetings, the Service Provider Transition Manager will review the Transition Status Report and will present updated Transition Plans and Transition Schedules to reflect mutually agreed-upon changes, such as revisions to Transition Schedules, resource requirements, risk and risk mitigation plans, dependencies, dispute resolution, and priorities. The Transition Managers will determine and adjust as required the frequency, agenda, and location of all scheduled meetings and the format and templates to be used for review.
(B) The Transition team meetings will not serve as the method for collecting Transition status information, Instead, the meetings will serve as a forum to present Transition status information collected via project management activity throughout the week and to address exceptions and areas such as issues, risks and key decisions required of the TMO members. (C) A schedule for weekly TMO and HMO meetings will be established within 15 days following the Transition Start Date.
4. TRANSITION MANAGEMENT PLANS AND TOOLS
4.1 Risk Management Plan.
(A) Within 30 days following the Transition Start Date, Service Provider will develop and provide to Customer, for review and Acceptance, a plan (the "Risk Management Plan") that identifies the significant risks, and associated risk mitigation strategies identified by Service Provider for the Transitions. Service Provider will promptly update the Risk Management Plan as new risk elements are identified or existing elements are deemed no longer a significant risk. (B) During the Transitions, Service Provider's Transition team will assume a lead role for proposing contingency planning and risk mitigation strategies to mitigate risks, including risks associated with the simultaneous Transition of multiple Service Towers, possible delays in the Transition implementation or delays that affect the quality of the Services received by Customer. In addition, all delays in the Transition Schedules will be tracked and reported by Service Provider's Transition team to Customer and will be highlighted against the original applicable Transition Schedule, including the reason for the delay, activities to mitigate (and recover from) the delay, and any new completion dates as agreed to in writing by Customer.
4 (C) The Risk Management Plan will be reviewed and updated during the Transition team meetings. Changes to the Risk Management Plan will drive changes to the Transition Schedule in the form of the addition or deletion of contingency tasks and the addition or removal of schedule contingency time (i.e., float). The status of contingency planning and risk mitigation will be reported as a part of the regular Transition Management Committee reviews. (D) Service Provider will use its risk tracker Tool to manage this process. Each risk will be given a probability rating and a criticality rating. The risk rating score will allow the TMO to focus on the risks that will have the most substantial impact on the applicable Transition.
4.2 Change Management Plan.
(A) Changes relating to a Transition will be processed and implemented in accordance with the change control procedure. Within 30 days following the Effective Date, Service Provider will develop and provide to Customer, for review and Acceptance, a plan (the "Change Management Plan')that describes the process for categorizing, evaluating and approving Changes to a Transition.
(B) The applicable Change Request will describe the Change, the impact on the applicable Transition Schedule and the Transition Fees, and the potential additional effort that will be required as a result of the Change.
4.3 Quality Assurance Plan.
Within 30 days following the Transition Start Date, Service Provider will develop and provide to Customer, for review and Acceptance, a plan (the "Quality Assurance Plan") that identifies the quality assurance processes that have been approved by Customer for ensuring quality throughout the Transitions.
4.4 Communications Plan.
(A) Within 30 days following the Transition Start Date, Service Provider will develop and provide to Customer, for review and Acceptance, a plan (the "Communications Plan")that identifies the process for Transition communications. The objectives of the Communications Plan include the following:
(1) Define and manage communication between the Transition stakeholders, Transition team members, Customer management, and Service Provider management by distributing information in a timely manner;
(2) Educate, motivate, and promote sponsorship of the program team at all levels;
(3) Provide information at the appropriate level of detail so that program participants can make timely and informed decisions; and (4) Facilitate sharing and discussion of critical Transition information (e.g., schedule, scope, issues, risks, and resources) to the Transition teams and Executive Sponsors. (B) The Communications Plan will include:
(1) Transition program structure—the program organizational chart, Transition governance and management roles and responsibilities, a detailed project team organization chart, a Transition summary responsibility matrix, and staffing assignments. 5 (2) Program communications schedule— schedule and audience for Transition team meetings and reports, schedule and audience for key Service Tower meetings. (3) Program contact list—a comprehensive list and contact information for the Transition teams.
(4) Actions and issues management—a description of how to create, maintain, and close actions and issues.
(5) Escalation process—a description of the escalation path. (6) Resource on-boarding process and requirements - a description of the required approvals, clearances and steps for on-boarding Service Provider staff that are participating in Transition activities.
4.5 Issue Management.
(A) Within 30 days prior to the commencement of the first Transition, the Service Provider and Customer Transition teams will agree on a process for managing Transition issues. The Transition teams will use this process to present issues, problems, concerns, and comments to the Transition Managers during scheduled meetings or as otherwise necessary. The Transition Managers, working with the Transition teams, will identify plans for resolving issues and disputes, including identifying the responsible team members and the scheduled dates for resolution. (B) Service Provider will maintain a Transition issue tracker in an online repository that is accessible to both Transition teams. The TMO members will ensure that the issues are assigned to right team members and will follow up on such issues until resolution.
4.6 Transition Management Tools.
The following table lists and describes Service Provider's Transition management Tools to be used to support the Transition management processes, including those described above.
Tool Transition Management Process
Supported Description
Microsoft Office Unisys SDF o Word,
o Excel,
o Powerpoint,
o Outlook
Microsoft Project Unisys SDF o Project Management Software Microsoft SharePoint /OneDrive Unisys SDF o Collaboration Repository Tool
5. TRANSITION APPROACH AND METHODOLOGY
5.1 Knowledge Transfer Plan.
Within 30 days following the Transition Start Date, Service Provider will develop and provide to Customer, for review and Acceptance, a plan (the "Knowledge Transfer Plan")that documents the process for knowledge transfer during each Transition. The Knowledge Transfer Plan will be based on Service Provider's recommended processes for knowledge transfer and will address the specific requirements for each Service Tower.
6 5.2 Service Tower Transition Approach and Methodology.
Within 30 days following the Transition Start Date, Service Provider will develop and provide to Customer, for review and Acceptance, a description of Service Provider's Transition approach and methodology for each Service Tower, including details regarding key Transition project phases, and the objectives, tasks, and dependencies for each phase. The document will also describes Service Provider's approaches for key Transition/transformation activities, including the following; (A) Technology uplift/migration;
(B) Facility uplift;
(C) Tools migration;
(D) Process migration;
(E) Services migration;
(F) Testing;
(6) Service Level measurement and reporting validation; (H) Resource Unit measurement and invoicing validation; (I) Labor measurement and invoicing validation;
(J) Acceptance procedures specific to the Transitions; and (K) Training and communications with Customer stakeholders.
6. ASSET INVENTORY
During each Transition, Service Provider will conduct a wall-to-wall inventory, using a combination of Service Provider-provided electronic and physical methods, to obtain a complete, accurate, bar-coded inventory of Customer assets for each Service Tower. As Service Provider identifies assets, Service Provider will either scan, or tag and scan, them into a Service Provider-managed asset management database and will manage and maintain such database for the duration of the Term. The results of the inventory conducted in accordance with this Article will not impact the Fees or Fees Methodologies set forth in Schedule 3 unless otherwise agreed by Customer.
7. KEY TRANSITION ROLES AND RESPONSIBILITIES
The key Transition roles and responsibilities for Service Provider, and the individual filling such roles as of the Transition Start Date, are set forth below.
7.1 Service Provider Roles and Responsibilities.
Role Responsibilities
Name of Individual
(as of Transition Start
Date)
Contract Executive • Responsible for maintaining CustomerService Provider relationship • Contract and financial management
• Service Performance Primary contact
7 Role Responsibilities
Name of Individual
(as of Transition Start
Date)
point for service integration and demand
management across all in scope Service
Towers and third parties as applicable
• Provide thought leadership and is the
primary interface to client team on
matters pertaining to managed services
operational changes impacting the
organization
Transition Manager • Lead Transition activities. Responsible for planning, managing and monitoring
each Transition. Accountable for
successful Transition completion.
• Some of the key responsibilities are:
0 Attend kick-off meeting
0 Finalize Service Provider team
0 Prepare detailed Transition
Schedules
0 Measure and monitor Transition
progress against Transition
Schedules
0 Establish project management
procedures for Transitions
0 Status reporting
0 Risk assessment and identification
of mitigation plan
0 Issue management and resolution
0 Get sign off for processes from
external system support groups and
third parties
Applications Transition • Drive the Transition process and Lead
•
schedule , Mobilize Transition team
• Ensure that Applications team is
optimizing time and involvement from
Customer SMEs
• Ensure knowledge transfer success and
completion of Transition Deliverables
• Track and report to Service Provider and
Customer management
• Risk and issue management
• Escalate to Customer on a timely basis
and develop alternate transition options
if the situation demands
• Inter-team coordination
• Service integration
• Get sign off for processes from external
system support groups and third parties
IT Infrastructure Services • Lead Transition activities. Responsible Transition Lead for planning, managing and monitoring
Transition at global level. Accountable
for successful Transition completion.
8 Role Responsibilities
Name of Individual
(as of Transition Start
Date)
• Some of the activities are:
o Attend kick-off meeting
0 Finalize Service Provider team
0 Prepare detailed Transition
Schedules
0 Measure and monitor Transition
progress against Transition
Schedules
o Establish project management
procedures for Transition
0 Status reporting
0 Risk assessment and identification
of mitigation plan
0 Issue management and resolution
0 Give presentations to demonstrate
effective knowledge transfer
0 Get sign off for processes from
external system support groups and
third parties
Cross Functional Lead • Establish procedures for:
0 Incident management
0 Problem management
o Change management
o Release management
0 Capacity management
0 Availability management
0 Service catalogue management
o Issue and risk management
0 Communications managebment
0 Quality management
0 Resource management
0 Deliverable Acceptance
management
0 Financial management
• Participate in rehearsals to demonstrate
support team preparedness around
service delivery processes
• Tools specialist
• Understand Tools landscape (document
best practices, study Tool maturity,
identify possible gaps and suggest
mitigation)
DR Lead • Understand Customer's needs for
immediate business continuity with
minimal downtime
• Propose Customer Disaster recovery
plan in line with Service Provider's
assessment of Customer's needs
Security and Compliance • Conduct review of IT Security controls Lead (both Cross-Functional and access
management)
• Conduct review of security and
9 Role Responsibilities
Name of Individual
(as of Transition Start
Date)
compliance requirements per NIST
security framework and standards
• Conduct gap analysis and propose a
remediation plan
7.2 Third Party Provider Participation.
Customer acknowledges that the activities related to the Transitions will require input from Third Party Providers of other services. Customer will use commercially reasonable efforts to cause such Third Party Providers to provide representatives and support for key activities, such as process and tool requirements development and design, as necessary in order for Service Provider to complete its Transition responsibilities.
8. KEY TRANSITION DELIVERABLES
The key Transition Deliverables that the Customer expects Service Provider's Transition Plan to include are set forth below. Customer expects that additional Transition Deliverables will be developed.
The table below also sets forth those key Transition Deliverables that are Critical Transition Milestones and associated Corrective Assessments.
8.1 Service Provider Key Transition Deliverables, Critical Transition Milestones and Corrective Assessments.
Due Date = ED (Effective Date) + nn (Business Days).
Deliverable Due Date
Critical
Transition
Milestone (yin)?
Corrective
Assessment ($)
. Detailed Transition Plan
Complete
ED+30 Y $ 5,722.96
Transition Kickoff Meeting
Complete
ED+30
. Service Desk Module of the ITSM
Suite Operational (including
availability of City historical ticket
data — i.e., from current Remedy
system)
ED+90
4. Incident Management/Problem
Management Module of the ITSM
Suite Operational
Event Management Module of
the ITSM Suite Operational
Configuration Management
Module of the ITSM Suite
Operational
ED+90
ED+90
ED+90
.
.
. Change Management and
Release Management Module of
the ITSM Suite Operational
ED+90
8. Asset Management and CMDB
Module of the ITSM Suite
Operational
ED+90 N
10 Deliverable Due Date
Critical
Transition
Milestone (yin)?
Corrective
Assessment ($)
9. Service Request Management
Module of the ITSM Suite
Operational
ED+90 N
10. Knowledge Management
Module of the ITSM Suite
Operational
ED+90 N
11. Software License Management
Module of the ITSM Suite
Operational
ED+90 N
12. Project Management Module of
the ITSM Suite Operational
ED+90 N
13. Procedures Manual Complete ED+90 Y $ 5,722.96
14. Service Environment
Documentation for All Service
Towers Complete
ED+90 N
15. Service Catalog Complete ED+90 N
16. Reports Formats and Contents
Approved
ED+60 N
17. All Key Service Provider
Personnel in Place
ED'-30 N
18. Governance Process Meeting
Preparation Completed
(including development of
standing detailed agendas for all
governance meetings, inputs and
outputs for all meetings defined,
attendees list for all meetings
developed, schedules for all
meetings developed, meeting
requests for all meetings sent to
required attendees)
ED+30 N
19. Content and format for the
Governance Reports/Meetings
Complete
ED+30 N
20. Balanced Scorecard Format and
Contents Developed and
Approved by Customer
Annual End-User Customer
Satisfaction Survey Format and
Content Developed and
Approved by Customer
ED+30
ED+30
N
21. N
22. Annual Department Customer
Satisfaction Survey Format and
Content Developed and
Approved by Customer
ED+30 N
23. Annual Business Analysis
Services Satisfaction Survey
Format and Content Developed
and Approved by Customer
ED+30 N
24. Customer Portal Access
Completed
ED+90 N
1 1
Deliverable Due Date
Critical
Transition
Milestone (yin)?
Corrective
Assessment ($)
25. Knowledgebases Completed and
Available on Customer Portal
ED+90 N
26. Service Provider Account Staff
Training Program Developed and
Approved by Customer
ED+30
27. Service Provider Account Staff
Onboarding Training Complete
ED+90 N
28. Customer Training Complete ED+90
29. Cross-Functional Service Tower
Transition Complete
ED+90
30. Service Desk Service Tower
Transition Complete
ED+90
31. End-User Service Tower
Transition Complete
ED+90 N
32. Enterprise Computing Service
Tower Transition Complete
ED+90
33. Applications Service Tower
Transition Complete
ED+90
34. Security Services Transition
Completed
ED 90 N
35. Information / Cyber Security Plan
Completed and Approved by
Customer
ED 90 V $ 5,722.96
36. Compreshenisve Program
Management Office and
Resource Capacity Management
operational per mutually agreed
criteria, maturity model defined,
and milestones for future
progress in place
ED+90 Y $ 17,168.87
OCM Deliverables
37. Phase 1: Strategy Complete ED+15 N
38. Phase 2: Analysis Complete ED+30 N
39. Phase 3: Engagement Complete ED+100 N
40. Phase 4: Support Complete ED+80 N
41. Phase 5: Measurement Complete ED+90 N
42. Phase 6: Sustainment Complete ED+110 Y $ 22,891.83
ServiceNow Deliverables
43. Project Planning Complete ED+5
44. Assessment, Workshops, and
Design Complete
ED+30
45. Build & Test Complete ED+70
46. Cutover & Go-live of all in scope
modules Complete
ED+90 Y $ 28,614.79
SAFe Agile & DevOps Deliverables
47,1 Baselining current activities / ED+30 1 N 1
12 Deliverable Due Date
Critical
Transition
Milestone (yin)?
Corrective
Assessment ($)
tickets Complete
48. Current state assessment
Complete
ED+35 N
49. Future state, tracking and road
map work shop (3 day workshop)
Complete
ED+45 N
50. Leading SAFe training (4 hours
every day for a week) Complete
ED+15 N
51. SAFe for teams training (4 hours
every day for a week) Complete
ED+45 N
52. Backlog creation and
implementation design Complete
ED+50 N
53. 1st PI Planning (2 full days)
Complete
ED+60 N
54. SAFe Agile & DevOps
implemented, operational per
mutually agreed criteria, maturity
model defined, and milestones
for future progress in place
ED+90 Y $ 28,614.79
Tech Café Deliverables
55. Plan, Design, Build Complete ED+70 N
56. Training Complete ED+80 N
57. Soft Opening Complete - Ready
for Grand Opening
ED+90 N
13 SCHEDULE 14
CHANGE CONTROL PROCEDURES
TO
MASTER SERVICES AGREEMENT
BY AND BETWEEN
CITY OF SANTA CLARA
AND
SERVICE PROVIDER
Schedule 14 — Change Control Procedures
Table of Contents
I. INTRODUCTION 3
2. CHANGE CONTROL 3
3. EFFECTIVE DATE OF A CHANGE 6
4. CHANGE MANAGEMENT REPORTING REQUIREMENTS 6
5. FAILURE TO AGREE 7
6. EMERGENCY CHANGE PROCESS; CHANGES TO COMPLY WITH LAWS 7
7. CHANGE REQUEST LOG 7
Schedule 14 - Change Control Procedures
Schedule 14
Change Control Procedures
1. Introduction
This Change Control Schedule describes the process ("Change Control") to be followed by Customer and Service Provider when either Party wishes to make a Change. The Parties may by joint written agreement amend or waive any part of the Change Control process including, but not limited to, where the Parties agree that shorter or longer timeframes are more appropriate, provided that any modifications to the Change Control process are recorded in a Change Proposal (as such term is defined in Section 2.3(b) below) and such Change Proposal is allocated a unique number by Service Provider and is signed by duly authorized representatives of Customer and Service Provider.
The purposes and objectives of Change Control are as follows:
a) to review each request for a Change (a "Change Request") to determine whether such Change is appropriate;
b) to prepare a more detailed proposal to implement a Change Request where required (such proposal, a "Change Proposal");
C) to prioritize all Change Requests and Change Proposals; d) to minimize the risk of exceeding both time and cost estimates, if any, associated with the requested Change by identifying, documenting, quantifying, controlling, managing and communicating: (i) Change Requests, (ii) the preparation of Change Proposals, and (iii) their disposition;
e) to identify the different roles, responsibilities and actions that shall be assumed and taken by the Parties to define and implement the Changes; and
to document a Change whether or not such Change results in any resource adjustments and/or extra Fee.
2. Change Control
2.1 Either Service Provider or Customer may initiate a Change Request by delivering to the other's Contract Executive or his/her nominated representative a writing that describes the requested • Change and sets forth the reasons for it. The Customer Contract Executive shall assign a priority level to the Change Request depending on its urgency. The Service Provider Contract Executive shall assign a unique number to any such request, and shall register the Change Request in the Change Request Log as described in Section 7.1 below. Customer may at any time modify the priority level for any Change Request in its sole discretion. Each Change Proposal that may be prepared for a Change Request shall be tracked by reference to the Change Request to which it relates.
2.2 Each Party's respective Contract Executive or his/her nominated representatives shall be responsible for reviewing and considering any Change Request. If Customer determines that the Change Request requires further investigation, the Customer Contract Executive shall authorize such investigation, which shall be performed as required by Service Provider and/or Customer. Service Provider may also further investigate any Change Request for itself, at its own expense. In
Schedule 14 - Change Control Procedures
accordance with Section 7.2 below, the Contract Executives shall be responsible for keeping up to date the status of each Change Request in the Change Request Log as the status of the Change Request changes through Change Control.
2.3 For each Change Request that the Parties have approved for further investigation, regardless of which Party has proposed or investigated the Change, Service Provider shall if practicable prepare and submit to Customer within seven (7) calendar days (or as otherwise agreed) of such approval for further investigation, a preliminary written report.
Such preliminary report shall contain:
(i) the estimated costs (both charges and retained costs) associated with the Change;
(ii) any anticipated impact on existing Service Levels; (iii) the timeframe for implementing the Change (including any timing constraints);
(iv) the preliminary technical or business case for making the Change, as well as any changes or additions to policies, standards and procedures of Service Provider and or Customer as the case may be, in accordance with which the Change is to be implemented;
(v) an initial analysis of the potential risks (if any) to Customer if the Change is not implemented; and
(vi) an estimate of time for preparing a comprehensive Change Proposal containing the information and analysis set forth in Section 2.3(b) below (the "Estimate").
Service Provider shall bear the costs of preparing the preliminary report, estimate and Change Proposal as set forth in this Section 2.3(a), and shall provide such report as part of the Services.
Customer and Service Provider shall review the preliminary report and Customer shall, within seven (7) calendar days after delivery of such preliminary report in writing, either (1) instruct Service Provider to prepare a comprehensive Change Proposal as set forth in this Section 2.3(b), (2) notify the Service Provider that it does not wish to proceed with the Change, or (3) proceed with the Change on mutually- agreed terms. Where Customer has instructed Service Provider to prepare a comprehensive Change Proposal, thirty (30) calendar days (or as otherwise agreed) after receiving such instruction, Service Provider shall prepare and deliver to Customer, at no additional charge to Customer, a Change Proposal that addresses the following elements of the Agreement, to the extent necessary and appropriate:
(i) scope of the Services;
(ii) the associated Service Levels, if any;
(iii) the Fees for the Change (i.e., fixed price/time and materials, including an estimate of total costs), if any, as well as changes to the Base Fees, if any;
(iv) timeline, milestones, delivery dates, incentives and consequences for nonperformance;
Schedule 14 - Change Control Procedures
(v) evaluation testing, development, acceptance testing period, acceptance testing and acceptance criteria (which must be included in the final Change Order for it to be valid);
(vi) Changes to Disaster Recovery/Business Continuity Services; (vii) Impacts to, additions or deletions of, Third Party Agreements; (viii) any impacts on Customer's, Service Provider's or any Third Party's software, hardware, systems, business operations, personnel requirements or other services;
(ix) any related technical or human resource systems/procedures; (x) any legal and regulatory compliance issues;
(xi) any other matter requested by Customer at the time of preparation of the impact analysis or reasonably considered by Service Provider to be relevant;
(xii) the termination assistance plan;
(xiii) any additional terms and conditions applicable to the Change; (xiv) a detailed analysis of the potential risks (if any) to Customer or Service Provider if the Change Proposal is not implemented; and (xv) the proposed allocation of ownership rights in any Intellectual Property developed as part of the Change, if different from the default provisions of the Agreement.
2.4 Once submitted by Service Provider, Customer shall review the Change Proposal and as soon as reasonably practicable, and in any event not more than thirty (30) calendar days (or as otherwise agreed) after receipt of the Change Proposal, either:
a) Customer may accept the Change Proposal in which case the Change Proposal shall be signed by the Contract Executives and the Change incorporated in accordance with Section 3.0 below; b) Customer may notify Service Provider that it does not wish to proceed with the Change, in which case no further action shall be taken in respect of the Change Proposal; or c) Customer may request that the Parties meet to discuss the Change Proposal (such meeting to be referred to as the "Change Proposal Meeting").
2.5 At the Change Proposal Meeting, the Parties shall use reasonable endeavors to agree to either:
(a) take no further action in respect of the proposed Change, in which case no further action shall be taken in respect of the Change Proposal;
(b) acquire further information before deciding whether to proceed with the Change; (c) amend some or all of the contents of the Change Proposal, which Service Provider will incorporate into a revised version of the Change Proposal; or (d) proceed with the Change as detailed in the Change Proposal in which case the Change Proposal shall be signed and the Change incorporated in accordance with Section 3.0 below.
Schedule 14 - Change Control Procedures
2.6 In the event that the Parties agree to proceed in accordance with one of the options detailed in Section 2.5(b) or 2.5(c) above, then the Parties shall gather any necessary information and/or Service Provider shall prepare a revised version of the relevant Change Proposal, upon which the Parties shall decide whether to proceed in accordance with Section 2.5(a)-(c) above. The Parties shall continue to go through the process detailed above until such time as a final resolution is made by the Parties. The Parties shall act in good faith at all times during such process.
2.7 If the Parties' Contract Executives agree to a Change prior to any investigation conducted by either Party, unless otherwise agreed by the Parties, Service Provider shall in any event prepare a Change Proposal in accordance with Section 2.3 above and submit such Change Proposal for review and approval in accordance with Section 2.4 above.
2.8 The Parties anticipate that not all Changes will result in increases to the Base Fees.
Nevertheless, the Parties intend that all material Changes will be processed in accordance with these Change Control Procedures. Service Provider and Customer will determine, in good faith, whether a change will result in an increase or decrease to the Fees in accordance with the Change Control Procedures Section of the Agreement.
3. Effective Date of a Change
3.1 Upon the signature of a Change Proposal by both Parties' Contract Executives in respect of a Change, the contents of such Change Proposal shall be deemed to be agreed and incorporated into the Agreement on the date of the last signature or as the Parties may otherwise agree. No part of the discussions or interchanges between the Parties shall obligate the Parties to approve any Change or shall constitute an amendment or waiver of the Agreement unless and until reflected in a Change Proposal and adopted in accordance with this Schedule 14.
3.2 Neither Party shall have any obligation to commence or comply with any Change, perform Services that would be covered by any Change, or pay any Fees that would be covered by any Change, until such time as the Parties' Contract Executives have signed the appropriate Change Order. Disputes regarding a Change shall be subject to the dispute resolution process set forth in Schedule 17 of the Agreement.
3.3 Customer's acceptance of, and payment for, work under other Change Orders will be subject to Customer's approval that such work materially complies with the mutually agreed objective acceptance criteria during an acceptance period designated in the Change Order (or if no such acceptance period is specified in the Change Order, thirty (30) days). If Service Provider's work under a Change Order does not materially comply with the applicable acceptance criteria for such Change Order, Service Provider will correct such work and resubmit the Change for Customer's acceptance. If, following one or more resubmissions, Service Provider fails to fulfill its obligations to meet the Change Order acceptance criteria within a time period specified in the Change Order (or if no such period is specified in the Change Order, one hundred twenty (120) days), Customer may terminate such Change Order in accordance with the provisions of such Change Order (or if not otherwise provided in the Change Order, Customer shall be entitled to relief from further payments under such Change Order and a credit or refund (at Customer's option) for any un-realized advance payments previously made under the Change Order).
4. Change Management Reporting Requirements
4.1 Service Provider shall provide Customer as part of the monthly reports set forth in Schedule 7 of the Agreement, a summary specifying the status of all pending Change Requests and Change Proposals.
Schedule 14 - Change Control Procedures
5. Failure to Agree
5.1 In the event that the Party initiating a Change Request believes that the requested Change is required or necessary, the requesting Party shall inform the other Party in writing of the reasons why the Change is required and the impact if it is not implemented. In the event that the other Party does not agree to implement the Change, the requesting Party shall be entitled to consider the other Party's failure to agree to implement the Change as a dispute, and the requesting Party may escalate such Dispute for resolution in accordance with Article 21 and Schedule 17 of the Agreement.
5.2 Notwithstanding anything herein to the contrary, Service Provider shall proceed with any Change requested by Customer that is required by Law or which Customer deems necessary in its sole discretion. In the event the Parties are unable to agree upon any Change or changes to the Fee in connection with any such Change, the parties agree such dispute will be subject to the dispute resolution process set forth in Article 21 and Schedule 17 of the Agreement.
6. Emergency Change Process; Changes to Comply with Laws
6.1 In the event that either Party requires a Change in order to respond to an emergency and such Change would, in the opinion of the requesting Party, if it was not implemented until Change Control had been followed, have a detrimental effect on the requesting Party's ability to meet its obligations pursuant to the Agreement, the requesting Party shall make all reasonable efforts to contact the other Party's Contract Executive, and if the requesting Party is unable to contact the other Party's Contract Executive after reasonable efforts, the requesting Party shall, where appropriate and practical, make all efforts to contact the other Party's designated member of the Steering Committee. If the requesting Party is unable to contact either the other Party's Contract Executive or the other Party's designated Steering Committee member, the requesting Party may make temporary Changes to the Services without the prior consent of the other Party. The requesting Party shall notify the other Party as soon as practicable but no later than seventytwo (72) hours after the event of such Change and shall, as soon as practicable (but no later than seven (7) calendar days thereafter) document and report in writing on such Changes to the other Party. Any agreed Change as a result shall be agreed in accordance with Change Control.
Disputes regarding any extra Fees for Changes under this Section 6 are subject to Article 11 of the Agreement.
6.2 Notwithstanding the Change consideration and implementation process outlined in Sections 2 and 3 of this Schedule 14 but in all events subject to Section 5.1 above, if a Change is required to comply with applicable Law, Service Provider shall immediately begin implementing as appropriate the Change upon request by Customer. Service Provider shall also prepare and deliver to Customer a Change Proposal related to such Change on an expedited basis, where appropriate, and the Parties shall work together in good faith to determine the impact on the Agreement as a result of implementing such Change. If the Parties are unable to agree on the impact on the Agreement within thirty (30) days after Customer has received the Change Proposal from Service Provider, either Party may consider such failure to agree to be a Dispute, and may escalate such Dispute for resolution in accordance with Article 21 and Schedule 17 of the Agreement.
7. Change Request Log
7.1 Each entry made in the Change Request Log shall consist of the following fields:
Schedule 14- Change Control Procedures
(a) serial number of the Change Request;
(b) name of the originating party;
(c) a brief description of the Change;
(d) the current status of the Change; and
(e) the date of registration of the Change Request in Change Request Log.
7.2 The status of the Change Request at any stage in Change Control shall be one of the following:
(a) raised (i.e., that the Change Request has been entered in the Change Request Log, but no Change Proposal has been issued);
(b) pending (i.e., that the Change Request has been raised and the Change Proposal has been issued);
(c) approved (i.e., awaiting implementation);
(d) in process (i.e., being implemented);
(e) closed (i.e., all implementation tasks have been completed); or (f) rejected (i.e., closed and not implemented).
SCHEDULE 15
SERVICE LOCATIONS
TO
MASTER SERVICES AGREEMENT
BY AND BETWEEN
CITY OF SANTA CLARA
AND
SERVICE PROVIDER
Schedule 15 — Service Locations
Schedule 15
Service Locations
Schedule 15- Service Locations
Customer Service Location Address (ALL locations in Santa Clara, CA) City Hall Complex 1500 Warburton Avenue, Santa Clara, CA Communications/E0C 1990 Walsh Avenue, Santa Clara, CA
Fire Station 1/Fire HQ + Annex 777 Benton Street, Santa Clara, CA Fire Station 2 1900 Walsh Avenue, Santa Clara, CA
Fire Station 3 2821 Homestead Road, Santa Clara, CA
Fire Station 4 2323 Pruneridge Avenue, Santa Clara, CA
Fire Station 5 1912 Bowers Avenue, Santa Clara, CA
Fire Station 6 3575 De La Cruz Boulevard, Santa Clara CA Fire Station 7 3495 Benton Street, Santa Clara, CA
Fire Station 8 2400 Agnew Road, Santa Clara, CA
Fire Station 9 3011 Corm Drive, Santa Clara, CA
Fire Station 10 5111 Stars & Stripes Way, Santa Clara, CA Fire Training Center 1900 Walsh Avenue, Santa Clara, CA Police HQ 601 El Camino Real, Santa Clara, CA
Community Services 1500 Warburton Avenue, Santa Clara, CA Utility Corp Yard 1705 Martin Avenue, Santa Clara, CA
Street Corp Yard 1700 Walsh Avenue, Santa Clara, CA
Bldg Maintenance 2796 Lafayette Street, Santa Clara, CA Central Library 2635 Homestead Road, Santa Clara, CA
Mission Library 1098 Lexington Avenue, Santa Clara, CA
Parks Service Center 2600 Benton Street, Santa Clara, CA Mission City Memorial Park 420 N. Winchester Boulevard, Santa Clara CA Community Rec. Center 969 Kiely Boulevard, Santa Clara, CA International Swim Center 2625 Patricia Drive, Santa Clara, CA Senior Citizens Center 1303 Fremont Street, Santa Clara, CA Youth Activity Center 2450 Cabrillo Avenue, Santa Clara, CA Teen Center 2446 Cabrillo Avenue Santa Clara, CA
Henry Schmidt Park 555 Los Padres Boulevard, Santa Clara, CA ITD Main Office 1405 Civic Center Dr Santa Clara, CA
SVP 881 Martin Ave, Santa Clara, CA
Police Sub Station 3992 Rivermark Pkwy Santa Clara, CA
Northside Library 695 Moreland Way, Santa Clara, CA
Levi Stadium 4900 Marie P. DeBartolo Way Santa Clara, CA Tasman Parking Garage 2525 Tasman Dr., Santa Clara, CA
Santa Clara Youth Soccer
Park
5049 Centennial Blvd., Santa Clara, CA
Reed and Grant Sports Park
(Future)
Reed St. and Grant St., Santa Clara, CA
Silicon Valley Animal Control
Authority
3370 Thomas Road, Santa Clara, CA
Triton Museum of Art 1505 Warburton Dr. Santa Clara, CA San Tomas & Monroe
Community Garden Park
(Future)
Monroe St. and San Thomas Expressway, Santa
Clara, CA
PD Monitored Site 1700 Space Park Dr., Santa Clara, CA •
Schedule 15- Service Locations
City Parks listed below - Most
don't receive ITD services, but
some may have a VoiP phone and a
few possible will get a computer or
tablet in future. Details not known
at this time
Address (ALL locations in Santa Clara, CA)
Agnew - 2150 Agnew Rd.
Bowers - 2582 Cabrillo Ave
Bracher - 2560 Alhambra Dr.
Central - 909 Kiely Blvd.
City Plaza - Lexington St. & Main St. u
Civic Center - Lincoln St. & El Camino Real
Earl R. Carmichael - 3445 Benton St.
Everett Alvarez, Jr. - 2280 Rosita Dr.
Fairway Glen - 2051 Calle de Primavera
Fremont - 1303 Fremont St.
Fuller St. - 61 Fuller St.
Geof Goodfellow Sesquicentennial - 1590 El Camino Real
Henry Schmidt - 555 Los Padres Blvd.
Homeridge - 2985 Stevenson St.
Jenny Strand - 250 Howard Dr.
Larry J. Marsalli - 1425 Lafayette St.
Lick Mill - 4750 Lick Mill Blvd.
Live Oak - 641 Moreland Way
Machado - 3360 Cabrillo Ave.
Mary Gomez - 651 Bucher Ave.
Maywood - 3330 Pruneridge Ave.
Memorial Cross - Martin Ave. & De La Cruz Blvd.
Montague - 3595 MacGregor Lane u
Montague Swim Center - 3750 De La Cruz Blvd. u
Parkway - 3657 Forest Ave.
Raymond G. Gamma Dog Park - 888 Reed St.
Rotary - 1490 Don Ave.
Steve Carli - 1045 Los Padres Blvd.
Thamien - 4321 Lick Mill Blvd.
Ulistac Natural Area - 4901 Lick Mill Blvd. (walking trails) War Memorial Playground - 295 Monroe St.
Warburton - 2250 Royal Dr.
Westwood Oaks - 460 La Herran Dr.
Thomas Barrett Park 1885 Worthington Circle
Youth Soccer Park 5020 Starts and Stripes Drive
Central Park Annex (Future)
Reed & Grant Street Sports Park
(Future)
Reed St. and Grant St.
San Tomas & Monroe Community
Garden Park (Future)
Monroe St. and San Thomas Expressway
Schedule 15 - Service Locations
Service Provider Service Locations Address
Unisys Service Delivery Center - Salt Lake City 480 North 2200 West, Salt Lake City, Utah 84116
Unisys Service Delivery Center - Eagan 3199 Pilot Knob Rd Eagan, Minnesota 55121
SCHEDULE 16
TERMINATION ASSISTANCE
TO
MASTER SERVICES AGREEMENT
BY AND BETWEEN
CITY OF SANTA CLARA
AND
SERVICE PROVIDER
Schedule 16— Termination Assistance
Table of Contents
1.0 Termination Assistance Plan Overview 4
2.0 People Processes 4
2.1 Transfer of Service Provider staff to City or new City Service Provider 4
3.0 Management Processes 5
3.1 Project Management 5
3.2 Issue Management 5
3.3 Risk Management and Mitigation 5
3.4 Policy/Procedure Documentation Access and Transfer 6
3.5 Disentanglement Reporting (type and frequency) 6
4.0 Technology 6
4.1 Handover Procedures 6
4.2 Physical Hardware, Software, Networks and Data Transfer 7
5.0 Legal/Financial 7
5.1 License Transfer 7
5.2 Asset Transfer 7
6.0 Service Provider Termination Assistance Plan Roles and Responsibilities 7
7.0 Termination Assistance Plan 8
7.1 Tasks Required to Disentangle Services Back to City or Another Provider 8
7.2 Phases 9
List of Tables
Table 1. Service Provider Termination Assistance Responsibilities 7
Schedule 16 - Termination Assistance
This is Schedule 16 (Termination Assistance Plan) to the Agreement between the City of Santa Clara ("City") and Service Provider.
Service Provider shall develop a Detailed Termination Assistance Plan, which shall contain Service Provider's strategy and plan for disentanglement as set forth in this Schedule 16. The written Detailed Termination Assistance Plan, once reviewed and approved by the City, shall be incorporated into this Schedule 16 by reference.
Schedule 16 - Termination Assistance
1.0 Termination Assistance Plan Overview
The Termination Assistance Plan relies on the following elements:
• The Successor will require reasonable access to Service Provider and subcontractor(s) that are dedicated to the Services of the existing City contract. Service Provider anticipates that the access would be part of a structured interview and transfer of staff process subject to the agreements and obligations guiding Service Provider. • The termination assistance communication plan is a critical component of the risk management during termination assistance period. The communication plan contains information about regularly scheduled meetings that will regularly review plans for potential risks arid develop mitigation plans for them. • Service Provider and the Successor will need to establish a project plan which outlines expectations, roles, and responsibilities. It will also need to define conflict and resolution during knowledge transfer processes and service transition. • Service Provider and Successor termination assistance team will be the focal point of all termination assistance activity. They will bring status, plans, and issues to the City termination assistance management committee in a regularly scheduled meeting. • Service Provider will provide copies of any Service Provider Software then in use in accordance with the terms of the Agreement and provide reasonable assistance to City or the Successor in connection with the transfer to the Successor of Third Party Software then in use, or in securing rights to use such Software. • Service Provider will provide a detailed project plan for termination assistance with phases, tasks, timelines and major milestones identified for transitioning services back to City or over to another service provider upon termination of either the entire Agreement or termination of selected Services (e.g., Service Tower(s)). Service Provider will provide a plan for such termination events as applicable.
• Service Provider will provide access to the Successor to conduct the knowledge transfer activities; this includes the documentation, naming conventions, Third Party Software, and so on.
• Service Provider will coordinate with City to create very detailed, systematic plans with go/no-go decision points and appropriate fallback plans before the termination of Services.
• Service Provider will provide a wall-to-wall inventory to the Successor.
2.0 People Processes
2.1 Transfer of Service Provider staff to City or new City Service Provider
Service Provider will provide to the Successor reasonable access to Service Provider and subcontractor(s) that are dedicated to the Services of the existing City contract. The access would part of a structured interview and transfer of staff process subject to the agreements and obligations guiding Service Provider.
Schedule 16 - Termination Assistance
3.0 Management Processes
3.1 Project Management
The first level of the model hierarchy is a termination assistance management committee that will have the authority to resolve issues and make decisions as necessary during the termination assistance period. The second level will consist of the overall termination assistance management team composed of Service Provider and successor termination assistance managers. This team will be the focal point of all termination assistance activity and will bring status, plans, and issues to the termination assistance management committee in a regularly scheduled meeting. They will coordinate and control the activities across the Service Towers by working closely with the Service Tower leads and subproject managers who will be assigned specific termination assistance components. A group of subproject managers will report to and support the Service Tower leads—the third level of the hierarchy—and will be assigned to specific termination assistance components.
If necessary, the termination assistance management committee will develop a project schedule as a termination assistance planning foundation at the level of detail necessary to enable Service Provider to build the required Service Provider activities into a Detailed Termination Assistance Plan.
3.2 Issue Management
The termination assistance management committee will consist of Service Provider, Successor, and City leadership including a Service Provider and a City termination assistance manager.
The Service Provider and Successor termination assistance managers will bring issues and status information to the committee on a regular schedule to have decisions made and to inform key leadership about status. The termination assistance management committee will meet biweekly for a regularly scheduled session or more frequently if the situation dictates.
The Service Provider termination assistance manager is the owner and focal point of the termination assistance and is responsible for all termination assistance activity. The Service Provider termination assistance manager will manage a group of Service Tower leads who are responsible for termination assistance for their assigned Service Tower.
3.3 Risk Management and Mitigation
Service Provider's Risk Management and Mitigation methodology is an iterative process for identification, mitigation, and avoidance of risks. As a part of the early planning process, there will be reviews of the project plans to identify potential risks and develop mitigation plans. City will be a key participant in the risk identification and mitigation process during disentanglement start-up. The Service Tower leads will hold these meetings, document risk mitigation plans, and execute the mitigation as necessary throughout the framework disentanglement.
A key component of the risk management plan is the termination assistance communication plan. The communication plan contains information about regularly scheduled meetings that will regularly review plans for potential risks and develop mitigation plans for them.
Before Service Provider terminates any Services, City will be involved in reviews, go-no-go decisions, and completion approval sessions.
Service Provider will create very detailed systematic plans with go/no-go decision points and appropriate fallback plans before the disentanglement of services. Each of these decision points will involve testing and validation activities before a decision to perform the cut over. Before the
Schedule 16 - Termination Assistance
larger cutovers, Service Provider will work with the City to develop a set of acceptance criteria to demonstrate completeness of the activity and make the approval process flow smoothly.
3.4 Policy/Procedure Documentation Access and Transfer
The termination assistance team will use industry-standard management processes to ensure that Service Provider has completely planned, thoroughly documented, systematically implemented, and thoroughly tested the disentanglement before acceptance. These processes are a combination of project management, system engineering, and general management techniques used within the IT industry and across other business sectors as well. In addition, Service Provider will use specific processes and policies that are company or product unique to implement individual tasks to accomplish disentanglement.
This process will include Service Provider identifying, collecting and providing to the City all City technical, configuration, architectural and operational documentation including the City's Procedures Manual.
3.5 Disentanglement Reporting (type and frequency)
Service Provider will provide to City management a weekly written report covering the progress and status of the termination assistance. The weekly reports will continue until Service Provider has completed all of the termination assistance activities and City has accepted them. Service Provider will write reports and organize them by Service Tower and task; Service Provider's reports will contain the following information:
• Key responsible person
• Scheduled completion date
• Estimated actual completion date
• Completion status
• Percent complete
• Actual completion date
• Key issues and comments.
During the Termination Assistance period, the termination assistance team may discover information that may have a notable Services or financial change impact. Service Provider will identify and review such issues with the City.
4.0 Technology
4.1 Handover Procedures
The rules of cutover and handover will be agreed upon and signed off by the Successor, City, and Service Provider. Service Provider will follow mutually agreed upon and approved termination assistance handover procedures with appropriate acceptance criteria. Service Provider will assist the Successor to maintain effective communication during the handover process.
Schedule 16- Termination Assistance
4.2 Physical Hardware, Software, Networks and Data Transfer Service Provider and subcontractors will provide the transfer of physical hardware, Software, networks, and data transfer in the physical or electronic transfer methodology requested that are consistent with the service capabilities defined with in the Agreement.
5.0 Legal/Financial
5.1 License Transfer
Subject to the Parties' rights and obligations under the Agreement, and Service Provider's intellectual property rights with respect to Software, (i) Service Provider will provide copies of any Service Provider Software then in use in accordance with the terms of the Agreement and (ii) Service Provider will provide reasonable assistance to City and the Successor in connection with the transfer to the Successor of Third Party Software then in use, or in securing rights to use such Software.
Subject to the Parties' rights and obligations under the Agreement with respect to Software, Service Provider will generate and provide a current listing of (i) the City Software then in use and (ii) any Third Party Software then in use, both in a form reasonably requested by City.
Service Provider will provide source code, object code, and related documentation in Service Provider's possession for City Software.
Subject to the Parties' rights and obligations with respect to Third Party Software under the Agreement, Service Provider will provide any other Software and related documentation then in use that City is authorized to use.
5.2 Asset Transfer
Service Provider will provide a wall-to-wall inventory to the Successor. Service Provider Service Tower leads will investigate and resolve any discrepancies resulting from the comparison of the physical inventories. The Successor will manage and maintain the resulting final complete master inventory list for the duration of the Termination Assistance period.
Service Provider will provide asset transfer for all City-owned or leased equipment and other City assets used by Service Provider to perform the Services on the agreed cutover periods.
6.0 Service Provider Termination Assistance Plan Roles
and Responsibilities
Table 1. Service Provider Termination Assistance Responsibilities Service Provider Role Responsibilities Comments
Termination Assistance Manager Manage termination assistance of all Service Towers,
Build and manage Service Provider
project plan during the project.
Data Center Lead Detail and manage termination
assistance activities,
Coordinate the server data capture
and cut-over events.
Service Desk Lead Detail and manage termination
assistance activities,
Provide knowledge transfer staff and
historical data.
End-User Support Lead Detail and manage termination
assistance activities,
Provide knowledge transfer staff and
historical data.
Network Lead Detail and manage termination
assistance activities,
Provide knowledge transfer staff and
historical data.
Schedule 16 - Termination Assistance
Service Provider Role Responsibilities Comments
Applications Lead Detail and manage termination Provide knowledge transfer staff and assistance activities. historical data.
End of Table
7.0 Termination Assistance Plan
Service Provider will provide disentanglement to enable the Services to continue without interruption and facilitate an orderly transfer of Services.
7.1 Tasks Required to Disentangle Services Back to City or Another Provider
If Termination Assistance Services are requested by the City in accordance with the Agreement, Service Provider will provide the following:
(a) Service Provider will provide assistance to City and the Successor with the development of a plan for the disentanglement of equipment, Software, data, and documentation owned by or leased to City and used by Service Provider and all operations performed by Service Provider, each as part of the Services from Service Provider to the Successor (the "Detailed Termination Assistance Plan"). The Detailed Termination Assistance Plan may include, among other things, performance of (i) the Services described in this proposal, (ii) similar or related activities for which Service Provider is responsible, and (iii) a plan by Service Tower. (b) Service Provider will familiarize qualified personnel identified by the Successor with the equipment, Software, processes, procedures, and documentation used in performance of the Services that are to be transferred.
(c) Service Provider will provide the Successor with such information regarding the Services as is prudent or reasonably necessary to implement the Termination Assistance Plan and for the Successor to assume responsibility for, and continue the performance of, the Services in an orderly manner. Service Provider will make reasonable efforts to minimize disruption in the operations of City caused by its performance of disentanglement, including identifying key support contacts (names and telephone numbers) of Service Provider personnel during the disentanglement.
(d) Service Provider will provide the Successor with reasonable access to and use of City's equipment, data, documentation, and Software; Service Provider personnel; Third Parties; and other resources then being used by Service Provider to provide the Services (subject to Service Provider's reasonable security requirements, its contractual obligations to Third Parties, and its continuing obligation to perform Services for City). Service Provider's obligations are subject to any prohibitions or restrictions on the use or disclosure of Third Party Software contained in applicable license agreements. (e) Before providing the disentanglement, Service Provider will have the right to request and receive from the Successor (if the Successor is not City) written assurances that the Successor will maintain the confidentiality of Service Provider's Confidential Information disclosed or provided to the Successor during the termination assistance process.
Schedule 16 - Termination Assistance
(f) All Successor personnel are to be skilled in the performance of similar service.
7.2 Phases
If required, Service Provider will follow a three-phased approach to disentanglement. This approach will apply to all Service Towers. The three phases are the following:
• Phase 1 - Preparatory services
• Phase 2 - Disentanglement services
• Phase 3 - Post-Disentanglement services.
7.2.1 Phase 1 - Preparatory Services
(a) Prepare that portion of the Termination Assistance Plan detailing Service Provider's responsibilities, including as appropriate, schedules and resource commitments. (b) Provide to the Successor (subject to the Agreement's provisions concerning confidentiality and intellectual property) copies of all manuals and documentation relevant to, and used by Service Provider in, performing the Services including, without limitation, (i) relevant portions of any Disaster Recovery Plan that apply to City; (ii) access to City data, Software, and inventories; (iii) configuration information; (iv) all manuals and other relevant technical documentation (in a mutually agreed digital format) ordinarily used or necessary for the performance of Services, and (iv) 1 year of historical data information related to satisfying Service Levels.
(c) Provide to the Successor copies of other information regarding the Services that may be required to implement the Termination Assistance Plan, and, to the extent available, and in the form ordinarily maintained during the course of performance.
For example, Service Provider will provide then-current End-User profiles from the service desk, problem and change management records, and asset tracking records for the 12- month period before expiration or termination.
Any Third Party contracts related to the delivery of the Services are to be transferred to or administered by the Successor (e.g., copies of security tables, rules, and End-User lists used in the provision of the Services).
(d) Identify and provide the control release levels for systems Software in City environments. (e) Review and explain the documentation and manuals to the Successor's operations staff. (f) Provide assistance to the Successor in their notification to Third Party service providers of the procedures to be followed during the disentanglement. (g) Provide to the Successor information about naming conventions then in effect. (h) Subject to the Parties' rights and obligations under the Agreement and Service Provider's intellectual property rights with respect to Software, (i) provide copies of any Service Provider Software then in use in accordance with the terms of the Agreement and (ii) provide reasonable assistance to City and/or the Successor in connection with the transfer to Successor of Third Party Software then in use, or in securing rights to use such Software. (i) Subject to the Parties' rights and obligations under the Agreement with respect to Software, generate and provide a current listing of (i) the City Software then in use and (ii) any Third Party Software then in use, both in a form reasonably requested by City. (j) Provide to the Successor reasonable access to Service Provider personnel who were performing the Services to facilitate the orderly transfer of the Services to the Successor. (k) Provide any City data stored on Service Provider equipment to the Successor in a mutually agreed digital form, as reasonably requested.
Schedule 16- Termination Assistance
(I) Cooperate with the Successor and participate in the preparation and conducting of disentanglement testing to assist in the orderly transfer of Services insofar as within Service Provider's control.
(m) Provide to the Successor current and pending project plans authorized by City and status to assist the Successor to carry out such plans without unreasonable disruption of City's operations. Provide for the orderly handoff of ongoing projects or a reasonable bridge services agreement (as may be mutually agreed) to complete essential projects after the termination or expiration of the Agreement.
(n) Provide asset listings for all City-owned or -leased equipment and other City assets used by Service Provider to perform the Services, in a mutually agreed digital format. (o) Provide any additional incidental services not specified by this schedule as reasonably requested by City.
7.2.2 Phase 2 - Disentanglement Services
As part of disentanglement, Service Provider will perform its responsibilities under the Termination Assistance Plan for the following disentanglement services, and such others as may be mutually agreed:
(a) In conjunction with the Successor, conduct a rehearsal before cutover to the Successor at a time reasonably acceptable to the Parties.
(b) Remove City data and City Confidential Information from Service Provider's systems, and assist the Successor in loading same on its systems.
(c) Transfer responsibility to the Successor for off-site backup tape and document storage. (d) Make available requested City data and City Confidential Information (in mutually agreed digital form) stored on personal computers and servers for which Service Provider is responsible, including backup data.
(e) Provide assistance to the Successor with the transfer of operational responsibility, including providing assistance and cooperation in the execution of parallel operation and testing. (f) Provide source code, object code, and related documentation in Service Provider's possession for City Software.
(g) Subject to the Parties' rights and obligations with respect to Third Party Software under the Agreement, provide any other Software and related documentation then in use that City is authorized to use.
(h) Assist in the conduct of disentanglement testing.
7.2.3 Phase 3 - Post-Disentanglement Services
Service Provider will perform the following post-disentanglement services (and such others as may be mutually agreed, or required by the Agreement):
(a) Provide additional, incidental assistance at City's request to ensure continuity of operations, to the extent within Service Provider's control (bearing in mind that Service Provider's staff engaged in performance of Services for City may disperse after the Agreement expires or terminates).
(b) Return to City (or destroy, if so directed by City in writing, as provided below) without additional charge, any property of City in Service Provider's possession, including any remaining reports, documentation, data, and other Confidential Information, subject to applicable terms of the Agreement.
Schedule 16- Termination Assistance
(c) Certify to City in writing that all City data, files, and Confidential Information have been removed from Service Provider's systems provided, in accordance with the Agreement, however, that Service Provider may retain one copy of such materials only to the extent necessary for Service Provider to comply with its audit and record retention responsibilities under the Agreement
SCHEDULE 17
GOVERNANCE MODEL
TO
MASTER SERVICES AGREEMENT
BY AND BETWEEN
CITY OF SANTA CLARA
AND
SERVICE PROVIDER
Schedule 17- Governance Model
Table of Contents
1. Overview 3
2. Objectives and Scope 3
3. Expected Results 4
4. Balanced Scorecard 5
S. Governance Model Structure & Roles 5
6. Responsibility Matrix 8
Schedule 17 - Governance Model
Schedule 17
Governance Model
1. Overview
The governance processes set out in this Schedule are intended to provide for the Service Provider's alignment with Customer's business objectives and to facilitate the establishment and maintenance of the outsourcing relationship. It is the goal of the governance processes that the Services are delivered and managed in the most efficient and cost-effective way, while providing a framework for the resolution of any problems, introducing approaches for improving performance of the Services and introducing approaches for enhancing Customer use of information systems and tools to achieve business objectives.
This Schedule establishes the working structure of communication between Customer and Service Provider and provides the framework for the ongoing management and maintenance of the Services, introduction of strategic initiatives and operational improvement recommendations., along with both Customer and Service Provider responsibilities.
2. Objectives and Scope
The primary objective of this Governance Model is to enable effective direction of the Services for Customer and to establish communication between Service Provider and Customer. The sections described herein specify activities that lend themselves to effective communication between the two organizations.
Governance encompasses the performance of duties by each of the following: (a) the Executive Committee, (b) the Management Committee, (c) the Service Provider Contract Executive, (d) the Customer Contract Executive, and (e) the Parties' operational layer of management, including Service Provider Program Managers, Service Provider PMO Lead, project managers and Services Tower technical management and staff. The Service Provider Contract Executive and the Customer Contract Executives will act as the final escalation point for issues and problems that have been escalated from the Operations and Management Committee, Project Management Office and operational leads. The Service Provider Contract Executive will also meet with the Customer Contract Executive to review Service Provider's performance related to all Service Levels, status of any Service Level performance improvement initiatives, and the status of any other key operational improvement or strategic initiatives on a monthly basis.
Service Provider will recommend standards, processes and technology for Customer's approval, encompassing all Services provided under the Master Service Agreement and all related Service Descriptions. Service Provider will perform and manage all in-scope functions at the stated levels of service described in each Service Description, and all Service Levels therein, in a cost-effective and measurable manner in support of Customer's business objectives stated herein or in any other contract or operational documentation. Stipulations stated in this Schedule are:
a. Proactive solution development for Customer's business needs and requirements for Services; b. Architectural input and direction focused on industry best practices, standards and development and long-term strategy requirements;
c. Performance and status reporting/reviews;
Schedule 17 - Governance Model
d. Timely access to highly skilled and readily available Service Provider personnel with a deep knowledge of Customers environment;
e. Timely billing of Customer's account;
f. Management of Out-of-Scope function requests;
g. The capability to deliver initiatives on time and on budget with acceptance criteria and quality metrics agreed to by Customer; and
h. Ability to deliver and balance Customer's mix of IT operational, business focused improvement initiatives, and in scope project-based work within an annual budget while maintaining service levels including high customer satisfaction
i. Others as added by mutual agreement.
This Governance Model: (a) describes the operating relationship between Service Provider and Customer, and (b) serves as the guideline for Service Provider in performing the Service Descriptions agreed to by the Parties. Service Provider shall recommend standards, processes and technology for Customer's approval encompassing all Services provided as part of continuous process improvement over the Term of all the Service Descriptions under the Master Service Agreement.
Service Provider will create an environment that fosters the creation of recommendations that will have a positive and measurable impact on the Services and customer business operations. Service Provider will actively engage the Customer and its constituent departments to develop proposed service improvements for the Customer's consideration and to develop and implement Customer-approved projects and strategic initiatives, Service Provider will make recommendations to improve productivity and performance standards, achieve cost savings, and reduce complexities in processes. The Services are to focus on Customer's changing and evolving business needs and the technology and services needed to address business needs. Service Provider will provide Customer with access to subject matter experts to advise and consult with Customer to develop and recommend solutions for new and evolving services, technology and processes.
3. Expected Results
Listed below are the results that Customer expects from Service Provider's performance. These results shall be reflected in a number of Service Levels and will be directly measured through achievement of deliverables based Service Levels and Customer Satisfaction based Service Levels. a. Innovation and Thought Leadership: Customer expects Service Provider to spearhead innovation agenda related to technology and processes to add measurable business value to Customer.
Service Provider shall provide innovation recommendations to the Customer at the quarterly Management Committee meetings, in accordance with the service requirements and Service Levels. Service Provider is expected to introduce and deploy industry standard practices to Customer's environment and help Customer in strategic planning, improve the scope, quality and innovation in services it delivers to its end customers. b. Assessment and Planning:Customer expects Service Provider to proactively work with Customer and its departments to plan for new technology, projects and strategic initiatives, including the discussion of such projects and strategic initiatives with Customer departments at the quarterly Management Committee meetings. Customer also expects Service Provider to create and provide Customer with an annual account review, which shall contain an analysis of Service Provider's performance in relation to the Service Levels and other contract objectives, how specifically Service Provider shall correct any performance failures and an analysis of
Schedule 17 - Governance Model
Service Provider's performance in relation to Services that are not measured using formal Service Levels. Customer also expects Service Provider to create, maintain and provide Customer with an annual plan that will outline the major activities that it will perform in the coming year to improve its Service performance and increase the value that it provides to Customer. c. Continuous Improvement:Customer expects the Service Provider and its staff dedicated to providing Services to the Customer to institute processes that continuously seek opportunities to improve quality and value of services provided to Customer. Customer expects continuous improvement to be a key success criterion to measure success of the relationship d. Efficiency and Effectiveness: Customer expects that Service Provider will implement a highly efficient and effective delivery model to eliminate re-work, waste, unwarranted effort and avoidable costs. This governance model and associated governance processes is expected to provide measurement, visibility and direction to the both Parties about the efficiency and effectiveness initiatives underway.
e. Documentation, Reporting and Communication: Timely and accurate information regarding Service Provider's performance via status meetings, status reports and general performance reporting is a key expected result. Customer expects Service Provider to document procedures that will identify how Service Provider will deliver consistent and high-quality Services. In addition, this governance model is expected to create an effective and efficient way for Customer and Service Provider to communicate.
f. Compliance:Customer expects Service Provider to (a) perform contract change management, (b) provide Customer with accurate bills/invoices, (c) in accordance with the Master Service Agreement, comply with all legal requirements, (d) in accordance with the Master Service Agreement, follow Customer's policies, procedures and guidelines, such as those related to information security, physical security and privacy and (e) support Customer's audit requirements and provide auditing access and assistance to Customer and its authorized representatives in accordance with the Master Service Agreement.
4. Balanced Scorecard
A balanced scorecard will be developed by the parties prior to the first Service Commencement Date and will be used to gauge service performance, relationship quality and business alignment on an ongoing basis. In addition to the Service Levels, the scorecard will be balanced to reflect qualitative measures such as customer satisfaction (including results of the Customer Satisfaction Service Levels), compliance to roles and responsibilities, satisfaction with the working environment from both Customer and Service Provider perspectives, continuous improvement, and other items that would reflect the effectiveness and satisfaction with the Services.
The scorecard will serve as the primary vehicle for measuring the overall success of the relationship.
Accordingly, it will be used by operational teams and governance bodies as a key standing agenda item.
5. Governance Model Structure & Roles
The following governance committees define the framework of the participants, the responsibilities and activities for the administration of the governance processes.
The governance committees shall meet using face-to-face facilities, audio conferencing, or Web conferencing, as mutually agreed by both Parties.
Schedule 17- Governance Model
a. Contract Executives:Service Provider will assign to the Customer account an executive who will fulfill the role of Service Provider Contract Executive under the Master Services Agreement. This individual shall be suitably qualified and shall be subject to Customer's approval pursuant to the Master Service Agreement. Customer will appoint an executive who will fulfill the role of Customer Contract Executive under the Master Service Agreement. Customer Contract Executive shall meet with Customer's CIO or his designee on a weekly basis to discuss any aspects of the contract governance described in this schedule. b. Executive Committee:The Executive Committee will be comprised of senior executives from each party, including the Customer's CIO, Customer's Contract Executive and senior Service Provider executives (TBD - e.g., VP IT Outsourcing Services) who will meet to discuss high-level strategic and operational issues relating to the Agreement.
The Executive Committee will meet at least once semi-annually to:
• Address relevant high-level strategic and operational issues appropriate for a boardlevel discussion • Address major contract issues/changes
• Review the Service Provider Balanced Scorecard for business alignment with the City's goals and objectives
• Address areas of misalignment with the Balanced Scorecard and actions to achieve realignment
• Build an executive level relationship
• Discuss innovation, strategy and capability development at the enterprise level - business, IT, sourcing, optimization
• Discuss new business opportunities
• Review and approve the use of innovation processes to drive significant business change
• Address major relationship and alignment issues, disputes and Service and contract changes that have been escalated to this level.
c. Management Committee: The Management Committee will be comprised of the Customer Contract Executive, the Service Provider Contract Executive, Service Provider Program Managers, and other nominated Management Committee members.
The Management Committee shall meet at least once quarterly to:
• Review Service Provider performance over the previous three (3) months, such as Service Levels, costs, and process issues.
• Resolve any issues escalated to the Management Committee. • Review opportunities for technology improvement and increased process efficiency based on Service Provider research and experience in the market place. • Review and discuss Service Provider's semi-annual written report regarding innovative products and services that may be of benefit to Customer, as referenced in Schedule 3A.
• Review and discuss Service Provider's semi-annual written report regarding operational efficiencies improvements, as referenced in Schedule 3A,
Schedule 17 - Governance Model
• Review and discuss results of Customer-approved operation efficiencies improvement recommendations and innovative products and services recommendations • Review and discuss the results of annual end user and department personnel satisfactions surveys, as referenced in Schedule 3A.
• Review and discuss Service Provider's progress against the Annual Execution Plan, including any required corrections
d. Services Review Committee: The Services Review Committee will include Customer Contract Executive, Service Provider Contract Executive and Service Provider Service Delivery Managers.
The Services Review Committee shall meet at least once monthly to:
• Discuss any issues relating to Service Provider performance in the provision of Services such as service performance, costs, operational issues, user complaints, delivery failures, and ongoing email End-User satisfaction survey results from closed incident and Service Request tickets
• Conduct Service Level, Root Cause Analysis and improvement plan review • Conduct Service improvement status review
• Conduct operational improvements status review
• Conduct new operational improvements review
• Address security-related issues and proactive initiatives to prevent security breaches • Review monthly demand vs. capacity results, imbalances and resolution and rolling quarterly projections review
• Discuss any issues relating to Service Provider provision of Services that need immediate management attention
• Discuss the status of Projects in progress and conduct planning for any new Projects under Customer consideration that may impact Service Provider • Discuss any personnel-related issues affecting the relationship or provision of Service • Discuss solutions to address service deficiencies
e. Service Tower Review Meeting: The Service Tower Review Meeting will include the CIO, Customer Program Managers and Service Provider Program Managers as well as relevant project and Service Tower personnel, as required. Each week the Service Tower Review Meeting shall rotate its main focus on four areas: Infrastructure (Enterprise Compute, End User and Service Desk), Applications, Cybersecurity, and GIS.
The Service Tower Review Meeting shall meet weekly to:
• Conduct a high level review of outstanding operational issues • Review completed Incident Root Cause Analyses and approve remediation plans • Review project forecasts (function, timing)
• Address issues impacting project delivery
• Review and discuss technology roadmap
• Discuss Emerging Trends as relevant to the City and IT Services
Schedule 17- Governance Model
• Discuss potential changes to procedures in support of continuous improvement • Discuss and resolve issues relating to Customer department projects and initiatives f. Steady State and Project Stand-up Meeting: The joint Steady State and Project Stand-up Meeting will include Customer Program Managers and Service Provider Program Managers.
The Steady State and Project Stand-up Meeting shall occur every Monday, Wednesday arid Friday to:
• Discuss any production problems that occurred during the previous week/day. • Address outstanding or unresolved operational and project issues • Address security-related issues and proactive initiatives to prevent security breaches • Address any open items such as problem tickets or Project requests. • Review the status of all in progress changes
• Discuss major activities and initiatives for the week
6. Responsibility Matrix
The responsibility matrix set out below (the "Responsibility Matrix") lists the key processes, activities and tasks to be undertaken by Service Provider as part of the Services, as well as Customer responsibilities. It also indicates which of the Parties is ultimately responsible and accountable for the listed process, activity or task. It is not the intent of this or any Responsibility Matrix to absolutely define every process, activity, or task that must be performed in connection with the Services.
Governance Services Service
Provider Customer
I. Service Delivery Team
1. Designate a dedicated Service Provider Contract Executive. X
2. Approve the Service Provider Contract Executive. X
3. Identify Key Service Provider Personnel. X
4. Review and approve Key Service Provider Personnel. X
5. Assign account team. X
6 . Provide adequate training of account team and review team performance. X
7. Implement corrective actions relating to team performance, as necessary.
X
II. Project Management Office
8. Establish a Project Management Office. X
9. Develop, manage and maintain a current organizational chart with contact names, functional titles, and phone numbers for all key staff, as well as escalation hierarchy aligning the Service Provider PM0 functionally to Customer's management team.
X
10. Provide updated current organization chart to Customer on single web portal. X
11. Communicate to Customer in a timely manner and in writing, any restructuring or reorganizations in the Service Provider service delivery structure.
X
Schedule 17— Governance Model
Governance Services
Service
Provider Customer
12. Coordinate and manage all implementation activities and act as the single point of accountability for all service delivery issues at Customer locations.
X
13. Assign an owner, a priority, a description, a resolution plan, and an estimated time to resolve for all governance-related issues. X
14. Review issues log with Customer during operational, monthly, and annual reviews.
X
15. On a monthly basis, the Service Provider Program Management Office will provide services reports as speci fied in Schedule 7. X
16. Establish a process for the escalation of issues by Customer. X
17. Approve the escalation process. X
18. Capture all change requests from Customer and work with Customer to prioritize change requests received. X
III. Communication Strategy — Changes
19. Develop a communications strategy for all Changes that affect Customer's technology environment. X
20. Approve communications strategy. X
21. Execute communications strategy. X
22. Assist in executing communications strategy, as relevant. X
23. Communicate all Changes and updates to stakeholders and support personnel with sufficient lead-time to allow planning, testing, and training development.
X
24. Assist in communicating all Changes and updates to
stakeholders and support personnel.
X
IV. Committee Meetings and Reporting
25. Propose committee meeting schedules. X
26. Approve committee meeting schedules. X
27. Schedule and conduct committee meetings with Customer X
28. Participate in committee meetings. X
29. Prepare and distribute Project status and Service performance reports for required committee meetings. X
30. Review and provide analysis of the status and Service performance reports with Customer.
X
31. Identify areas for performance improvement and propose appropriate changes. X
32. Approve or reject proposed Changes or suggest alternatives. X
33. Prepare and distribute minutes from committee meetings. X
34. Provide a plan to implement action items resulting from, and agreed to during, committee meetings. X
35. Approve plan to implement action items resulting from, and agreed to during, committee meetings.
X
36. Provide follow up reporting on results of implemented action items and actions taken to achieve identified objectives, and integrate such reporting and discussion with Customer into governance bodies' committee meetings.
X
37. Approve follow up reporting. X
Schedule 17- Governance Model
Governance Services Service
Provider Customer
38. Provide Service Level, resource utilization, project pool analysis and activity reports for required committee meetings. X
39. Audit Service Level, resource utilization, project pool analysis and activity reports for required committee meetings X
40. Prepare quarterly management briefing for current and proposed projects and strategic initiatives, technology improvement and efficiency gain opportunities, and innovation recommendations.
X
41. Schedule and attend quarterly Management Committee meeting. X
42. Attend quarterly Management Committee meeting. X
43. Implement action items resulting from, and agreed to, during Management Committee meeting. X
44. Assist in implementing action items resulting from, and agreed to, during Management Committee meeting, as relevant.
45. Manage consequences resulting from Management Committee meeting. X
46. Prepare and distribute an overview of activity plans as a result of Management Committee meetings. X
47. Prepare an Annual Execution Plan. Such plan will outline the major activities, projects and associated schedules that the Service Provider will perform in the coming year to deliver the Services meeting existing Service Levels and improving Service.
X
48. Provide input into Annual Execution Plan. X
49. Modify Annual Execution Plan as necessary. X
50. Finalize Annual Execution Plan. X
51. Execute Annual Execution Plan. X
52. Review progress against Annual Execution Plan during quarterly Management Review Committee meeting. X
V. Contract Change Management
53. Review contract for continuous improvements and propose contract Changes (such as additions or Changes to Service Levels). X
54. Review contract for continuous improvements and propose contract Changes (such as additions or Changes to Service Levels). X 55, Approve or reject contract Changes. X
56. Submit contract Change Orders to the Customer Contract Executive for review and approval. X
57. Escalate contract Change disputes to the Management Committee. X VI. Report Management
58. Identify reporting requirements. X
59. Assist in identifying reporting requirements X
60. Review existing reports and propose new reports. X
61. Develop sample reports. X
62. Approve sample reports. X
63. Develop a report schedule with the frequency of report production, the number of copies of each report to be produced, the report distribution list, and the report format (e.g. hard copy, email, Web portal).
X
Schedule 17- Governance Model
Governance Services Service
Provider Customer
64. Approve report schedule. X
65. Produce and deliver reports in accordance with the Schedule 7. X
66. Provide reporting via a Web portal. X
67. Review reports and follow-up with the Service Provider, if necessary.
X
68. Correct erroneous reports. X
69. Re-produce reports, if necessary. X
70. Approve reports. X
VII. Billing/Invoicing
71. Provide an invoice that meets Customer's accounting and financial requirements.
X
72. Approve the invoice format. X
73. Request clarification for charges in dispute. X
74. Investigate and respond to requests for clarification, as required. X
75. Escalate billing disputes to Management Committee, as relevant. X
76. Escalate billing disputes to Management Committee, as relevant. X
77. Pay correct invoices per payment terms. X
VIII. Service Provider Third-Party Contract Management
78. Provide Customer with notification of the desire to enter into a third-party contract in order to provide Services, if any. X
79. Approve use of third-party contractors by Service Provider. X
80. Negotiate or renegotiate Service Provider third-party contracts, as necessary.
X
81. Manage third-party contract terms and conditions (e.g. contract expiration). X
82. Manage Subcontractors' compliance with the Master Service Agreement. X
IX. Compliance Management
83. Report to Customer any activity within the environments under control of the Service Provider which do not comply with legal and regulatory requirements affecting Service Provider's business and Customer specified standards.
X
84. Provide Customer specific standards. X
85. Conduct periodic audits of the Procedures Manual to verify accuracy and compliance. X
86. Ensure that the Service Provider's systems and procedures comply with legal and regulatory requirements related to the provision of the Services.
X'
87. Review and certify that proposed Changes are compliant with existing quality standards prior to implementation of the Change. X
88. Conduct regular reviews, not less frequently than annually, of regulatory requirements, quality standards and processes. X
89. Participate in regular reviews, not less frequently than annually, of regulatory requirements, quality standards and processes. X
90. Make recommendations on implementation activities and X
Schedule 17- Governance Model
Governance Services
Service
Provider Customer
improvements to meet regulatory requirements, quality standards and processes.
91. Implement disciplinary process for Service Provider personnel, in accordance with Service Provider's policies. X
X. Satisfaction Surveys
92. Conduct End-User, management and Service Desk satisfaction surveys in accordance with Schedule 3A and 3B. X
93•
Report survey results and Service Provider's survey method, and meet with Customer to present survey results and recommend approaches to address Customer dissatisfaction.
X
94. Define the survey(s) including, but not limited to format and content.
95. Provide input into defining the survey(s) including, but not limited to format and content. X
96. Approve the surveys. X
97. Conduct the surveys. X
98. Audit the survey results. X
99. Suggest changes to processes or deliverables in response to satisfaction survey results to drive continuous improvement. X 10 0.
Approve proposed process or deliverable changes or suggest alternatives.
X
101. Implement Customer-approved process or deliverable changes. X XL Auditing Support
102. Develop and maintain auditing support procedures. X 103. Approve auditing support procedures. X
104. Notify Service Provider of intent to perform an audit. X 105. Perform audits. X
106. Provide audit support for internal and external audits. X 107. Provide audit responses and remediation, as applicable. X 108. Provide audit responses and remediation, as applicable. 109'
Implement recommendations from audit findings within
agreed upon timeframe, as applicable. X
110
.
Implement recommendations from audit findings within
agreed upon timeframe, as applicable. X
SCHEDULE 18
APPROVED SUBCONTRACTORS
TO
MASTER SERVICES AGREEMENT
BY AND BETWEEN
CITY OF SANTA CLARA
AND
UNISYS CORPORATION
Schedule 18- Approved Subcontractors
Schedule 18
Approved Subcontractors
1. Pinnacle Technical Resources dba Pinnacle Group.
SCHEDULE 19
CUSTOMER SOFTWARE
TO
MASTER SERVICES AGREEMENT
BY AND BETWEEN
CITY OF SANTA CLARA
AND
UNISYS CORPORATION
Schedule 19 - Customer Software
Schedule 19
Customer Software
As of the Effective Date, Customer Software includes the following:
Tools & Knowledgebase
1. End user information intranet site (CSI, Sharepoint, TLC)
2. Software and patch distribution toolset and infrastructure (e.g. SCCM)
3. Security assessment software (e.g. Critical Watch or similar)
4. AirWatch
5. End user security software (e.g. McAfee ePO)
6. Cisco Prime Infrastructure
7. Solar Winds IPAM
8. Solar Winds Bandwidth Monitor
9. Solar Winds Virtualization Manager
10. Symantec NetBackup
11. VMWare Vcenter
12. Zscaler
13. DuoSecurity
14. ShoreTel's ShoreDirector
15. Nimble's Cloud Monitoring, Management and InfoSight
16. Dell OpenManage
Applications
The list of Customer applications as of the Effective Date is attached as Exhibit 1 hereto. This list will be updated during the term of the Agreement to reflect changes in the City's application environment.
Schedule 19, Exhibit 1
'City Applications
City of Santa Clara
CONFIDENTIAL
SCHEDULE 22
SERVICE PROVIDER SOFTWARE and SERVICE PROVIDER MATERIALS TO
MASTER SERVICES AGREEMENT
BY AND BETWEEN
CITY OF SANTA CLARA
AND
UNISYS CORPORATION
Schedule 22 - Service Provider Software and Service Provider Materials Schedule 22
Service Provider Software and Service Provider Materials As of the Effective Date, Service Provider will provide an enterprise service management toolset that includes software tools for:
1. ServiceNow ITSM applications (see Schedule 3A Exhibit 3)
2. Event detection and correlation
3. Capacity management
4. Availability management
SCHEDULE 23
DISASTER RECOVERY PLAN
TO
MASTER SERVICES AGREEMENT
BY AND BETWEEN
CITY OF SANTA CLARA
AND
UNISYS CORPORATION
Schedule 23- Disaster Recovery Plan
Schedule 23
Disaster Recovery Plan
As of the Effective Date of this Agreement, the Disaster Recovery Plan is not available. Service Provider will develop a Customer approved Disaster Recovery Plan as identified in Schedule2.
Background
The Disaster Recovery Plan is a companion document to the Business Continuity Plan that includes all mission critical business applications, consisting of the following documents:
• Business Continuity Program: Information Technology Strategy • Business Impact Analysis
• IT Incident and Communications Management Plan
• Disaster Recovery and Scheduled System Testing
• Data Center Restore Plan
• CSC Information Technology Operations Recovery Plan
• IT Operations Metro Failover Guide
• ITSM Offline Workaround
• CSC - Business Continuity Program Tabletop Test Plan
• CSC - BCDR Risk Assessment Table
• Business Continuity and Information Security Executive Steering Committee Charter.
The Disaster Recovery Plan will validate the majority of dependencies, recovery metrics such as the City's Recovery Time Objective (RTO) and Recovery Point Objective (RPO) requirements as developed within the delivered Business Continuity Plan documents outlined above.
This Schedule will be updated via Change Control upon successful completion of the Disaster Recovery Plan by the Service Provider and will collaborate with the City to review and update the Business Continuity and Disaster Recovery Plans on an annual basis or as otherwise required.
Schedule 23 - Disaster Recovery Plan
Information Technology Disaster Recovery (DR) Plan
Business Purpose
The ability to continue government operations, mission critical business services need the ability to recover specific IT assets upon which they are dependent and which have been defined within the Business Continuity Plan.
Project Scope
This project will consist of two phases:
Phase 1: Design and implement a High Availability (HA) capability.
Develop the detail requirements, design and implement solutions within the current High-Availability (HA) environment in place at the city for the recovery of those City Applications and the required supporting IT assets considered business critical in the event of a major disaster or service disruption.
Phase 2: Design and implement a Disaster Recovery capability.
Develop the detail requirements and design including rough order of costs and timeline to implement a DR solution for the mission critical applications and related IT assets at an off-site, remote facility in the event of a disaster, which precludes HA failover to the on premises datacenter.
General Overview of Approach
A Metro Stretch Cluster has been deployed at the City to provide High Availability between sites using technology from VMware that allows for the ability to transfer both compute workloads and storage between sites with little or no interruption of service in a both a planned and an unplanned outage situation. While the infrastructure is in place, the supporting processes and procedures around an outage, and in particular an unplanned one, are lacking.
An external Unisys BC/DR/HA SME will lead the project to provide HA (Phase 1 and off-site DR (phase 2) for all of the City's mission critical business applications and IT assets to be recovered in an outage situation.
A Disaster Recovery Plan for the HA environment and the off-site DR capability will be developed. It will include the following as some of the focus points:
• Validating the assumptions and architecture of the current HA environment, • Identify impacts of hybrid cloud environment including cloud backup and end user devices for accessing,
• Validating all mission critical business applications requirements in the BC plan. Select 5 onsite applications from that list to test the HA plan,
• Development and implementation of HA failover plan,
• Development of an off-site DR plan. Implementation of such off-site DR plan will be subject to and in accordance with the Change Control Procedure. Additionally, such off-site DR plan may be dependent on procurement by the City of additional third party services, and software and/or hardware outside the scope of this Agreement.
• Development of a restore to normal IT operations plan, • Developing of end user messaging and communications plans, • Definition and circumstances for which an outage will be declared • Develop test plan for both HA and DR and perform a table top exercise of the HA plan
Schedule 23 - Disaster Recovery Plan
• Apply lessons learned, and
• Perform an actual HA failover under controlled conditions and apply any further lessons learned to the HA plan.
Delivery of these services will require collaboration with the onsite architect, tower leads, and to a lesser degree, stakeholders within the IT department as well as in other City departments. The stakeholders will be the same group as used for the original Business Continuity Plan.
Schedule 23 - Disaster Recovery Plan
Summary of Project Deliverables
Validation and stakeholder review of the prioritization scheme for the IT Assets in scope:
• Review, validation and approval of the list of business applications and IT assets to be recovered, the RTO/RPO objectives and inter-dependencies (developed in the BCP project). • Identify the impacts of the hybrid cloud environment now in place and of the proposed cloud backup solution.
Consolidated list of IT assets to be recovered:
• In the event of a disaster the list of IT assets that need to be recovered in order of priority. • Identify and agree upon the Business Critical applications as the subject of the HA (5 applications) and DR Plans.
Technical specifications for the HA and the DR recovery solution:
• These are high level technical specifications for the HA and the off-site DR solution. • Scalable, re-usable technical solution for HA and DR Failover.
Incident response and communication plan:
• Define who is going to declare a disaster and under what circumstances, • Who is going to communicate,
• Who is going to manage the incident.
Develop and validate test plan:
• Develop Test Plan,
• Perform Table Top HA Test,
• Apply Lessons Learned
Perform an actual failover under controlled conditions and apply any further lessons learned to the HA plan.
Perform restore to normal operations
Review findings and recommendations with appropriate IT and stakeholders and incorporate input.
Schedule 23 - Disaster Recovery Plan
Project Schedule
Subject to confirmation and revision at actual start of project:
Task Name Duration
Validate and Update Existing BC Plan 14 days
Validate current assumptions and HA environment 5 days
IdentifyHybrid Cloud & Backup impacts 5 days
Validate all Business Critical Applications 5 days
Review and Obtain city sign-off on BCP Updates 1 day
HA DR Information Plan 75 days
Disaster RecoveryProgram: InformationTechnology Strategy:
Enterprise & Cloud Architecture
Identify and research Cloud/Hosted DR solutions
Define conceptual architecture aspects of a Disaster Recovery solution, including Cloud-based options
Describe Replication of Server & Data Images to DR Site Describe Deployment of Servers & Infrastructure at DR Site Investigate the number/feasibility of providing web-based access to all thick-client applications through a virtual pc or similar interface technology Investigate the feasibility of designating a work area for deployment as a Business Resumption Center
DR Analysis:
Identify vendors which enable the proposed solution
Describe recommendations to current Technology Infrastructure in support of Proposed I.T. Operations Resilience & Recovery Plans
Write up technical requirements for DR Solution
DR SolutionMigration Cost Estimate
33 days
12 days
IT Failover procedures and Guide critical level 1 and level 2 systems/applications Return to normal operations procedures
IT Incidentand Communication Management Plan
Activation and Notification Criteria and Process
Datacenter Restore Plan
Perform BC/DR Tabletop Test
Preparation for the HA Tabletop test
Perform Actual HATabletop Test
Lessons learned
10 days
10 days
5 days
5 days
5 days
2 days
2 days
1 day
Schedule 23 - Disaster Recovery Plan
Update DR Plan
IT Operations Recovery Plan
IT Incident and Communication Management Plan
DR and Regular CSC System Testing (MASTER) Plan
Datacenter Restore Plan
Diagrams, architecture and related documentation
BC and DR plan updates complete
Perform Actual HA Failover and Restore (return to normal operations) Preparation for the test
Perform Actual Test ofthe selected5 applications
Lessons learned — Final Document Release
City Sign Off on HA and DR Plans
10 days
2 days
2 days
2 days
2 days
2 days
0 days
5 days
2 days
2 days
1 day
1 day
Provisional Disaster Recovery Plan Document
The Disaster Recovery Planning document proposed high level layout and table of contents will be as follows, subject to change during the development process.
1. Introduction
1.1 Purpose
1.2 Objective
1.3 Scope
1,4 Assumptions
1.5 Applicable Standards and Guidance
Concept of Operations
2.1 Four Phases
2,2 Data Backup Readiness Information
2.3 Site Readiness Information
2.4 Hybrid Cloud Readiness Information
2.5 Roles and Responsibilities
Activation and Notification
3.1 Activation Criteria and Procedure
3.2 Notification Instructions
3.3 Outage Assessment
3.4 Incident Team(s)
3.5 End User Messaging/Communications
Schedule 23 - Disaster Recovery Plan
4. Plan Activation Procedures
4.1 Media Retrieval and Delivery
4.2 Cloud Backup Data Recovery
4.3 Disaster Recovery Overview
4.2.1 General Application Description
4.2.2 Recovery Contacts
4.2.3 Data Center Overview
4.3 Infrastructure Recovery Procedures
4.4 Critical Business Application Recovery Procedures
4.5 Website Recovery Procedures
4.6 DNS Changes
4.7 Network Recovery Procedures
5. Reconstitution
5.1 Data Validation Testing
5.2 Functional Validation Testing
5.3 Recovery Declaration
5.4 User Notification
5.5 Cleanup
5.6 Returning Backup Media
5.7 Backing up Restored Systems
5.8 Event Documentation
6. Recovery Plan Testing
Appendices:
Key Personnel and Team Member Contact List
Vendor Contact List
Alternate Telecommunications Provisions
Diagrams
Network Configurations
Hardware Inventory
Recovery Plan Test Report
Related Documents
SCHEDULE 24
CONSENTS
TO
MASTER SERVICES AGREEMENT
BY AND BETWEEN
CITY OF SANTA CLARA
AND
UNISYS CORPORATION
Schedule 24 - Consents
Schedule 24
Consents
As of the Effective Date of this Agreement, there are no tools owned or provisioned by Service Provider that Customer requires Consents.
As of the Effective Date of this Agreement, there are no tools owned or provisioned by Customer that Service Provider requires Consents.
In the event any Consent is required by either Party during the Term, the provisions in Section 4.4 . apply and this Schedule 24 will be updated through the Change Control Procedures.
SCHEDULE 26
INVOICE FORMAT
TO
MASTER SERVICES AGREEMENT
BY AND BETWEEN
CITY OF SANTA CLARA
AND
UNISYS CORPORATION
Schedule 26 - Invoice Format
Schedule 26
Invoice Format
Monthly invoice format will be finalized during Transition Services and will include the following either on the invoice or the invoice backup supplied to the City of Santa Clara. (i) Main Invoice - Monthly
a. Fees by Service Tower
i. Fees for Service Tower A
ii. Fees for Service Tower B
iii. Fees for Service Tower C
iv. Fees for Service Tower D
b. Customer Project pool (excluding SVP Project Pool)
i. Total project pool
ii. Project pool utilized in the month
iii. Available project pool
d. Pass-Through Costs
i. Name of contract/agreement
ii. Costs
e. Adjustments
i, Service Credits
Earn back
iii. Any other adjustments
f. Levi Stadium Operations
(ii) Service Tower invoice - Monthly
a. Base Service Fees
i. Resource Baseline
Amount
iii. Variable Fees
1. ARC/RRC units beyond dead-band
2. ARC/RRC monthly rate
3. Total variable charges
b. FTE Charges
i. Roles
ii. Title of resources
iii. Fees
c. Projects
i. Project Name
Schedule 26- Invoice Format
1. Resource Title
2. Project hours - Total and Billable (Beyond Project Pool) Hours
3. Rate
d. Adjustments
i. Adjustments based on vacancies, absence of FTEs
ii. Service Credits, Earnback
iii. Any other adjustments
SCHEDULE 27
INTERNAL CONTROLS AND PROCEDURES
TO
MASTER SERVICES AGREEMENT
BY AND BETWEEN
CITY OF SANTA CLARA
AND
UNISYS CORPORATION
Schedule 27 — Internal Controls and Procedures
Schedule 27
Internal Controls and Procedures
Unisys has implemented certain controls with regard to vetting potential employees, granting of system privileges and auditing access, as follows:
• Unisys hiring process includes interviews and background checks. • Background checks are completed on all prospective employees prior to hire as permitted by law.
For any new hires, these checks assess work history, education, and criminal record. Drug screenings are also conducted.
• For specified Unisys employees, Unisys will comply with additional, defined background check requirements as reasonably required based on the employee's role, e.g., with respect to Unisys employees supporting the City's Public Safety.
• Unisys employees have a continuous performance appraisal process, including management review, input from peers, professional and personal development goals, and evaluation of technical and security proficiency.
• Annual security awareness training is required to be completed by all Unisys employees. Unisys employees are encouraged to pursue continuous education on technical and security topics. • Annual training is required of every Unisys employee with regard to Unisys Code of Ethics and Business Conduct and the Anti-Bribery policy. Every Unisys employee must certify their compliance with these policies. Targeted training with business teams on compliance policies is conducted as required.
• Separation of duties is implemented so that no single Unisys employee has universal access. All actions by highly privileged employees are audited and the audit logs are stored in a data repository that the employee does not have access to.
• Principles of least privilege are implemented to limit an employee's scope of access to that which is required to perform his or her job duties.
• Logical connectivity is controlled via a sequence of jump boxes, one on the Unisys network and the other on the City's network. In order for Unisys staff to access the City's systems, the employee must request access to each system separately and then pass the review process for each system via two distinct and separate approval processes. Once approved and granted access, the Unisys employee must authenticate through both systems each with conditional multifactor authentication.
• Accounts are promptly disabled upon termination of a Unisys employee's employment or upon the Unisys employee leaving the City's account.
• A third-party auditing firm performs an annual SSAE-16 audit of the internal Unisys processes.
Schedule 28 — Financial Responsibility Matrix
SCHEDULE 28
FINANCIAL RESPONSIBILITY MATRIX
TO MASTER SERVICE AGREEMENT
BY AND BETWEEN
CITY OF SANTA CLARA
AND
UNISYS CORPORATION
Schedule 28 - Financial Responsibility Matrix
Schedule 28
Financial Responsibility Matrix
Financial Responsibility Matrix — Hardware
Own Refresh
Upgrade /
Enhance -
Capital
Improvem
ents
Install,
Move,
Add,
Change
(IMAC)
3rd Party
Maintenan
ce
Contracts
Services Cost of Spares Cost for Disposal
Hardware at Customer Locations Infrastructure Servers Customer Customer Customer Service Provider Customer Service Provider Customer Customer Storage media/devices Customer Customer Customer Service Provider Customer Service Provider Customer Customer Data center Facilities HW (UPS,
Generator, Physical Security
Devices)
Customer Customer Customer 3rd Party Customer Service Provider Customer Customer Network Devices (Such as ports,
moderns, interface equipment and
terminals)
Customer Customer Customer Service Provider Customer Service Provider Customer Customer Desktops/Laptops - Used by
Customer Customer Customer Customer Service Provider Customer Service Provider Customer Customer Customer provided sample units (e.g. desktop, laptop, cellular devices) - Used by Service
Provider
Customer Customer Customer Service Provider Customer Service Provider Customer Customer Desktops/Laptops - Service Provider provided - Used by
Service Provider staff
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Printers, plotters, multi-function
devices, copiers, scanners Customer Customer Customer 3rd Party Customer Service Provider Customer Customer Mobile Data Terminal (MDT) / Mobile Data Computer (MDC) Customer Customer Customer Service Provider Customer Service Provider Customer Customer Cellular devices - Used by
Customer Customer Customer Customer 3rd Party Customer Service Provider Customer Customer Cellular devices - Used by Service Service Service Service Service Service Service Service Service
Schedule 28 - Financial Responsibility Matrix
Own Refresh
Upgrade!
Enhance -
Capital
Improvem
ents
Install,
Move,
Add,
Change
(IMAC)
3rd Party
Maintenan
ce
Contracts
Services Cost of Spares Cost for Disposal
Provider Provider Provider Provider Provider Provider Provider Provider Provider Smart phone's / PDAs - Used by
Customer Customer Customer Customer 3rd Party Customer Service Provider Customer Customer Smart phone's / PDAs - Used by
Service Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service •
Provider
All Hardware at Service Provider
Locations other than Customer provided sample units
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
2. Financial Responsibility Matrix — Facilities
Financial Responsibility
Customer facilities Customer Service Provider staff at Customer facilities Long distance telephone calls
responsible for direct cost
Customer financially
related to providing
Local telephone calls Use of office space
Consumables Services to Customer Use of other office equipment
3. Financial Responsibility Matrix — Personnel
Personnel Type*
Salary, Benefits,
Other
Compensation,
adjustments and
related Taxes.
Travel
Training
(Job
specific)
Training
(New skills
required for
Customer
requested
projects)
Severance
Post Service Commencement -
On-boarding of new employees
(e.g. hiring, Service Provider
internal process training,
knowledge transfer (if done in
parallel with existing staff))
Contract Staff - Type 1 Service Provider Customer Service Provider Customer Service Provider Service Provider Contract Staff - Type 2 Service Provider Customer Service Provider Customer Service Provider Service Provider
Schedule 28-Financial Responsibility Matrix
Personnel Type*
Salary, Benefits,
Other
Compensation,
adjustments and
related Taxes.
Travel
Training
(Job
specific)
Training
(New skills
required for
Customer
requested
projects)
Severance
Post Service Commencement -
On-boarding of new employees
(e.g. hiring, Service Provider
internal process training,
knowledge transfer (if done in
parallel with existing staff))
Contract Staff - Type 3 Service Provider Service Provider Service Provider Customer Service Provider Service Provider Contract Staff - Type 4 Service Provider Service Provider Service Provider Customer Service Provider Service Provider Contract Staff - Type 5 Service Provider Service Provider Service Provider Customer Service Provider Service Provider Contract Staff - Type 6 Service Provider Service Provider Service Provider Customer Service Provider Service Provider *- Classification of Personnel Type
• Contract Staff - Type 1 - Service Provider • Contract Staff - Type 2 - Service Provider • Contract Staff - Type 3 - Service Provider Locations
• Contract Staff - Type 4 - Service Provider
Locations
• Contract Staff - Type 5 - Service Provider
FTE from Customer Locations
Contract Staff - Type 6 - Service Provider
FTE from Service Provider Location
personnel providing Services and deployed for more than 3 months from Customer Locations personnel providing Services and deployed for less than 3 months from Customer Locations personnel providing Services and deployed for more than 3 months from Service Provider personnel providing Services and deployed for less than 3 months from Service Provider personnel providing Services and deployed on Long Term Commitment (> 1 Year) or dedicated personnel providing Services and deployed on Long Term Commitment (> 1 Year) or dedicated
4. Financial Responsibility Matrix — Software
License Refresh
Upgrade!
Enhance -
Capital
Improvements
Install, Move, Add, Change
(lMAC)
Services
3rd Party
Maintenance
Contracts
Customer Desktop OS Customer Customer Customer Service Provider Service Provider Customer Customer Desktop
Applications Customer Customer Customer Service Provider Service Provider Customer Service Provider internal
employee Desktop OS
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Schedule 28 — Financial Responsibility Matrix
License Refresh
Upgrade /
Enhance -
Capital
Improvements
Install, Move,
Add, Change
(IMAC)
Services
3rd Party
Maintenance
Contracts
Service Provider internal
employee Desktop
Applications
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Server OS Customer Customer Customer Service Provider Service Provider Customer Server based Applications and
applications provided as a
service
Customer Customer Customer Service Provider Service Provider Customer Service Provider provides tools
identified in Schedule 22,
Service Provider Software
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Service
Provider
Customer provided tools
identified in Schedule 19,
Customer Software
Customer Customer Customer Service Provider Service Provider Customer
SCHEDULE 29
CUSTOMER INSURANCE REQUIREMENTS
TO
MASTER SERVICES AGREEMENT
BY AND BETWEEN
CITY OF SANTA CLARA
AND
SERVICE PROVIDER
Schedule 29 - Customer Insurance Requirements
Schedule 29
Customer Insurance Requirements
INSURANCE COVERAGE REQUIREMENTS
FOR PROFESSIONAL SERVICES
Without limiting the Service Provider's indemnification of the City, and prior to commencing any of the Services required under this Agreement, the Service Provider shall purchase and maintain in full force and effect during the period of performance of the Agreement and for thirty-six (36) months following acceptance by the City, at its sole cost and expense, the following insurance policies from insurance companies authorized to do business in the State of California. These policies shall be primary insurance but only to the extent of the liabilities assumed by Service Provider as set forth in the Indemnification Article of this Agreement as to the City of Santa Clara so that any other coverage held by the City shall not contribute to any loss under Service Provider's insurance. The minimum coverage, provisions and endorsements are as follows:
A. COMMERCIAL GENERAL LIABILITY INSURANCE
1. Commercial General Liability Insurance policy which provides coverage at least as broad as Insurance Services Office form CG 00 01. Policy limits are subject to review, but shall in no event be less than, the following:
$1,000,000 Each Occurrence
$2,000,000 General Aggregate
$2,000,000 Products/Completed Operations Aggregate
$1,000,000 Personal Injury
2. Exact structure and layering of the coverage shall be left to the discretion of Service Provider; however, any excess or umbrella policies used to meet the required limits shall be at least as broad as the underlying coverage and shall otherwise follow form.
3. The following provisions shall apply to the Commercial Liability policy as well as any umbrella policy maintained by the Service Provider to comply with the insurance requirements of this Agreement:
a. Coverage shall be on a "pay on behalf" basis with defense costs payable in addition to policy limits;
b. There shall be no cross liability exclusion which precludes coverage for claims or suits by one insured against another; and
c. Coverage shall apply separately to each insured against whom a claim is made or a suit is brought, except with respect to the limits of liability.
B. BUSINESS AUTOMOBILE LIABILITY INSURANCE
Business automobile liability insurance policy which provides coverage at least as broad as ISO form CA 00 01 with policy limits a minimum limit of not less than one million dollars ($1,000,000) each accident using, or providing coverage at least as broad as, Insurance Services Office form CA 00 01. Liability coverage shall apply to all owned (if any), non-owned and hired autos.
Schedule 29— Customer Insurance Requirements
In the event that the Services being performed under this Agreement involves transporting of hazardous or regulated substances, hazardous or regulated wastes and/or hazardous or regulated materials, Service Provider and/or its Sub-contractors involved in such activities shall provide coverage with a limit of one million dollars ($1,000,000) per accident covering transportation of such materials by the addition to the Business Auto Coverage Policy of Environmental Impairment Endorsement MCS90 or Insurance Services Office endorsement form CA 99 48, which amends the pollution exclusion in the standard Business Automobile Policy to cover pollutants that are in or upon, being transported or towed by, being loaded onto, or being unloaded from a covered auto.
C. WORKERS' COMPENSATION
1. Workers' Compensation Insurance Policy as required by statute and employer's liability with limits of at least one million dollars ($1,000,000) policy limit Bodily Injury by disease, one million dollars ($1,000,000) each accident/Bodily Injury and one million dollars ($1,000,000) each employee Bodily Injury by disease.
2. The indemnification and hold harmless obligations of Service Provider included in this Agreement shall not be limited in any way by any limitation on the amount or type of damage, compensation or benefit payable by or for Service Provider or any Sub-contractor under any Workers' Compensation Act(s), Disability Benefits Act(s) or other employee benefits act(s).
3. This policy must include a Waiver of Subrogation in favor of the City of Santa Clara, its City Council, commissions, officers, employees, volunteers and agents.
D. PROFESSIONAL LIABILITY
Professional Liability or Errors and Omissions Insurance as appropriate shall be written on a policy form coverage specifically designed to protect against negligent acts, errors or omissions of the Service Provider and its employees. Covered services as designated in the policy must specifically include work performed under this agreement. Coverage shall be in an amount of not less than fifteen million dollars ($15,000,000) per occurrence or fifteen million dollars ($15,000,000) aggregate. Any coverage containing a deductible or self-retention must first be approved in writing by the City Attorney's Office.
E. COMPLIANCE WITH REQUIREMENTS
All of the following clauses and/or endorsements, or similar provisions, must be part of each commercial general liability policy, and each umbrella or excess policy. 1 Additional Insureds. City of Santa Clara, its City Council, commissions, officers, employees, volunteers and agents are hereby added as additional insureds but only to the extent of the liabilities assumed by Service Provider as set forth in the Indemnification Article of this Agreement in respect to liability arising out of Service Provider's work for City, using Insurance Services Office (ISO) Endorsement CG 20 10 11 85, or the combination of CG 20 10 03 97 and CG 20 37 10 01, or its equivalent.
2. Primary and non-contributing. Each insurance policy provided by Service Provider shall contain language or be endorsed to contain wording making it primary insurance but only to the extent of the liabilities assumed by Service Provider as set forth in the Indemnification Article of this Agreement as respects to, and not requiring contribution from, any other insurance which the indemnities
Schedule 29- Customer Insurance Requirements
may possess, including any self-insurance or self-insured retention they may have. Any other insurance indemnities may possess shall be considered excess insurance only and shall not be called upon to contribute with Service Provider's insurance.
3. Cancellation.
a. Each insurance policy shall contain language or be endorsed to reflect that no cancellation or material modification of the coverage provided due to non-payment of premiums shall be effective until written notice has been given to City at least ten (10) days prior to the effective date of such modification or cancellation. In the event of non-renewal, written notice shall be given at least ten (10) days prior to the effective date of non-renewal.
b. Each insurance policy shall contain language or be endorsed to reflect that no cancellation or material modification of the coverage provided for any cause save and except non-payment of premiums shall be effective until written notice has been given to City at least thirty (30) days prior to the effective date of such modification or cancellation. In the event of non-renewal, written notice shall be given at least thirty (30) days prior to the effective date of non-renewal.
4. Other Endorsements. Other endorsements may be required for policies other than the commercial general liability policy if specified in the description of required insurance set forth in Sections A through E of this Schedule 29, above.
F. ADDITIONAL INSURANCE RELATED PROVISIONS
Service Provider and City agree as follows:
1. Service Provider agrees to ensure that subcontractors, and any other party involved with the Services, who is brought onto or involved in the performance of the Services by Service Provider, provide the same minimum insurance coverage required of Service Provider, except as with respect to limits. Service Provider agrees to monitor and review all such coverage and assumes all responsibility for ensuring that such coverage is provided in conformity with the requirements of this Agreement. Service Provider agrees that upon request by City, all agreements with, and insurance compliance documents provided by, such subcontractors and others engaged in the project will be submitted to City for review.
2. Service Provider agrees to be responsible for ensuring that no contract used by any party involved in any way with the project reserves the right to charge City or Service Provider for the cost of additional insurance coverage required by this Agreement. Any such provisions are to be deleted with reference to City. It is not the intent of City to reimburse any third party for the cost of complying with these requirements. There shall be no recourse against City for payment of premiums or other amounts with respect thereto.
3. The City reserves the right to withhold payments from the Service Provider in the event of material noncompliance with the insurance requirements set forth in this Agreement.
Schedule 29 - Customer Insurance Requirements
G. EVIDENCE OF COVERAGE
Prior to Effective Date of this Agreement, Service Provider, and its Sub-contractor shall, at its sole cost and expense, purchase and maintain not less than the minimum insurance coverage with the endorsements indicated in this Agreement. Such insurance coverage shall be maintained with insurers, and under forms of policies, satisfactory to City however, such satisfactory approval shall not be unreasonably withheld, and as described in this Agreement. Service Provider shall file with the City all certificates and endorsements for the required insurance policies for City's approval as to adequacy of the insurance protection.
H. EVIDENCE OF COMPLIANCE
Service Provider or its insurance broker shall provide the required proof of insurance compliance, consisting of Insurance Services Office (ISO) endorsement forms or their equivalent and the ACORD form 25-S certificate of insurance (or its equivalent), evidencing all required coverage shall be delivered to City, or its representative as set forth below, at or prior to execution of this Agreement. In the event of any claim or potential claim and upon City's reasonable request, Service Provider shall submit to City copies of the actual insurance policies or renewals or replacements. Unless otherwise required by the terms of this Agreement, all certificates, endorsements, coverage verifications and other items required to be delivered to City pursuant to this Agreement shall be mailed to:
EBIX Inc.
City of Santa Clara
Information Technology Department
P.O. Box 100085 — S2 or 1 Ebix Way
Duluth, GA 30096 John's Creek, GA 30097
Telephone number: 951-766-2280
Fax number: 770-325-0409
Email address: [email protected]
I. QUALIFYING INSURERS
All of the insurance companies providing insurance for Service Provider shall have, and provide written proof of, an A. M. Best rating of at least A minus 6 (A- VI) or shall be an insurance company of equal financial stability that is approved by the City or its insurance compliance representatives.
SCHEDULE 30
CUSTOMER ETHICS POLICY
TO
MASTER SERVICES AGREEMENT
BY AND BETWEEN
CITY OF SANTA CLARA
AND
SERVICE PROVIDER
Schedule 30
Customer Ethics Policy
ETHICAL STANDARDS FOR CONTRACTORS SEEKING TO ENTER INTO AN
AGREEMENT WITH THE CITY OF SANTA CLARA, CALIFORNIA
Termination of Agreement for Certain Acts.
A. The City may, at its sole discretion, terminate this Agreement in the event any one or more of the following occurs:
1. If a Service Provider' does any of the following:
a. Is convicted2of operating a business in violation of any Federal, State or local law or regulation;
b. Is convicted of a crime punishable as a felony involving dishonesty 3 ; c. Is convicted of an offense involving dishonesty or is convicted of fraud or a criminal offense in connection with: (1) obtaining; (2) attempting to obtain; or, (3) performing a public contract or subcontract; d. Is convicted of any offense which indicates a lack of business integrity or business honesty which seriously and directly affects the present responsibility of a City Service Provider or subService Provider; and/or, e. Made (or makes) any false statement(s) or representation(s) with respect to this Agreement.
2. If fraudulent, criminal or other seriously improper conduct of any officer, director, shareholder, partner, employee or other individual associated with the Service Provider can be imputed to the Service Provider when the conduct occurred in connection with the individual's performance of duties for or on behalf of the Service Provider, with the Service Provider's knowledge, approval or For purposes of this Agreement "Service Provider" means any of the following: an owner or co-owner of a sole proprietorship; a person who controls or who has the power to control a business entity; a general partner of a partnership; a principal in a joint venture; or a primary corporate stockholder [i.e., a person who owns more than ten percent (10%) of the outstanding stock of a corporation] and who is active in the day to day operations of that corporation.
2 For purposes of this Agreement, the words "convicted" or "conviction" mean a judgment or conviction of a criminal offense by any court of competent jurisdiction, whether entered upon a verdict or a plea, and includes a conviction entered upon a plea of nob o contendere within the past five (5) years. 3 As used herein, "dishonesty" includes, but is not limited to, embezzlement, theft, forgery, bribery, falsification or destruction of records, making false statements, failure to pay tax obligations, receiving stolen property, collusion or conspiracy.
acquiescence, the Service Provider's acceptance of the benefits derived from the conduct shall be evidence of such knowledge, approval or acquiescence.
B. The City may also terminate this Agreement in the event any one or more of the following occurs:
1. The City determines that Service Provider no longer has the financial capability 4 or business experience 5to perform the terms of, or operate under, this Agreement; or,
2. If City determines that the Service Provider fails to submit information, or submits false information, which is required to perform or be awarded a contract with City, including, but not limited to, Service Provider's failure to maintain a required State issued license, failure to obtain a City business license (if applicable) or failure to provide and maintain bonds and/or insurance policies required under this Agreement.
C. In the event a prospective Service Provider (or bidder) is ruled ineligible (debarred) to participate in a contract award process or a contract is terminated pursuant to these provisions, Service Provider may appeal the City's action to the City Council by filing a written request with the City Clerk within ten (10) days of the notice given by City to have the matter heard. The matter will be heard within thirty (30) days of the filing of the appeal request with the City Clerk. The Service Provider will have the burden of proof on the appeal. The Service Provider shall have the opportunity to present evidence, both oral and documentary, and argument.
4 Service Provider becomes insolvent, transfers assets in fraud of creditors, makes an assignment for the benefit of creditors, files a petition under any section or chapter of the federal Bankruptcy Code (11 U.S.C.), as amended, or under any similar law or statute of the United States or any state thereof, is adjudged bankrupt or insolvent in proceedings under such laws, or a receiver or trustee is appointed for all or substantially all of the assets of Service Provider.
5 Loss of personnel deemed essential by the City for the successful performance of the obligations of the Service Provider to the City.
By:
Schedule 30— Customer Ethics Policy
AFFIDAVIT OF COMPLIANCE WITH ETHICAL STANDARDS
I hereby state that I have read and understand the language, entitled "Ethical Standards" set forth in Exhibit D. I have the authority to make these representations on my own behalf or on behalf of the legal entity identified herein. I have examined appropriate business records, and I have made appropriate inquiry of those individuals potentially included within the definition of "Service Provider" contained in Ethical Standards at footnote 1.
Based on my review of the appropriate documents and my good-faith review of the necessary inquiry responses, I hereby state that neither the business entity nor any individual(s) belonging to said "Service Provider" category [i.e., owner or co-owner of a sole proprietorship, general partner, person who controls or has power to control a business entity, etc.] has been convicted of any one or more of the crimes identified in the Ethical Standards within the past five (5) years.
The above assertions are true and correct and are made under penalty of perjury under the laws of the State of California.
UNISYS CORPORATION
a Delaware corporation
Signature of Authorized—Person or Representative
Name: Robert Von Essen
Title: Director of Public Sector Accounts
NOTARY'S ACKNOWLEDGMENT TO BE ATTACHED
Please execute the affidavit and attach a notary public's acknowledgment of execution of the affidavit by the signatory. If the affidavit is on behalf of a corporation, partnership, or other legal entity, the entity's complete legal name and the title of the person signing on behalf of the legal entity shall appear above.
Written evidence of the authority of the person executing this affidavit on behalf of a corporation, partnership, joint venture, or any other legal entity, other than a sole proprietorship, shall be attached.
ANNETTE AGEE
Notary Public - California
Santa Clara County
Commission I 2t87760
My Comm. Extrestiilar 23, 2021
WITNESS my hayfd anOfficial seal.
SI ARY PUBLIC
California All-Purpose Acknowledgment CIVIL CODE § 1189 A notary public or other officer completing this certificate verifies only the identity of the individual who signed the document to which this certificate is attached, and not the truthfulness, accuracy, or validity of that document.
STATE OF CALIFORNIA
COUNTY OF SANTA CLARA
} SS
On May 3, 2017, before me, Annette Agee, a Notary Public, personally appeared Robert Von Essen who proved to me on the basis of satisfactory evidence to be the person(s) whose name(s) is/are subscribed to the within instrument and acknowledged to me that he/she/they executed the same in his/her/their authorized capacity(ies), and that by his/her/their signature(s) on the instrument the person(s), or the entity upon behalf of which the person(s) acted, executed the instrument.
I certify under PENALTY OF PERJURY under the laws of the State of California that the foregoing paragraph is true and correct.
THIS CERTIFICATE, MUST BE ATTACHED TO THE DOCUMENT DESCRIBED BELOW:
Unisys Corporation
Schedule 30 Customer Ethics Policy to Master Service Agreement