For EBIX Insurance No. S200000696
AGREEMENT FOR THE PERFORMANCE OF SERVICES
BY AND BETWEEN THE
CITY OF SANTA CLARA, CALIFORNIA,
AND
ACCELA, INC.
PREAMBLE
This agreement for the performance of services ("Agreement") is by and between Accela, Inc., a California corporation, with its principal place of business located at 2633 Camino Ramon, Suite 500, San Ramon, CA 94853 ("Contractor"), and the City of Santa Clara, California, a chartered California municipal corporation with its primary business address at 1500 Warbmion Avenue, Santa Clara, California 95050 ("City"). City and Contractor may be refe1Ted to individually as a "Party" or collectively as the "Parties" or the "Paiiies to this Agreement."
RECITALS
A. City desires to secure professional services more fully described in this Agreement, at Exhibit A, entitled "Scope of Services"; and
B. Contractor represents that it, and its subcontractors, if any, have the professional qualifications, expertise, necessary licenses and desire to provide certain goods and/or required services of the quality and type which meet objectives and requirements of City; and,
C. The Parties have specified herein the te1ms and conditions under which such services will be provided and paid for.
The Parties agree as follows:
AGREEMENT PROVISIONS
1. EMPLOYMENT OF CONTRACTOR.
City hereby employs Contractor to perform services set forth in this Agreement. To accomplish that end, City may assign a Project Manager to personally direct the Services to be provided by Contractor and will notify Contractor in writing of City's choice. City shall pay for all such materials and services provided which are consistent with the terms of this Agreement.
2. SERVICES TO BE PROVIDED.
Except as specified in this Agreement, Contractor shall furnish all technical and professional services for hosted subscriptions services, ( collectively refened to as "Subscribed Services" as defined in Exhibit H, Paragraph 3) to satisfactorily complete the work required by City at his/her own risk and expense. Subscribed Services to be provided to City are more fully described in Exhibit H. All of the exhibits referenced in this Agreement are attached and are incorporated by this reference.
Agreement for the Perfonnance of Services/ Accela, Inc.
Rev. 06/22/17
Page I of9
3. COMMENCEMENT OF SUBSCRIBED SERVICES.
CUSTOMER'S SUBSCRIPTION TERM COMMENCES ON A MUTUALLY
AGREED UPON DATE TO OCCUR BEFORE SEPTEMBER 30, 2018 AND SAID DATE IS CUSTOMER'S "SERVICE DATE" FOR PURPOSES OF
DESIGNATING THE START OF ANY SUBSCRIPTION TERM. FOR THE
AVOIDANCE OF DOUBT, THE SERVICE DATE AND THE EFFECTIVE DATE MAY NOT BE THE SAME.
Contractor shall begin providing the Subscription services under the requirements of this Agreement upon receipt of written Notice to Proceed from City. Such notice shall be deemed to have occuned three (3) calendar days after it has been deposited in the regular United States mail. Contractor shall complete the Services within the time limits set forth in the Scope of Services or as mutually determined in writing by the Parties Contract execution.
When City determines that Contractor has satisfactorily completed the Services. Upon receipt of such notice, Contractor shall not incur any further costs under this Agreement.
Contractor may request this determination of completion be made when, in its opinion, the Services have been satisfactorily completed.
4. QUALIFICATIONS OF CONTRACTOR- STANDARD OF WORKMANSHIP.
Contractor represents and maintains that it has the necessary expertise in the professional calling necessary to perform services, and its duties and obligations, expressed and implied, contained herein, and City expressly relies upon Contractor's representations regarding its skills and knowledge. Contractor shall perform such services and duties in conformance to and consistent with the professional standards of a specialist in the same discipline in the State of California.
The plans, designs, specifications, estimates, calculations, reports and other documents furnished under Exhibit A shall be of a quality acceptable to City. The criteria for acceptance of the work provided under this Agreement shall be a product of neat appearance, well organized, that is technically and grammatically coffect, checked and having the maker and checker identified. The minimum standard of appearance, organization and content of the drawings shall be that used by City for similar projects.
5. TERM OF AGREEMENT.
Unless otherwise set forth in this Agreement or unless this paragraph is subsequently modified by a written amendment to this Agreement, the term of this Agreement shall begin on the Effective Date of this Agreement and terminate five (5) years from the Service Date. The Agreement may be renewed by the City, at its sole discretion, for two additional one (1) year terms.
Agreement for the Performance of Services/ Accela, Inc.
Rev. 06/22/17
6. MONITORING OF SUBSCIUBED SERVICES.
City may monitor the Subscribed Services perfonned under this Agreement to determine whether Contractor's operation conforms to City policy and to the terms of this Agreement. City may also monitor the Subscribed Services to be performed to determine whether financial operations are conducted in accord with applicable City, county, state, and federal requirements. If any action of Contractor constitutes a breach, City may terminate this Agreement pursuant to the provisions described herein.
7. PERFORMANCE OF SUBSCRIBED SERVICES.
Contractor shall perform all requested services in an efficient and expeditious manner and shall work closely with and be guided by City. Contractor shall be as fully responsible to City for the acts and omissions of its subcontractors, and of persons either directly or indirectly employed by them, as Contractor is for the acts and omissions of persons directly employed by it. Contractor will perform all Subscribed Services in a safe manner and in accordance with all federal, state and local operation and safety regulations.
8. BUSINESS TAX LICENSE REQUIRED.
Contractor must comply with Santa Clara City Code section 3.40.060, as that section may be amended from time to time or renumbered, which requires that any person who transacts or carries on any business in the City of Santa Clara pay business license tax to the City. A business tax certificate may be obtained by completing the Business Tax Affidavit Form and paying the applicable fee at the Santa Clara City Hall Municipal Services Division.
9. RESPONSIBILITY OF CONTRACTOR.
Contractor shall be responsible for the professional quality, technical accuracy and coordination of the Subscribed Services furnished by it, as set faith under this Agreement, including any exhibits or attachments. Neither City's review, acceptance, nor payments for any of the Services required under this Agreement shall be construed to operate as a waiver of any rights under this Agreement or of any cause of action arising out of the performance of this Agreement and Contractor shall be and remain liable to City (subject to any limitations in this Agreement) in accordance with applicable law for all damages to City caused by Contractor's Agreement, applicable federal, state, county, and/or municipal laws, ordinances, regulations, rules and orders.
10. COMPENSATION AND PAYMENT.
In consideration for Contractor's complete performance of Subscribed Services, City shall pay Contractor for all materials provided and services rendered by Contractor at the rate per hour for labor and cost per unit for materials as outlined in Exhibit B, entitled "SCHEDULE OF FEES."
Contractor will bill City on a monthly basis for Subscribed Services provided by Contractor during the preceding month, subject to verification by City. City will pay Contractor within thirty (30) days of City's receipt of invoice.
Agreement for the Performance of Services/ Accela, Inc.
Rev. 06/22/17
11. TERMINATION OF AGREEMENT.
Either Paity may terminate this Agreement without eause by giving the other Party written notice ("Notice of Termination") which clearly expresses that Paity's intent to tenninate the Agreement, which will be effective on the following anniversary of the Subscription Term provided such Notice of Termination is received 30 days prior to the anniversary of the Effective Date of the upcoming Subscription Term. Notice of Termination shall become effective no less than thirty (30) calendar days after a Party receives such notice. After either Party terminates the Agreement, Contractor shall discontinue further services as of the effective date of termination, and City shall pay Contractor for all Subscl'ibed Services satisfactorily perfonned up to such date.
If City renews the Agreement for additional one year terms after first five (5) year tenn, then upon such renewal either Party may terminate the Agreement without cause by giving the other Party Notice of Termination. Such Notice of Termination shall be effective ninety (90) days after receipt by the other Party. Upon any such Notice of Tennination after the first five (5) year term, Contractor will refund any prepaid subscription fees covering the remainder of the subscription term after the effective date of termination.
Either party may terminate this Agreement if either Party materially breaches any terms and conditions of this Agreement after receiving a written notice describing the circumstances of the material breach, and the Paity fails to correct the breach within thirty (30) calendar days. Upon any termination for cause by City, Contractor will refund any prepaid subscription fees covering the remainder of the subscription term after the effective date of termination.
12. NO ASSIGNMENT OR SUBCONTRACTING OF AGREEMENT.
City and Contractor bind themselves, their successors and assigns to all covenants of this Agreement. This Agreement shall not be assigned or transferred without the prior written approval of City. Contractor shall not hire subcontractors without express written permission from City.
13. NO THIRD PARTY BENEFICIARY.
This Agreement shall not be construed to be an agreement for the benefit of any third party or parties and no third party or parties shall have any claim or right of action under this Agreement for any cause whatsoever.
14. INDEPENDENT CONTRACTOR.
Contractor and all person(s) employed by or contracted with Contractor to furnish labor and/or materials under this Agreement are independent contractors and do not act as agent(s) or employee(s) of City. Contractor has full rights, however, to manage its employees in their performance of Subscribed Services under this Agreement. Contractor is not authorized to bind City to any contracts or other obligations.
Agreement for the Performance of Services/ Accela, Inc.
Rev. 06/22/17
15. NO PLEDGING OF CITY'S CREDIT.
Under no circumstances shall Contractor have the authority or power to pledge the credit of City or incur any obligation in the name of City. Contractor shall save and hold harmless the City, its City Council, its officers, employees, boards and commissions for expenses arising out of any unauthorized pledges of City's credit by Contractor under this Agreement.
16. CONFIDENTIALITY OF MATERIAL.
All ideas, memoranda, specifications, plans, manufacturing procedures, data, drawings, descriptions, documents, discussions or other information developed or received by or for Contractor and all other written information submitted to Contractor in connection with the performance of this Agreement shall be held confidential by Contractor and shall not, without the prior written consent of City, be used for any purposes other than the performance of the Subscribed Services nor be disclosed to an entity not connected with performance of the Subscribed Services. Nothing furnished to Contractor which is otherwise known to Contractor or becomes generally known to the related industry shall be deemed confidential.
17. USEO.FCITYNAMEOREMBLEM.
Contractor shall not use City's name, insignia, or emblem, or distribute any information related to services under this Agreement in any magazine, trade paper, newspaper or other medium without express written consent of City.
18. OWNERSHIP OF MATERIAL.
Please refer to Exhibit H.
19. RIGHT OF CITY TO INSPECT RECORDS OF CONTRACTOR.
City, through its authorized employees, representatives or agents shall have the right during the term of this Agreement and for two (2) years from the date of final payment for goods or services provided under this Agreement, to audit the books and records of Contractor for the purpose of verifying any and all charges made by Contractor in connection with Contractor compensation under this Agreement, including termination of Contractor. Contractor agrees to maintain sufficient books and records in accordance with generally accepted accounting principles to establish the co1Tectness of all charges submitted to City. Any expenses not so recorded shall be disallowed by City.
Contractor shall submit to City any and all reports concerning its performance under this Agreement that may be requested by City in writing. Contractor agrees to assist City in meeting City's rep01ting requirements to the State and other agencies with respect to Contractor's Subscribed Services hereunder.
Agreement for the Performance of Services/ Acee la, Inc.
Rev. 06/22/17
20. CORRECTION OF SUBSCRIBED SERVICES.
Contractor agrees to conect any incomplete, inaccurate or defective Subscribed Services at no further costs to City, when such defects are due to the negligence, errors or omissions of Contractor.
21. FAIREMPLOYMENT.
Contractor shall not discriminate against any employee or applicant for employment because of race, color, creed, national origin, gender, sexual orientation, age, disability, religion, ethnic background, or marital status, in violation of state or federal law.
22. HOLD HARMLESS/INDEMNIFICATION. PLEASE REFER TO EXHIBIT H.
23. INSURANCE REQUIREMENTS.
During the term of this Agreement, and for any time period set forth in Exhibit C, Contractor shall provide and maintain in full force and effect, at no cost to City insurance policies with respect to employees and vehicles assigned to the Performance of Subscribed Services under this Agreement with coverage amounts, required endorsements, certificates of insurance, and coverage verifications as defined in Exhibit C.
24. AMENDMENTS.
This Agreement may be amended only with the written consent of both Parties.
25. INTEGRATED DOCUMENT.
This Agreement represents the entire agreement between City and Contractor. No other understanding, agreements, conversations, or otherwise, with any representative of City prior to execution of this Agreement shall affect or modify any of the terms or obligations of this Agreement. Any verbal agreement shall be considered unofficial information and is not binding upon City.
26. SEVERABILITY CLAUSE.
In case any one or more of the provisions in this Agreement shall, for any reason, be held invalid, illegal or unenforceable in any respect, it shall not affect the validity of the other provisions, which shall remain in full force and effect.
27. WAIVER.
Contractor agrees that waiver by City of any one or more of the conditions of performance under this Agreement shall not be construed as waiver(s) of any other condition of performance under this Agreement.
Agreement for the Perfonnance of Services/Acee la, Inc.
Rev. 06/22/17
Page6of9
28. NOTICES.
All notices to the Parties shall, unless otherwise requested in writing, be sent to City addressed as follows:
City of Santa Clara
Attention: Community Development Department, Building Division 1500 Warburton Avenue
Santa Clara, California 95050
or by facsimile at ( 408) 241-3823
And to Contractor addressed as follows:
Name: General Counsel
Address: 2633 Camino Ramon
San Ramon, CA94853
or by facsimile at 925-659-3201
If notice is sent via facsimile, a signed, hard copy of the material shall also be mailed.
The workday the facsimile was sent shall control the date notice was deemed given if there is a facsimile machine generated document on the date of transmission. A facsimile transmitted after 1 :00 p.m. on a Friday shall be deemed to have been transmitted on the following Monday.
29. CAPTIONS.
The captions of the various sections, paragraphs and subparagraphs of this Agreement are for convenience only and shall not be considered or refel1'ed to in resolving questions of interpretation.
30. LAW GOVERNING CONTRACT AND VENUE.
This Agreement shall be governed and construed in accordance with the statutes and laws of the State of California. The venue of any suit filed by either Party shall be vested in the state courts of the County of Santa Clara, or if appropriate, in the United States District Court, Northern District of California, San Jose, California.
31. DISPUTE RESOLUTION.
A. Unless otherwise mutually agreed to by the Parties, any controversies between Contractor and City regarding the construction or application of this Agreement, and claims arising out of this Agreement or its breach, shall be submitted to mediation within thirty (30) days of the written request of one Pa1iy after the service of that request on the other Party.
B. The Parties may agree on one mediator. If they cannot agree on one mediator, the Pa1iy demanding mediation shall request the Superior Comi of Santa Clara County to appoint a mediator. The mediation meeting shall not exceed one day ( eight (8) hours). The Paities may agree to extend the time allowed for mediation under this Agreement.
Agreement for the Performance of Services/ Acee la, Inc.
Rev. 06/22/17
C. The costs of mediation shall be borne by the Parties equally.
D. For any contract dispute, mediation under this section is a condition precedent to filing an action in any court. In the event of mediation which arises out of any dispute related to this Agreement, the Pmiies shall each pay their respective attorney's fees, expert witness costs and cost of suit through mediation only. If mediation does not resolve the dispute, the Parties agree that the matter shall be litigated in a comi of law, and not subject to the arbitration provisions of the Public Contracts Code.
32. COMPLIANCE WITHETIDCAL STANDARDS.
Contractor shall:
A. Read Exhibit D, entitled "ETHICAL STANDARDS FOR CONTRACTORS
SEEKING TO ENTER INTO AN AGREEMENT WITH THE CITY OF SANTA CLARA, CALIFORNIA"; and,
B. Execute Exhibit entitled "AFFIDA VII OF COMPLIANCE WITH ETHICAL STANDARDS."
33. Afi'FORDABLE CARE ACT OBLIGATIONS
To the extent Contractor is obligated to provide health insurance coverage to its employees pursuant to the Affordable Care Act ("Act") and/or any other similar federal or state law, Contractor warrants that it is meeting its obligations under the Act and will fully indemnify and hold harmless City for any penalties, fines, adverse rulings, or tax payments associated with Contractor's responsibilities under the Act.
34. CONFLICT OF INTERESTS.
This Agreement does not prevent either Party from entering into similar agreements with other parties. To prevent a conflict of interest, Contractor certifies that to the best of its knowledge, no City officer, employee or authorized representative has any financial interest in the business of Contractor and that no person associated with Contractor has any interest, direct or indirect, which could conflict with the faithful performance of this Agreement. Contractor is familiar with the provisions of California Government Code Section 87100 and following, and certifies that it does not know of any facts which would violate these code provisions. Contractor will advise City if a conflict arises.
Agreement for the Performance ofServices/Accela, Inc.
Rev. 06/22/ I 7
CITY OF SANT A CLARA, CALIFORNIA
a chartered California municipal corporation
APPROVED AS TO FORM:
~
City Attorney
ATTEST:
? (,1}fNNIFER Y AMAGUMA
Acting City Clerk
Dated:
"CITY"
City Manager
1500 Warbmion Avenue
Santa Clara, CA 95050
Telephone: (408) 615-2210
Fax: (408) 241-6771
ACCELA, INC.
a California corporation
--~ +-'~---+~ ~---
By: _;z_~=====- ------ ---l--------
1gnature of Person executing the Agreement on behalf of ontractor)
Name: Jonathon Knight
Title: Chief Customer Officer
Local Address: 2633 Camino Ramon, Suite 500
San Ramon, CA 94583
Email Address: jknight@accela .com
Telephone: (925) 359-3200
Fax: (925) 659-3201
"CONTRACTOR"
S:\Attomey\AGREEMENTS\Service\OVER $50K SERVICE AGREEMENT FORM.doc Agreement for the Performance of Se1vices/ Accela, Inc.
Rev. 06/22/17
AGREEMENT FOR THE PERFORMANCE OF SUBSCRIBED SERVICES
BY AND BETWEEN THE
CITY OF SANTA CLARA, CALIFORNIA,
AND
ACCELA, INC.
EXHIBIT A
SCOPE OF SUBSCRIBED SERVICES
This exhibit is not used in this agreement. For the software subscription terms and conditions, please refer to Exhibit H.
Agreement with Acee la, lnc./Scope of Services/Exhibit A Rev. 06/22/17
AGREEMENT FOR THE PERFORMANCE OF SUBSCRIBED SERVICES
BY AND BETWEEN THE
CITY OF SANTA CLARA, CALIFORNIA,
AND
ACCELA, INC.
EXHIBITB
FEE SCHEDULE
In no event shall the amount billed to City by Contractor for services under this Agreement exceed One Million Two Hundred Eighteen Thousand Six Hundred Fifty-Nine Dollars and Ninety-Eight Cents ($1,218,659.98), subject to budget appropriations.
Citizen Access
PART# PRODUCT NAME
SS10MCAPOP0001 Accela Citizen Access - Subscription Population Subtotal
Civic Platform
PART# PRODUCT NAME
SS10APFMSLVR001 Accela Civic Platlom1 Silver - Subscliption User SS10APFMSLVR001 Accela Civic Platlom1 Silver - Suliscription User SS10APFMSLVR001 Accela Civic Platform Silver - Sullscription User SS10APFMSLVR001 Accela Civic Plat1om1 Silver- Subscription User SS10APFMSLVR001 Accela Civic Platlom1 Silver - Subscription User Subtotal
PART# PRODUCT NAME
SS 1 0MCAPOP0001 Accela Citizen Access - Subscription Population SS10MCAPOP0001 Accela Citizen Access - Subscription Population SS10MCAPOP0001 Accela Citizen Access - Subscription Population SS10MCAPOP0001 Accela Citizen Access - Subscription Population Subtotal
Agreement with Accela, Inc./Fee Schedule/Exhibit B
Rev. 06/22/17
QTY NET PRICE
125,948 USD 12,594.80
USD 12,594.80
QTY NET PRICE
40 USD 71,520.00
140 USD 257,829.60
140 USD 265,563.93
140 USD 273,531.52
140 USD 281,737.01
USD 1,150,182.06
QTY NET PRICE
125,948 USD 13,363.08
125,948 USD 13,753.52
125,948 USD 14,169.15
125,948 USD 14,597.37
USO 55,883.12
TOTAL: USO 1,218,659.981
AGREEMENT FOR THE PERFORMANCE OF SUBSCRIBED SERVICES
BY AND BETWEEN THE
CITY OF SANTA CLARA, CALIFORNIA,
AND
ACCELA, INC.
EXIDBIT C
INSURANCE REQUIREMENTS
INSURANCE COVERAGE REQUIREMENTS
Without limiting the Contractor's indemnification of the City, and prior to commencing any of the Services required under this Agreement, the Contractor shall provide and maintain in full force and effect, at its sole cost and expense, the following insurance policies with at least the indicated coverages, provisions and endorsements:
A. COMMERCIAL GENERAL LIABILITY INSURANCE
1. Commercial General Liability Insurance policy which provides coverage at least as broad as policy limits, which are subject to review, but shall in no event be less than, the following:
$1,000,000 Each Occurrence
$2,000,000 General Aggregate
$2,000,000 Products/Completed Operations Aggregate
$1,000,000 Personal Injury
2. Exact structure and layering of the coverage shall be left to the discretion of Contractor; however, any excess or umbrella policies used to meet the required limits shall be at least as broad as the underlying coverage and shall otherwise follow form.
3. . The following provisions shall apply to the General Commercial Liability policy as well as any umbrella policy maintained by the Contractor to comply with the insurance requirements of this Agreement:
a. Coverage shall be on a "pay on behalf' basis with defense costs payable in addition to policy limits;
b. There shall be no cross liability exclusion which precludes coverage for claims or suits by one insured against another; and
c. Coverage shall apply separately to each insured against whom a claim is made or a suit is brought, except with respect to the limits of liability.
Agreement with Accela, Inc./Insurance Requirements/Exhibit C Rev. 06/22/17
B. BUSINESS AUTOMOBILE LIABILITY INSURANCE
Business automobile liability insurance policy which provides coverage at least as broad as ISO form CA 00 01 with policy limits a minimum limit of not less than one million dollars ($1,000,000) each accident using, or providing coverage at least as broad as, Insurance Services Office fonn CA 00 01. Liability coverage shall apply to all non owned and hired autos.
C. WORKERS' COMPENSATION
1. Workers' Compensation Insurance Policy as required by statute and employer's liability with limits of at least one million dollars ($1,000,000) policy limit Bodily Injury by disease, one million dollars ($1,000,000) each accident/Bodily Injury and one million dollars ($1,000,000) each employee Bodily Injury by disease.
2. The indemnification and hold harmless obligations of Contractor included in this Agreement shall not be limited in any way by any limitation on the amount or type of damage, compensation or benefit payable by or for Contractor or any subcontractor under any Workers' Compensation Act( s ), Disability Benefits Act(s) or other employee benefits act(s).
3. This policy must include a Waiver of Subrogation in favor of the City of Santa Clara, its City Council, commissions, officers, employees, volunteers and agents.
D. COMPLIANCE WITH REQUIREMENTS
All of the following clauses and/or endorsements, or similar provisions, must be part of each commercial general liability policy.
1. 2.
3. Additional Insureds. The Commercial General Liability insurance will include the City of Santa Clara, its City Council, commissions, officers, employees, volunteers and agents are hereby added as additional insureds in respect to liability arising out of Contractor's work for City.
Primary and non-contributing. Commerical General Liability policy provided by Contractor shall contain language or be endorsed to contain wording making it primary insurance as respects to, and not requiring contribution from, any other insurance which the Indemnities may possess, including any self-insurance or self-insured retention they may have. Any other insurance Indemnities may possess shall be considered excess insurance only and shall not be called upon to contribute with Contractor's insurance.
Cancellation.
a. Commercial General Liability policy shall contain language or be endorsed to reflect that no cancellation of the coverage provided due to non-payment of premiums shall be effective until written notice has been Agreement with Accela, Inc./Insurance Requirements/Exhibit C Rev. 06/22/17
given to City at least ten ( 10) days prior to the effective date of such cancellation
b. Each insurance policy shall contain language or be endorsed to reflect that no cancellation of the coverage provided for any cause save and except non-payment of premiums shall be effective until written notice has been given to City at least thirty (30) days prior to the effective date of such cancellation.
4. Other Endorsements. Other endorsements may be required for policies other than the commercial general liability policy if specified in the description of required insurance set forth in Sections A through D of this Exhibit C, above.
E. ADDITIONAL INSURANCE RELATED PROVISIONS
Contractor and City agree as follows:
1. Contractor agrees that upon request by City, all agreements with, and insurance compliance documents provided by, such subcontractors and others engaged in the project will be submitted to City for review.
2. Contractor agrees to be responsible for ensuring that no contract used by any pmiy involved in any way with the project reserves the right to charge City or Contractor for the cost of additional insurance coverage required by this Agreement. Any such provisions are to be deleted with reference to City. It is not the intent of City to reimburse any third party for the cost of complying with these requirements. There shall be no recourse against City for payment of premiums or other amounts with respect thereto.
3. The City reserves the right to withhold payments from the Contractor in the event of material noncompliance with the insurance requirements set fo1ih in this Agreement.
F. EVIDENCE OF COVERAGE
Prior to commencement of any Services under this Agreement, Contractor, and shall, at its sole cost and expense, provide and maintain not less than the minimum insurance coverage with the endorsements and deductibles indicated in this Agreement. Such insurance coverage shall be maintained with insurers, and under forms of policies, satisfactory to City and as described in this Agreement. Contractor shall file with the City all ce1iificates and endorsements for the required insurance policies for City's approval as to adequacy of the insurance protection.
G. EVIDENCE OF COMPLIANCE
Contractor or its insurance broker shall provide the required proof of insurance compliance, consisting of Insurance Services Office (ISO) endorsement forms or their equivalent and the ACORD form 25-S certificate of insurance ( or its equivalent), Agreement with Accela, Inc./Insurance Requirements/Exhibit C Rev. 06/22/17
evidencing all required coverage shall be delivered to City, or its representative as set forth below, at or prior to execution of this Agreement. Upon City's request Contractor shall submit to City eopies of portions of the actual insurance policies or renewals or replacements to the extent necessary to ensure compliance with this Exhibit C. Unless otherwise required by the tenns of this Agreement, all certificates, endorsements, coverage verifications and other items required to be delivered to City pursuant to this Agreement shall be mailed to:
EBIX Inc.
City of Santa Clara, Community Development Department, Building Division P.O. Box 100085 S2 or I Ebix Way
Duluth, GA 30096 John's Creek, GA 30097
Telephone number:
Fax number:
Email address:
H. QUALIFYING INSURERS
951-766-2280
770-325-0409
ctsantaclara@e b ix.com
All of the insurance companies providing insurance for Contractor shall have, and provide written proof of, an A. M. Best rating of at least A minus 6 (A- VI) or shall be an insurance company of equal financial stability that is approved by the City or its insurance compliance representatives.
S:\Attomey\INSURANCE\CITY\EXHIBIT C-02 Contract over $50,000 limited exposure.doc Agreement with Accela, Inc./Insurance Requirements/Exhibit C Rev. 06/22/17
AGREEMENT FOR THE PERFORMANCE OF SUBSCRIBED SERVICES
BY AND BETWEEN THE
CITY OF SANTA CLARA, CALIFORNIA,
AND
ACCLA,INC.
EXHIBITD
ETHICAL STANDARDS FOR CONTRACTORS SEEKING TO ENTER INTO AN
AGREEMENT WITH THE CITY OF SANTA CLARA, CALIFORNIA
Termination of Agreement for Certain Acts.
A. The City may, at its sole discretion, terminate this Agreement in the event any one or more of the following occurs:
1. If a Contractor 1 does any of the following:
a. Is convicted 2 of operating a business in violation of any Federal, State or local law or regulation;
b. Is convicted of a crime punishable as a felony involving dishonest/; c. Is convicted of an offense involving dishonesty or is convicted of fraud or a criminal offense in connection with: (1) obtaining; (2) attempting to obtain; or, (3) performing a public contract or subcontract; d. Is convicted of any offense which indicates a lack of business integrity or business honesty which seriously and directly affects the present responsibility of a City contractor or subcontractor; and/or, e. Made (or makes) any false statement(s) or representation(s) with respect to this Agreement.
For purposes of this Agreement, the word "Consultant" (whether a person or a legal entity) also refers to "Contractor" and means any of the following: an owner or co-owner of a sole proprietorship; a person who controls or who has the power to control a business entity; a general paitner of a pa11nership; a principal in a joint venture; or a primary corporate stockholder [i.e., a person who owns more than ten percent (10%) of the outstanding stock ofa corporation] and who is active in the day to day operations of that corporation. 2 For purposes of this Agreement, the words "convicted" or "conviction" mean a judgment or conviction of a criminal offense by any court of competent jurisdiction, whether entered upon a verdict or a plea, and includes a conviction entered upon a plea of nolo contendere within the past five (5) years.
As used herein, "dishonesty" includes, but is not limited to, embezzlement, theft, forgery, bribery, falsification or destruction of records, making false statements, failure to pay tax obligations, receiving stolen property, collusion or conspiracy.
Agreement with Accela, Inc./Ethical Standards for Contractors/Exhibit D Rev. 06/22/17
If fraudulent, criminal or other seriously improper conduct of any officer, director, shareholder, partner, employee or other individual associated with the Contractor can be imputed to the Contractor when the conduct occuffed in connection with the individual's performance of duties for or on behalf of the Contractor, with the Contractor's knowledge, approval or acquiescence, the Contractor's acceptance of the benefits derived from the conduct shall be evidence of such knowledge, approval or acquiescence.
B. The City may also terminate this Agreement in the event any one or more of the following occurs:
I. The City determines that Contractor no longer has the financial capability 4 or business experience5 to perform the terms of, or operate under, this Agreement; or,
2. If City determines that the Contractor fails to submit information, or submits false information, which is required to perform or be awarded a contract with City, including, but not limited to, Contractor's failure to maintain a required State issued license, failure to obtain a City business license (if applicable) or failure to provide and maintain bonds and/or insurance policies required under this Agreement.
C. In the event a prospective Contractor ( or bidder) is ruled ineligible ( debarred) to participate in a contract award process or a contract is terminated pursuant to these provisions, Contractor may appeal the City's action to the City Council by filing a written request with the City Clerk within ten ( 10) days of the notice given by City to have the matter heard. The matter will be heard within thirty (30) days of the filing of the appeal request with the City Clerk. The Contractor will have the burden of proof on the appeal.
The Contractor shall have the oppo1iunity to present evidence, both oral and documentary, and argument.
4 Contractor becomes insolvent, transfers assets in fraud of creditors, makes an assignment for the benefit of creditors, files a petition under any section or chapter of the federal Bankruptcy Code (11 U.S.C.), as amended, or under any similar law or statute of the United States or any state thereof, is adjudged bankrupt or insolvent in proceedings under such laws, or a receiver or trustee is appointed for all or substantially all of the assets of Contractor.
Loss of personnel deemed essential by the City for the successful performance of the obligations of the Contractor to the City.
Agreement with Accela, lnc./Ethical Standards for Contractors/Exhibit D Rev. 06/22/17
AGREEMENT FOR THE PERFORMANCE OF SUBSCRIBED SERVICES
BY AND BETWEEN THE
CITY OF SANTA CLARA, CALIFORNIA,
AND
ACCELA, INC.
EXHIBIT E
AFFIDAVIT OF COMPLIANCE WITH ETHICAL ST AND ARDS
I hereby state that I have read and understand the language, entitled "Ethical Standards" set faith in Exhibit D. I have the authority to make these representations on my own behalf or on behalf of the legal entity identified herein. I have examined appropriate business records, and I have made appropriate inquiry of those individuals potentially included within the definition of "Contractor" contained in Ethical Standards at footnote 1.
Based on my review of the appropriate documents and my good-faith review of the necessary inquiry responses, I hereby state that neither the business entity nor any individual(s) belonging to said "Contractor" category [i.e., owner or co-owner of a sole proprietorship, general partner, person who controls or has power to control a business entity, etc.] has been convicted of any one or more of the crimes identified in the Ethical Standards within the past five (5) years.
The above asse1tions are hue and conect and are made under penalty ofpe1jury under the laws of the State of California.
ACCELA, INC.
a California corporation
By:
ignature of Authorized Person or Repre entative
Name: Jonathon Knight
Title: Chief Customer Officer
NOTARY'S ACKNOWLEDGMENT TO BE ATTACHED
Please execute the affidavit and attach a notary public's acknowledgment of ~en-11f'l1ie affidavit by the signatory. If the affidavit is on behalfofa corporation, partne1:s_hip1 oi-ctlfeilegal entity, the entity's complete legal name and the title of the person signing on behalf of the legal entity shall appear above. Written evidence of the authority of the person executing this affidavit on behalf of a corporation, partnership, joint venture, or any other legal entity, other than a sole proprfotorship, shall be attached.
Agreement with Accela, Inc.I Affidavit of Compliance/Exhibit E Rev. 06/22/17
Page I of 2
CALIFORNIA ALL-PURPOSE ACKNOWLEDGMENT CIVIL CODE § 1189 •0000~16™~
A notary public or other officer completing this certificate verifies only the identity of the individual who signed the document to which this certificate is attached, and not the truthfulness, accuracy, or validity of that document.
State of California
County of U11{ri,1... }
On /½n;.i JA If'\. Zo / ,y before me, --'-'''-'-5"--''t'---h=(=-'--=-..,_--'+-=-'~+--_,_,,__,,_,/J--'-"---n~f---'-f},-'-,.1_,_/,,_,_,--=· L'-- _ _, fJ Date Here fnse Name and Title the Officer
personally appeared _____ _.)_,_, n_st~/b_a="~--t<,~· ~n..,J~J"'·h~+-~----------------- Name(s) of Signer(s)
who proved to me on the basis of satisfactory evidence to be the person(s) whose name(s) is/are subscribed to the within instrument and acknowledged to me that he/she/they executed the same in his/her/their authorized capacity(ies), and that by his/her/their signature(s) on the instrument the person(s), or the entity upon behalf of which the person(s) acted, executed the instrument. ·i· ............ ~ -"""~-~., ....... ,,_{
ESTHER SIGC••I:.
~ Notarv P,J:tic · C1i1fc~11.1 r
~ C.;~tfJ Cc~t.1 CJc; .. ·t·.t ;·_
i
(or.~·is;io-1 ° ,237556 r
/,\;(ucw··. L.,pircsl,,,c ~- 2022 £1
. ~4---~?19JWC:.?.l~.,~"'/l\.l!. n.\Jjl:S::~-<ha- ..... t Place Notary Seal and/or Stamp Above
I certify under PENAL TY OF PERJURY under the
laws of the State of California that the foregoing
paragraph is true and correct.
WITNESS my hand and official seal.
t::' l
S~n~u~--~~-~----~~----------1 ~ Signature of Notary Public
OPTIONAL
Completing this information can deter alteration of the document or fraudulent reattachment of this form to an unintended document.
Description of Attached Document
Title or Type of Document: ___________________________ _ Document Date: _____________________ Number of Pages: ___ _ Signer(s) Other Than Named Above: _______________________ _ Capacity(ies) Claimed by Signer(s)
Signer's Name: Signer's Name: ____________ _
□ Corporate Officer - Title(s): ______ _ □ Corporate Officer - Title(s): ______ _ □ Partner - □ Limited □ General □ Partner - □ Limited □ General □ Individual □ Attorney in Fact □ Individual □ Attorney in Fact □ Trustee □ Guardian of Conservator □ Trustee □ Guardian of Conservator □ Other: □ Other:
Signer is Representing: _________ _ Signer is Representing: _________ _ ©2017 National Notary Association
AGREEMENT FOR THE PERFORMANCE OF SUBSCRIBED SERVICES
BY AND BETWEEN THE
CITY OF SANTA CLARA, CALIFORNIA,
AND
ACCELA, INC.
EXHIBITF
SPECIFICATIONS AND REQUIREMENTS
Agreement with Accela, Inc./Specifications and Requirements /Exhibit F Page 1 oflO
EXHIBIT F
SPECIFICATIONS AND REQUIREMENTS
Product Specifications
Accela's solution for the City's permitting and inspection functions will leverage Accela Civic Platform's Land Management solution along with its integral components for Citizen Access, GIS, and Mobile.
Land Management
The Civic Platform allows the City to automate and streamline your civic processes related to permitting.
Accela's Land Management makes it easy for state, county and city agencies of all sizes to coordinate activities for the consideration and approval of land use and building permits, inspections and enforcement to meet your jurisdiction codes. The solution saves time, increases productivity and connects government agencies to the businesses, professionals and citizens they serve.
Accela's Land Management:
♦ Simplifies the permit process. Manage your entire pennitting process including application check-in, plan reviews, fee calculation and collection, inspections , sign-offs, task lists, and more.
Easily manage both the proposed plan and the relationships to the project - including imposing restrictions on transactions, property or individuals until compliance measures and fees are satisfied.
Land Management ♦ Engages your citizens 24/7/365 days of the year. Accela's Citizen Access and IVR capabilities provide quick and easy access to information about permits and inspections directly from any telephone, web browser, or mobile device.
♦ Visualizes information with built-in GIS capabilities, which deliver mapping and routing functionality to the enterprise. This overlays govermnent data onto GIS maps and allows customers to initiate and manage permit activities from a geospatial platform . ♦ Provides online access to save time for agency staff out in the field. Productivity apps, such as Analytics , Inspector, and Contractor Central, connect and equip agency field workers with the right mobile device for the job.
User Interface
Accela's web-based Civic Platform user interface shows several screens on a single page and are configured to meet the needs of individual user roles.
Agreement with Accela, lnc./Specifications and Requirements/E xhibit F Page 2 of 10 Among the most frequently used screens are those presenting alerts and notifications, upcoming and overdue tasks, perfonnance-based charting, and frequently used data queries. When used with Accela's GIS capabilities, government activity data is viewable on a map screen, confinning the solution's versatility in how data is represented.
When used with Accela's mobile capabilities, all land management activity data is available to field staff, enabling a full mobile field office solution. Inspector assignments, schedules, routes, status reports, and inspection results are all logically presented. Data collected in the field is recorded electronically and uploaded to the solution for immediate availability throughout the enterprise.
Further extending Land Management offerings to the public are Accela's Citizen Access, which promote true government transparency and citizen self-service by bringing government services to the public 24/7. Self-service options may include property information, online applications, fee collection and inspection scheduling. In eliminating the need for in-person and paper processing, these solution components unite governments and their constituents through accessible technology while reducing costs.
Citizen Access
Citizen participation and collaboration are now one of the most urgent needs facing our government. The ability to put processes online greatly assists this mission in two key ways - by allowing applicants to take advantage of self-service and by increasing agency staff productivity. Another obvious advantage is the solution's inherent ability to address budgetary concerns and help government do more with less.
Accela has long been cognizant of the need for transparency and accountability. Through a self service web portal and an open user interface, Citizen Access extends government services to the public 24-hours a day by providing members of the public with on line access to apply for land development applications, permits, licenses, schedule inspections, request services, and perform tasks from the convenience of their home, office or job site. This presents a useful way for public users to interact with your agency in an efficient manner.
By configuring a custom welcome page and designing page flows that are intuitive, easy-to-use, and come with agency defined context specific help agencies can better engage and connect with their public. This enables truly transparent government operations. Citizen Access supports IE 11 and the latest stable versions of Firefox, Safari, Chrome, and Opera browsers.
Agreement with Accela , lnc./Specifications and Requirements/Exhibit F Page 3 of 10 - PetmilS PIMwng u,..,... 311 / COmplAintl [nfotttffl"'I W.Lcomt DM)'nt Pottor10n
1'0M411!ft<:M~lill
WhatMiuld ~ llb loda tolby'1
M'lllnced Se..vd'I •
looe.1t.arte4 Yleet0N-of lh11 NtYCm nteabdow' .
Clene .. 1 lnrormatlon Permits
LPl(I,~ ..... flf.t0"1ft _,_,,,
.,. • ~,.,,..,,d\M,,u. C-. lfMlD'"""'
~toici,,1 '(t-l!A..-
"'" :ti, .... ~.,..
-
l'llnnlr111 Ucen••
.,..."~""
-· .... ' ...
'-rcl'I•
- '""""-.,,,,...rti,:w\
311 / Complalnll Enforcement
-··- ""''
C4'11ZJ
,1111 ..
H,RHU
Exhibit 1: Citizen Access Dashboard
~ Permits Planning llcen ■•• :SU/ Compl.-lnt.. Cntorc:.,ment Advanced S•■tch •
Sea r ch for Permits
Fn1r>r lnforrnnUQO"I brliPW fg ,_r-cn ttw ~,m,u.
Sll11 _11,0~1,
contr,11.t:tr,f 1n1 ... ~t•on
Parcal Nurnbc'r
Permit 1n.fo,m•1ton
General Sea'°ch
P•rmlt Number: Parmlt T,rpa.
J"ln,t
l'""d Oata· )
lil/.l.1/.)0\!. @
N11me or Du•lno!ii•
Exhibit 2: Advanced search in Citizen Access
Agreement with Accela, lnc./Specifications and Requirements/Exhibit F Page 4 of 10 Among the many citizen privileges available, external users can take advantage of the following capabilities:
•
Apply for permits •
View solution generated
ale1is and notifications
•
Research parcels using Esri
GIS •
View a history of all
•
Submit complaints
complaints/requests
•
Conduct searches
•
Submit requests for service
•
Check status of •
Pay fees
applications, permits, and •
View data on maps
inspections
•
Search addresses/parcel
•
Upload electronic plans and information
other documents or
•
Access government
photographs documents
•
View all parcel history
Agreement with Accela , lnc./Specifications and Requirements /Exhibit F Page 5 of 10 Citizen Access is available in English (U.S. and Australian), Spanish, French, Arabic, Chinese, Po1iuguese, and Vietnamese language packs.
Additionally, we developed the solution so that all financial transactions are PCI DSS compliant. Furthennore, our
solution is Section 508c compliant, to make our
products accessible to people with disabilities
- such as blindness and low vision.
Purchase of Citizen Access includes the mobile
application, Mobile Citizen Access, which
further enhances accessibility options for
public users. Constituents now enjoy a truly
mobile access to government data, using iOS or
Android devices.
Citizen Access inherits the exact business rules
established in Land Management. System
administrators simply select which service
request activities are to be made available to
the public. Additionally, the Civic Platform
utilizes one central database-data submitted
through Citizen Access is immediately
available for processing by back office users in Land Management.
GIS
The Civic Platform includes GIS functionality out of the box to help streamline mapping processes. The technology integration offers governments a geographic view of all land-use, zoning and infrastructure information associated with parcels, permits, inspections, and service requests, and works seamlessly with Esri maps, layering the information for increased visibility. The Civic Platfonn map component is built using the Esri JavaScript map control and consumes GIS services published from the agency's ArcGIS Server or ArcGIS Online, as well as can consume Open Geospatial Cons01iium Web Mapping and Web Feature Service map services.
GIS also provides visualization of an agency's government data geographically by plotting locations of activities captured in the Civic Platfonn on the map. GIS provides enhanced user experience with • Optimal server response times
• Smooth pa1ming
• Context-sensitive commands and menu items
Agreement with Accela, lnc./Specificat ions and Requirements/Exhibit F Page 6 of 10 • Drag and drop functionality
• Client side graphic rendering
Q. .. ... . a 61 .. , 0
~ Ii
' • .. 7 . '~
( • r.t
J: . _,_ C
I . ,._
\
r ! l . -r4 ... _ . --
j
I -
I ,{
-r
\
\
I - _(
r \ I I _,
n \ I ~~ - I
Exhibit 3: GIS Map Interface
Accela's GIS gives users the option to initiate and manage all land management activities from a map interface. GIS is a bi-directional interface enabling viewing, interaction, and presentation of both tabular and spatial information. It leverages an agency's GIS database and map services published by one or more ArcGIS Servers. Base maps published from one agency can be combined with map data from another agency to provide a comprehensive view of geographic information. .. ..
lluld"'9footp,lrN jll
Q l"lroal, 111
AddrtN Polnt1 I 41
UNtl'IIILoololloll
1 '1'C111CSIUM1t!IIIOm'.-~
! L- .
Agreement with Accela, lnc./Specifications and Requirements/Exhibit F
AECOROS
CMltllUDl)IO<
ONl:1.&Ent .t. GOUJE. .... ~JT
..........
IIEMELl!!l'.C,lt,lk,110
,_
,.,.,.ID , -.,i,..lwtll!OS
"""' 0-. ..............
--~o.•: IDlt-1>1~
...........
-ID: M-1,-«111116
1,,. ,._,
-
o,...n.i. :
,,_.ID ...... tHGIR
'"""' "'_.,........,ucw,, ..
- · .,,_..i,.-. fllJ.IMt
..... , ...,..,
,.__.ID ~
~ ................ ~
-
0,.,-Dii:IL tDi.11-10
-..
,_ID ..,Tl~M~
,,,. . .......... OillJJllc:I
--
Dfl,IIIM.DIII, Zl1'·11•10
-•: ....
-ID: M•~o«.tlo4
,~ 1"'11.'lr'ltCIUllil~
~ .. ,
Dfl,IIIMGIIII : lll1 ►1MD
·-· ..........
Exhibit 4: Share the Civic Platform data in Esri ArcGIS Online Optional map editing tools empower end users to draw new features using points, lines, or polygons to represent actual geographic elements or assets. Once these new features are created, they can be associated with transactions in the Civic Platform database. GIS supp01is efficient fieldwork through its routing features. Inspection schedules can be automatically routed or users can choose to optimize inspection schedules based on shortest distance or travel time.
Agreement with Accela , lnc./Specifications and Requirements/E xhibit F Page 8 of 10 ■ 1 ,
!-~
q
.. ,H,
Exhibit 5: Accela GIS Heat Map
Customers may enhance user views by adding the agency's ArcGIS map layers to the map viewer. Together, these data sources, united with Accela transaction data, offer the most comprehensive visual representation of government and location data available. Users can manage, edit, and update data from the map viewer. The map viewer presents reference data and context-based action items for a selected parcel(s) (i.e., create a record, show record, create inspection, etc.).
When deployed with Mobile, routing capabilities are available whether connected or disconnected from the network. Routes and driving directions can be saved and printed as needed. Optimized routing can be done one of two ways:
1. To use an agency 's street file, that agency needs ArcGIS Server Network Extension and a published routing service. The agency typically creates the network via ArcGIS Desktop and the Network Analyst extension.
2. The agency may not have a quality street file in an Esri GIS format or does not have the additional Esri software list noted above in number one.
Agreement with Accela, lnc./Sp ecifications and Requirements/Exhibit F Page 9 of 10 The following is a list of features/functions that are available out of the box in Accela's GIS solution:
♦ Plotting event locations (address, parcel or asset matching) ♦ Start new application/transaction from selected map feature ♦ Navigation (pan, zoom in/out, zoom to scale/selected/full extent) ♦ Select (by line, polygon, rectangle)
♦ Buffer selection
♦ Attach/associate feature to transaction record
♦ Add selected features to a Set in Accela
♦ Redlining (point, line, polygon and text box)
♦ Identify (click on map and see attributes offeatures) ♦ Reverse geocoding for mobile mapping
0. II
151
M
• Ci
I
\
- -,
P1,~JC-lun~o111il'ri-p«ty
i \L - L
L • l'.l
1 '
7 I
1 _J
• • • 11, • • D D ,
' ), f- -
D ~ l:J ' L I L
4q;..j ljf
.! -=--......
r- ,:::..
j _ .. ,_
Exhibit 6: Redlining in Accela GIS
Agreement with Accela , lnc./Specifications and Requirements /Exhibit F Page 1 O of 1 O
AGREEMENT FOR THE PERFORMANCE OF SUBSCRIBED SERVICES
BY AND BETWEEN THE
CITY OF SANTA CLARA, CALIFORNIA,
AND
ACCELA, INC.
EXHIBIT G
CLOUD SERVICE PROVIDER CHECKLIST
Agreement with Accela, Inc./Cloud Service Provider Checklist /Exhibit G Page I of 35 Title:
Date:
Compliance Audit Planning CO- I co- Do you produce audit assertions Yes. Accela enforces policies and standards that comply with NIST 01 01.1 using a structured, industry accepted 800-53, Audit and Accountability (AU) security controls. format (ex. CloudAudit/A6 URI
Ontology, CloudTrust, SCAP/CYBEX,
GRC XML, ISACA's Cloud Computing
Management Audit/Assurance
Program, etc.)?
Compliance Independent Audits CO- CO- Do you allow Yes. Accela makes the following reports available to clients and 02 02.1 (describe/ exp la in/ attach/ em bed potentia clients with NDA's on file for their review:
associated documents) tenants to • SSAE 16/SOC 2
view your SAS70 Type I1/SSAE 16 • PCI AOC
SOC2/ISAE3402/ISO27001:2005 or • NIST 800-53 Controls Status and POAM summary for any similar third party audit reports? remediation efforts that may be in progress at the time.
Compliance co- Do you conduct Yes. Pentetration tests, that include assessing the infrastructure and
02.2 (describe/ exp la in/ attach/ em bed application, are completed bi-annually. Vulenerability scans are associated documents) network completed monthly.
penetration tests of your cloud
service infrastructure regularly as
prescribed by industry best practices
and guidance?
Compliance co- Do you conduct Yes. Pentetration tests, that include assessing the infrastructure and
02.3 (describe/ exp la in/ attach/ em bed application, are completed bi-annually. Vulenerability scans are associated documents) regular completed monthly.
application penetration tests of your
cloud infrastructure as prescribed by
industry best practices and
guidance?
Compliance co- Do you conduct Yes. External SSAE 16/SOC 2 and PCI audits are completed annualy.
02.4 ( describe/explain/ attach/ embed External NIST 800-53 audits are completed bi-annually. Accela has an associated documents) internal internal audit function that is continuously reviewing compliance with audits regularly as prescribed by specific control families. industry best practices and
guidance?
Compliance CO- Do you conduct Yes. External SSAE 16/SOC 2 and PCI audits are completed annualy.
02.5 (describe/explain/attach/embed External NIST 800-53 audits are completed bi-annually. Accela has an associated documents) external internal audit function that is continuously reviewing compliance with audits regularly as prescribed by specific control families. industry best practices and
guidance?
Compliance CO- Are the results of the network No, due to the sensitive nature of this information. However, result
02.6 penetration tests available to tenants summaries and remediation plans are available for client review. at their request?
Compliance CO- Are the results of internal and
02.7 external audits available to tenants No, due to the sensitive nature of this information. However, result at their request? summaries and remediation plans are available for client review.
Compliance ] Third Party Audits CO- CO- Do you permit tenants to perform No. Due to the instability this may cause in shared tenant I 03 03.1 independent vulnerability environment, this activity is carefully planned and coordinated by I assessments? Accela.
Compliance CO- Do you have
03.2 (describe/ exp la in/ attach/ em bed Yes. Pentetration tests, that include assessing the infrastructure and associated documents) external application, are completed bi-annually. Vulenerability scans are I third-party conduct vulnerability completed monthly.
scans and periodic penetration tests
on your applications and networks?
I
Compliance Contact/ Authority CO- CO- Do you maintain liaisons and points Yes. Accela maintains contact with various parties associated with Maintenance 04 04.1 of contact with local authorities in NIST 800-53, PCI-DSS and SSAE 16 compliance regulations. accordance with contracts and
appropriate regulations?
Compliance Information System CO- CO- Do you have Yes. Tenants are logically segmented at the database attribute level.
Regulatory Mapping 05 05.1 (describe/explain/attach/embed associated documents) the ability to
logically segment or encrypt
customer data such that data may be
produced for a single tenant only,
without inadvertently accessing
a not her tenant's data?
Compliance Intellectual Property
Compliance Intellectual Property
Compliance Intellectual Property
CO-
06 CO-
07 CO-
08 C0-
05.2 CO-
06.1 CO-
07.1 CO-
08.1 Do you have
(describe/exp la in/attach/ em bed
associated documents) capability to
logically segment and recover data for
specific customer in the case of a failur
or data loss?
Do you have
(describe/exp la in/attach/em bed
associated documents) policies and
procedures in place describing what
controls you have in place to protect
tenants intellectual property?
If utilization of tenants services
housed in the cloud is mined for
cloud provider benefit, are the
tenants IP rights preserved?
If utilization of tenants services
housed in the cloud is mined for
cloud provider benefit, do you
provide
(describe/exp la in/ attach/ em bed
associated documents) tenants the
ability to opt-out?
Yes. Tenants are logically segmented at the database attribute level.
Procedures are in place for tenant data restoration.
Yes. Accela has several policies that address confidentiality, integrity and availability of client data.
Accela does not mine client data.
Accela does not mine client data.
- ~~ ------ - - -- - -- -~ -- - - ---~~ --- - - - - ----- -- - ----~-- - --- -- -- - Data Governance
Data Ownership/
Governance Stewardship
DG- DG- Do you follow
01 01.1 (describe/explain/attach/embed
associated documents) a structured
data-labeling standard (ex. ISO
15489, Oasis XML Catalog
Specification, CSA data type
guidance)?
Yes. Accela enforces policies and standards that comply with NIST 800-53, Media Protection (MP) security controls.
Data Classification DG- DG- Do you provide No, however, platform instantiation is carefully managed and Governance 02 02.1 (describe/exp la in/attach/em bed monitored. associated documents) a capability to
identify virtual machines via policy
tags/metadata (ex. Tags can be used
to limit guest operating systems from
booti ng/i nsta ntiati ng/tra ns porting
data in the wrong country, etc.)?
Data DG- Do you provide
Governance 02.2 (describe/ exp la in/ attach/em bed
associated documents) a capability to
identify hardware via policy Yes. All hardware is tracked as part of asset management. tags/metadata/hardware tags (ex.
TXT/TPM, VN-Tag, etc.)?
Data DG-
I
Do you have
Governance 02.3 (describe/exp la in/ attach/ em bed No. associated documents) a capability to
use system geographic location as an
authentication factor?
Data DG- Can you provide
Governance 02.4 (describe/ exp la in/ attach/em bed Yes. All data is housed in the continental United States in either our associated documents) the physical East or West Coast data centers. location/geography of storage of a
tenant's data upon request?
Data DG- Do you allow
Governance 02.5 (describe/ explain/ attach/ em bed No. Accela carefully selects georgraphical locations for services and associated documents) tenants to data based on numerous factors, including throughputassociated with define acceptable geographical physical distance and client load patterns. locations for data routing or resource
instantiation?
Data Handling/ Labeling/ DG- DG- Are Policies and procedures Yes. Accela enforces policies and standards that comply with NIST Governance Security Policy 03 03.1 established for labeling, handling and 800-53, Media Protection (MP) security controls. security of data and objects, which
contain data?
Data DG- Are mechanisms for label inheritance
Governance 03.2 implemented for objects that act as Applications do not use data labeling. aggregate containers for data? Although Public or private/sensitive data are implied during system implementation/configuration, it is which controlled by access rights.
At the application level, 'sensitive data' is managed by leveraging hashing & encryption algorithms.
No labeling is used at the database level.
Data Retention Policy DG- DG- Do you have Accela does not delete or archive client data. Clients have the Governance 04 04.1 (describe/explain/ attach/ em bed capability, via the user interface or a special Services request, to associated documents) technical delete and archive data. control capabilities to enforce tenant
data retention policies?
Data DG- Do you have
Governance 04.2 (describe/exp la in/ attach/ em bed Yes. Accela does not grant requests for client data from 3rd parties or associated documents) a governments unless required by written subpoena. documented procedure for
responding to requests for tenant
data from governments or third
parties?
Data Secure Disposal DG- DG- Do you support Data is deleted but no extra steps to wipe slack space are taken. That Governance 05 05.1 (describe/exp la in/ attach/ em bed data is reclaimed and used by other DB segments as part of normal associated documents) secure processing.
deletion (ex. degaussing/
cryptographic wiping) of archived
data as determined by the tenant?
Data DG- Can you provide Data is deleted but no extra steps to wipe slack space are taken. That Governance 05.2 (describe/exp la in/attach/ em bed data is reclaimed and used by other DB segments as part of normal associated documents) a published processing.
procedure for exiting the service
arrangement, including assurance to
sanitize all computing resources of
tenant data once a customer has
exited your environment or has
vacated a resource?
1 Data I Nonproduction Data DG- DG- Do you have Yes. Accela has policies in place prohibiting the exporting of Governance I 06 06.1 (describe/ exp la in/attach/ em bed production data to non-production environments with the exception I associated documents) procedures in of using sanitized production data for testing and troubleshooting place to ensure production data shall purposes.
not be replicated or used in non-
production environments?
Data Information Leakage DG- DG- Do you have Yes.
Governance 07 07.1 (describe/ exp la in/attach/ em bed
associated documents) controls in
place to prevent data leakage or
intentional/accidental compromise
between tenants in a multi-tenant
environment?
Data DG- Do you have Yes.
Governance 07.2 (describe/exp la in/attach/ em bed
associated documents) a Data Loss
Prevention {OLP) or extrusion
prevention solution in place for all
systems which interface with your
cloud service offering?
Data Risk Assessments DG- DG- Do you provide Security & Complaince control status information is available to all Governance 08 08.1 (describe/exp la in/ attach/ em bed clients upon request. associated documents) security
control health data in order to allow
tenants to implement industry
standard Continuous Monitoring
(which allows continual tenant
validation of your physical and logical
control status?)
- - -- - - - - - - - - -
Facility Security
Facility Policy FS- FS- Can you provide Yes. Accela enforces policies and standards that comply with the NIST Security 01 01.1 (describe/ exp la in/ attach/ em bed 800-53 family of controls. associated documents) evidence that
policies and procedures have been
established for maintaining a safe
and secure working environment in
offices, rooms, facilities and secure
areas?
Facility User Access FS- FS- Pursuant to local laws, regulations, Yes. Per Accela Background Check policy, background checks are Security 02 02.1 ethics and contractual constraints are conducted on all permanent employees and contractors. all employment candidates,
contractors and third parties subject
to background verification?
Facility Controlled Access FS- FS- Are physical security perimeters Yes. All data centers and work areas have standard physical controls in Security Points 03 03.1 (fences, walls, barriers, guards, gates, place. Data centers comply with SSAE 16 compliance. electronic surveillance, physical
authentication mechanisms,
reception desks and security patrols)
implemented?
Facility Secure Area FS- FS- Do you allow No. Accela carefully selects georgraphical locations for services and Security Authorization 04 04.1 (describe/explain/ attach/ em bed data based on numerous factors, including throughput associated with associated documents) tenants to physical distance and client-load patterns. specify which of your geographic
locations their data is allowed to
traverse into/out of (to address legal
jurisdictional considerations based
on where data is stored vs.
I accessed)?
Facility Unauthorized FS- FS- Are ingress and egress points such as Yes. Accela enforces policies and standards that comply with the NIST Security Persons Entry 05 05.1 service areas and other points where 800-53 family of controls. unauthorized personnel may enter
the premises monitored, controlled
and isolated from data storage and
process?
Facility Offsite FS- FS- Do you provide Yes. Accela enforces policies and standards that comply with NIST Security Authorization 06 06.1 (describe/ exp la in/attach/ em bed 800-53, Physical and Environmental Protection (PE) security controls. associated documents) tenants with
documentation that describes
scenarios where data may be moved
from one physical location to
another? (ex. Offsite backups,
business continuity failovers,
replication)
Facility Offsite equipment FS- FS- Do you provide Yes. Accela enforces policies and standards that comply with NIST Security 07 07.1 (describe/exp la in/attach/ em bed 800-53, Media Protection (MP) security controls. associated documents) tenants with
documentation describing your
policies and procedures governing
asset management and repurposing
of equipment?
Facility Asset Management FS- FS- Do you maintain a complete Yes All critical assets are maintained in the Configuration Management Security 08 08.1 inventory of all of your critical assets, Database (CMDB) and updated throughthe use of Accela's Change which includes ownership of the Managemeent process.
asset?
Facility FS- Do you maintain a complete
Security 08.2 inventory of all of your critical Yes. Our contract management function maintains this list. supplier relationships?
Human Resources Security
Human Background HR- HR- Pursuant to local laws, regulations, Yes. Per Accela Background Check policy, background checks are Resources Screening 01 01.1 ethics and contractual constraints are conducted on all permanent employees and contractors.
Security all employment candidates,
contractors and third parties subject
to background verification? What is
checked during the background
verification?
Employment HR- HR- Do you specifically train your Yes. All Accela employees are required to participate in required, Agreements 02 02.1 employees regarding their role vs. annual Security and Complaince awareness classes.
Human the tenant's role in providing
Resources information security controls?
Security HR- Do you document employee
02.2 acknowledgment of training they Yes. This is systematically captrured in our centralized training system. have completed?
I
Human Employment HR- HR- Are Roles and responsibilities for Yes.
Resources Termination 03 03.1 following performing employment Security termination or change in
employment procedures assigned,
documented and communicated?
Information Security
Information Management IS- IS- Do you provide Yes. Various security and compliance artifacts, including security Security Program 01 01.1 (describe/ exp la in/ attach/ em bed control status, Plaon of Action and Milestones (POAM), and various associated documents) tenants with types of complaince reports or attestation of compliance (AOC) are documentation describing your available upon request
Information Security Management
Program (ISMP)?
Information Management IS- IS- Are policies Yes. Accela publishes and maintains and Information Technology and Security Support/ 02 02.1 (describe/exp la in/ attach/ em bed Security Standards documentation that is distributed to all applicable Involvement associated documents) in place to team members . ensure executive and line
management take formal action to Executive management reviews and approves security and complaince support information security through roadmaps and POAMS. clear documented direction ,
commitment, explicit assignment and
verification of assignment execution?
Information Policy IS- IS- Do your information security and Yes. Thety are aligned with NIST 800-53, PCI and SSAE 16 controls.
Security 03 03.1 privacy policies align with particular
industry standards (ISO-27001, ISO-
22307, CoBIT, etc.)?
IS- Do you have
03.2 (describe/ exp la in/attach/ em bed Yes. Accela has Interconnect Agreements in place. associated documents) agreements,
which ensure your providers adhere
to your information security and
privacy policies?
IS- Can you provide
03.3 (describe/exp la in/attach/ em bed Yes. Detailed control status and POAM's are available upon request. associated documents) evidence of
due diligence mapping of your
controls, architecture and processes
to regulations and/or standards?
Information Baseline IS- IS- Do you have Yes. Baselines are documented for critical components. These Security Requirements 04 04.1 (describe/exp la in/attach/ em bed baselines are reviewed and potentially adjusted annualy. associated documents) documented
information security baselines for
every component of your
infrastructure (ex. Hypervisors,
operating systems, routers, DNS
servers, etc.)?
Information IS- Do you have Yes. Accela's internal audit function regularly audits security controls Security 04.2 (describe/exp la in/ attach/ em bed and reports results, which consequently transition into a Plan of Action associated documents) a capability to and Milestone (POAM). continuously monitor and report the
compliance of your infrastructure
against your information security
baselines?
Information IS- Do you allow No.
Security 04.3 (describe/exp la in/ attach/ em bed
associated documents) your clients
to provide their own trusted virtual
machine image to ensure
conformance to their own internal
standards?
Information Policy Reviews IS- IS- Do you notify your tenants when you No. However, Accela's security and complaince status are readiuly Security 05 05.1 make material changes to your available for client review. information security and/or privacy
policies?
Information Policy Enforcement IS- IS- Is a formal disciplinary or sanction Yes. This is specifically managed Human Resources and the resource Security 06 06.1 policy established for employees who manager. have violated security policies and
procedures?
Information IS- Are employees made aware of what Yes.
Security 06.2 action might be taken in the event of
a violation and stated as such in the
policies and procedures?
Information User Access Policy IS- IS- Do you have Yes. Accela enforces policies and standards that comply with NIST Security 07 07.1 (describe/ exp la in/ attach/ em bed 800-53, Access Control (AC) security controls. associated documents) controls in
place ensuring timely removal of
systems access, which is no longer
required for business purposes?
Information IS- Do you provide Yes. Timely deactivation of accounts is governed by policy.
Security 07.2 (describe/ exp la in/ attach/ em bed
associated documents) metrics that
track the speed with which you are
able to remove systems access which
is no longer required for business
I
purposes?
Information User Access IS- IS- Do you document how you grant and Internal access requests from Accela team members is reviewed Security Restriction/ 08 08.1 approve access to tenant data? through the use of the change management process and explicit Authorization approval is required by the Change Management Review Board (CMRB). All change management activity is recorded using an enterprise change management tool.
Information IS- Do you have Yes. Accela adhered to a data classification methodology.
Security 08.2 (describe/exp la in/attach/ em bed
associated documents) a method of
aligning provider and tenant data
classification methodologies for
access control purposes?
Information User Access IS- IS- Is timely de-provisioning, revocation Yes. Timely deactivation of accounts is governed by policy.
Security Revocation 09 09.1 or modification of user access to the organizations systems, information
assets and data implemented upon
any change in status of employees,
contractors, customers, business
partners or third parties?
Information IS- Is any change in status intended to Yes. Status changes requiring access review include termination, role Security 09.2 include termination of employment, change or department transfer. contract or agreement, change of
employment or transfer within the
organization?
Information User Access Reviews IS- IS- Do you require at least annual Yes. Accela adhered to bi-annual and annual policy, procedure and Security 10 10.1 certification of entitlements for all standards review, which includes entitlements. system users and administrators
I (exclusive of users maintained by
your tenants)?
Yes. The incident and change management processes are used.
Information IS- If users are found to have
Security 10.2 inappropriate entitlements, are all
remediation and certification actions
recorded? Yes.
Information IS- Will you share user entitlement
Security 10.3 remediation and certification reports
with your tenants, if inappropriate
access may have been allowed to
tenant data?
Information Training/ IS- IS- Do you provide Yes. All Accela employees are required to participate in required, Security Awareness 11 11.1 (describe/explain/attach/ em bed annual Security and Complaince awareness classes. associated documents) or make
available a formal security awareness
training program for cloud-related
access and data management issues
(i.e., multi-tenancy, nationality, cloud
delivery model segregation of duties
implications, and conflicts of interest)
for all persons with access to tenant
data?
Information IS- Are administrators and data stewards
Security 11.2 properly educated on their legal
responsibilities with regard to
security and data integrity?
Information Industry Knowledge IS- IS- Do you participate in industry groups Yes. Some of the groups Accela is associated with are ISACA, (ISC)2, Security / Benchmarking 12 12.1 and professional associations related NIST, US-Cert. to information security?
IS- Do you benchmark your security Yes. NIST 800-53 and PCI are reviewed on a continuous basis by our
12.2 controls against industry standards? internal audit team for compliance. External audits are conducted annualy.
Information Roles/ IS- IS- Do you provide Yes.
Security Responsibilities 13 13.1 (describe/explain/attach/ em bed associated documents) tenants with
a role definition document clarifying
your administrative responsibilities
vs. those of the tenant?
Information Management IS- IS- Are Managers responsible for Yes. Security policies and procedures are reviewed annually with Security Oversight 14 14.1 maintaining awareness of and managers. Managers are expected to deessiminate relevant complying with security policies, information to staff. procedures and standards that are
relevant to their area of
responsibility?
Information Segregation of IS- IS- Do you provide Yes. Information is available upon request.
Security Duties 15 15.1 (describe/explain/attach/embed
associated documents) tenants with
documentation on how you maintain
segregation of duties within your
cloud service offering?
Information User Responsibility IS- IS- How are users made aware oftheir Security 16 16.1 responsibilities for maintaining Accela uses the Security and Compliance awareness program to awareness and compliance with achieve this goal. Additionally, meetings are help on as needed nasis published security policies, to review policies with stakeholders, especially if material changes procedures, standards and applicable have been made to these documents. regulatory requirements?
Information IS- How are users made aware of their Accela uses the Security and Compliance awareness program to Security 16.2 responsibilities for maintaining a safe achieve this goal. and secure working environment?
Information IS- How are users made aware of their
Security 16.3 responsibilities for leaving Accela communicates these requirements through the on-boarding unattended equipment in a secure process and is governed by security policies. manner?
Information Workspace IS- IS- Do your data management policies Although this is not explicitly addressed within our policies, however, Security 17 17.1 and procedures address tenant and Accela is committed to remediating any SLA/service conflicts with our service level conflicts of interests? clients. To date, this has not been an area of contention or conflict Information IS- Do your data management policies with our clients.
Security 17.2 and procedures include a tamper
audit or software integrity function Yes. Data integrity algorithms are enforce. Log activity is also for unauthorized access to tenant monitored on a periodic basis. data?
Information IS- Does the virtual machine
Security 17.3 management infrastructure include a Yes. Baselines are defined and used to detect changes to the tamper audit or software integrity build/configuration of the VM's function to detect changes to the
1 build/configuration of the virtual I !
!
machine?
Information Encryption IS- IS- Do you have i Encryption keys are not unique per tenant.
Security 18 18.1 (describe/explain/attach/embed
associated documents) a capability to
allow creation of unique encryption
keys per tenant?
Information IS- Do you support No. This is not practical in a multi-tenant environment with shared Security 18.2 (describe/ explain/attach/ em bed data stores. associated documents) tenant
generated encryption keys or permit
tenants to encrypt data to an identity
without access to a public key
certificate. (E.g. Identity based
encryption)?
Information Encryption Key IS- IS- Do you encrypt tenant data at rest Yes. Data at rest and in transit are encypted.
Security i Management 19 19.1 (on disk/storage) within your I environment? I
Information IS- Do you leverage encryption to Yes.
Security 19.2 protect data and virtual machine
images during transport across and
between networks and hypervisor
instances?
Information IS- Do you have Yes.
Security 19.3 (describe/explain/ attach/ em bed
associated documents) a capability to
manage encryption keys on behalf of
tenants?
Information IS- Do you maintain key management Yes. This is integrated into Accela Information Technology and Security 19.4 procedures? Security Standards.
Information Vulnerability/ Patch IS- IS- Do you conduct Yes. This is conducted on a monthly basis.
Security Management 20 21.1 (describe/explain/attach/embed associated documents) network-layer
vulnerability scans regularly as
prescribed by industry best
practices?
Information IS- Do you conduct i Yes. This is conducted on an annual basis or as deemed necessary due Security 20.2 (describe/explain/attach/embed to signifincat changes. , associated documents) application-
I layer vulnerability scans regularly as l
I prescribed by industry best
practices?
Information IS- Do you conduct
Security 20.3 (describe/explain/attach/embed Yes. This is conducted on a monthly basis. associated documents) local
operating system-layer vulnerability
scans regularly as prescribed by
industry best practices?
High-level summary of findings, along with general remediation plans Information IS- Will you make the results of Security 20.4 vulnerability scans available to may be made available to tenants upon request. Detailed vulnerability tenants at their request? scan and penetration test results are general not available due to the Information IS- Do you have sensitive nature ofthis information.
Security 20.5 (describe/explain/attach/embed
associated documents) a capability to Yes. This is systematically perfomed on a regular basis. rapidly patch vulnerabilities across all
of your computing devices,
applications, and systems?
Yes. Information IS- Will you provide your risk-based
Security 20.6 systems patching timeframes to your
tenants upon request?
Information Antivirus / Malicious IS- IS- Do you have Yes. These programs are updated on a regular basis.
Security Software 21 21.1 (describe/explain/attach/embed associated documents) anti-malware
programs installed on all systems
that support your cloud service
offerings?
Information IS- Do you ensure that security threat Accela has IDS capabilities deployed in a limited fashion. Accela's IDS Security 21.2 detection systems that use capabilities is currently under review. The goal is to define an signatures, lists, or behavioral enterprise strategy across all data centers., m. patterns are updated across all
infrastructure components within
industry accepted timeframes?
Information Incident IS- IS- Do you have Yes. Accela enforces policies and standards that comply with NIST Security Management 22 22.1 (describe/explain/attach/ em bed 800-53, Incident Response (IR) security controls. associated documents) a
documented security incident
response plan?
Information
I
IS- Do you integrate customized tenant Accela is committed to continuous improvement of the IR processes Security I 22.2 requirements into your security and welcomes client feedback that may be incorporated as enterprise I
incident response plans? standards.
1 Information IS- Do you publish a roles and
Security 22.3 responsibilities document specifying Tennant responsibilities are not included yet. This will be considered what you vs. your tenants are in the roles and responsibilities section of a futire version ofthe IR responsible for during security policy.
incidents?
Information Incident Reporting IS- IS- Does your security information and Yes. Bl tools are used against the merged results to conduct analysis Security 23 23.1 event management (SIEM) system and generate trending data. merge data sources (app logs,
firewall logs, IDS logs, physical access
logs, etc.) for granular analysis and
alerting?
Information IS- Does your logging and monitoring Yes.
Security 23.2 framework allow isolation of an
incident to specific tenants?
Information Incident Response IS- IS- Does your incident response plan Yes. Accela enforces policies and standards that comply with NIST Security Legal Preparation 24 24.1 comply with industry standards for 800-53, Incident Response (IR) security controls. legally admissible chain-of-custody
management processes & controls?
Information IS- Does your incident response Yes.
Security 24.2 capability include the use of legally
admissible forensic data collection
and analysis techniques?
Information IS- Are you capable of supporting Yes. Point in time archives may be completed for this purpose.
Security 24.3 litigation holds (freeze of data from a
specific point in time) for a specific
tenant without freezing other tenant
data?
Information IS- Do you enforce and attest to tenant Yes. Tenant data separation is accomplished through the use of logical Security 24.4 data separation when producing data controls. in response to legal subpoenas?
Information Incident Response IS- IS- Do you monitor and quantify the Yes. The IR ifecycle includes, identification, validation, inpact anaylsis Security Metrics 25 25.1 types, volumes, and impacts on all and after-incident debriefs. information security°incidents?
Information IS- Will you share statistical information Yes.
Security 25.2 security incident data with your
tenants upon request?
Information Acceptable Use IS- IS- Do you provide Yes. Accela discloses how it uses tenant data. Tennat data is not sold Security 26 26.1 (describe/explain/attach/ em bed or shared with external entities unles required by law. associated documents)
documentation regarding how you
may utilize or access tenant data
and/or metadata?
Information IS- Do you collect or create metadata Yes. This is mainly done to help with product and feature road maps.
Security 26.2 about tenant data usage through the
use of inspection technologies
(search engines, etc.)?
Information IS- Do you allow No, since this is performed strictly for Accela-internal use and to help Security 26.3 (describe/ exp la in/ attach/ em bed improve the product. associated documents) tenants to
opt-out of having their
data/metadata accessed via
inspection technologies?
Information Asset Returns IS- IS- Are systems in place to monitor for Yes.
Security 27 27.1 privacy breaches and notify tenants
expeditiously if a privacy event may
have affected their data?
Information IS- Is your Privacy Policy aligned with Yes. Nist 800-53 security and privacy controls.
Security 27.2 industry standards? What standards
are they aligned to?
Information e-commerce IS- IS- Do you provide Yes.
Security Transactions 28 28.1 (describe/explain/ attach/ em bed associated documents) open
encryption methodologies (3.4ES,
AES, etc.) to tenants in order for
them to protect their data if it is
required to traverse public
networks? (ex. the Internet)
Information IS- Do you utilize open encryption Yes.
Security 28.2 methodologies any time your
infrastructure components need to
communicate to each other over
public networks {ex. Internet-based
replication of data from one
environment to another)?
Information Audit Tools Access IS- IS- Do you restrict, log, and monitor Yes. Only select roles are granted access to these coponents.
Security 29 29.1 access to your information security
management systems? (Ex.
Hypervisors, firewalls, vulnerability
scanners, network sniffers, APls, etc.)
Information Diagnostic/ IS- IS- Do you utilize dedicated secure Yes.
Security Configuration Ports 30 30.1 networks to provide management Access access to your cloud service
infrastructure?
Information Network/ IS- IS- Do you collect capacity and Yes.
Security Infrastructure 31 31.1 utilization data for all relevant ' Services components of your cloud service I
i
offering?
Information IS- Do you provide Capacity planning and utilization reports are internally monitored to Security 31.2 {describe/explain/attach/embed provide clients with adequate support and resources. This information associated documents) tenants with may be made available upon request. capacity planning and utilization
reports?
Information Portable/ Mobile IS- IS- Are policies Yes. Accela enforces policies and standards that comply with NIST Security Devices 32 32.1 (describe/explain/attach/embed 800-53, Media Protection (MP} security controls. associated documents) and
procedures established and
measures implemented to strictly
limit access to sensitive data from
portable and mobile devices, such as
laptops, cell phones, and personal
digital assistants (PDAs), which are
generally higher-risk than non-
portable devices (e.g., desktop
computers at the provider
organization's facilities)?
Information Source Code Access IS- IS- Are controls in place to prevent Yes. Access control is role based and carefully monitored. Access Security Restriction 33 33.1 unauthorized access to your rights are audited on a periodic basis. application, program or object source
code, and assure it is restricted to
authorized personnel only?
Information IS- Are controls in place to prevent Yes. Access control is role based and carefully monitored. Access Security 33.2 unauthorized access to tenant rights are audited on a periodic basis. application, program or object source
code, and assure it is restricted to
authorized personnel only?
Information Utility Programs IS- IS- Are utilities that can significantly Yes. Access control is role based and carefully monitored. Access Security Access 34 34.1 manage virtualized partitions (ex. rights are audited on a periodic basis. shutdown, clone, etc.) appropriately
restricted and monitored?
Information IS- Do you have The virtual infrastructure is not a component of the presentation layer.
Security 34.2 (describe/explain/attach/embed ESXi firewalls are in place with limited open ports. ESXi 6 hardening associated documents) a capability to methods are generally used which serve as prenetative measures detect attacks which target the against threats such as "blue pill". virtual infrastructure directly (ex.
shimming, Blue Pill, Hyper jumping,
etc.)?
I
Information
Security
Legal
Legal
Legal
Legal
Legal
Nondisclosure
Agreements
Third Party
Agreements
I Operations Management
· Operat ions Policy
Management
LG-
01 LG-
02 IS- Are attacks that target the virtual
34.3 infrastructure prevented with
technical controls?
LG- Are requirements for non-disclosure
01.1 or confidentiality agreements
reflecting the organization 's needs for
the protection of data and operational
details identified, documented and
reviewed at planned intervals?
LG- Do you select and monitor outsourced
02.1 providers to verify that they comply
with laws in the country where the
data is processed and stored and
transmitted?
LG- Do you select and monitor outsourced
02.2 providers in compliance with laws in
the country where the data
originates?
LG- Does legal counsel review all third
02.3 party agreements ?
OP- OP- Are policies
01 01.1 (describe/explain/attach/embed
associated documents) and
procedures established and made
available for all personnel to
adequately support services
operations roles?
Yes.
Yes, these items are documented and reviewed on planned intervals .
Legal places requirements in contracts that are passed through for these types of data issues, and our provides comply.
Yes, we address for Canada and the United States. The Mideast and SOPAC are managed separately.
Yes, legal reviews.
Yes. Polcies and standards are periodically reviewed with personnel and are also made available post-review .
Operations Documentation OP- OP- Are Information system Yes. System documentation is periodically reviewed with personnel Management 02 02.1 documentation (e.g., administrator and are also made available post-review. Secuirty baselines have been and user guides, architecture established and incorporated into Information Technology and diagrams, etc.) made available to Security standards.
authorized personnel to ensure
configuring, installing, and operating
the information system is completed
and performed correctly?
Operations Capacity/ Resource OP- OP- Do you provide No.
Management Planning 03 03.1 (describe/explain/ attach/ em bed associated documents)
documentation regarding what levels
of system (network, storage,
memory, 1/0, etc.) oversubscription
you maintain and under what
cir cu msta nces/scena rios?
Operations OP- Do you restrict use of the memory Yes, however, these limits are usually not reached.
Management 03.2 oversubscription capabilities present
in the hypervisor?
Operations Equipment OP- OP- If using virtual infrastructure, does Yes.
Management Maintenance 04 04.1 your cloud solution include hardware independent restore and recovery
capabilities?
Operations OP- If using virtual infrastructure, Do you Tenant data may be restored to particular point in time.
Management 04.2 provide
(describe/explain/attach/ em bed
associated documents) tenants with
a capability to restore a Virtual
Machine to a previous state in time?
Operations OP- If using virtual infrastructure, Do you No. This is shared environment with multiple tenants.
Management 04.3 allow
(describe/exp la in/ attach/ em bed
associated documents) virtual
machine images to be downloaded
and ported to a new cloud provider?
Operations OP- If using virtual infrastructure, are
Management 04.4 machine images made available to No.
the customer in a way that would
allow the customer to replicate those
images in their own off-site storage
location?
Operations OP- Does your cloud solution include Yes.
Management 04.5 software/ provider independent
restore and recovery capabilities?
Risk Management
Risk Program RI- RI- Is your organization insured by a 3rd Management 01 01.1 party for losses?
Risk RI- Do your organization's service level We do provide downtime credits for unplanned unavailability for Management 01.2 agreements provide tenant Subscription/Hosting per those standard agreements . remuneration for losses they may
incur due to outages or losses
experienced within your
infrastructure?
i Risk Assessments RI- RI- Are formal risk assessments aligned Yes. Risk assesmenst are conducted in tandem with internal, external Management 02 02.1 with the enterprise-wide framework audits. and performed at least annually, or
at planned intervals, determining the
likelihood and impact of all identified
risks, using qualitative and
quantitative methods?
Risk RI- Is the likelihood and impact Yes, but not using formal methods.
Management 02.2 associated with inherent and residual
risk determined independently,
considering all risk categories (e.g.,
audit results, threat and vulnerability
analysis, and regulatory compliance)?
Risk Mitigation/ RI- RI- Are risks mitigated to acceptable Yes. In areas where company-wide criteria is not pre-defined, Management Acceptance 03 03.1 levels based on company-established management reviews risks on an as-needed basis. criteria in accordance with
reasonable resolution time frames?
RI- RI- Is remediation conducted at Yes. In areas where company-wide criteria is not pre-defined, 03 03.2 acceptable levels based on company- management reviews remediation plans and residual risk on an as- established criteria in accordance needed basis.
with reasonable time frames?
Risk Business/ Policy RI- RI- Do risk assessment results include Risk assessments are evaluation and consequently, a remediation plan : Management Change Impacts 04 04.1 updates to security policies, is developed and managed to completion. Annual reviews are procedures, standards and controls conducted to maintain relevance with policies and standards. to ensure they remain relevant and
effective?
I
Risk Third Party Access RI- RI- Do you provide Yes this is included in Accela's Business Continuity Plan {BCP). I Management 05 05.1 {describe/exp la in/ attach/ em bed
associated documents) multi-failure
disaster recovery capability?
RI- Do you monitor service continuity Accela works closely with service providers during and post incident
05.2 with upstream providers in the event activity.
of provider failure?
RI- Do you have
05.3 (describe/explain/ attach/ em bed Yes for infrastructure, critical components and services. associated documents) more than
one provider for each service you
depend on?
RI- Do you provide
05.4 (describe/explain/attach/embed Yes, upon request.
associated documents) access to
operational redundancy and
continuity summaries that include
the services on which you depend?
RI- Do you provide
05.5 {describe/ explain/ attach/em bed No, however, the client may be a key stakeholder to validate a associated documents) the tenant declaration of a disaster depending the extent, location and impact of the ability to declare a disaster? such an event.
RI- Do you provide
05.6 (describe/explain/attach/embed
associated documents) a tenant
triggered failover option?
RI- Do you share your business
05.7 continuity and redundancy plans
with your tenants?
No. Failover options are managed by Accela personnel.
Yes upon request.
- - -- - - - --- -- - - - -- ---~-~ - - - -- -~-- -- -- - - - -- - --- -- - - - Release Management
Release New Development/ RM- RM- Are policies Yes. Accela enforces policies and standards that comply with NIST 800-53, Service Acquisition (SA) security controls. Management Acquisition 01 01.1 (describe/explain/attach/embed Release Production Changes
Management
Release Quality Testing
Management
Release Outsourced
Management Development
RM- RM-
02 02.1
RM- RM-
03 03.1
RM- RM-
04 04.1
associated documents) and
procedures established for
management authorization for
development or acquisition of new
applications, systems, databases,
infrastructure, services, operations,
and facilities?
Do you provide Yes, upon request
(describe/exp la in/ attach/ em bed
associated documents) tenants with
documentation which describes your
production change management
procedures and their
roles/rights/responsibilities within it?
Do you provide Yes, upon request.
(describe/explain/attach/embed
associated documents) your tenants
with documentation which describes
your quality assurance process?
Do you have
(describe/exp la in/attach/ em bed
associated documents) controls in
place to ensure that standards of
Yes. They are available for review upon request .
quality are being met for all software
development?
Release RM- Do you have Yes. Detailed code walk-throughs are part of our security review Management 04.2 (describe/explain/attach/ em bed process. associated documents) controls in
place to detect source code security
defects for any outsourced software
development activities?
Release Unauthorized RM- RM- Do you have Yes. This is governed by policy . Additionally, periodic review of Management Software 05 05.1 (describe/ explain/ attach/ em bed software and system configurations (bi-annual and annual, depending Installations associated documents) controls in on the subject area). place to restrict and monitor the
installation of unauthorized software
onto your systems?
Resiliency
Resiliency Management RS- RS- Are Policy, process and procedures Yes. Accela has Business Continuity Process (BCP) and Disaster Program 01 01.1 defining business continuity and Recovery (DR) plans enforce. disaster recovery in place to
minimize the impact of a realized risk
event and properly communicated to
tenants?
Resiliency Impact Analysis RS- RS- Do you provide Yes. This is available upon request. 02 02.1 (describe/explain/attach/embed
associated documents) tenants with
ongoing visibility and reporting into
your operational Service Level
Agreement (SLA) performance?
Resiliency RS- Do you make standards-based This capability is currently under development.
02.2 information security metrics (CSA,
CAMM, etc.) available to your
tenants?
Resiliency RS- Do you provide Yes. This is available upon request.
02.3 {describe/ explain/attach/ em bed
associated documents) customers
with ongoing visibility and reporting
into your SLA performance?
Resiliency Business Continuity RS- RS- Do you provide Yes. Accela has established a DR plan that includes a geographically, Planning 03 03.1 {describe/explain/attach/embed separate DR data center. associated documents) tenants with
geographically resilient hosting
options?
Resiliency RS- Do you provide Accela manages all infrastructure failover capabilities, including ones
03.2 i {describe/explain/attach/embed associated with services provided by other providers. associated documents) tenants with
infrastructure service failover
I I
capability to other providers?
I
Resiliency Business Continuity RS- I RS- Are business continuity plans subject Yes. Accela tests a variety of plans on an annual basis, incuding Testing 04 04.1 to test at planned intervals or upon Incident Response and related plans such as BCP and DR. significant organizational or
environmental changes to ensure
continuing effectiveness?
Resiliency Environmental Risks RS- RS- Is physical protection against damage Yes. This is incorporated in Accela's Business Continuity Plan (BCP). 05 05.1 from natural causes and disasters as
well as deliberate attacks
anticipated, designed and
countermeasures applied?
l
Resiliency Equipment Location RS- RS- Are any of your datacenters located No. Accela has taken great care in selecting production and disaster 06 06.1 in places which have a high recovery data centers. probability/occurrence of high-
l impact environmental risks (floods, i
i
I tornadoes, earthquakes, hurricanes, I
I
i etc.)?
I
Resiliency Equipment Power RS- RS- Are Security mechanisms and Yes. Comprehensive power redundancy is in place.
Failures 07 07.1 redundancies implemented to
protect equipment from utility
service outages (e.g., power failures,
network disruptions, etc.)?
Resiliency Power/ RS- RS- Do you provide Not usually, however, this is an area that may be revisited especially I Telecommunications 08 08.1 (describe/explain/attach/embed the context of a related incident. All network traffic is constrained to associated documents) tenants with continental United States. documentation showing the
transport route of their data
between your systems?
Resiliency RS- Can Tenants define how their data is No. All network traffic is constrained to continental United States.
08.2 transported and through which legal
jurisdiction?
- - - - - - - - - - - -
Security Architecture
Security Customer Access SA- SA- Are all identified security, contractual Yes.
Architecture Requirements 01 01.1 and regulatory requirements for customer access contractually
addressed and remediated prior to
granting customers access to data,
assets and information systems?
Security User ID Credentials SA- SA- Do you support Not at the moment, however, this is actively being pursued and it is on Architecture 02 02.1 (describe/exp la in/ attach/em bed the product roadmap. associated documents) use of, or
integration with, existing customer-
based Single Sign On (SSO) solutions
to your service?
Security SA- Do you use open standards to Yes.
Architecture 02.2 delegate authentication capabilities
to your tenants?
Security SA- Do you support Not at the moment, however, this is actively being pursued and it is on Architecture 02.3 (describe/ exp la in/attach/ em bed the product roadmap. associated documents) identity
federation standards (SAML, SPML,
WS-Federation, etc.) as a means of
authenticating/authorizing users?
Security SA- Do you have Accela uses Active Directory (AD).
Architecture 02.4 (describe/exp la in/attach/em bed
associated documents) a Policy
Enforcement Point capability (ex.
XACML} to enforce regional legal and Although role-based identity management is in place, it is not done policy constraints on user access? systematically, yet.
I Not at the moment, however, this is actively being pursued and it is on the product roadmap.
Security SA- Do you have
Architecture 02.5 (describe/explain/attach/embed Agency administrators can restrict users in the system to groups which associated documents} an identity have different levels of functionality and access. management system in place which
enables both role-based and context-
based entitlement to data (enables
' classification of data for a tenant)?
Security SA- Do you provide
Architecture 02.6 ( describe/explain/ attach/ em bed Not in the hosted environment. associated documents) tenants with
strong (multifactor) authentication
options (digital certs, tokens,
i biometric, etc.) for user access?
! Security SA- Do you allow We don't have any in the hosted environment using this. SSO adapters Architecture 02.7 (describe/explain/ attach/ em bed in an on-premise setting may provide that depending on the use case. associated documents) tenants to
use third party identity assurance
services?
Security Data Security/ SA- SA- Is your Data Security Architecture We are working towards a FISMA (NIST 800-53) com pliancy audit date Architecture Integrity 03 03.1 designed using an industry standard? 10/16. (ex. CDSA, MULITSAFE, CSA Trusted
Cloud Architectural Standard,
FedRAMP CAESARS)
Security Application Security SA- SA- Do you utilize industry standards We are working towards a FISMA (NIST800-53) com pliancy audit date Architecture 04 04.1 (Build Security in Maturity Model 10/16. [BSIMM] Benchmarks, Open Group
ACS Trusted Technology Provider
Framework, NIST, etc.) to build-in
security for your Systems/Software
Development Lifecycle (SDLC)?
Security SA- Do you utilize an automated source- HP Weblnspect is used during the development process to detect Architecture 04.2 code analysis tool to detect code issues. security defects prior to production?
Security SA- Do you verify that all of your
Architecture 04.3 software suppliers adhere to industry standards for Systems/Software I
Development Lifecycle (SDLC)
security?
Security Data Integrity SA- SA- Are data input and output integrity There is basic data input validation. Additionally, administrators can Architecture 05 05.1 routines {i.e., reconciliation and edit create custom expressions for other types of extended validaation. checks) implemented for application
interfaces and databases to prevent
manual or systematic processing
errors or corruption of data?
Security Production/ SA- SA- For your Saas or PaaS offering, Do Yes, each tenant gets two other environments {support, test) along Architecture Non production 06 06.1 you provide with production.
Environments (describe/explain/attach/embed
associated documents) tenants with
separate environments for
production and test processes?
Security SA- For your laaS offering, Do you Yes, our Customer Support and Services teams can help with these.
Architecture 06.2 provide
(describe/explain/attach/embed
associated documents) tenants with
guidance on how to create suitable
production and test environments?
Security Remote User SA- SA- Is multi-factor authentication Yes Architecture M ultifactor 07 07.1 required for all remote user access? Authentication
Security Network Security SA- SA- For your laaS offering, Do you We can provide information on network communication for all Architecture 08 08.1 provide endpoints such that the architecture can be built. {describe/explain/attach/embed
associated documents) customers
with guidance on how to create a
layered security architecture
I
equivalence using your virtualized
solution?
Security Segmentation SA- SA- Are system and network Yes Architecture 09 09.1 ' environments logically separated to ensure Business and customer
security requirements?
Security SA- Are system and network Yes
, Architecture 09.2 environments logically separated to I ensure compliance with legislative, ' i regulatory, and contractual requirements?
Security SA- Are system and network
Architecture 09.3 environments logically separated to Yes, production and non-production environments use their own 1 ensure separation of production and independent resources.
I non-production environments?
Security SA- Are system and network
Architecture 09.4 environments logically separated to Yes ensure protection and isolation of
sensitive data?
Security Wireless Security SA- SA- Are policies Yes
Architecture 10 10.1 (describe/ exp la in/attach/ em bed associated documents), procedures
established, and mechanisms
implemented to protect network
environment perimeter and
configured to restrict unauthorized
traffic?
Security SA- Are policies Yes
Architecture 10.2 (describe/exp la in/attach/ em bed
associated documents) and
procedures established and
mechanisms implemented to ensure
proper security settings enabled with
strong encryption for authentication
and transmission, replacing vendor
default settings? (e.g., encryption
keys, passwords, SNMP community
strings, etc.)
Security SA- Are policies Yes
Architecture 10.3 (describe/ exp la in/attach/ em bed
associated documents) and
procedures established and
mechanisms implemented to protect
network environments and detect
the presence of unauthorized (rogue)
I network devices for a timely
disconnect from the network?
!
Security Shared Networks SA- SA- Is access to systems with shared Yes i Architecture 11 11.1 network infrastructure restricted to authorized personnel in accordance
with security policies, procedures
and standards? Networks shared
i with external entities shall have a
documented plan detailing the
compensating controls used to
separate network traffic between
i
organizations. Provide information
about your plan.
Security Clock SA- SA- Do you utilize a synchronized time- Yes Architecture Synchronization 12 12.1 service protocol (ex. NTP) to ensure all systems have a common time
reference?
1 Security Equipment SA- SA- Is automated equipment No, equipment is not identified in an automated fashion.
Architecture Identification 13 13.1 identification used as a method of connection authentication to validate
i connection authentication integrity
based on known equipment
location?
Security Audit Logging/ SA- SA- Are file integrity (host) and network Yes Architecture Intrusion Detection 14 14.1 intrusion detection (IDS) tools implemented to help facilitate timely
detection, investigation by root
cause analysis and response to
incidents?
Security I ! SA- ls Physical and logical user access to Yes Architecture 14.2 audit logs restricted to authorized
personnel?
Security SA- Can you provide Yes, our System Security Plan, which is used within our NIST 800-53 Architecture 14.3 (describe/explain/attach/embed controls for FISMA, is evidenice of our due dillegence in regards to associated documents) evidence that security controls.
due diligence mapping of regulations
and standards to your
controls/architecture/processes has
been done?
Security Mobile Code SA- SA- Is mobile code authorized before its Architecture 15 15.1 installation and use? Is the code Yes configuration checked to ensure that
! I the authorized mobile code operates I
according to a clearly defined
security policy?
Security SA- Is all unauthorized mobile code Yes
Architecture 15.2 prevented from executing?
AGREEMENT FOR THE PERFORMANCE OF SUBSCRIBED SERVICES
BY AND BETWEEN THE
CITY OF SANTA CLARA, CALIFORNIA,
AND
ACCELA, INC.
EXHIBITH
ACCELA SUBSCRIPTION TERMS AND CONDITIONS
Version 52615a
Agreement with Accela, Inc./Subscription Terms and Conditions/Exhibit H Page I of8
1. As used herein, "Accela" refers to Accela, Inc. and "Customer" refers to the subscribing customer designated on the attached Order. Accela and Customer are collectively designated as the "Parties".
2. These Subscription Terms and Conditions ("Terms") are effective upon execution of the Order by Customer and are for the exclusive benefit of the Pa11ies. Nothing herein will be construed to create any benefits, rights, or responsibilities in any other parties.
3. Customer's subscription term commences on the date set fo11h in the body of the Agreement.
4. Subscription terms are twelve (12) calendar months in duration. At the end of Customer's subscription term or, if a multi-tenn subscription is indicated on the Order, the last of Customer's subscription terms, Customer's may renew subscription as set forth in the Agreement. The per-unit pricing during said additional term will be the same as the prior term's annual fees unless Accela notifies Customer otherwise not less than sixty (60) calendar days prior to the end of said prior te1m and Customer agrees to the change in pricing in writing. Any price increase will be effective at the start of the renewal term, subject to Customer's budget appropriations and approvals. No such price increase will exceed three percent (3%) of the prior term's annual pricing.
5. In exchange for its use of the Subscribed Services, Customer will pay to Accela the amounts indicated in the Order. Said amounts are based on services purchased and not actual usage; payment obligations are non-cancelable and fees paid are non-refundable, except as otherwise specifically-provided herein. Unless otherwise stated, such fees do not include any taxes, levies, duties or similar governmental assessments of any nature, including but not limited to value-added, sales, use or withholding taxes, assessable by any local, state, provincial, federal or foreign jurisdiction ("Taxes"). Customer is responsible for paying all Taxes associated with its purchases hereunder. If Accela has the legal obligation to pay or collect Taxes for which Customer is responsible, the appropriate amount will be invoiced to and paid by Customer, unless Accela is provided with a valid tax exemption certificate authorized by the appropriate taxing authority.
Accela is solely responsible for taxes assessable against it based on its income, property, employees, and as set fmih in Section 8 of this Agreement.
6. The Subscribed Services are protected under the laws of the United States and the individual states and by international treaty provisions. Accela retains full ownership in the Subscribed Services and grants to Customer a limited, nonexclusive, nontransferable right to use the Subscribed Services, subject to the following terms and conditions: a) The Subscribed Services are provided for use only by Customer employees and to the extent of their duties for Customer, Customer's agents, contractors and officials; b) Customer may not make any form of derivative work from the Subscribed Services, although Customer is permitted to develop additional or alternative functionality for the Software using tools and/or techniques provided to Customer by Accela; c) Customer may not obscure, alter, or remove any confidentiality or proprietary rights notices; d) Customer may use the Subscribed Services only to process transactions relating to properties within both its own geographical and political boundaries and may not sell, rent, assign, lend, or Agreement with Accela, Inc./Subscription Terms and Conditions/Exhibit H Page 2 of8 share any of its rights hereunder; e) Customer is responsible for all activities conducted using its user credentials and for its users' compliance with the provisions of these Terms; and f) All rights not expressly granted to Customer are retained by Accela. Accela will make the Subscribed Services available to Customer pursuant to these Terms during a subscription term. Customer agrees that its purchases hereunder are neither contingent on the delivery of any future functionality or features nor dependent on any oral or written public comments made by Accela regarding future functionality or features.
7. Accela waITants that it has full power and authority to agree to these Terms and that, as of the effective date hereof, the Subscribed Services do not infringe on any existing intellectual property rights of any third party. If a third party claims that the Subscribed Services do infringe, Accela may, at its sole option, secure for Customer the right to continue using the Subscribed Services or modify the Subscribed Services so that these do not infringe. Accela will have the sole right to conduct the defense and will defend any legal action and conduct all negotiations for its settlement or compromise.
8. WARRANTIES AND DISCLAIMERS
8.1 Specifications. Accela shall be responsible for the acquisition and operation of all network support related to the services being provided. The technical and professional activities required for establishing, managing and maintaining the environments are the responsibilities of Accela. The system shall be available 24/7/365 (with agreed-upon maintenance downtime) and provide service to customer as defined in the SLC set fo1ih in section 8.2 of this Exhibit. Subject to the limitations set fo1ih below, Accela warrants that the Service will operate in all material respects in accordance with the Specifications.
As Customer's sole and exclusive remedy and Accela's entire liability for any breach of the foregoing warranty, Accela will use commercially reasonable efforts to modify the Service so that it conforms to foregoing waITanty.
8.2 Service Level Commitment. During the Subscription Period, Accela further warrants that the Service will meet the performance level specified in the Service Level Commitment, as made available by Accela in the Attachment A to Exhibit I. The Service Level Commitment sets forth Customer's sole and exclusive remedy for Accela's failure to achieve the stated Service performance level.
8.3 Disclaimers. EXCEPT AS EXPRESSLY PROVIDED HEREIN, ACCELA DOES NOT
MAKE ANY WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED,
STATUTORY OR OTHERWISE, AND ACCELA SPECIFICALLY DISCLAIMS ALL
IMPLIED WARRANTIES, INCLUDING ANY WARRANTIES OF
MERCHANTABILITY, NON-INFRINGEMENT OR FITNESS FOR A PARTICULAR
PURPOSE, OR ANY WARRANTIES ARISING OUT OF THE COURSE OF
DEALING OR USAGE OF TRADE, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW. Accela will not be responsible to the extent failure of the Service to operate as warranted is caused by or results from: (i) any modification to the Service other than a Supp01ied Modification; (ii) combination, operation or use of the Service with Customer's or a third party's applications, software or systems; (iii) abuse, willful misconduct or negligence by anyone other than Accela or Accela's designee; (iv) use of Agreement with Acee la, Inc./Subscription Terms and Conditions/Exhibit H Page 3 of 8 the Service other than in accordance with the terms of this Agreement and/or the applicable Specifications and Accela documentation or (v) any of the SLC Exclusions (as defined in the Service Level Co1mnitment).
8.4 MUTUAL INDEMNIFICATION
8.5 Indemnification by Customer. Customer will defend ( or settle), indemnify and hold harmless Accela, its officers, directors, employees and subcontractors, from and against any liabilities, losses, damages and expenses, including comi costs and reasonable attorneys' fees, arising out of or in connection with any third-pm1y claim that: (i) a third pa1iy has suffered injury, damage or loss resulting from Customer's or any End User's use of the Service ( other than any claim for which Accela is responsible under Section
7.2); or (ii) Customer or any End User has used the Service in a manner that violates these Terms or applicable law. Customer's obligations under this Section 7.1 are contingent upon: (a) Accela providing Customer with prompt written notice of such claim; (b) Accela providing reasonable cooperation to Customer, at Customer's expense, in defense and settlement of such claim; and ( c) Customer having sole authority to defend or settle such claim.
8.6 Indemnification by Accela. Accela will defend (or settle) any suit or action brought against Customer to the extent that it is based upon a claim that the Service, as furnished by Accela hereunder, infringes or misappropriates the Intellectual Prope1iy Rights of any third party, and will pay any costs, damages and reasonable attorneys' fees attributable to such claim that are awarded against Customer. Accela's obligations under this Section 7.2 are contingent upon: (a) Customer providing Accela with prompt written notice of such claim; (b) Customer providing reasonable cooperation to Accela, at Accela's expense, in the defense and settlement of such claim; and (c) Accela having sole authority to defend or settle such claim. THIS SECTION 9.2 STATES THE ENTIRE
OBLIGATION OF ACCELA AND ITS LICENSORS WITH RESPECT TO ANY
ALLEGED OR ACTUAL INFRINGEMENT OR MISAPPROPRIATION OF
INTELLECTUAL PROPERTY RIGHTS BY SERVICE. Accela will have no liability under this Section 9 .2 to the extent that any third-paiiy claims described herein are based on any combination of the Service with products, services, methods, or other elements not furnished by Accela, or any use of the Service in a manner that violates this Agreement or the instructions given to Customer by Accela.
8.7 Mitigation Measures. In the event that (i) any claim or potential claim covered by Section
9.2 arises or (ii) Accela's right to provide the Service is enjoined or in Accela's reasonable opinion is likely to be enjoined, Accela may, in its discretion, seek to mitigate the impact of such claim or injunction by obtaining the right to continue providing the Service, by replacing or modifying the Service to make it non-infringing, and/or by suspending or terminating Customer's use of the Service with reasonable notice to Customer. In the case of a suspension or termination pursuant to this Section 7.3, Accela will refund to Customer a portion of fees prepaid by Customer for the then-cmTent Subscription period, prorated to the po1iion of that Subscription period that is affected by the suspension or termination).
Agreement with Accela, Inc./Subscription Terms and Conditions/Exhibit H Page 4 of& 9 9.1
9.2 9.3
9.4 LIMITATIONS OF LIABILITY. IN NO EVENT WILL ACCELA'S AGGREGATE
LIABILITY TO CUSTOMER OR ANY THIRD PARTY ARISING OUT OF OR IN
CONNECTION WITH THIS AGREEMENT OR FROM THE USE OF OR INABILITY
TO USE THE SERVICE, WHETHER IN CONTRACT, TORT OR UNDER ANY
OTHER THEORY OF LIABILITY, EXCEED THE TOTAL AMOUNT PAID BY
CUSTOMER HEREUNDER OR, WITH RESPECT TO ANY SINGLE INCIDENT,
THE AMOUNT PAID BY CUSTOMER DURING THE SUBSCRIPTION PERIOD UNDER WHICH INCIDENT OCCURS.
Exclusion of Damages. NEITHER ACCELA NOR ANY OTHER PERSON OR
ENTITY INVOLVED IN CREATING, PRODUCING, OR DELIVERING THE
SERVICE WILL BE LIABLE FOR ANY INCIDENTAL, SPECIAL, EXEMPLARY OR
CONSEQUENTIAL DAMAGES, INCLUDING LOST PROFITS, LOSS OF DATA OR
LOSS OF GOODWILL, SERVICE INTERRUPTION, COMPUTER DAMAGE OR
SYSTEM FAIL URE OR THE COST OF SUBSTITUTE PRODUCTS OR SERVICES,
ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT OR FROM
THE USE OF OR INABILITY TO USE THE SERVICE, WHETHER BASED ON
WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), PRODUCT LIABILITY OR ANY OTHER LEGAL THEORY. THE FOREGOING EXCLUSIONS
APPLY WHETHER OR NOT ACCELA HAS BEEN INFORMED OF THE
POSSIBILITY OF SUCH DAMAGE, AND EVEN IF A LIMITED REMEDY SET FORTH HEREIN IS FOUND TO HAVE FAILED OF ITS ESSENTIAL PURPOSE.
NOTHING IN THESE TERMS EXCLUDES OR RESTRICTS THE LIABILITY OF
EITHER PARTY FOR DEATH OR PERSONAL INJURY RESULTING FROM ITS NEGLIGENCE.
Security and Other Risks. Customer acknowledges that, notwithstanding security features of the Service, no product, hardware, software or service can provide a completely secure mechanism of electronic transmission or communication and that there are persons and entities, including enterprises, governments and quasi-governmental actors, as well as technologies, that may attempt to breach any electronic security measure. Subject only to its limited warranty obligations set forth in Section 6, Accela will have no liability for any security breach caused by any such persons, entities, or technologies.
Any Accela security patches for "Very High" and "High" severity level security risks will be available to customer and patched within thi1iy (30) days of patch availability.
Accela defines a Very High severity level where the offending line or lines of code is a very serious weakness and is an easy target for an attacker. Accela defines High severity level where the offending line or lines of code have significant weakness.
Customer further acknowledges that the Service is not guaranteed to operate without interruptions, failures, or errors. If Customer or End Users use the Service in any application or environment where failure could cause personal injury, loss of life, or other substantial harm, Customer assumes any associated risks and will indemnify Accela and hold it harmless against those risks.
Agreement with Accela, Inc./Subscription Terms and Conditions/Exhibit H Page 5 of8
9.5 Data Breach Notification:
The service provider shall inform the Customer of any unauthorized and unlawful acquisition of unencrypted personal data ("Data Breach"). a. Data Breach Response: The service provider may need to communicate with outside parties regarding a security incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the contract. Discussing Data Breach with the Customer should be handled on an urgent as-needed basis, as part of service provider communication and mitigation processes as mutually agreed upon, defined by law or contained in the contract.
b. Data Breach Reporting Requirements: If the service provider has actual knowledge of a confirmed Data Breach that affects the security of any Customer content that is subject to applicable Data Breach notification law, the service provider shall ( l) promptly notify the appropriate Customer identified contact within 48 hours or sooner, unless shmier time is required by applicable law, and (2) take commercially reasonable measures to address the Data Breach.
9.6 Basis of Bargain. THE LIMITATIONS OF LIABLITY AND EXCLUSIONS OF DAMAGES SET FORTH IN THIS SECTION 10 ARE FUNDAMENTAL ELEMENTS
OF THE BASIS OF THE BARGAIN BETWEEN ACCELA AND CUSTOMER AND
WILL APPLY TO THE MAXIMUM EXTENT ALLOWED UNDER APPLICABLE LAW.
11. The following are not covered by these Terms, but may be separately available at rates and on terms which may vary from those described herein: a) Services required due to misuse of the Subscribed Services; b) Services required due to external factors including, but not necessarily limited to, Customer's use of software or hardware not authorized by Accela; or c) Services required to resolve or work-around conditions which cannot be reproduced in Accela's supp01i environment.
12. Customer warrants that it owns or has been authorized to provide the data to Accela.
Customer retains full ownership of said data and grants to Accela a limited, nonexclusive, nontransferable license to use said data only to perform Accela's obligations in accordance with these Terms.
13. Subject to the limitations of Section 6, Customer may authorize access to the Subscribed Services by creating unique user names and passwords ("Logins") up to the number of users indicated in the Order.
14. Each Login must be assigned to a single individual and may not be shared or used by more than one such user. Customer may reassign any Login to another individual, provided that such reassignments do not circumvent the "single individual" requirement described in this Section.
Agreement with Acee la, Inc./Subscription Terms and Conditions/Exhibit H Page 6 of8
15. Customer acknowledges that transm1ss1ons and processing of Customer's electronic communications are fundamental to Customer's use of the Subscribed Services.
Customer further acknowledges that portions of such transmissions and processing may occur within various computer networks not owned or operated by Accela. Customer agrees that Accela is not responsible for any delays, losses, alterations, interceptions, or storage of its electronic communications which occur in computer networks not owned or operated by Accela.
16. "Disclosing Party" and "Recipient" refer respectively to the pa1iy which discloses information and the paiiy to which information is disclosed in a given exchange. Either Accela or Customer may be deemed Disclosing Party or Recipient depending on the circumstances of a pa1iicular communication or transfer of information. "Confidential Information" means all disclosed information relating in whole or in paii to non-public data, proprietary data compilations, computer source codes, compiled or object codes, scripted programming statements, byte codes, or data codes, entity-relation or workflow diagrams, financial records or info1mation, client records or information, organizational or personnel information, business plans, or works-in-progress, even where such works, when completed, would not necessarily comprise Confidential Info1mation. The foregoing listing is not intended by the Parties to be comprehensive, and any info1mation which Disclosing Party marks or otherwise designates as "Confidential" or "Proprietary" will be deemed and treated as Confidential Infonnation. Information which qualifies as "Confidential Information" may be presented to Recipient in oral, written, graphic, and/or machine-readable formats. Regardless of presentation format, such information will be deemed and treated as Confidential Information. Notwithstanding, the following specific classes of information are not "Confidential Information" within the meaning of this Section: a) information which is in Recipient's possession prior to disclosure by Disclosing Party; b) information which is available to Recipient from a third party without violation of this Section or Disclosing Party's intellectual prope1iy rights; c) information which is in the public domain at the time of disclosure by Disclosing Paiiy, or which enters the public domain from a source other than Recipient after disclosure by Disclosing Party; d) information which is subpoenaed by governmental or judicial authority; and e) information subject to disclosure pursuant to a state's public records laws. Recipient will protect the confidentiality of Confidential Information using the same degree of care that it uses to protect its own information of similar imp01iance, but will in any case use no less than a reasonable degree of care to protect Confidential Information. Recipient will not directly or indirectly disclose Confidential Information or any part thereof to any third party without Disclosing Paiiy's advance express written authorization to do so. Recipient may disclose Confidential Information only to its employees or agents under its control and direction in the normal course of its business and only on a need-to-know basis. In responding to a request for Confidential Information, Recipient will cooperate with Disclosing Paiiy, in a timely fashion and in a manner not inconsistent with applicable laws, to protect the Confidential Information to the fullest extent possible.
Accela acknowledges that Customer is a public agency subject to the requirements of the California Public Records Act Cal. Gov. Code section 6250 et seq. Customer acknowledges that Accela may submit information to Customer that Accela considers Agreement with Accela, Inc./Subscription Terms and Conditions/Exhibit H Page 7 of8 confidential, proprietary, or trade secret information pursuant the Uniform Trade Secrets Act (Cal. Civ. Code section 3426 et seq.), or otherwise protected from disclosure pursuant to an exemption to the California Public Records Act (Government Code sections 6254 and 6255). Accela acknowledges that Customer may submit to Accela information that Customer considers confidential or proprietary or protected from disclosure pursuant to exemptions to the California Public Records Act (Government Code sections 6254 and 6255). Upon request or demand of any third person or entity not a party to this Agreement ("Requestor") for production, inspection and/or copying of information designated by a Disclosing Pat1y as Confidential Information, the Recipient as soon practical but within three (3) days of receipt of the request, shall notify the Disclosing Party that such request has been made, by telephone call, letter sent via facsimile and/or by US Mail to the address and facsimile number listed at the end of the Agreement. The Disclosing Party shall be solely responsible for taking whatever legal steps are necessary to protect information deemed by it to be Confidential Information and to prevent release of information to the Requestor by the Recipient. If the Disclosing Party takes no such action, after receiving the foregoing notice from the Recipient, the Recipient shall be permitted to comply with the Requestor's demand and is not required to defend against it.
17. ACCELA WILL, AT ALL TIMES DURING THE AGREEMENT, MAINTAIN INSURANCE COVERAGE AS SET l!'ORTH IN EXHIBIT C. TO THE EXTENT NOT OFFSET BY ITS
INSURANCE COVERAGE AND TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE
LAWS, IN NO EVENT WILL ACCELA'S CUMULATIVE LIABILITY FOR ANY GENERAL,
INCIDENTAL, SPECIAL, COMPENSATORY, OR PUNITIVE DAMAGES WHATSOEVER
SUFFERED BY CUSTOMER OR ANY OTHER PERSON OR ENTITY EXCEED THE FEES PAID TO ACCELA BY CUSTOMER DURING THE TWELVE (12) CALENDAR MONTHS
IMMEDIATELY PRECEDING THE CIRCUMSTANCES WHICH GIVE RISE TO SUCH CLAIM(S) OF LIABILITY.
18. If Accela is delayed in its performance of any obligation hereunder due to causes or effects beyond its control, Accela will give timely notice to Customer of such circumstances and will act in good faith to resume performance as soon as practicable.
19. Accela may not assign its rights and obligations hereunder for purposes of financing or pursuant to corporate transactions involving the sale of all or substantially all of its stock or assets without Customer's written consent.
20. Section 5 will survive the End of Term for so long as is required to complete collection of unpaid amounts. The limitations and waivers described in Sections 8, 19, and 21 will survive the End of Term. Section 12 will smvive the End of Term for a period of thirty (30) calendar days. Section 16 will survive the End of Term for a period of thirty (30) calendar days or for so long as is required for Accela to complete its response to a Customer request made during said thirty-day period. Section 20 will survive the End of Term for a period of two (2) years. With the exceptions of the foregoing surviving sections, the remainder of these Terms will terminate at the End of Term.
Agreement with Accela, Inc./Subscription Terms and Conditions/Exhibit H Page 8 of8
AGREEMENT FOR THE PERFORMANCE OF SUBSCRIBED SERVICES
BY AND BETWEEN THE
CITY OF SANTA CLARA, CALIFORNIA,
AND
ACCELA, INC.
EXHIBIT I
ACCELA SECURITY EXHIBIT
Accela will provide hosting at a SSAE-16 Tier III or higher facility as defined by the Uptime Institute, Inc. Per the hosting datacenter's disclosure policies, Accela will provide, where allowable, a copy of the datacenter's annual SSAE-16 Type 2 audit report. Accela will provide a backup hosting site with equivalent status for disaster recovery should a major catastrophic outage occur.
The hosting facility will be constructed and configured to ensure reasonable and adequate protection of the equipment in the event of a natural event considered possible for the physical location, including but not limited to earthquake, flood, hurricane, tornado, etc.
Data Location:
The service provider shall provide its services to the Customer and its end users solely from data centers in the U.S. Storage of Customer data at rest shall be located solely in data centers in the U.S. The service provider shall not allow its personnel or contractors to store Customer data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. The service provider shall permit its personnel and contractors to access Customer data remotely only as required to provide technical support. The service provider may provide technical user supp01i on a 24/7 basis using a Follow-the-Sun model, unless otherwise prohibited in the SLC listed in this Exhibit H.
The hosting facility must have power sufficient to support the equipment platform as configured; this includes provisions for back-up power supplies. The facility will include:
• Dual power availability to each rack unit from independent Power Distribution Units (PDUs) removes PDU loss as a single point of failure
• N+ 1 redundancy of uninte1rnptible power supplies
• Redundant fuel-based generator power supplies, in the event of a power failure from commercial power.
The hosting facility will have reasonable and adequate heating and cooling to insure continuous operation of equipment within acceptable operational limits. The hosting facility shall include but not be limited to the following features:
• N+ 1 redundancy of cooling towers, water pumps and chillers • Multiple air handling units providing an additional level of redundancy Agreement with Accela, Inc./Security/Exhibit I Page 1 of 12 • Cooling units maintain consistent environment temperature and relative humidity levels • Rack cabinet fans to circulate warm air generated by the servers The hosting facility will have physical security to control unauthorized access to the equipment, including but not limited to:
• 24/7 on-site security guard
• Indoor and outdoor security monitoring
• Badge/picture ID access screening
• Biometric access screening
• Escort requirements for access to raised floor areas
• Logged entries for all users entering or leaving the premises The hosting facility will have data line capacity to ensure responsive access to the proposed data system by Accela employees, jurisdictions and customers.
Accela shall provide the equipment, hardware and network infrastructure necessary to operate and sustain all contracted software on behalf of customer and to provide the necessary development, test, production, and training environments.
The hosting facility will provide secure encrypted transmission of personal data to include, but not limited to, personal name and address, SSN, credit card, banking, and payment data, passwords, and any other data subject to Federal or California State data privacy protection laws, and provide protection that meets or exceeds any such statutory requirements. Secure Socket Layer (SSL) encryption will be utilized to meet this requirement.
Accela will be responsible for the data communication infrastructure that connects the data servers to the communication network (switches, etc.)
Accela will maintain any service agreements for the equipment and operating systems, and maintain the equipment in optimal working order.
Accela shall provide a PCI compliant infrastructure for deployment within the data center.
Accela's applications have been developed to comply with all 12 requirements of PCI Data Security Standard, including:
• The use of a firewall within the proposed infrastructure to protect cardholder data provided via both Accela Automation and Accela Citizen Access (public portal) • The use of strong passwords and password policies to ensure password protection and delineates and enforces role-based security to ensure that only authorized users and administrators can access sensitive data
• The use of secured sessions to prevent any unauthorized access to sensitive cardholder data
• The use of encryption per PCI and P ABP standards whenever cardholder data is transmitted across open, public networks
• Adherence to all applicable industry standards for the development of secure systems Agreement with Accela, Inc./Security/Exhibit I Page 2 of 12 and the Accela applications that operate within these systems • The assignment of unique User IDs and Passwords for each user granted access to the system
• The provision of full audit trail tracking to track and monitor all access to network resources and cardholder data
Accela will provide operational services to support the infrastructure and operating environment.
Accela shall provide the equipment, hardware and network infrastructure necessary to operate and sustain all contracted software and to provide the necessary, production, support and staging environments.
Accela shall ensure there are no covert channels to access the system and musttake precautions to protect the system and data from Trojan invasion.
Accela contracts for warranty services. In the event that wan-anty services are required, Accela shall provide staff support sufficient to complete all necessary service and maintenance to the hardware and software platform for the duration of a Vendor-site support agreement.
Accela shall perform daily backups of the data. The images that constitute the functional system will have snapshots taken weekly and stored to the fully redundant storage system.
Aceela's backup strategies and fully redundant Data Recovery (DR) site ensure that a complete system rebuild of data will not be necessary. Accela will use commercially reasonable efforts to replicate all relevant agency data "in near real-time" to a geographically separate location where we have the ability to stand up the Accela application stack and restore service.
Throughout the term of the agreement, upon the request of Customer, Accela will provide Customer with:
(i) a copy of its data in a database dump file
(ii) an APO property conversion upload
(iii) a Crystal Report placement
Within thirty (30) calendar days following the end of its final Subscribed Services term ("End of Term"), Accela shall provide a complete copy of Customer's data and associated documents, as updated or modified by Customer's use of the Subscribed Services, in a database dump file format. Accela will comply in a timely manner with such request, provided that Customer pays any and all unpaid amounts due to Accela.
Accela will meet measurable standards for expected and reasonable system availability (up time) as established elsewhere in this Hosting Attachment. The system must generally be available seven days a week, twenty-four hours per day. Scheduled down time is acceptable.
Unplanned down time between 6:00 am and 8:00 pm Pacific time must be to resolve production emergencies only, limited to no more than One Hundred and Twenty (120) minutes and occur no more than one time per month. In no event will any proposed standard be less than a commercially reasonable standard.
Agreement with Accela, Inc./Security/Exhibit I Page 3 of 12 The Accela system implementation shall provide functional equivalents of the following environments; hardware and software requirements must include provisions to support these environments:
• Support An environment available to customers to develop and test new configurations or changes to existing configurations prior to implementation in production. • Staging - An environment available to customers to test new Accela Automation application releases against their production configuration. New application code will be deployed to the Staging environment within one week of becoming Generally Available (GA) from Engineering. New application code will be deployed to the Support and Production environments one month after being deployed to Staging for Major releases and two weeks for Minor releases (Service Packs).
• Production The environment used by customers, jurisdiction staff, central administrative staff, and analysts/programmers to submit, track and manage live transactions and associated data.
The Customer shall have the ability to import or export data in piecemeal at its discretion without interference from the service provider. Accela will provide the customer with a full database export on a quarterly basis at the request of Customer. The customer has the option to request a more frequent export if desired, but will not exceed one per calendar week.
Accela will respond to requests for production or support/staging environment report posting within 72 hours of the request. Repo1is will be reviewed for system performance and data integrity before posting. If issues are found they will be documented and communicated back to the customer for correction. In the event that a report request is urgent, Accela will expedite this process to an extent that is reasonable for the request.
To provide the Hosting Services, Accela shall provide, host, manage and maintain the System as follows:
A. Management, Support and Maintenance of Hardware
1. Accela will provide, manage and maintain operating systems on all System environment hardware. This will involve application of any necessary patches or updates and upgrades as necessary. Accela will provide system redundancy.
2. Accela will provide, manage and maintain, for the System, the physical or virtual resources. This will involve any physical fix as needed, updates or refreshes as necessary.
B. Capacity Planning and Monitoring
Accela will be responsible for monitoring capacity and performing capacity planning to ensure the System environment has sufficient capacity to meet the service level agreements agreed upon in this Agreement.
Agreement with Accela, Inc./Security/Exhibit I Page 4 of 12 C. Asset Management
Asset Management services provide inventory and tracking of equipment and the management of vendor-provided maintenance agreements.
Accela will perform the following tasks:
1. Manage third party vendor contracts for equipment used in support of this Agreement (rental agreements, leases, service agreements, wan-anties, amendments, maintenance contracts, and insurance policies)
2. Provide hardware and software at the appropriate hardware and software levels to comply with vendor maintenance contracts.
3. Provide an asset tracking tool to maintain a database of asset information such as make, model, operating system, number of CPUs, amount of memory, and amount of storage.
D. Facilities Services
Accela will provide a PCI-DSS compliant facility.
E. Monitoring Server and OS
1. Monitoring Server and OS service detects and responds to up/down availability faults generated by monitored servers.
2. Accela will perform the following:
• Provide the operational support processes required for up/down monitoring
• Document and track all detected problems using the site problem management process
• Escalate all detected problems to the appropriate support personnel F. Operations Management
1. Operations Management are those activities requiring physical hands-on support. Accela shall provide skilled staff to support all operational support services at an Acee la data center facility.
2. Accela will perform the following:
• Perform systems operation functions such as power on/off and start/stop/reset device intervention
• Monitor vendors on the Accela premise perfonning work maintenance or problem resolution work
• Maintain responsibility for procuring any expendable supplies (CDs, Agreement with Accela, Inc./Security/Exhibit I Page 5 of 12 tapes, cleaning supplies, and so f01th)
G. Operating System Management
1. Accela shall provide proper functionality of hosting software on servers. Support is provided for operating systems and related software products. Included are all ongoing processes to maintain supplier-supp01ted operating platforms including preventive software maintenance services.
2. Accela will perform the following:
• Install and maintain system-level software, such as operating system and other system-level products software requiring user access • Monitor system software status and take necessary action to resolve any ISsues
• Perform operation system software tuning as required to maintain daily operations for Accela-provided services
• Install preventive maintenance patches deemed critical by the vendor to support system software products to prevent known problems from impacting the operating environment
• Install patches per vendor instructions for security exposures deemed critical by the vendor
• Participate in the identification of connectivity and associated network problems
• Plan and implement necessary changes for the System
• Document and track all configuration management changes using the site change management process
• Provide problem escalation and interact as necessary with third-party suppliers
H. System/File Backup and Restore
1. System/File Backup and Restore Services provide the operational and management processes to backup and restore operating system.
2. Accela will perform the following:
• Design and implement the backup Plan
• Perform backups
• Provide for data restores as needed if Agency causes the need for a data restoration, Agency will be responsible for the cost of the data restore at the hourly service rate in the Contract.
• Monitor backup processes and verification of successful completion • Adjust backup and restore plans as new components are added to the System
Agreement with Accela, Inc./Security/Exhibit I Page 6 of 12 I. Server Storage Management
1. Server Storage Management provides for the support of server direct-attached storage environment.
2. Accela will perform to following:
• Integrate the storage hardware and software to provide the appropriate level of capacity, scalability, and performance of the server storage hardware and software
• Manage hardware and software maintenance requirements based on the manufacturer's recommended schedule
• Implement security practices, such as logical unit masking, preventing unauthorized storage access from an unauthorized server • Maintain proper storage configuration(s) (mapping logical volumes, creating file systems, balancing I/O capacity)
J. Server Management Services
Accela will provide server management services.
K. Hardware Management
Accela will provide Hardware Management. Hardware management provides the services necessary to enable compute equipment to be physically installed, maintained, and kept operational.
L. Controlled Server Access
Accela will provide Controlled Server Access. Controlled server access provides the tools and processes to manage access to assets. This includes the management of user logon IDs and their access rights to system-level resources, as well as maintaining server-level security parameters and security product options.
M. Virus Protection
Accela will provide Virus Protection services. Server level anti-virus service provides anti- virus software on each server to provide protection and detection of viruses, worms, and other malicious code. The anti-virus software can be updated with current virus signatures and detection engines automatically or by file distribution software.
This service also provides the means to scan the server at the system level to detect malicious code.
N. Security Event Logging
Accela will provide Security Event Logging. Security Event Logging is a detective control that enables the recording of security events on system hosts based on preset Agreement with Accela, Inc./Security/Exhibit I Page 7 of 12 parameters. The administrative tool's logging function is enabled and the security events are retained in a record for future review.
0. Vulnerability Scan and Repmi
Accela will provide Vulnerability management. Vulnerability management includes preventive and detective services to identify vulnerabilities as they emerge; to prevent those vulnerabilities from affecting the in-scope systems; to detect when an in-scope system has been affected; and to cure those affected systems. Vulnerability management includes both Vulnerability Alert management and Vulnerability Scanning processes.
Vulnerability Alert management is the preventive process that collects known vulnerabilities and prioritizes vulnerabilities based on associated risk. Vulnerability Scanning is the detective process of identifying potential vulnerabilities on servers for exposures to such vulnerabilities.
P. Managed Cluster
Accela will provide Managed Cluster Management. Managed Cluster Management provides processes to deliver server/storage configurations clustered together in the same physical site. This is delivered through the use of hardware configuration and software to meet availability requirements.
Q. Host Based Intrusion Detection
Accela will provide Host Based Intrusion Detection. Host Based Intrusion Detection is the real-time identification, detection, and notification of suspected unauthorized intrusions on individual servers.
R. Secondary Mirrored Site Management
Accela will provide mirrored secondary site allows for replication of the primary site in the event of a natural disaster rendering the primary data center inoperable. Accela will provide skilled staff to support all operational support services. These services include support processes necessary to provide a secondary mirrored site.
S. Data Recovery
Accela will provide multiple ways to recover data:
Suspected error conditions will be investigated and corrected by ACCELA personnel at ACCELA'S offices to the extent possible. Onsite corrections shall be at the exclusive judgement of ACCELA at no additional cost to the User. User may, however, request that ACCELA conduct such investigations and travel to the location of the User at the User's request; User will pay ACCELA for reasonable travel and subsistence expenses. If ACCELA, in its reasonable judgment, determines that the suspected e1Tor condition was attributable to a Agreement with Accela, Inc./Security/Exhibit I Page 8 of 12 cause other than an error in ACCELA'S Subscribed Service or an enhancement by ACCELA, the User will pay for ACCELA'S effmis on a time and materials basis.
ACCELA may provide the User with unsolicited error co1Tections or changes to the Subscribed Service, without additional charge, which ACCELA determines are necessary for proper operation of its Subscribed Service, and User shall incorporate these corrections or changes into the Subscribed Service within 180 days of release by ACCELA. ACCELA will provide all documentation changes necessary as a result of changes to the software.
ACCELA will provide User all enhancements released by ACCELA as standard enhancements, and which are generally made available to other users purchasing comparable Subscribed Service during the term of this Agreement.
Agreement with Accela, Inc./Security/Exhibit I Page 9 of 12
EXHIBIT I
ATTACHMENT A
ACCELA, INC. SERVICE LEVEL COMMITMENT
This Saas Service Level Commitment ("SLC") is a policy governing the use of Accela software-as service products (individually or collectively, the "Service") under the terms of the Accela Master Services Agreement (the "Agreement") between Accela, Inc. and its affiliates ("Accela", "us" or "we") and the purchaser of Accela's Subscription Service ("Customer").
Unless otherwise provided herein, this SLC is subject to the terms of the Agreement and capitalized terms will have the meaning specified in the Agreement. Accela reserves the right to change the terms of this SLC in accordance with the Agreement.
DEFINITIONS
"Monthly Uptime Percentage" is calculated by subtracting from 100% the percentage of minutes during the month in which the Service was Unavailable. Measurement of the Monthly Uptime Percentage excludes downtime resulting directly or indirectly from any SLC Exclusion. "Service Credit" is a dollar credit, calculated as set forth below, that Accela may credit back to an eligible Customer account.
"Unavailable" means, as applicable: (i) Customer is repeatedly unable to log into the Service; (ii) Customer experiences repeated connection request failures; (iii) Customer experiences lack of connectivity of external, public instances or sites lasting for more than five (5) minutes; (iv) Customer is unable to connect and sync mobile applications within the Service to Accela servers; and/or (v) Customer is unable to download or sync data from mobile applications within the Service to Accela servers. The foregoing events must be verifiable or replicable by Accela or its designee. Availability of Accela APis, as separate from Service access, is expressly excluded from this SLC.
SERVICE COMMITMENT
Accela will use commercially reasonable effo1is to make the Service available with a Monthly Uptime Percentage of at least 99.9%, in each calendar month of the Subscription Period (the "Commitment"). In the event the Service does not meet this Commitment, Customer will be eligible to receive a Service Credit as described below.
SCHEDULED & EMERGENCY MAINTENANCE
Accela will maintain ce1iain scheduled maintenance windows during which regular, planned maintenance of the Service may be performed. Accela will use commercially reasonable efforts to provide Customer with no less than twenty-four (24) hours' notice prior to Services unavailability due to planned maintenance .. Accela's standard maintenance window will generally fall between the hours of 9:00 PM [21:00] Thursday and 1:00 AM [1:00] Friday local time.
Accela will endeavor to provide as much notice as is practicable under the circumstances for patches, updates, fixes and other emergency maintenance activities which may be applied on an urgent basis.
Agreement with Accela, Inc./Security/Exhibit I Page 10 of 12 Accela will provide three (3) business days' notice prior to any planned network, server hardware, operating environment, or database modifications of a material nature.
SERVICJi: CREDITS
System availability is measured by the following formula:
x (n - y) *100 / n
Notes: (I) "x" is the uptime percentage;
11 11
11 is the total number of hours in the given calendar month minus scheduled downtime; and "y" is the total number of downtime hours in the given calendar month. (2) Specifically excluded from "n and "y" in this calculation are the exception times on scheduled upgrade and maintenance windows.
Service Availability Percentage of Monthly Service Fees Credited > 99.9% 2%
99.5% - < 99.9% 5%
99.0% - < 99.5% 10%
95.0% - < 99.0% 0%
90.0% - < 95.0% 40%
< 90.0% - < 80.0% 45%
<80% 50%
Accela will apply any Service Credits only against future Service payments otherwise due from Customer. Service Credits will not entitle Customer to any refund or other payment from Accela. Service Credits may not be transferred or applied to any other account. Unless otherwise provided in the Agreement, Customer's sole and exclusive remedy for any unavailability, non-performance, or other failure by Accela to provide the Service is the receipt of a Service Credit (if eligible) in accordance with the terms of this SLC.
SLC EXCLUSIONS
The Service Commitment does not apply to any unavailability, suspension or termination of the Service or any Service performance issues: (i) caused by factors outside of Accela's reasonable control, including any force majeure event or Internet access or related problems beyond the Service demarcation point; (ii) that result from customizations (if outside of Accela's best practice recommendations), configuration changes, scripting, or data loss caused by or on behalf of Customer or any End User; (iii) that result from Customer's or any End User's or third party's equipment, software or other technology or integrations (other than third party equipment within Accela's direct control); (iv) that result from any maintenance as provided for pursuant to the above terms; or (vii) arising from our suspension or termination of Customer's right to use the Service in accordance with the Agreement (collectively, the "SLC Exclusions"). If availability is impacted by factors other than those used in the Monthly Uptime Percentage calculation, Accela may issue a Service Credit with consideration to pertinent factors as assessed by Accela in its sole discretion.
Agreement with Acce\a, Inc./Security/Exhibit I Page 11 of 12
SUPPORT COMMITMENT
This Silver Support SLA Addendum (the "Addendum") is issued under and subject to additional conditions and limitations as set out in the agreement by and between Accela and Customer.
The following Issues, Response Goals and Resolution Goals are applicable to support services for Accela supp01ted products functioning in Customer's production environment (the "Supported Products") and is not applicable to any other Accela software, services or environments. Any references to "business day" are exclusive of the U.S. federal and state holidays observed by Accela:
Priority Definition Response Goal Resolution Goal
Critical Severity Issue Supported Product is Confirmation of receipt Upon confirmation ofreceipt, (Priority 1) non-functional or within one ( 1) business Accela will put forth our best seriously affected and hour. effort to provide a workaround, there is no reasonable Update as information fix, or estimated completion date workaround available arrives or at the interval within seventy-two (72) hours ( e.g. business is specified by Customer. after the problem has been halted). diagnosed and/or replicated.
High Severity Issue Suppo1ied Product is Confinnation of receipt Accela will put forth our best (Priority 2) affected and there is within four (4) business effort to provide a workaround no workaround hours. or fix or estimated completion
available or the date within fourteen (14)
workaround is business days after the problem
impractical ( e.g. has been diagnosed and/or
Supported Product replicated.
response is very
slow, day to day
operations continue
but are impacted by
the work around).
Medium Severity Issue Support Product is Confirmation of receipt Accela will put fo1ih our best (Priority 3) non-functional within eight (8) business eff01i to provide a workaround however a convenient hours. or fix or estimated completion workaround exists date within twenty-one (21)
( e.g. non-critical business days after the problem
feature is unavailable has been diagnosed and/or
or requires additional replicated.
user intervention).
Low Severity Issue Supported Product Confirmation of receipt Resolution for the Issue may be (Priority 4) works, but there is a within twenty-four (24) released as a patch set or be minor problem (e.g. business hours. incorporated into a future incorrect label, or schedule release of the product.
cosmetic defect).
Agreement with Accela, Inc./Security/Exhibit I Page 12 of 12