9.5 In the event one of the annual budgets shown in Subparagraph 9.2 of this Attachment B
#MA063-25010752 Page 11 of 14 March 20, 2025
Attachment B is modified, the modified budget shall remain in effect for the remainder of the contract term, unless superseded by subsequent budget modification(s) that have been approved in writing by ADMINISTRATOR. For example, if Budget Modification #1 is approved on August 15, 2025, the modified budget will be in effect until Budget Modification #2 is requested and approved in writing. The annual budget beginning on July 1st of each Contract year shall be identical to the most recently modified annual budget.
10. STAFFING REQUIREMENTS
10.1 Recruitment Practices
10.1.1 DRP1 CONTRACTOR shall use a formal recruitment plan which complies with federal and State employment and labor regulations. DRP1 CONTRACTOR shall recruit and maintain trained personnel who are responsive to, and who understand, the diversity of cultures which can be found among the target population identified in Subparagraph 1.1 of this Attachment B. DRP1 CONTRACTOR shall employ staff with the background, education, training, language skills, and experience to perform all functions as described in this Contract.
10.1.2 DRP1 CONTRACTOR shall notify ADMINISTRATOR, in writing, no later than seventy-two (72) hours of any staffing vacancies or filling of vacant positions that occur during the term of this Contract. For resignations, DRP1 CONTRACTOR’s notification shall include employee’s name, position title, date of resignation, a description of planned recruitment activities, and the DRP1 CONTRACTOR’s contingency plan to cover services during the vacancy. For new hires, DRP1 CONTRACTOR’s notification shall include candidate’s resume or application, position title, and date of hire.
10.1.3 The number of direct service bilingual staff proposed should include how staffing will meet the needs of the community to be served.
10.1.4 DRP1 CONTRACTOR may be required to submit employer’s bilingual certification criteria and/or test results to ADMINISTRATOR.
Attachment B
#MA063-25010752 Page 12 of 14 March 20, 2025
10.2 DRP1 CONTRACTOR shall provide the following described staff positions:
10.2.1 DR-Path One Community Engagement Coordinator
Duties
Organizing, developing, and implementing an outreach plan to engage DR-Path One Families to enroll in preventative services, assess appropriateness needs of services; attend MDT meetings, presenting cases at MDT meetings, track all outreach efforts, coordinate and communicate with FRC Coordinator and MDT members, attend all required meetings and trainings, administer FaCT-approved measurement tools, and data entry into DRTS, or similar system, and the FaCT database.
Qualifications
Option One (1): An Associate’s degree or sixty (60) college units in human services or related field from an accredited
college/university; one (1) year of experience, including leadership/supervisory experience, providing direct services to the target population; capable of relating well to individuals from diverse backgrounds, cultures, varied income, and education levels; and computer competency. Proficiency in English is required. Based on community need, bilingual proficiency may be required; or
Option Two (2): Three (3) years of experience, including one (1) year of leadership/supervisory experience, providing direct services to the target population; capable of relating well to individuals from diverse backgrounds, cultures, varied income, and education levels; and computer competency. Proficiency in English is required. Based on community need, bilingual proficiency may be required.
10.2.2 DR-Path One Family Support Advocate
Duties
Responsible for serving all DR-Path One Family Support
Attachment B
#MA063-25010752 Page 13 of 14 March 20, 2025
Services referrals. Services shall include, but not limited to:
assessing family strengths and needs; linkages to resources; case planning; communicating applicable case related information to SSA staff, as requested; compiling and maintaining records; preparing reports; presenting cases at MDT meetings;
completing FaCT designated measurement tools and entering all required data into DRTS, or similar system, and the FaCT database; and attending all required FaCT meetings and trainings.
Qualifications
Option One (1): Bachelor’s degree in human services or related field from an accredited university. Proficiency in English is required. Based on community need, bilingual proficiency may be required; or
Option Two (2): A minimum of three (3) years of experience providing direct services to the target population. Proficiency in English is required. Based on community need, bilingual proficiency may be required.
10.2.3 DR-Path One Program Manager
Duties
Responsible for administrative and budgetary oversight of County of Orange SSA (FaCT) contracts at designated sites; leadership and supervisory support including staff development plans to ensure contract goals are met; oversee FRC projects and initiatives; collaborate with FaCT leadership; attend FaCT committee meetings and forums, and local and regional FRC platform advocacy; oversees operations at the FRC, including DR-Path One services, monitoring grant funds and maintaining compliance.
Qualifications
Option One (1): A Master’s degree from an accredited
college/university with two (2) years of management experience; Attachment B
#MA063-25010752 Page 14 of 14 March 20, 2025
four (4) years of increasingly responsible recreation/grant program experience, including one (1) year of lead supervisory responsibility; or
Option Two (2): A Bachelor’s degree or equivalent to a
Bachelor’s degree from an accredited college/university with major course work in recreation, public administration or a related field; five (5) years management experience; four (4) years of increasingly responsible recreation/grant program experience, including one (1) year of lead supervisory
responsibility.
11. TRAINING
11.1 DRP1 CONTRACTOR’s staff shall attend SSA training, conferences, and meetings as required by SSA.
11.2 DRP1 CONTRACTOR shall provide DRP1 CONTRACTOR’s staff with ongoing training and assistance to ensure that service deliverables are met.
11.3 DRP1 CONTRACTOR shall ensure that DRP1 CONTRACTOR’s staff receives cultural awareness and responsiveness training.
11.4 DRP1 CONTRACTOR shall maintain a log of in-house training activities for DRP1 CONTRACTOR’s staff. This log shall be made available to SSA, upon request.
11.5 DRP1 CONTRACTOR shall provide training to MDT members in areas including, but not limited to:
11.5.1 Prevention, identification, management, or treatment of child abuse or neglect cases.
11.5.2 Prevention, remedying, or assisting in the solution of problems that may result in, the neglect, abuse, exploitation, or delinquency of children.
11.5.3 Prevention of the unnecessary separation of FAMILIES by identifying family problems, assisting FAMILIES in resolving their problems, and preventing the breakup of FAMILIES where the prevention of child Attachment B
#MA063-25010752 Page 15 of 14 March 20, 2025
removal is desirable and possible.
11.5.4 Identification of available community resources available to FAMILIES.
11.5.5 Rules of confidentiality that apply to this Contract and the MDT.
11.5.6 Operational procedures of the MDT as established by SSA.
11.5.7 Usage of DRTS, FaCT database, or similar data tracking system identified by SSA.
11.5.8 All other pertinent provisions of this Contract.
11.6 Participate in MDT and DR-Path One related training as requested by SSA.
11.7 DRP1 CONTRACTOR shall provide a minimum of twenty (20) hours of in-service training per year for its’ MDT members. Training programs shall be related to the service delivery requirements in this Attachment B.
11.8 DRP1 CONTRACTOR’s Coordinators shall complete COUNTY’s eight (8) hour training program in Social Services Agency’s policies and procedures. #MA063-25010752 Page 1 of 1 March 20, 2025
ATTACHMENT B-1
MEMBER CERTIFICATION OF
DIFFERENTIAL RESPONSE PATH ONE
MULTIDISCIPLINARY TEAM
To: Orange County Social Services Agency
Children and Family Services
Attention: DR-Path One Contract Administrator
500 N. State College Blvd., Suite 100
Orange, CA 92868
_________________________ (CBO) hereby designates the following person as a member of the Orange County Social Services Agency (SSA) Differential Response - Path One multidisciplinary personnel team (MDT):
Name: ________________________________
Title: ________________________________
Agency: ________________________________
Address: ________________________________
________________________________
Phone: ________________________________
The above CBO hereby certifies that the above-designated person is qualified to serve on the MDT as indicated in Subparagraph 5.1 of Attachment B and it has provided training to the abovedesignated person as required by Subparagraph 11.5, and 11.6 of Attachment B, an agreement between SSA and CBO/MDT member to establish a MDT for DR-Path One Services (063- 25010006-LC).
___________________________________ Dated: ______________________ CBOs Member Signature
____________________________________ Title: _______________________ Print Name
I hereby certify that I have received the required training in Paragraph 5.1 of Attachment B to participate as a member of the MDT and that I am qualified to provide services. I have received a copy of Attachment B and understand the scope and purpose of the MDT and agree to keep all information confidential.
_______________________________ Dated: ____________________ MDT Member Signature
_______________________________
Print Name
#MA063-25010752 Page 1 of 6 March 20, 2025
ATTACHMENT C
COUNTY OF ORANGE INFORMATION TECHNOLOGY SECURITY PROVISIONS All Contractors with access to County data and/or systems shall establish and maintain policies, procedures, and technical, physical, and administrative safeguards designed to (i) ensure the confidentiality, integrity, and availability of all County data and any other confidential information that the Contractor receives, stores, maintains, processes, transmits, or otherwise accesses in connection with the provision of the contracted services, (ii) protect against any threats or hazards to the security or integrity of County data, systems, or other confidential information, (iii) protect against unauthorized access, use, or disclosure of personal or County confidential information, (iv) maintain reasonable procedures to prevent, detect, respond, and provide notification to the County regarding any internal or external security breaches, (v) ensure the return or appropriate disposal of personal information or other confidential information upon contract conclusion (or per retention standards set forth in the contract), and (vi) ensure that any subcontractor(s)/agent(s) that receives, stores, maintains, processes, transmits, or otherwise accesses County data and/or system(s) is in compliance with statements and the provisions of statements and services herein.
1. This County of Orange Information Technology Security Provisions document provides a high-level guide for contractors to understand the resiliency and cybersecurity expectations of the County. The County of Orange Security Guidelines follow the latest National Institute of Standards and Technology (NIST) 800-53 framework to ensure the highest levels of operational resiliency and cybersecurity.
Contractor, Contractor personnel, Contractor’s subcontractors, any person performing work on behalf of Contractor, and all other agents and representatives of Contractor will, at all times, comply with and abide by all County of Orange Information Technology Security Provisions (“Security Provisions”) that pertain to Contractor(s) in connection with the Services performed by Contractor(s) as set forth in the scope of work of this Contract. Any violations of the Security Provisions shall, in addition to all other available rights and remedies available to County, be cause for immediate termination of this Contract. Such Security Provisions include, but are not limited to, Attachment “E” - County of Orange Information Technology Security Guidelines.
Contractor shall use industry best practices and methods with regard to confidentiality, integrity, availability, and the prevention, detection, response, and elimination of threat, by all appropriate means, of fraud, abuse, and other inappropriate or unauthorized access to County data and/or system(s) accessed in the performance of Services under this Contract.
2. The Contractor shall implement and maintain a written information security program that contains reasonable and appropriate security measures designed to safeguard the confidentiality, integrity, availability, and resiliency of County data and/or system(s). The Contractor shall review and update its information security program in accordance with contractual, legal, and regulatory requirements. Contractor shall provide to County a copy of the organization’s information security program and/or policies. #MA063-25010752 Page 2 of 6 March 20, 2025
3. Information Access: Contractor shall use appropriate safeguards and security measures to ensure the confidentiality and security of all County data.
County may require all Contractor personnel, subcontractors, and affiliates approved by County to perform work under this Contract to execute a confidentiality and non-disclosure agreement concerning access protection and data security in the form provided by County.
County shall authorize, and Contractor shall issue, any necessary information-access mechanisms, including access IDs and passwords, and in no event shall Contractor permit any such mechanisms to be shared or used by other than the individual Contractor personnel, subcontractor, or affiliate to whom issued. Contractor shall provide each Contractor personnel, subcontractors, or affiliates with only such level of access as is required for such individual to perform his or her assigned tasks and functions.
Throughout the Contract term, upon request from County but at least once each calendar year, Contractor shall provide County with an accurate, up-to-date list of those Contractor personnel and/or subcontractor personnel having access to County systems and/or County data, and the respective security level or clearance assigned to each such Contractor personnel and/or subcontractor personnel. County reserves the right to require the removal and replacement of Contractor personnel and/or subcontractor personnel at the County’s sole discretion. Removal and replacement shall be performed within 14 calendar days of notification by the County.
All County resources (including County systems), County data, County hardware, and County software used or accessed by Contractor: (a) shall be used and accessed by such Contractor and/or subcontractors personnel solely and exclusively in the performance of their assigned duties in connection with, and in furtherance of, the performance of Contractor’s obligations hereunder; and (b) shall not be used or accessed except as expressly permitted hereunder, or commercially exploited in any manner whatsoever, by Contractor or Contractor’s personnel and subcontractors, at any time.
Contractor acknowledges and agrees that any failure to comply with the provisions of this paragraph shall constitute a breach of this Contract and entitle County to deny or restrict the rights of such non-complying Contractor personnel and/or subcontractor personnel to access and use the County data and/or system(s), as County in its sole discretion shall deem appropriate.
4. Data Security Requirements: Without limiting Contractor’s obligation of confidentiality as further described in this Contract, Contractor must establish, maintain, and enforce a data privacy program and an information and cyber security program, including safety, physical, and technical security and resiliency policies and procedures, that comply with the requirements set forth in this Contract and, to the extent such programs are consistent with and not less protective than the requirements set forth in this Contract and are at least equal to applicable best industry practices and standards (NIST 800-53).
Contractor also shall provide technical and organizational safeguards against accidental, unlawful, or unauthorized access or use, destruction, loss, alteration, disclosure, transfer, commingling, or processing of such information that ensure a level of security appropriate to the risks presented by the processing of County Data,
#MA063-25010752 Page 3 of 6 March 20, 2025
Contractor personnel and/or subcontractor personnel and affiliates approved by County to perform work under this Contract may use or disclose County personal and confidential information only as permitted in this Contract. Any other use or disclosure requires express approval in writing by the County of Orange. No Contractor personnel and/or subcontractor personnel or affiliate shall duplicate, disseminate, market, sell, or disclose County personal and confidential information except as allowed in this Contract. Contractor personnel and/or subcontractor personnel or affiliate who access, disclose, market, sell, or use County personal and confidential information in a manner or for a purpose not authorized by this Contract may be subject to civil and criminal sanctions contained in applicable federal and state statutes.
Contractor shall take all reasonable measures to secure and defend all locations, equipment, systems, and other materials and facilities employed in connection with the Services against hackers and others who may seek, without authorization, to disrupt, damage, modify, access, or otherwise use Contractor systems or the information found therein; and prevent County data from being commingled with or contaminated by the data of other customers or their users of the Services and unauthorized access to any of County data.
Contractor shall also continuously monitor its systems for potential areas where security could be breached. In no case shall the safeguards of Contractor’s data privacy and information and cyber security program be less stringent than the safeguards used by County. Without limiting any other audit rights of County, County shall have the right to review Contractor’s data privacy and information and cyber security program prior to commencement of Services and from time to time during the term of this Contract.
All data belongs to the County and shall be destroyed or returned at the end of the contract via digital wiping, degaussing, or physical shredding as directed by County.
5. Enhanced Security Measures: County may, in its discretion, designate certain areas, facilities, or solution systems as ones that require a higher level of security and access control. County shall notify Contractor in writing reasonably in advance of any such designation becoming effective. Any such notice shall set forth, in reasonable detail, the enhanced security or accesscontrol procedures, measures, or requirements that Contractor shall be required to implement and enforce, as well as the date on which such procedures and measures shall take effect.
Contractor shall and shall cause Contractor personnel and subcontractors to fully comply with and abide by all such enhanced security and access measures and procedures as of such date.
6. General Security Standards: Contractor will be solely responsible for the information technology infrastructure, including all computers, software, databases, electronic systems (including database management systems, email systems, auditing, and monitoring systems) and networks used by or for Contractor (“Contractor Systems”) to access County resources (including County systems), County data or otherwise in connection with the Services and shall prevent unauthorized access to County resources (including County systems) or County data through the Contractor Systems.
#MA063-25010752 Page 4 of 6 March 20, 2025
a) Contractor System(s) and Security: At all times during the contract term, Contractor shall maintain a level of security with regard to the Contractor Systems, that in all events is at least as secure as the levels of security that are common and prevalent in the industry and in accordance with industry best practices (NIST 800-53). Contractor shall maintain all appropriate administrative, physical, technical, and procedural safeguards to secure County data from data breach, protect County data and the Services from loss, corruption, unauthorized disclosure, and from hacks, and the introduction of viruses, disabling devices, malware, and other forms of malicious and inadvertent acts that can disrupt County’s access and use of County data and the Services.
b) Contractor and the use of Email: Contractor, including Contractor’s employees and subcontractors, that are provided a County email address must only use the County email system for correspondence of County business. Contractor, including Contractor’s employees and subcontractors, must not access or use personal, nonCounty Internet (external) email systems from County networks and/or County computing devices. If at any time Contractor’s performance under this Contract requires such access or use, Contractor must submit a written request to County with justification for access or use of personal, non-County Internet (external) email systems from County networks and/or computing devices and obtain County’s express prior written approval.
Contractors who are not provided with a County email address, but need to transmit County data will be required to maintain and transmit County data in accordance with this Agreement.
7. Security Failures: Any failure by the Contractor to meet the requirements of this Contract with respect to the security of County data, including any related backup, disaster recovery, or other policies, practices or procedures, and any breach or violation by Contractor or its subcontractors or affiliates, or their employees or agents, of any of the foregoing, shall be deemed a material breach of this Contract and may result in termination and reimbursement to County of any fees prepaid by County prorated to the date of such termination. The remedy provided in this paragraph shall not be exclusive and is in addition to any other rights and remedies provided by law or under the Contract.
8. Security Breach Notification: In the event Contractor becomes aware of any act, error or omission, negligence, misconduct, or security incident including unsecure or improper data disposal, theft, loss, unauthorized use and disclosure or access, that compromises or is suspected to compromise the security, availability, confidentiality, and/or integrity of County data or the physical, technical, administrative, or organizational safeguards required under this Contract that relate to the security, availability, confidentiality, and/or integrity of County data, Contractor shall, at its own expense, (1) immediately (or within 24 hours of potential or suspected breach), notify the County’s Chief Information Security Officer and County Privacy Officer of such occurrence; (2) perform a root cause analysis of the actual, potential, or suspected breach; (3) provide a remediation plan that is acceptable to County within 30 days #MA063-25010752 Page 5 of 6 March 20, 2025
of verified breach, to address the occurrence of the breach and prevent any further incidents; (4) conduct a forensic investigation to determine what systems, data, and information have been affected by such event; and (5) cooperate with County and any law enforcement or regulatory officials investigating such occurrence, including but not limited to making available all relevant records, forensics, investigative evidence, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by County and/or any law enforcement or regulatory officials, and (6) perform or take any other actions required to comply with applicable law as a result of the occurrence (at the direction of County).
County shall make the final decision on notifying County officials, entities, employees, service providers, and/or the general public of such occurrence, and the implementation of the remediation plan. If notification to particular persons is required under any law or pursuant to any of County’s privacy or security policies, then notifications to all persons and entities who are affected by the same event shall be considered legally required. Contractor shall reimburse County for all notification and related costs incurred by County arising out of or in connection with any such occurrence due to Contractor’s acts, errors or omissions, negligence, and/or misconduct resulting in a requirement for legally required notifications.
In the case of a breach, Contractor shall provide third-party credit and identity monitoring services to each of the affected individuals for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following the date of notification to such individuals.
Contractor shall indemnify, defend with counsel approved in writing by County, and hold County and County Indemnitees harmless from and against any and all claims, including reasonable attorney’s fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from County in connection with the occurrence.
Notification shall be sent to:
Andrew Alipanah, MBA, CISSP
Chief Information Security Officer
721 S. Parker St.
Suite 200
Orange, CA 92868
Phone: (714) 567-7611
[email protected]
Linda Le, CHPC, CHC, CHP
County Privacy Officer
721 S. Parker St.
Suite 200
Orange, CA 92868
Phone: (714) 834-4082
[email protected]
9. Security Audits: Contractor shall maintain complete and accurate records relating to its system and Organization Controls (SOC) Type II audits or equivalent’s data protection practices, internal and external audits, and the security of any of County-hosted content, including any confidentiality, integrity, and availability operations (data hosting, backup, disaster recovery, external dependencies management, vulnerability testing, penetration testing, patching, or other related policies, practices, standards, or procedures). #MA063-25010752 Page 6 of 6 March 20, 2025
Contractor shall inform County of any internal/external security audit or assessment performed on Contractor’s operations, information and cyber security program, disaster recovery plan, and prevention, detection, or response protocols that are related to hosted County content, within sixty (60) calendar days of such audit or assessment. Contractor will provide a copy of the audit report to County within thirty (30) days after Contractor’s receipt of request for such report(s).
Contractor shall reasonably cooperate with all County security reviews and testing, including but not limited to penetration testing of any cloud-based solution provided by Contractor to County under this Contract. Contractor shall implement any required safeguards as identified by County or by any audit of Contractor’s data privacy and information/cyber security program.
In addition, County has the right to review Plans of Actions and Milestones (POA&M) for any outstanding items identified by the SOC 2 Type II report requiring remediation as it pertains to the confidentiality, integrity, and availability of County data. County reserves the right, at its sole discretion, to immediately terminate this Contract or a part thereof without limitation and without liability to County if County reasonably determines Contractor fails or has failed to meet its obligations under this section.
10. Business Continuity and Disaster Recovery (BCDR):
For the purposes of this section, “Recovery Point Objectives” means the maximum age of files (data and system configurations) that must be recovered from backup storage for normal operations to resume if a computer, system, or network goes down as a result of a hardware, program, or communications failure (establishing the data backup schedule and strategy). “Recovery Time Objectives” means the maximum duration of time and a service level within which a business process must be restored after a disaster (or disruption) in order to avoid unacceptable consequences associated with a loss of functionality.
The Contractor shall maintain a comprehensive risk management program focused on managing risks to County operations and data, including mitigation of the likelihood and impact of an adverse event occurring that would negatively affect contracted services and operations of the County. Business continuity management will enable the Contractor to identify and minimize disruptive risks and restore and recover hosted County business-critical services and/or data within the agreed terms following an adverse event or other major business disruptions. Recovery and timeframes may be impacted when events or disruptions are related to dependencies on third-parties. The County and Contractor will agree on Recovery Point Objectives and Recovery Time Objectives (as needed)) and will periodically review these objectives. Any disruption to services of system will be communicated to the County within 4 hours, and every effort shall be undertaken to restore contracted services, data, operations, security, and functionality.
All data and/or systems and technology provided by the Contractor internally and through third-party vendors shall have resiliency and redundancy capabilities to achieve high availability and data recoverability. Contractor Systems shall be designed, where practical and possible, to ensure continuity of service(s) in the event of a disruption or outage. #MA063-25010752 Page 1 of 14 March 20, 2025
ATTACHMENT D
STATE PRIVACY AND SECURITY PROVISIONS
1. DEFINITIONS
For the purpose of this Agreement, the following terms mean:
a. “Assist in the Administration of the Program” means performing administrative functions on behalf of programs, such as determining eligibility for, or enrollment in, and collecting PII for such purposes, to the extent such activities are authorized by law.
b. “Breach” refers to actual loss, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users and for other than authorized purposes have access or potential access to PII, whether electronic, paper, verbal, or recorded.
c. “Contractor Staff” means those employees of the contractor/subcontractor, vendors and agents performing any functions for the county that require access to and/or use of PII and that are authorized by the county to access and use PII. d. “PII” is personally identifiable information that is obtained through the MEDS or IEVS on behalf of the programs and can be used alone, or in conjunction with any other reasonably available information, to identify a specific individual. The PII includes, but is not limited to, an individual's name, social security number, driver's license number, identification number, biometric records, date of birth, place of birth, or mother’s maiden name. The PII may be electronic, paper, verbal, or recorded. e. “Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of PII, or interference with system operations in an information system which processes PII that is under the control of the county or county’s Statewide Automated Welfare System (SAWS) Consortium, or CalWIN (California Welfare Information Network), or under the control of a contractor, subcontractor or vendor of the county, on behalf of the county. f. “Secure Areas” means any area where:
i. Contractor Staff assist in the administration of their program; ii. Contractor Staff use or disclose PII; or
iii. PII is stored in paper or electronic format.
#MA063-25010752 Page 2 of 14 March 20, 2025
2. PRIVACY AND CONFIDENTIALITY
a. The County staff, contractors, subcontractors and vendors, covered by this Agreement may use or disclose PII only as permitted in this Agreement and only to assist in the administration of programs in accordance with 45 CFR § 205.50 et. seq and Welfare and Institutions Code section 10850, and Section 14100.2 of the Welfare and Institutions Code, Section 431.300 et. Seq. of Title 42 Code of Federal Regulations, or as authorized or required by law. Disclosures, which are authorized or required by law, such as a court order, or are made with the explicit written authorization of the individual, who is the subject of the PII, are allowable. Any other use or disclosure of PII requires the express approval in writing by County of Orange. No Contractor Staff shall duplicate, disseminate or disclose PII except as allowed in this Agreement. b. Pursuant to this Agreement, Contractor Staff may only use PII to perform administrative functions related to administering their respective programs. c. Access to PII shall be restricted to Contractor Staff who need to perform their official duties to assist in the administration of their respective programs. d. Contractor Staff who access, disclose or use PII in a manner or for a purpose not authorized by this Agreement may be subject to civil and criminal sanctions contained in applicable federal and state statutes.
3. PERSONNEL CONTROLS
The County agrees to advise Contractor Staff, who have access to PII, of the confidentiality of the information, the safeguards required to protect the information, and the civil and criminal sanctions for non-compliance contained in applicable federal and state laws. For that purpose, the Contractor shall implement the following personnel controls:
a. Employee Training. Train and use reasonable measures to ensure compliance with the requirements of this Agreement by Contractor Staff, including, but not limited to:
i. Provide initial privacy and security awareness training to each new Contractor Staff within thirty (30) days of employment and;
ii. Thereafter, provide annual refresher training or reminders of the privacy and security safeguards in this Agreement to all Contractor Staff. Three (3) or more security reminders per year are recommended;
iii. Maintain records indicating each Contractor Staff’s name and the date on which the privacy and security awareness training was completed; iv. Retain training records for a period of three (3) years after completion of the training.
b. Employee Discipline.
i. Provide documented sanction policies and procedures for Contractor Staff who #MA063-25010752 Page 3 of 14 March 20, 2025
fail to comply with privacy policies and procedures or any provisions of these requirements.
ii. Sanction policies and procedures shall include termination of employment when appropriate.
c. Confidentiality Statement. Ensure that all Contractor Staff, accessing, using or disclosing PII, sign a confidentiality statement (provided by the County). The statement shall be signed by Contractor staff prior to accessing PII and annually thereafter.
Signatures may be physical or electronic. The signed statement shall be retained for a period of three (3) years.
The statement shall include at a minimum:
i. General Use;
ii. Security and Privacy Safeguards;
iii. Unacceptable Use; and
iv. Enforcement Policies.
d. Background Screening.
i. Conduct a background screening of a Contractor Staff before they may access PII.
ii. The background screening should be commensurate with the risk and magnitude of harm the employee could cause. More thorough screening shall be done for those employees who are authorized to bypass significant technical and operational security controls.
iii. The Contractor shall retain each Contractor Staff’s background screening documentation for a period of three (3) years following conclusion of employment relationship.
4. MANAGEMENT OVERSIGHT AND MONITORING
To ensure compliance with the privacy and security safeguards in this Agreement the County shall perform the following:
a. Conduct periodic privacy and security reviews of work activity by Contractor Staff, including random sampling of work product. Examples include, but are not limited to, access to case files or other activities related to the handling of PII. b. The periodic privacy and security reviews must be performed or overseen by management level personnel who are knowledgeable and experienced in the areas of privacy and information security in the administration of their program, and the use or disclosure of PII.
5. INFORMATION SECURITY AND PRIVACY STAFFING
#MA063-25010752 Page 4 of 14 March 20, 2025
The Contractor agrees to:
a. Designate information security and privacy officials who are accountable for compliance with these and all other applicable requirements stated in this Agreement. b. Provide County with applicable contact information for these designated individuals.
Any changes to this information should be reported to County within ten (10) days. c. Assign staff to be responsible for administration and monitoring of all security related controls stated in this Agreement.
6. PHYSICAL SECURITY
The Contractor shall ensure PII is used and stored in an area that is physically safe from access by unauthorized persons at all times. The Contractor agrees to safeguard PII from loss, theft, or inadvertent disclosure and, therefore, agrees to:
a. Secure all areas of the Contractor’s facilities where Contractor Staff assist in the administration of their program and use, disclose, or store PII. b. These areas shall be restricted to only allow access to authorized individuals by using one or more of the following:
i. Properly coded key cards
ii. Authorized door keys
iii. Official identification
c. Issue identification badges to Contractor Staff.
d. Require Contractor Staff to wear these badges where PII is used, disclosed, or stored. e. Ensure each physical location, where PII is used, disclosed, or stored, has procedures and controls that ensure an individual who is terminated from access to the facility is promptly escorted from the facility by an authorized employee and access is revoked. f. Ensure there are security guards or a monitored alarm system at all times at the Contractor facilities and leased facilities where five hundred (500) or more individually identifiable records of PII is used, disclosed or stored. Video surveillance are recommended.
g. Ensure data centers with servers, data storage devices, and/or critical network infrastructure involved in the use, storage, and/or processing of PII have perimeter security and physical access controls that limit access to only authorized Contractor Staff. Visitors to the data center area must be escorted at all times by authorized Contractor Staff.
#MA063-25010752 Page 5 of 14 March 20, 2025
h. Store paper records with PII in locked spaces, such as locked file cabinets, locked file rooms, locked desks, or locked offices in facilities which have multi-use functions in one building in work areas that are not securely segregated from each other. It is recommended that all PII be locked up when unattended at any time, not just within multi-use facilities.
i. The Contractor shall have policies that include, based on applicable risk factors, a description of the circumstances under which the Contractor Staff can transport PII, as well as the physical security requirements during transport. A Contractor that chooses to permit its staff to leave records unattended in vehicles must include provisions in its policies to ensure the PII is stored in a non-visible area such as a trunk, that the vehicle is locked, and under no circumstances permit PII be left unattended in a vehicle overnight or for other extended periods of time.
j. The Contractor shall have policies that indicate Contractor Staff are not to leave records with PII unattended at any time in airplanes, buses, trains, etc., including baggage areas.
This should be included in training due to the nature of the risk. k. Use all reasonable measures to prevent non-authorized personnel and visitors from having access to, control of, or viewing PII.
7. TECHNICAL SECURITY CONTROLS
a. Workstation/Laptop Encryption. All workstations and laptops, which use, store and/or process PII, must be encrypted using a FIPS 140-2 certified algorithm 128 bit or higher, such as Advanced Encryption Standard (AES). The encryption solution must be full disk. It is encouraged, when available and when feasible, that the encryption be 256 bit.
b. Server Security. Servers containing unencrypted PII must have sufficient administrative, physical, and technical controls in place to protect that data, based upon a risk assessment/system security review. It is recommended to follow the guidelines documented in the latest revision of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations.
c. Minimum Necessary. Only the minimum necessary amount of PII required to perform required business functions may be accessed, copied, downloaded, or exported. d. Mobile Device and Removable Media. All electronic files, which contain PII data, must be encrypted when stored on any mobile device or removable media (i.e. USB drives, CD/DVD, smartphones, tablets, backup tapes etc.). Encryption must be a FIPS 140-2 certified algorithm 128 bit or higher, such as AES. It is encouraged, when #MA063-25010752 Page 6 of 14 March 20, 2025
available and when feasible, that the encryption be 256 bit. e. Antivirus Software. All workstations, laptops and other systems, which process and/or store PII, must install and actively use an antivirus software solution. Antivirus software should have automatic updates for definitions scheduled at least daily. f. Patch Management.
i. All workstations, laptops and other systems, which process and/or store PII, must have critical security patches applied, with system reboot if necessary. ii. There must be a documented patch management process that determines installation timeframe based on risk assessment and vendor recommendations. iii. At a maximum, all applicable patches deemed as critical must be installed within thirty (30) days of vendor release. It is recommended that critical patches which are high risk be installed within seven (7) days. iv. Applications and systems that cannot be patched within this time frame, due to significant operational reasons, must have compensatory controls implemented to minimize risk.
g. User IDs and Password Controls.
i. All users must be issued a unique username for accessing PII. ii. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee within twenty-four (24) hours. Note:
Twenty-four (24) hours is defined as one (1) working day. iii. Passwords are not to be shared.
iv. Passwords must be at least eight (8) characters.
v. Passwords must be a non-dictionary word.
vi. Passwords must not be stored in readable format on the computer or server. vii. Passwords must be changed every ninety (90) days or less. viii. Passwords must be changed if revealed or compromised. ix. Passwords must be composed of characters from at least three (3) of the following four (4) groups from the standard keyboard:
A. Upper case letters (A-Z)
B. Lower case letters (a-z)
C. Arabic numerals (0-9)
D. Special characters (!,@,#, etc.)
h. Data Destruction. When no longer needed, all PII must be cleared, purged, or destroyed consistent with NIST SP 800-88, Guidelines for Media Sanitization, such that the PII cannot be retrieved.
i. System Timeout. The systems providing access to PII must provide an automatic timeout, requiring re-authentication of the user session after no more than twenty (20) minutes of inactivity.
j. Warning Banners. The systems providing access to PII must display a warning banner #MA063-25010752 Page 7 of 14 March 20, 2025
stating, at a minimum:
i. Data is confidential;
ii. Systems are logged;
iii. System use is for business purposes only, by authorized users; and iv. Users shall log off the system immediately if they do not agree with these requirements.
k. System Logging.
i. The systems which provide access to PII must maintain an automated audit trail that can identify the user or system process which initiates a request for PII or alters PII.
ii. The audit trail shall:
A. Be date and time stamped;
B. Log both successful and failed accesses;
C. Be read-access only; and
D. Be restricted to authorized users.
iii. If PII is stored in a database, database logging functionality shall be enabled. iv. Audit trail data shall be archived for at least three (3) years from the occurrence. l. Access Controls. The system providing access to PII shall use role-based access controls for all user authentications, enforcing the principle of least privilege. m. Transmission Encryption.
i. All data transmissions of PII outside of a secure internal network must be encrypted using a Federal Information Processing Standard (FIPS) 140-2 certified algorithm that is 128 bit or higher, such as Advanced Encryption Standard (AES) or Transport Layer Security (TLS). It is encouraged, when available and when feasible, that 256 bit encryption be used. ii. Encryption can be end to end at the network level, or the data files containing PII can be encrypted.
iii. This requirement pertains to any type of PII in motion such as website access, file transfer, and email.
n. Intrusion Prevention. All systems involved in accessing, storing, transporting, and protecting PII, which are accessible through the Internet, must be protected by an intrusion detection and prevention solution.
8. AUDIT CONTROLS
a. System Security Review.
i. The Contractor must ensure audit control mechanisms are in place. ii. All systems processing and/or storing PII must have at least an annual system #MA063-25010752 Page 8 of 14 March 20, 2025
risk assessment/security review that ensures administrative, physical, and technical controls are functioning effectively and provide an adequate level of protection.
iii. Reviews should include vulnerability scanning tools. b. Log Reviews. All systems processing and/or storing PII must have a process or automated procedure in place to review system logs for unauthorized access. c. Change Control. All systems processing and/or storing PII must have a documented change control process that ensures separation of duties and protects the confidentiality, integrity and availability of data.
d. Anomalies. When the County or DHCS suspects MEDS usage anomalies, the County will work with Contractor to investigate the anomalies and report conclusions of such investigations and remediation to California Department of Social Services (CDSS).
9. BUSINESS CONTINUITY / DISASTER RECOVERY CONTROLS
a. Emergency Mode Operation Plan. The Contractor must establish a documented plan to enable continuation of critical business processes and protection of the security of PII kept in an electronic format in the event of an emergency. Emergency means any circumstance or situation that causes normal computer operations to become unavailable for use in performing the work required under this Agreement for more than twenty-four (24) hours.
b. Data Centers. Data centers with servers, data storage devices, and critical network infrastructure involved in the use, storage and/or processing of PII, must include environmental protection such as cooling, power, and fire prevention, detection, and suppression.
c. Data Backup and Recovery Plan.
i. The Contractor shall have established documented procedures to backup PII to maintain retrievable exact copies of PII.
ii. The documented backup procedures shall contain a schedule which includes incremental and full backups.
iii. The procedures shall include storing backups offsite. iv. The procedures shall ensure an inventory of backup media. v. The Contractor shall have established documented procedures to recover PII data.
vi. The documented recovery procedures shall include an estimate of the amount of time needed to restore the PII data.
vii. It is recommended that the Contractor periodically test the data recovery process.
#MA063-25010752 Page 9 of 14 March 20, 2025
10. PAPER DOCUMENT CONTROLS
a. Supervision of Data. The PII in paper form shall not be left unattended at any time, unless it is locked in a file cabinet, file room, desk or office. Unattended means that information may be observed by an individual not authorized to access the information. b. Data in Vehicles. The Contractor shall have policies that include, based on applicable risk factors, a description of the circumstances under which the Contractor Staff can transport PII, as well as the physical security requirements during transport. A Contractor that chooses to permit its staff to leave records unattended in vehicles must include provisions in its policies to ensure the PII is stored in a non-visible area such as a trunk, that the vehicle is locked, and under no circumstances permit PII be left unattended in a vehicle overnight or for other extended periods of time. c. Public Modes of Transportation. The PII in paper form shall not be left unattended at any time in airplanes, buses, trains, etc., including baggage areas. This should be included in training due to the nature of the risk.
d. Escorting Visitors. Visitors to areas where PII is contained shall be escorted, and PII shall be kept out of sight while visitors are in the area. e. Confidential Destruction. PII must be disposed of through confidential means, such as cross-cut shredding or pulverizing.
f. Removal of Data. The PII must not be removed from the premises of Contractor except for identified routine business purposes or with express written permission of HHS. g. Faxing.
i. Faxes containing PII shall not be left unattended and fax machines shall be in secure areas.
ii. Faxes shall contain a confidentiality statement notifying persons receiving faxes in error to destroy them and notify the sender.
iii. Fax numbers shall be verified with the intended recipient before sending the fax h. Mailing.
i. Mailings containing PII shall be sealed and secured from damage or inappropriate viewing of PII to the extent possible.
ii. Mailings that include five hundred (500) or more individually identifiable records containing PII in a single package shall be sent using a tracked mailing method that includes verification of delivery and receipt, unless the Contractor #MA063-25010752 Page 10 of 14 March 20, 2025
obtains prior written permission from HHS to use another method.
11. NOTIFICATION AND INVESTIGATION OF BREACHES AND SECURITY
INCIDENTS
During the term of this Agreement, the County agrees to implement reasonable systems for the discovery and prompt reporting of any Breach or Security Incident, and to take the following steps:
a. Initial Notice to HHS:
i. The Contractor will provide initial notice to the County. The Contractor agrees to perform the following incident reporting to County.
ii. Immediately upon discovery of a suspected security incident that involves data provided to Contractor by County, the Contractor will notify the County by email or telephone.
iii. Within one working day of discovery, the Contractor will notify the County by email or telephone of unsecured PII, if that PII was, or is, reasonably believed to have been accessed or acquired by an unauthorized person, any suspected security incident, intrusion, or unauthorized access, use, or disclosure of PII in violation of this Agreement, or potential loss of confidential data affecting this Agreement. Notice shall be made by contacting the County as provided in this agreement, including all information known at the time.
iv. A breach shall be treated as discovered by the Contractor as of the first day on which the breach is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing the breach), who is an employee, officer or other agent of the Contractor. v. Upon discovery of a breach, security incident, intrusion, or unauthorized access, use, or disclosure of PII, the Contractor shall take:
A. Prompt corrective action to mitigate any risks or damages involved with the breach and to protect the operating environment; and B. Any action pertaining to such unauthorized disclosure required by applicable Federal and State laws and regulations.
b. Investigation and Investigative Report. The Contractor shall immediately investigate breaches and security incidents involving PII. The Contractor will cooperate with the County during this investigation. Within seventy-two (72) hours of discovery, the Contractor shall provide new or updated information if available to County. The updated report shall include any other applicable information related to the breach or security incident known at that time. The Contractor shall provide status update to County on a regular basis as agreed upon.
The Contractor shall provide to County all specific and pertinent information about the Breach, including copies of any reports conducted by the Contractor or on behalf of the #MA063-25010752 Page 11 of 14 March 20, 2025
Contractor. The Contractor shall waive any assertion of privilege in relation to such reports. Such information and/or reports shall be provided to County without unreasonable delay and in no event later than fifteen (15) calendar days the Contractor have such information and/or report.
c. Complete Report. The complete report of the investigation shall include an assessment of all known factors relevant to the determination of whether a breach occurred under applicable provisions of the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, the Information Protection Act, or other applicable law.
The report shall include a Corrective Action Plan (CAP) which includes, at a minimum, detailed information regarding the mitigation measures taken to halt and/or contain the improper use or disclosure.
If County requests additional information related to the incident, the Contractor shall make reasonable efforts to provide County with such information. County will review report and determine whether a breach occurred and whether individual notification is required. County will maintain the final decision making over a breach determination. d. Notifications of Individuals. When applicable state or federal law requires notification to individuals of a breach or unauthorized disclosure of their PII, the County will make the decision to either notify clients or have the Contractor give notice. If the Contractor shall give the notice, it would be subject to the following provisions:
i. If the cause of the breach is attributable to the Contractor or its subcontractors, agents or vendors, the Contractor shall pay any costs of such notifications, as well as any and all costs associated with the breach. If there are any questions as to whether the County or the Contractor is responsible for the breach, the County and the Contractor shall jointly determine responsibility for purposes of allocating the costs;
ii. All notifications (regardless of breach status) regarding the beneficiaries’ PII shall comply with the requirements set forth in Section 1798.29 of the California Civil Code and Section 17932 of Title 42 of the United States Code, inclusive of its implementing regulations, including but not limited to the requirement that the notifications be made without reasonable delay and in no event, later than sixty (60) calendar days from discovery; iii. The County has contractual requirement with the California Department of Social Services and California Department of Health Care Services to approve the time, manner and content of any such notifications and their review and approval shall be obtained before notifications are made. Therefore, the Contractor must provide the notifications to County to obtain review and approval prior to notifications are made. If notifications are distributed without State review and approval, secondary follow-up notifications may be required; and
iv. The County may elect to assume responsibility for such notification from the #MA063-25010752 Page 12 of 14 March 20, 2025
Contractor.
e. Responsibility for Reporting of Breaches when Required by State or Federal Law.
If the cause of a breach is attributable to the Contractor or its agents, subcontractors or vendors, the Contractor is responsible for all required reporting of the breach. If the cause of the breach is attributable to the County, the County is responsible for all required reporting of the breach. When applicable law requires the breach be reported to a federal or state agency or that notice be given to media outlets, DHCS (Department of Health Care Services) and CDSS (California Department of Social Services) (if the breach involves MEDS or SSA data), then the Contractor shall coordinate with the County to ensure such reporting is in compliance with applicable law and to prevent duplicate reporting, and to jointly determine responsibility for purposes of allocating the costs of such reports, if any.
f. County Contact Information. The Contractor shall utilize the below contact information to direct all notifications of breach and security incidents to the County.
The County reserves the right to make changes to the contact information by giving written notice to the Contractor. Said changes shall not require an amendment to this Agreement or any other agreement into which it is incorporated.
Social Services Agency
Contact
County Privacy Officer
County of Orange
Social Services Agency
Contracts Services
500 N. State College
Blvd, Suite 100
Orange, CA 92868
714-541-7785
[email protected]
Linda Le, CHC, CHPC, CHP
County of Orange
OCIT - Enterprise Privacy &
Cybersecurity
1055 N. Main St, 6th Floor
Santa Ana, CA 92701
Email: [email protected]
[email protected]
[email protected]
12. COMPLIANCE WITH SSA (SOCIAL SECURITY ADMINISTRATION)
AGREEMENT
The County has agreed to comply with applicable privacy and security requirements in the #MA063-25010752 Page 13 of 14 March 20, 2025
Computer Matching and Privacy Protection Act Agreement (CMPPA) between the SSA and the California Health and Human Services Agency (CHHS), in the Information Exchange Agreement (IEA) between SSA and CDSS, and in the Electronic Information Exchange Security Requirements and Procedures for State and Local Agencies Exchanging Electronic Information with SSA (TSSR). If Contractor have access to the PII data provided by SSA, then Contractor must agree to comply with the applicable privacy and security requirements, which is available upon request.
If there is any conflict between a privacy and security standard in the CMPPA, IEA or TSSR, and a standard in this Agreement, the most stringent standard shall apply. The most stringent standard means the standard which provides the greatest protection to PII.
13. COMPLIANCE WITH DEPARTMENT OF HOMELAND SECURITY
AGREEMENT
The County has agreed to comply with substantive privacy and security requirements in the Computer Matching Agreement (CMA) between the Department/Agency of Homeland Security, United States Citizenship and Immigration Services (DHS-USCIS) and CDSS. If Contractor have access to the PII data provided by DHS-USCIS, then Contractor must agree to comply with the applicable privacy and security requirements, which is available upon request.
If there is any conflict between a privacy and security standard in the CMA and a standard in this Agreement, the most stringent standard shall apply. The most stringent standard means the standard which provides the greatest protection to PII.
14. CONTRACTOR AGENTS. SUBCONTRACTORS, AND VENDORS
The Contractor agrees to enter into written agreements with all agents, subcontractors, and vendors that have access to the Contractor’s PII. These agreements will impose, at a minimum, the same restrictions and conditions that apply to the Contractor with respect to PII upon such agents, subcontractors, and vendors. These shall include, at a minimum, (1) restrictions on disclosure of PII, (2) conditions regarding the use of appropriate administrative, physical, and technical safeguards to protect PII, and, where relevant, (3) the requirement that any breach, security incident, intrusion, or unauthorized access, use, or disclosure of PII be reported to the Contractor. If the agents, subcontractors, and vendors of the Contractor access data provided to the County by SSA or DHS-USCIS, the Contractor shall also incorporate the Agreement's Exhibits into each subcontract or subaward with agents, subcontractors, and vendors.
15. ASSESSMENTS AND REVIEWS
#MA063-25010752 Page 14 of 14 March 20, 2025
In order to enforce this Agreement and ensure compliance with its provisions, the Contractor agrees to assist the County (on behalf of CDSS and DHCS) in performing compliance assessments. These assessments may involve compliance review questionnaires, and/or review of the facilities, systems, books, and records of the Contractor, with reasonable notice from the County. Such reviews shall be scheduled at times that take into account the operational and staffing demands. The Contractor agrees to promptly remedy all violations of any provision of this Agreement and certify the same to the County in writing, or to enter into a written CAP (Corrective Action Plan) with the County containing deadlines for achieving compliance with specific provisions of this Agreement.
16. ASSISTANCE IN LITIGATION OR ADMINISTRATIVE PROCEEDINGS In the event of litigation or administrative proceedings involving the County based upon claimed violations by the Contractor of the privacy or security of PII, or federal or state laws or agreements concerning privacy or security of PII, the Contractor shall make all reasonable effort to make itself and Contract Workers assisting in the administration of their program and using or disclosing PII available to the County at no cost to the County to testify as witnesses. The County shall also make all reasonable efforts to make itself and any subcontractors, agents, and employees available to the Contractor at no cost to the Contractor to testify as witnesses, in the event of litigation or administrative proceedings involving the Contractor based upon claimed violations by the County of the privacy or security of PII, or state or federal laws or agreements concerning privacy or security of PII.
County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 1
ATTACHMENT E
1 ASSET MANAGEMENT
Asset management establishes an organization’s inventory of fixed and controlled assets and defines how these assets are managed during their lifecycle to ensure sustained productivity in support of the organization’s critical services. An event that disrupts an asset can inhibit the organization from achieving its mission. An asset management program helps identify appropriate strategies that shall allow the assets to maintain productivity during disruptive events. There are four broad categories of assets: people, information, technology, and facilities.
The Cybersecurity Program strives to achieve and maintain appropriate protection of IT assets. Loss of accountability of IT assets could result in a compromise or breach of IT systems and/or a compromise or breach of sensitive or privacy data. All vendors who contract with the County of Orange ("County") shall work cooperatively to assist County in achieving the objectives and abide by the applicable terms under these Guidelines at all times during the term of its contract with County.
1.1 GOALS AND OBJECTIVES
1.1.1 Services are identified and prioritized.
1.1.2 Assets are inventoried, and the authority and responsibility for these assets is established.
1.1.3 The relationship between assets and the services they support is established.
1.1.4 The asset inventory is managed.
1.1.5 Access to assets is managed.
1.1.6 Information assets are categorized and managed to ensure the sustainment and protection of the critical service.
1.1.7 Facility assets supporting the critical service are prioritized and managed.
1.2 ASSET MANAGEMENT POLICY STATEMENTS
1.2.1 Services Inventory
1.2.1.1 Departments shall maintain an inventory of its services. This listing shall be used by the department to assist with its risk management analysis.
1.2.2 Asset Inventory – Information
1.2.2.1 All information that is created or used within the County’s trusted environment in support of County business activities shall be considered the property of the County. All County property shall be used in compliance with this policy.
1.2.2.2 County information is a valuable asset and shall be protected from unauthorized disclosure, modification, or destruction. Prudent information security standards and practices shall be implemented to ensure that the integrity, confidentiality, and availability of County information are not compromised. All County information shall be protected from the time of its creation through its useful life and authorized disposal.
1.2.2.3 Departments shall establish internal procedures for the secure handling and storage of all electronically maintained County information that is owned or controlled by the department.
County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 2
1.2.3 Asset Inventory - Technology (Devices, Software)
1.2.3.1 Departments shall maintain an inventory of all department managed devices that connect to County network resources or processes, stores, or transmits County data including but not limited to:
• Desktop computers,
• Laptop Computers,
• Tablets (iPads and Android devices),
• Mobile Phones (basic cell phones),
• Smart Phones (iPhones, Blackberry, Windows Phones and Android Phones), • Servers,
• Storage devices,
• Network switches,
• Routers,
• Firewalls,
• Security Appliances,
• Internet of Things (IoT) devices,
• Printers,
• Scanners,
• Kiosks and Thin clients,
• Mainframe Hardware, and
• VoIP Phones.
1.2.3.2 Asset inventory shall map assets to the services they support.
1.2.3.3 Departments shall adopt a standard naming convention for devices (naming convention to be utilized as devices are serviced or purchased) that, at a minimum, includes the following:
• Department (see Appendix A for an example Department Listing) • Facility (see Appendix B for an example Facility Listing) • Device Type (see Appendix C for an example Device Type Listing)
1.2.3.4 Each department shall ensure that all software used on County systems and in the execution of County business shall be used legally and in compliance with licensing agreements.
1.2.4 Asset Inventory - Facilities
1.2.4.1 Departments shall maintain an inventory of its facilities. This listing shall be used by the department to assist with its risk management analysis.
1.2.4.2 Departments shall identify the facilities used by its critical services.
1.2.5 Access Controls
1.2.5.1 Departments shall establish a procedure that ensures only users with legitimate business needs to access County IT resources are provided with user accounts.
1.2.5.2 Access to County information systems and information systems data shall be based on each user’s access privileges. Access controls shall ensure that even legitimate users cannot access stored information unless they are authorized to do so. Access control should start by denying access to everything, and then explicitly granting access according to the “need to know” principle.
1.2.5.3 Access to County information and County information assets should be based on the principle County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 3
of “least privilege,” that is, grant no user greater access privileges to the information or assets than County responsibilities demand.
1.2.5.4 The owner of each County system, or their designee, provides written authorization for all internal and external user access.
1.2.5.5 All access to internal County computer systems shall be controlled by an authentication method involving a minimum of a user identifier (ID) and password combination that provides verification of the user’s identity.
1.2.5.6 All County workforce members are to be assigned a unique user ID to access the network.
1.2.5.7 A user account shall be explicitly assigned to a single, named individual. No group or shared computer accounts are permissible except when necessary and warranted due to legitimate business needs. Such need shall be documented prior to account creation and accounts activated only when necessary.
1.2.5.8 User accounts shall not be shared with others including, but not limited to, someone whose access has been denied or terminated.
1.2.5.9 Departments shall conduct regular reviews of the registered users’ access level privileges.
System owners shall provide user listings to departments for confirmation of user’s access privileges.
1.2.6 Asset Sanitation/Disposal
1.2.6.1 Unless approved by County management, no County computer equipment shall be removed from the premises.
1.2.6.2 Prior to re-deployment, storage media shall be appropriately cleansed to prevent unauthorized exposure of data.
1.2.6.3 Surplus, donation, disposal or destruction of equipment containing storage media shall be appropriately disposed according to the terms of the equipment disposal services contract.
1.2.6.4 Sanitization methods for media containing County information shall be in accordance with NSA standards (for example, clearing, purging, or destroying).
1.2.6.5 Disposal of equipment shall be done in accordance with all applicable County, state or federal surplus property and environmental disposal laws, regulations or policies.
County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 4
2 CONTROLS MANAGEMENT
The Controls Management domain focuses on the processes by which an organization plans, defines, analyzes, and assesses the controls that are implemented internally. This process helps the organization ensure the controls management objectives are satisfied.
This domain focuses on the resilience controls that allow an organization to operate during a time of stress.
These resilience controls are implemented in the organization at all levels and require various levels of management and staff to plan, define, analyze, and assess.
2.1 GOALS AND OBJECTIVES
2.1.1 Control objectives are established.
2.1.2 Controls are implemented.
2.1.3 Control designs are analyzed to ensure they satisfy control objectives.
2.1.4 Internal control system is assessed to ensure control objectives are met.
2.2 CONTROL MANAGEMENT POLICY STATEMENTS
2.2.1 Physical and Environmental Security
2.2.1.1 Procedures and facility hardening measures shall be adopted to prevent attempts at and detection of unauthorized access or damage to facilities that contain County information systems and/or processing facilities.
2.2.1.2 Restricted areas within facilities that house sensitive or critical County information systems shall, at a minimum, utilize physical access controls designed to permit access by authorized personnel only.
2.2.1.3 Physical protection measures against damage from external and environmental threats shall be implemented by all departments as appropriate.
2.2.1.4 Access to any office, computer room, or work area that contains sensitive information shall be physically restricted from unauthorized access.
2.2.1.5 Access points such as delivery and loading areas and other points where unauthorized persons may enter the premises shall be controlled and, if possible, isolated from information processing facilities to avoid unauthorized access. An example of this would be separating the two areas by a badge-only accessible door.
2.2.1.6 Continuity of power shall be provided to maintain the availability of critical equipment and information systems.
2.2.1.7 Power and telecommunications cabling carrying data or supporting information services shall be protected from interception or damage. Different, yet appropriate methods shall be utilized for internal and external cabling.
2.2.1.8 Equipment shall be properly maintained to ensure its continued availability and integrity.
2.2.1.9 All shared IT infrastructure by more than one department shall meet countywide security policy for facility standards, availability, access, data & network security.
County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 5
2.2.2 Network Segmentation
NOTE: This section is applicable to Departments that manage their own network devices.
2.2.2.1 Segment (e.g., VLANs) the network into multiple, separate zones (based on trust levels of the information stored/transmitted) to provide more granular control of system access and additional intranet boundary defenses. Whenever information flows over a network of lower trust level, the information shall be encrypted.
2.2.2.2 Segment the network into multiple, separate zones based on the devices (servers, workstations, mobile devices, printers, etc.) connected to the network.
2.2.2.3 Create separate network segments (e.g., VLANs) for BYOD (bring your own device) systems or other untrusted devices.
2.2.2.4 The network infrastructure shall be managed across network connections that are separated from the business use of that network, relying on separate VLANs or, preferably, on entirely different physical connectivity for management sessions for network devices.
2.2.3 Mobile Computing Devices
To ensure that Mobile Computing Devices (MCDs) do not introduce threats into systems that process or store County information, departments’ management shall:
2.2.3.1 Establish and manage a process for authorizing, issuing and tracking the use of MCDs.
2.2.3.2 Permit only authorized MCDs to connect to County information assets or networks that store, process, transmit, or connects to County information and information assets.
2.2.3.3 Implement applicable access control requirements in accordance with this policy, such as the enforcement of a system or device lockout after 15 minutes of inactivity requiring re-entering of a password to unlock.
2.2.3.4 Install an encryption algorithm that meets or exceeds industry recommended encryption standard for any MCD that will be used to store County information. See Section on Encryption.
2.2.3.5 Ensure that MCDs are configured to restrict the user from circumventing the authentication process.
2.2.3.6 Provide security awareness training to County employees that informs MCD users regarding MCD restrictions.
2.2.3.7 Label MCDs with County address and/or phone number so that the device can be returned to the County if recovered.
2.2.3.8 The installation of any software, executable, or other file to any County computing device is prohibited if that software, executable, or other file downloaded by, is owned by, or was purchased by an employee or contractor with his or her own funds unless approved by the department. If the device (“i” device or smartphone, only) complies with the mobile device management security standards (see section 9.2.3 Mobile Computing Devices), this is not applicable.
2.2.4 Personally Owned Devices
Personal computing devices include, but are not limited to, removable media such as thumb or USB drives, external hard drives, laptop or desktop computers, cellular phones, or personal digital assistants (PDA's) owned by or purchased by employees, contract personnel, or other non-County users.
2.2.4.1 The connection of any computing device not owned by the County to a County network (except the Public Wi-Fi provided for public use) or computing device is prohibited unless previously County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 6
approved.
2.2.4.2 The County authorizes the use of personal devices to access resources that do not traverse the County network directly. Such resources include County’s Microsoft Office 365 environment, OC Expediter, and VTI timesheet applications, to name a few. Access to some agency specific applications, e.g., applications that are subject to compliance regulations may require prior approval of the County CISO and the associated Department Head.
2.2.4.3 The County will respect the privacy of a user’s voluntary use of a personally owned device to access County IT resources.
2.2.4.4 The County will only request access to the personally owned device in order to implement security controls; to respond to litigation hold (aka: e-discovery) requests arising out of administrative, civil, or criminal directives, Public Record Act requests, and subpoenas; or as otherwise required or permitted by applicable state or federal laws. Such access will be performed by an authorized technician or designee using a legitimate software process.
2.2.5 Logon Banners and Warning Notices
2.2.5.1 At the time of network login, the user shall be presented with a login banner.
2.2.5.2 All computer systems that contain or access County information shall display warning banners informing potential users of conditions of use consistent with state and federal laws.
2.2.5.3 Warning banners shall remain on the screen until the user takes explicit actions to log on to the information system.
2.2.5.4 The banner message shall be placed at the user authentication point for every computer system that contains or accesses County information. The banner message may be placed on an initial logon screen in situations where the logon provides access to multiple computer systems.
2.2.5.5 At a minimum, banner messages shall provide appropriate privacy and security information and shall contain information informing potential users that:
• User is accessing a government information system for conditions of use consistent with state and federal information security and privacy protection laws. • System usage may be monitored, recorded, and subject to audit. • Unauthorized use of the system is prohibited and subject to criminal and civil penalties. • Use of the system indicates consent to monitoring and recording.
2.2.6 Authentication
2.2.6.1 Authenticate user identities at initial connection to County resources.
2.2.6.2 Authentication mechanisms shall be appropriate to the sensitivity of the information contained.
2.2.6.3 Users shall not receive detailed feedback from the authenticating system on failed logon attempts.
2.2.7 Passwords
2.2.7.1 County approved password standards and/or guidelines shall be applied to access County systems. These standards extend to mobile devices (see Section 9.2.4 Mobile Computing Devices for additional guidance on mobile devices) and personally owned devices used for work (see Section 9.2.5 Personally Owned Devices for additional guidance on personally owned devices).
2.2.7.2 Passwords are a primary means to control access to systems and shall therefore be selected, used, and managed to protect against unauthorized discovery or usage. Passwords shall satisfy the following complexity rule:
County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 7
• Passwords will contain a minimum of one upper case letter • Passwords will contain a minimum of one lower case letter • Passwords will contain a minimum of one number: 1- 0
• Passwords will contain a minimum of one symbol: !,@,#,$,%,^,&,*,(,) • Password characters will not be sequential (Do not use: ABCD , This is ok: ACDB) • Passwords characters will not be repeated in a row (Do not use: P@$$S. This is ok:
P@$S$)
• COMPLEX PASSWORD EXAMPLE: P@$SWoRd13
2.2.7.3 Passwords shall have a minimum length of 8 characters.
2.2.7.4 Passwords shall not be reused for twelve iterations.
2.2.7.5 Departments shall require users to change their passwords periodically (e.g., every 90 days at the maximum). Changing passwords more often than 90 days is encouraged.
2.2.7.6 Network and application systems shall be configured to enforce automatic expiration of passwords at regular intervals (e.g., every 90 days at the maximum) when the technology is feasible or available.
2.2.7.7 Newly created accounts shall be assigned a randomly generated password prior to account information being provided to the user.
2.2.7.8 No user shall give his or her password to another person under any circumstances. Workforce members who suspect that their password has become known by another person shall change their password immediately and report their suspicion to management in accordance with Section 12: Incident Management.
2.2.7.9 Users who have lost or forgotten their passwords shall make any password reset requests themselves without using a proxy (e.g., another County employee) unless approved by management. Prior to processing password change requests, the requester shall be authenticated to the user account in question. (e.g., Verification with user’s supervisor or the use of passphrases can be used for this authentication process.) New passwords shall be provided directly and only to the user in question.
2.2.7.10When technologically feasible, a new or reset password shall be set to expire on its initial use at log on so that the user is required to change the provided password to one known only to them.
2.2.7.11 All passwords are to be treated as sensitive information.
2.2.7.12 User Accounts shall be locked after five consecutive invalid logon attempts within a 24-hour period. The lockout duration shall be at least 30 minutes or until a system administrator enables the user ID after investigation. These features shall be configured as indicated when the technology is feasible or available.
2.2.7.13All systems containing sensitive information shall not allow users to have multiple concurrent sessions on the same system when the technology is feasible or available.
2.2.8 Inactivity Timeout and Restricted Connection Times
2.2.8.1 Automatic lockouts for system devices, including workstations and mobile computing devices (refer to Section 9.2.4 Mobile Computing Devices), after no more than 15 minutes of inactivity.
2.2.8.2 Automated screen lockouts shall be used wherever possible using a set time increment (e.g., 15 minutes of non-activity). In situations where it is not possible to automate a lockout, operational procedures shall be implemented to instruct users to lock the terminal or equipment so that unauthorized individuals cannot make use of the system. Once logged on, workforce members shall not leave their computer unattended or available for someone else to use.
County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 8
2.2.8.3 When deemed necessary, user logins and data communications may be restricted by time and date configurations that limit when connections shall be accepted.
2.2.9 Account Monitoring
2.2.9.1 Access to a County network and its resources shall be strictly controlled, managed, and reviewed to ensure only authorized users gain access based on the privileges granted. (e.g., Kiosks provide physical and public access to County networks. These shall be secured to ensure County resources are not accessed by unauthorized users.)
2.2.9.2 The control mechanisms for all types of access to County IT resources by contractors, customers or vendors are to be documented.
2.2.9.3 Monitor account usage to determine dormant accounts that have not been used for a given period, such as 45 days, notifying the user or user’s manager of the dormancy.
2.2.9.4 After a longer period, such as 60 days, the account shall be disabled by the system when the technology is feasible or available.
2.2.9.5 On a periodic basis, such as quarterly or at least annually, departments shall require that managers match active employees and contractors with each account belonging to their managed staff. Security or system administrators shall then determine whether to disable accounts that are not assigned to active employees or contractors.
2.2.10 Administrative Privileges
2.2.10.1Systems Administrators shall use separate administrative accounts, which are different from their end user account (required to have an individual end user account), to conduct system administration tasks.
2.2.10.2Administrative accounts shall only be granted to individuals who have a job requirement to conduct systems administration tasks.
2.2.10.3Administrative accounts shall be requested in writing and must be approved by the Department Head or designated representative (e.g., DISO) using the Security Review and Approval Process.
2.2.10.4Systems Administrator accounts that access County enterprise-wide systems or have enterprise-wide impact shall be approved by the CISO using the Security Review and Approval Process.
2.2.10.5Systems Administrators shall use separate administrative accounts to manage Mobile Device Management (MDM) platforms but may use the local user’s credentials when configuring a mobile phone or tablet device.
2.2.10.6All passwords for privileged system-level accounts (e.g., root, enable, OS admin, application administration accounts, etc.) shall comply with Section 9.2.8.
2.2.11 Remote Access
2.2.11.1 Departments shall take appropriate steps, including the implementation of appropriate encryption, user authentication, and virus protection measures, to mitigate security risks associated with allowing users to use remote access or mobile computing methods to access County information systems.
2.2.11.2 Remote access privileges shall be granted to County workforce members only for legitimate business needs and with the specific approval of department management.
County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 9
2.2.11.3All remote access implementations that utilize the County’s trusted network environment and that have not been previously deployed within the County shall be submitted to and reviewed by OCIT Enterprise Privacy and Cybersecurity. A memorandum of understanding (MOU) shall be utilized for this submittal and review process. This is required for any Suppliers utilizing remote access to conduct maintenance.
2.2.11.4 Remote sessions shall be terminated after 15 minutes of inactivity requiring the user to authenticate again to access County resources.
2.2.11.5All remote access infrastructures shall include the capability to monitor and record a detailed audit trail of each remote access attempt.
2.2.11.6All users of County networks and computer systems are prohibited from connecting and/or activating unauthorized dial-up or broadband modems on workstations, laptops, or other computing devices that are simultaneously connected to any County network.
2.2.11.7Periodic assessments shall be performed to identify unauthorized remote connections. Results shall be used to address any vulnerabilities and prioritized according to criticality.
2.2.11.8 Users granted remote access to County IT infrastructure shall follow all additional policies, guidelines and standards related to authentication and authorization as if they were connected locally. For example, this applies when mapping to shared network drives.
2.2.11.9 Users attempting to use external remote access shall utilize a County-approved multi-factor authentication process.
2.2.11.10 All remote access implementations that involve non-County infrastructures shall be reviewed and approved by both the department DISO and OCIT Enterprise Privacy and Cybersecurity.
This approval shall be received prior to the start of such implementation. The approval shall be developed as a memorandum of understanding (MOU).
2.2.11.11 Remote access privileges to County IT resources shall not be given to contractors, customers or vendors unless department management determines that these individuals or organizations have a legitimate business need for such access. If such access is granted, it shall be limited to those privileges and conditions required for the performance of the specified work.
2.2.12 Wireless Access
2.2.12.1 Departments shall take appropriate steps, including the implementation of appropriate encryption, user authentication, device authentication and malware protection measures, to mitigate risks to the security of County data and information systems associated with the use of wireless network access technologies.
2.2.12.2Only wireless systems that have been evaluated for security by both department management and OCIT Enterprise Privacy and Cybersecurity shall be approved for connectivity to County networks.
2.2.12.3 County data that is transmitted over any wireless network shall be protected in accordance with the sensitivity of the information.
2.2.12.4All access to County networks or resources via unapproved wireless communication technologies is prohibited. This includes wireless systems that may be brought into County facilities by visitors or guests. Employees, contractors, vendors and customers are prohibited from connecting and/or activating wireless connections on any computing device that are simultaneously connected to any County network, either locally or remotely.
2.2.12.5Each department shall make a regular, routine effort to ensure that unauthorized wireless networks, access points, and/or modems are not installed or configured within its IT environments. Any unauthorized connections described above shall be disabled immediately.
County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 10
2.2.13 System and Network Operations Management
2.2.13.1Operating procedures and responsibilities for all County information processing facilities shall be formally authorized, documented, and updated.
2.2.13.2 Departments shall establish controls to ensure the security of the information systems networks that they operate.
2.2.13.3Operational system documentation for County information systems shall be protected from unauthorized access.
2.2.13.4System utilities shall be available to only those users who have a business case for accessing the specific utility.
2.2.14 System Monitoring and Logging
2.2.14.1Systems operational staff shall maintain appropriate log(s) of activities, exceptions and information security events involving County information systems and services.
2.2.14.2Each department shall maintain a log of all faults involving County information systems and services.
2.2.14.3 Logs shall be protected from unauthorized access or modifications wherever they reside.
2.2.14.4The clocks of all relevant information processing systems and attributable logs shall be synchronized with an agreed upon accurate time source such as an established Network Time Protocol (NTP) service.
2.2.14.5Auditing and logging of user activity shall be implemented on all critical County systems that support user access capabilities.
2.2.14.6Periodic log reviews of user access and privileges shall be performed in order to monitor access of sensitive information.
2.2.15 Malware Defenses
2.2.15.1 Departments shall implement endpoint security on computing devices connected to the County network. Endpoint security may include one or more of the following software: anti-virus, antispyware, personal firewall, host-based intrusion detection (IDS), network-based intrusion detection (IDS), intrusion prevention systems (IPS), and whitelisting and blacklisting of applications, web sites, and IP addresses.
2.2.15.2Special features designed to filter out malicious software contained in either email messages or email attachments shall be implemented on all County email systems.
2.2.15.3Where feasible, any computing device, including laptops and desktop PCs, that has been connected to a non-County infrastructure (including employee home networks) and subsequently used to connect to the County network shall be verified that it is free from viruses and other forms of malicious software prior to attaining connectivity to the County network.
2.2.16 Data Loss Prevention
2.2.16.1 Departments shall implement host-based Data Loss Prevention (DLP) to reduce the risk of data breach related to sensitive information.
2.2.16.2 Departments shall deploy encryption software on mobile devices containing sensitive. See Section 9.2.19 Encryption for additional guidance.
2.2.17 Data Transfer
2.2.17.1Agreements shall be implemented for the exchange of information between the County and other entities. As well as between departments.
County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 11
2.2.17.2 County information accessed via electronic commerce shall have security controls implemented based on the assessed risk.
2.2.18 Encryption
2.2.18.1The decision to use cryptographic controls and/or data encryption in an application shall be based on the level of risk of unauthorized access and the sensitivity of the data that is to be protected.
2.2.18.2The decision to use cryptographic controls and/or data encryption on a hard drive shall be based on the level of risk of unauthorized access and the sensitivity of the data that is to be protected.
2.2.18.3Where appropriate, encryption shall be used to protect confidential (as defined by County policy) application data that is transmitted over open, untrusted networks, such as the Internet.
2.2.18.4When cryptographic controls are used, procedures addressing the following areas shall be established by each department:
• Determination of the level of cryptographic controls
• Key management/distribution steps and responsibilities
2.2.18.5 Encryption keys shall be exchanged only using secure methods of communication.
2.2.19 System Acquisition and Development
2.2.19.1 Departments shall identify all business applications that are used by their users in support of primary business functions. This includes all applications owned and/or managed by the department as well as other business applications that are used by the department but owned and/or managed by other County organizations. All business applications used by a department shall be documented in the department’s IT security plan as well as their Business Impact Analysis (BIA).
2.2.19.2 An application owner shall be designated for each internal department business application.
2.2.19.3All access controls associated with business applications shall be commensurate with the highest level of data used within the application. These same access controls shall also adhere to the policy provided in Section 7: Access Control.
2.2.19.4Security requirements shall be incorporated into the evaluation process for all commercial software products that are intended to be used as the basis for a business application. The security requirements in question shall be based on requirements and standards specified in this policy.
2.2.19.5 In situations where data needs to be isolated because there would be a conflict of interest (e.g., DA and OCPD data cannot be shared), data security shall be designed and implemented to ensure that isolation.
Business Requirements
2.2.19.6The business requirements definition phase of system development shall contain a review to ensure that the system shall adhere to County information security standards.
System Files
2.2.19.7Operating system files, application software and data shall be secured from unauthorized use or access.
2.2.19.8 Clear-text data that results from testing shall be handled, stored, and disposed of in the same County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 12
manner and using the same procedures as are used for production data.
2.2.19.9 System tests shall be performed on data that is constructed specifically for that purpose.
2.2.19.10 System testing shall not be performed on operational data unless the necessary safeguards are in place.
2.2.19.11 A combination of technical, procedural and physical safeguards shall be used to protect application source code from unintentional or unauthorized modification or destruction. All County proprietary information, including source code, needs to be protected through appropriate role-based access controls. An example of this is a change control tool that records all changes to source code including new development, updates, and deletions, along with check-in and check-out information.
System Development & Maintenance
2.2.19.12 The development of software for use on County information systems shall have documented change control procedures in place to ensure proper versioning and implementation.
2.2.19.13 When preparing to upgrade any County information systems, including an operating system, on a production computing resource; the process of testing and approving the upgrade shall be completed in advance in order to minimize potential security risks and disruptions to the production environment.
2.2.19.14 Any outside suppliers used for maintenance that are visitors to the facility are to be escorted and monitored while performing maintenance to critical systems. This does not apply to contractors that are assigned to work at the facility.
2.2.19.15 Systems shall be hardened, and logs monitored to ensure the avoidance of the introduction and exploitation of malicious code.
2.2.19.16 All County workforce members shall not create, execute, forward, or introduce computer code designed to self-replicate, damage, or impede the performance of a computer’s memory, storage, operating system, or application software.
2.2.19.17 In conjunction with other access control policies, any opportunity for information leakage shall be prevented through good system design practices.
2.2.19.18 Departments are responsible for managing outsourced software development related to department-owned IT systems.
System Requirements
Any system that processes or stores County Information shall:
2.2.19.19 Baseline configuration shall incorporate Principle of Least Privilege and Functionality.
2.2.19.20 Systems shall be deployed where feasible to utilize existing County authentication methods.
2.2.19.21 Session inactivity timeouts shall be implemented for all access into and from County networks.
2.2.19.22 All applications are to have access controls unless specifically designated as a public access resource.
2.2.19.23 Meet the password requirements defined in Section 9.2.8: Passwords.
2.2.19.24 Strictly control access enabling only privileged users or supervisors to override system controls or the capability of bypassing data validation or editing problems.
2.2.19.25 Monitor special privilege access, e.g., administration accounts.
2.2.19.26 Restrict authority to change master files to persons independent of the data processing function.
County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 13
2.2.19.27 Have access control mechanisms to prevent unauthorized access or changes to data, especially, the server file systems that are connected to the Internet, even behind a firewall.
2.2.19.28 Be capable of routinely monitoring the access to automated systems containing County Information.
2.2.19.29 Log all modifications to the system files.
2.2.19.30 Limit access to system utility programs to necessary individuals with specific designation.
2.2.19.31 Maintain audit logs on a device separate from the system being monitored.
2.2.19.32 Delete or disable all default accounts.
2.2.19.33 Restrict access to server file-system controls to ensure that all changes such as direct write, write access to system areas and software or service changes shall be applied only through the appropriate change control process.
2.2.19.34 Restrict access to server-file-system controls that allow access to other users’ files.
2.2.19.35 Ensure that servers containing user credentials shall be physically protected, hardened and monitored to prevent inappropriate use.
2.2.20 Procurement Controls
2.2.20.1Breach notification requirements clause to be included in new or renewal contracts (once policy is effective) for systems containing sensitive information.
Contractor shall report to the County within 24 hours as defined in this contract when Contractor becomes aware of any suspected data breach of Contractor’s or Sub-Contractor’s systems involving County’s data.
2.2.20.2 Departments shall review all procurements and renewals for software and equipment (hosted/managed by the vendor) that transmits, stores, or processes sensitive information to ensure that vendors and contractors are aware of and are in compliance with County’s cybersecurity policies if applicable. Departments shall obtain documentation supporting the business partners, contractors, consultants, or vendors compliance with County’s cybersecurity policies such as:
• SOC 1 Type 2
• SOC 2 Type 2
• Security Certifications (ISO, PCI, etc.)
• Penetration Test Results
2.2.21 IT Services Provided to Public
2.2.21.1Public access to County electronic information resources shall provide desired services in accordance with safeguards designed to protect County resources. All County electronic information resources are to be reviewed at least quarterly.
2.2.22 Removable Media
2.2.22.1When no longer required, the contents of removable media shall be permanently destroyed or rendered unrecoverable in accordance with applicable department, County, state, or federal record disposal and/or retention requirement
County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 14
3 CONFIGURATION & CHANGE MANAGEMENT
Configuration and Change Management (CCM) is the process of maintaining the integrity of hardware, software, firmware, and documentation related to the configuration and change management process.
CCM is a continuous process of controlling and approving changes to information or technology assets or related infrastructure that support the critical services of an organization. This process includes the addition of new assets, changes to assets, and the elimination of assets.
Cybersecurity is an integral component to information systems from the onset of the project or acquisition through implementation of:
• Application and system security
• Configuration management
• Change control procedures
• Encryption and key management
• Software maintenance, including but not limited to, upgrades, antivirus, patching and malware detection response systems
As the complexity of information systems increases, the complexity of the processes used to create these systems also increases, as does the probability of accidental errors in configuration. The impact of these errors puts data and systems that may be critical to business operations at significant risk of failure that could cause the organization to lose business, suffer damage to its reputation, or close completely. Having a CCM process to protect against these risks is vital to the overall security posture of the organization.
3.1 GOALS AND OBJECTIVES
3.1.1 The lifecycle of assets is managed.
3.1.2 The integrity of technology and information assets is managed.
3.1.3 Asset configuration baselines are established.
3.2 CONFIGURATION & CHANGE MANAGEMENT POLICY STATEMENTS
3.2.1 Changes to all information processing facilities, systems, software, or procedures shall be strictly controlled according to formal change management procedures.
3.2.2 Changes impacting security appliances managed by OCIT (e.g., security architecture, security appliances, County firewall, Website listings, application listings, email gateway, administrative accounts) shall be reviewed by OCIT Enterprise Privacy and Cybersecurity in accordance with the County Security Review and Approval Process.
3.2.3 Only authorized users shall make any changes to system and/or software configuration files.
3.2.4 Only authorized users shall download and/or install operating system software, service-related software (such as web server software), or other software applications on County computer systems without prior written authorization from department IT management. This includes, but is not limited to, free software, computer games and peer-to-peer file sharing software.
3.2.5 Each department shall develop a formal change control procedure that outlines the process to be used for identifying, classifying, approving, implementing, testing, and documenting changes to its IT resources.
County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 15
3.2.6 Each department shall conduct periodic audits designed to determine if unauthorized software has been installed on any of its computers.
3.2.7 As appropriate, segregation of duties shall be implemented by all County departments to ensure that no single person has control of multiple critical systems and the potential for misusing that control.
3.2.8 Production computing environments shall be separated from development and test computing environments to reduce the risk of one environment adversely affecting another.
3.2.9 System capacity requirements shall be monitored, and usage projected to ensure the continual availability of adequate processing power, bandwidth, and storage.
3.2.10 System acceptance criteria for all new information systems and system upgrades shall be defined, documented, and utilized to minimize risk of system failure.
County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 16
4 VULNERABILITY MANAGEMENT
The Vulnerability Management domain focuses on the process by which organizations identify, analyze, and manage vulnerabilities in a critical service’s operating environment.
4.1 GOALS AND OBJECTIVES
4.1.1 Preparation for vulnerability analysis and resolution activities is conducted.
4.1.2 A process for identifying and analyzing vulnerabilities is established and maintained.
4.1.3 Exposure to identified vulnerabilities is managed.
4.1.4 The root causes of vulnerabilities are addressed.
4.2 VULNERABILITY MANAGEMENT POLICY STATEMENTS
4.2.1 Departments shall develop and maintain a vulnerability management process as part of its Cybersecurity Program.
County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 17
5 CYBERSECURITY INCIDENT MANAGEMENT
Information Security Incident Management establishes the policy to be used by each department in planning for, reporting on, and responding to computer security incidents. For these purposes an incident is defined as any irregular or adverse event that occurs on a County system or network. The goal of incident management is to mitigate the impact of a disruptive event. To accomplish this goal, an organization establishes processes that:
• detect and identify events
• triage and analyze events to determine whether an incident is underway • respond and recover from an incident
• improve the organization’s capabilities for responding to a future incident This domain defines management controls for addressing cyber incidents. The controls provide a consistent and effective approach to Cyber Incident Response aligned with Orange County’s Cyber Incident Response Plan, to include:
• Collection of evidence related to the cyber incident as appropriate • Reporting procedures including any and all statutory reporting requirements • Incident remediation
• Minimum logging procedures
• Annual testing of the plan
5.1 GOALS AND OBJECTIVES
5.1.1 A process for identifying, analyzing, responding to, and learning from incidents is established.
5.1.2 A process for detecting, reporting, triaging, and analyzing events is established.
5.1.3 Incidents are declared and analyzed.
5.1.4 A process for responding to and recovering from incidents is established.
5.1.5 Post-incident lessons learned are translated into improvement strategies.
5.2 CYBERSECURITY INCIDENT MANAGEMENT POLICY STATEMENTS
5.2.1 Cybersecurity incident management procedures shall be established within each department to ensure quick, orderly, and effective responses to security incidents. In the event a department has not established these procedures, the department may adopt the County’s Cyber Incident Response Plan. The steps involved in managing a security incident are typically categorized into six stages:
5.2.2 System preparation
5.2.3 Problem identification
5.2.4 Problem containment
5.2.5 Problem eradication
5.2.6 Incident recovery
5.2.7 Lessons learned
5.2.8 The DISO shall act as the liaison between applicable parties during a cybersecurity incident. The DISO shall be the department’s primary point of contact for all IT security issues.
County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 18
5.2.9 A directory or phone tree shall be created listing all department cybersecurity incident liaison contact information.
5.2.10 Departments shall conduct periodic (at least annually) cybersecurity incident scenario sessions for personnel associated with the cybersecurity incident handling team to ensure that they understand current threats and risks, as well as their responsibilities in supporting the cybersecurity incident handling team.
5.2.11 Departments shall develop and document procedures for reporting cybersecurity incidents. For example, all employees, contractors, vendors and customers of County information systems shall be required to note and report any observed or suspected security weaknesses in systems to management. In the event a department has not established these procedures, the department may adopt the County’s Cyber Incident Response Plan.
5.2.12 Each department shall familiarize its employees on the use of its cybersecurity incident reporting procedures.
5.2.13 Contact with local authorities, including law enforcement, shall be conducted through an organized, repeatable process that is both well documented and communicated.
5.2.14 Contact with special interest groups, including media and labor relations, shall be conducted through an organized, repeatable process that is both well documented and communicated.
5.2.15 Where a follow-up action against an entity after a cybersecurity incident shall involve civil or criminal legal action, evidence shall be collected, retained, and presented to conform to the rules for evidence as demanded by the relevant jurisdiction(s). At the Department’s discretion, they may obtain the services of qualified external professionals to complete these tasks.
5.2.16 Departments shall report cybersecurity incidents to the Central IT Service Desk in accordance with the County’s Cyber Incident Reporting Policy.
5.2.17 Confirmed cybersecurity incidents that meet the criteria defined in the Significant Incident/Claim Reporting Protocol shall be reported by the County’s Chief Information Security Officer to the Chief Information Officer (CIO), County Executive Officer (CEO), and the Board of Supervisors within 24 hours of determination that a cybersecurity incident has occurred.
County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 19
6 SERVICE CONTINUITY MANAGEMENT
Service continuity planning is one of the more important aspects of resilience management because it provides a process for preparing for and responding to disruptive events, whether natural or man-made.
Operational disruptions may occur regularly and can scale from so small that the impact is essentially negligible to so large that they could prevent an organization from achieving its mission. Services that are most important to an organization’s ability to meet its mission are considered essential and are focused on first when responding to disruptions. The process of identifying and prioritizing services and the assets that support them is foundational to service continuity.
Service continuity planning provides the organization with predefined procedures for sustaining essential operations in varying adverse conditions, from minor interruptions to large-scale incidents. For example, a power interruption or failure of an IT component may necessitate manual workaround procedures during repairs. A data center outage or loss of a business or facility housing essential services may require the organization to recover business or IT operations at an alternate location.
The process of assessing, prioritizing, planning and responding to, and improving plans to address disruptive events is known as service continuity. The goal of service continuity is to mitigate the impact of disruptive events by utilizing tested or exercised plans that facilitate predictable and consistent continuity of essential services.
This domain defines requirements to document, implement and annually test plans, including the testing of all appropriate cybersecurity provisions, to minimize impact to systems or processes from the effects of major failures of information systems or disasters via adoption and annual testing of:
• Business Continuity Plan
• Disaster Recovery Plan
• Cyber Incident Response Plan
Business Continuity is intended to counteract interruptions in business activities and to protect critical business processes from the effects of significant disruptions. Disaster Recovery provides for the restoration of critical County assets, including IT infrastructure and systems, staff, and facilities.
6.1 GOALS AND OBJECTIVES
6.1.1 Service continuity plans for high-value services are developed.
6.1.2 Service continuity plans are reviewed to resolve conflicts between plans.
6.1.3 Service continuity plans are tested to ensure they meet their stated objectives.
6.1.4 Service continuity plans are executed and reviewed.
6.2 SERVICE CONTINUITY MANAGEMENT POLICY STATEMENTS
6.2.1 Backups of all essential electronically maintained County business data shall be routinely created and properly stored to ensure prompt restoration.
6.2.2 Each department shall implement and document a backup approach for ensuring the availability of critical application databases, system configuration files, and/or any other electronic information critical to maintaining normal business operations within the department.
County of Orange
Information Technology Security Guidelines
July 3, 2024 P a g e | 20
6.2.3 The frequency and extent of backups shall be in accordance with the importance of the information and the acceptable risk as determined by each department.
6.2.4 Departments shall ensure that locations where backup media are stored are safe, secure, and protected from environmental hazards. Access to backup media shall be commensurate with the highest level of information stored and physical access controls shall meet or exceed the physical access controls of the data’s source systems.
6.2.5 Backup media shall be labeled and handled in accordance with the highest sensitivity level of the information stored on the media.
6.2.6 Departments shall define and periodically test a formal procedure designed to verify the success of the backup process.
6.2.7 Restoration from backups shall be tested initially once the process is in place and periodically afterwards. Confirmation of business functionality after restoration shall also be tested in conjunction with the backup procedure test.
6.2.8 Departments shall retain backup information only as long as needed to carry out the purpose for which the data was collected, or for the minimum period required by law.
6.2.9 Alternate storage facilities shall be used to ensure confidentiality, integrity and availability of all County systems.
6.2.10 Each department shall develop, periodically update, and regularly test business continuity and disaster recovery plans in accordance with the County’s Business Continuity Management Policy.
6.2.11 Departments shall review and update their Risk Assessments (RAs) and Business Impact Analyses (BIAs) as necessary, determined by department management (annually is recommended). As detailed in Section 14: Risk Assessment and Treatment, RAs include department identification of risks that can cause interruptions to business processes along with the probability and impact of such interruptions and the consequences to information security.
A BIA establishes the list of processes and systems that the department has deemed critical after performing a risk analysis.
6.2.12 Continuity plans shall be developed and implemented to provide for continuity of business operations in the event that critical IT assets become unavailable. Plans shall provide for the availability of information at the required level and within the established Recovery Time Objective (RTO) and their location, as alternate facilities shall be used to maintain continuity.
6.2.13 Each department shall maintain a comprehensive plan document containing its business continuity plans. Plans shall be consistent, address information security requirements, and identify priorities for testing and maintenance. Plans shall be prepared in accordance with the standards established by the County’s Business Continuity Management Policy.
Each department shall define failure prevention protocols to maintain confidentiality, integrity and availability. Departments shall automate failover procedures where applicable and maintain adequate (predictable) levels of ancillary components to meet this provision.
55414.00000\33020133.1 - 1 -
CITY OF STANTON
PROFESSIONAL SERVICES AGREEMENT
FOR
Stanton FRC FY25-28 Agreement for the Provision of Family Resource Center Services
1. PARTIES AND DATE.
This Agreement is made and entered into this 1
st day of July , 2025__, by and between the
City of Stanton, a municipal organization organized under the laws of the State of California with its principal place of business at 7800 Katella Avenue, Stanton, California 90680 (“City”) and Boys & Girls Club of Garden Grove, a California Non-Profit Corporation with its principal place of business at 10540 Chapman Avenue, Garden Grove, CA 92840 (“Consultant”). City and Consultant are sometimes individually referred to herein as “Party” and collectively as “Parties.”
2. RECITALS.
2.1 Consultant.
Consultant desires to perform and assume responsibility for the provision of professional Counseling and Case Management consultant services required by the City on the terms and conditions set forth in this Agreement. Consultant represents that it is experienced in providing professional Counseling and Case Management consultant services to public clients, is licensed in the State of California, and is familiar with the plans of City.
2.2 Project.
City desires to engage Consultant to render such services for the Stanton FRC FY25-28 Agreement for the Provision of Family Resource Center Services project (“Project”) as set forth in this Agreement.
3. TERMS.
3.1 Scope of Services and Term.
3.1.1 General Scope of Services. Consultant promises and agrees to furnish to the City all labor, materials, tools, equipment, services, and incidental and customary work necessary to fully and adequately supply the professional Counseling and Case Management consultant services necessary for the Project (“Services”). The Services are more particularly described in Exhibit “A” attached hereto and incorporated herein by reference. All Services shall be subject to, and performed in accordance with, this Agreement, the exhibits attached hereto and incorporated herein by reference, and all applicable local, state and federal laws, rules and regulations.
3.1.2 Term. The term of this Agreement shall be from July 1, 2025 to June 30, 2028 unless earlier terminated as provided herein. The City Manager shall have the unilateral option, at its sole discretion, to renew this Agreement annually for no more than two additional Attachment: B
Click here to return to the agenda.
55414.00000\33020133.1 - 2 -
one-year terms. Consultant shall complete the Services within the term of this Agreement, and shall meet any other established schedules and deadlines.
3.2 Responsibilities of Consultant.
3.2.1 Control and Payment of Subordinates; Independent Contractor. The Services shall be performed by Consultant or under its supervision. Consultant will determine the means, methods and details of performing the Services subject to the requirements of this Agreement. City retains Consultant on an independent contractor basis and not as an employee.
Consultant shall complete, execute, and submit to City a Request for Taxpayer Identification Number and Certification (IRS FormW-9) prior to commencement of any Services under this Agreement. Consultant retains the right to perform similar or different services for others during the term of this Agreement. Any additional personnel performing the Services under this Agreement on behalf of Consultant shall also not be employees of City and shall at all times be under Consultant’s exclusive direction and control. Consultant shall pay all wages, salaries, and other amounts due such personnel in connection with their performance of Services under this Agreement and as required by law. Consultant shall be responsible for all reports and obligations respecting such additional personnel, including, but not limited to: social security taxes, income tax withholding, unemployment insurance, disability insurance, and workers’ compensation insurance.
3.2.2 Schedule of Services. Consultant shall perform the Services expeditiously, within the term of this Agreement, and in accordance with the Schedule of Services set forth in Exhibit “B” attached hereto and incorporated herein by reference. Consultant represents that it has the professional and technical personnel required to perform the Services in conformance with such conditions. In order to facilitate Consultant’s conformance with the Schedule, City shall respond to Consultant’s submittals in a timely manner. Upon request of City, Consultant shall provide a more detailed schedule of anticipated performance to meet the Schedule of Services.
3.2.3 Conformance to Applicable Requirements. All work prepared by Consultant shall be subject to the approval of City.
3.2.4 Substitution of Key Personnel. Consultant has represented to City that certain key personnel will perform and coordinate the Services under this Agreement. Should one or more of such personnel become unavailable, Consultant may substitute other personnel of at least equal competence upon written approval of City. In the event that City and Consultant cannot agree as to the substitution of key personnel, City shall be entitled to terminate this Agreement for cause. As discussed below, any personnel who fail or refuse to perform the Services in a manner acceptable to the City, or who are determined by the City to be uncooperative, incompetent, a threat to the adequate or timely completion of the Project or a threat to the safety of persons or property, shall be promptly removed from the Project by the Consultant at the request of the City.
The key personnel for performance of this Agreement are as follows: Christina Sepulveda, Vice President of Community Impact Programs.
3.2.5 City’s Representative. The City hereby designates the City Manager, or his or her designee, to act as its representative for the performance of this Agreement (“City’s Representative”). City’s Representative shall have the power to act on behalf of the City for all 55414.00000\33020133.1 - 3 -
purposes under this Contract. The City Manager hereby designates Zenia Bobadilla, Community Services Director, or his or her designee, as the City’s contact for the implementation of the Services hereunder. Consultant shall not accept direction or orders from any person other than the City’s Representative or his or her designee.
3.2.6 Consultant’s Representative. Consultant hereby designates Christina Sepulveda, Vice President of Community Impact Programs, or his or her designee, to act as its representative for the performance of this Agreement (“Consultant’s Representative”).
Consultant’s Representative shall have full authority to represent and act on behalf of the Consultant for all purposes under this Agreement. The Consultant’s Representative shall supervise and direct the Services, using his best skill and attention, and shall be responsible for all means, methods, techniques, sequences and procedures and for the satisfactory coordination of all portions of the Services under this Agreement.
3.2.7 Coordination of Services. Consultant agrees to work closely with City staff in the performance of Services and shall be available to City’s staff, consultants and other staff at all reasonable times.
3.2.8 Standard of Care; Performance of Employees. Consultant shall perform all Services under this Agreement in a skillful and competent manner, consistent with the standards generally recognized as being employed by professionals in the same discipline in the State of California. Consultant represents and maintains that it is skilled in the professional calling necessary to perform the Services. Consultant warrants that all employees and subconsultants shall have sufficient skill and experience to perform the Services assigned to them. Finally, Consultant represents that it, its employees and subconsultants have all licenses, permits, qualifications and approvals of whatever nature that are legally required to perform the Services and that such licenses and approvals shall be maintained throughout the term of this Agreement.
As provided for in the indemnification provisions of this Agreement, Consultant shall perform, at its own cost and expense and without reimbursement from the City, any services necessary to correct errors or omissions which are caused by the Consultant’s failure to comply with the standard of care provided for herein. Any employee of the Consultant or its sub-consultants who is determined by the City to be uncooperative, incompetent, a threat to the adequate or timely completion of the Project, a threat to the safety of persons or property, or any employee who fails or refuses to perform the Services in a manner acceptable to the City, shall be promptly removed from the Project by the Consultant and shall not be re-employed to perform any of the Services or to work on the Project.
3.2.9 Laws and Regulations. Consultant shall keep itself fully informed of and in compliance with all local, state and federal laws, rules and regulations in any manner affecting the performance of the Project or the Services, including all Cal/OSHA requirements, and shall give all notices required by law. Consultant shall be liable for all violations of such laws and regulations in connection with Services. If the Consultant performs any work knowing it to be contrary to such laws, rules and regulations and without giving written notice to the City, Consultant shall be solely responsible for all costs arising therefrom. Consultant shall defend, indemnify and hold City, its officials, directors, officers, employees and agents free and harmless, pursuant to the indemnification provisions of this Agreement, from any claim or liability arising out of any failure or alleged failure to comply with such laws, rules or regulations. 55414.00000\33020133.1 - 4 -
3.2.10 Insurance.
3.2.10.1 Time for Compliance. Consultant shall not commence Work under this Agreement until it has provided evidence satisfactory to the City that it has secured all insurance required under this section. In addition, Consultant shall not allow any subconsultant to commence work on any subcontract until it has provided evidence satisfactory to the City that the subconsultant has secured all insurance required under this section.
3.2.10.2 Types of Insurance Required. As a condition precedent to the effectiveness of this Agreement for work to be performed hereunder and without limiting the indemnity provisions of the Agreement, the Consultant in partial performance of its obligations under such Agreement, shall procure and maintain in full force and effect during the term of the Agreement, the following policies of insurance. If the existing policies do not meet the Insurance Requirements set forth herein, Consultant agrees to amend, supplement or endorse the policies to do so.
(a) Commercial General Liability: Commercial General Liability Insurance which affords coverage at least as broad as Insurance Services Office “occurrence” form CG 0001, with minimum limits of at least $1,000,000 per occurrence, and if written with an aggregate, the aggregate shall be double the per occurrence limit.
Defense costs shall be paid in addition to the limits.
The policy shall contain no endorsements or provisions limiting coverage for (1) contractual liability; (2) cross liability exclusion for claims or suits by one insured against another; or (3) contain any other exclusion contrary to the Agreement.
(b) Automobile Liability Insurance: Automobile Liability Insurance with coverage at least as broad as Insurance Services Office Form CA 0001 covering “Any Auto” (Symbol 1) with minimum limits of $1,000,000 each accident.
(c) Contractors Pollution Liability: [Include only if there is a pollution liability exposure.]
Contractors Pollution Liability Insurance covering all of the contractor’s operations to include onsite and offsite coverage for bodily injury (including death and mental anguish), property damage, defense costs and cleanup costs with minimum limits of $5 million per loss and $10 million total all losses. The policy shall contain no endorsements or provisions limiting contractual liability or coverage for cross liability of claims or suits by one insured against another.
If coverage is written on a claims-made basis, the retroactive date shall precede the effective date of the initial Agreement and continuous coverage will be maintained or an extended reporting 55414.00000\33020133.1 - 5 -
period will be exercised for a period of at least three (3) years from termination or expiration of this Agreement.
(d) Professional Liability: Professional Liability insurance with minimum limits of $1,000,000. Covered professional services shall specifically include all work to be performed under the Agreement and delete any exclusions that may potentially affect the work to be performed (for example, any exclusions relating to lead, asbestos, pollution, testing, underground storage tanks, laboratory analysis, soil work, etc.).
If coverage is written on a claims-made basis, the retroactive date shall precede the effective date of the initial Agreement and continuous coverage will be maintained or an extended reporting period will be exercised for a period of at least three (3) years from termination or expiration of this Agreement.
(e) Workers’ Compensation: Workers’ Compensation Insurance, as required by the State of California and Employer’s Liability Insurance with a limit of not less than $1,000,000 per accident for bodily injury and disease.
3.2.10.3 Endorsements. Required insurance policies shall not be in compliance if they include any limiting provision or endorsement that has not been submitted to the City for approval.
(a) The policy or policies of insurance required by Section 3.2.10.2 (a) Commercial General Liability and (c) Contractor’s Pollution Liability shall be endorsed to provide the following:
(1) Additional Insured: The City, its officials, officers, employees, agents, and volunteers shall be additional
insureds with regard to liability and defense of suits or claims arising out of the performance of the Agreement.
Additional Insured Endorsements shall not (1) be restricted to “ongoing operations”; (2) exclude “contractual liability”; (3) restrict coverage to “sole” liability of Consultant; or (4) contain any other exclusions contrary to the Agreement. (2) Cancellation: Required insurance policies shall not be canceled or the coverage reduced until a thirty (30) day written notice of cancellation has been served upon the City except ten (10) days shall be allowed for non-payment of premium.
55414.00000\33020133.1 - 6 -
(b) The policy or policies of insurance required by Section 3.2.10.2 (b) Automobile Liability and (d) Professional Liability shall be endorsed to provide the following:
(1) Cancellation: Required insurance policies shall not be canceled or the coverage reduced until a thirty (30) day written notice of cancellation has been served upon the City except ten (10) days shall be allowed for non-payment of premium.
(c) The policy or policies of insurance required by Section 3.2.10.2 (e) Workers’ Compensation shall be endorsed to provide the following:
(1) Waiver of Subrogation: A waiver of subrogation stating that the insurer waives all rights of subrogation against the indemnified parties.
(2) Cancellation: Required insurance policies shall not be canceled or the coverage reduced until a thirty (30) day written notice of cancellation has been served upon the City except ten (10) days shall be allowed for non-payment of premium.
3.2.10.4 Primary and Non-Contributing Insurance. All insurance coverages shall be primary and any other insurance, deductible, or self-insurance maintained by the indemnified parties shall not contribute with this primary insurance. Policies shall contain or be endorsed to contain such provisions.
3.2.10.5 Waiver of Subrogation. Required insurance coverages shall not prohibit Consultant from waiving the right of subrogation prior to a loss. Consultant shall waive all subrogation rights against the indemnified parties. Policies shall contain or be endorsed to contain such provisions.
3.2.10.6 Deductible. Any deductible or self-insured retention must be approved in writing by the City and shall protect the indemnified parties in the same manner and to the same extent as they would have been protected had the policy or policies not contained a deductible or self-insured retention.
3.2.10.7 Evidence of Insurance. The Consultant, concurrently with the execution of the Agreement, and as a condition precedent to the effectiveness thereof, shall deliver either certified copies of the required policies, or original certificates and endorsements on forms approved by the City. The certificates and endorsements for each insurance policy shall be signed by a person authorized by that insurer to bind coverage on its behalf. At least fifteen (15 days) prior to the expiration of any such policy, evidence of insurance showing that such insurance coverage has been renewed or extended shall be filed with the City. If such coverage is cancelled or reduced, Consultant shall, within ten (10) days after receipt of written notice of such cancellation or reduction of coverage, file with the City evidence of insurance showing that the required 55414.00000\33020133.1 - 7 -
insurance has been reinstated or has been provided through another insurance company or companies.
3.2.10.8 Failure to Maintain Coverage. Consultant agrees to suspend and cease all operations hereunder during such period of time as the required insurance coverage is not in effect and evidence of insurance has not been furnished to the City. The City shall have the right to withhold any payment due Consultant until Consultant has fully complied with the insurance provisions of this Agreement.
In the event that the Consultant’s operations are suspended for failure to maintain required insurance coverage, the Consultant shall not be entitled to an extension of time for completion of the Services because of production lost during suspension.
3.2.10.9 Acceptability of Insurers. Each such policy shall be from a company or companies with a current A.M. Best’s rating of no less than A:VII and authorized to do business in the State of California, or otherwise allowed to place insurance through surplus line brokers under applicable provisions of the California Insurance Code or any federal law.
3.2.10.10 Insurance for Subconsultants. All Subconsultants shall be included as additional insureds under the Consultant’s policies, or the Consultant shall be responsible for causing Subconsultants to purchase the appropriate insurance in compliance with the terms of these Insurance Requirements, including adding the City as an Additional Insured to the Subconsultant’s policies.
3.2.11 Safety. Consultant shall execute and maintain its work so as to avoid injury or damage to any person or property. In carrying out its Services, the Consultant shall at all times be in compliance with all applicable local, state and federal laws, rules and regulations, and shall exercise all necessary precautions for the safety of employees appropriate to the nature of the work and the conditions under which the work is to be performed. Safety precautions as applicable shall include, but shall not be limited to: (A) adequate life protection and life saving equipment and procedures; (B) instructions in accident prevention for all employees and subconsultants, such as safe walkways, scaffolds, fall protection ladders, bridges, gang planks, confined space procedures, trenching and shoring, equipment and other safety devices, equipment and wearing apparel as are necessary or lawfully required to prevent accidents or injuries; and (C) adequate facilities for the proper inspection and maintenance of all safety measures.
3.3 Fees and Payments.
3.3.1 Compensation. Consultant shall receive compensation, including authorized reimbursements, for all Services rendered under this Agreement at the rates set forth in Exhibit “C” attached hereto and incorporated herein by reference. The total compensation shall not exceed ONE HUNDRED AND FIVE THOUSAND DOLLARS ($105,000) per fiscal year (“Total Compensation”) without written approval of the City Manager. Extra Work may be authorized, as described below, and if authorized, will be compensated at the rates and manner set forth in this Agreement.
3.3.2 Payment of Compensation. Consultant shall submit to City a monthly itemized statement which indicates work completed and hours of Services rendered by Consultant. 55414.00000\33020133.1 - 8 -
The statement shall describe the amount of Services and supplies provided since the initial commencement date, or since the start of the subsequent billing periods, as appropriate, through the date of the statement. City shall, within 45 days of receiving such statement, review the statement and pay all approved charges thereon.
3.3.3 Reimbursement for Expenses. Consultant shall not be reimbursed for any expenses unless authorized in writing by City.
3.3.4 Extra Work. At any time during the term of this Agreement, City may request that Consultant perform Extra Work. As used herein, “Extra Work” means any work which is determined by City to be necessary for the proper completion of the Project, but which the Parties did not reasonably anticipate would be necessary at the execution of this Agreement.
Consultant shall not perform, nor be compensated for, Extra Work without written authorization from the City.
3.3.5 Prevailing Wages. Consultant is aware of the requirements of California Labor Code Section 1720, et seq., and 1770, et seq., as well as California Code of Regulations, Title 8, Section 16000, et seq., (“Prevailing Wage Laws”), which require the payment of prevailing wage rates and the performance of other requirements on “public works” and “maintenance” projects. If the Services are being performed as part of an applicable “public works” or “maintenance” project, as defined by the Prevailing Wage Laws, and if the total compensation is $1,000 or more, Consultant agrees to fully comply with such Prevailing Wage Laws. City shall provide Consultant with a copy of the prevailing rates of per diem wages in effect at the commencement of this Agreement. Consultant shall make copies of the prevailing rates of per diem wages for each craft, classification or type of worker needed to execute the Services available to interested parties upon request, and shall post copies at the Consultant’s principal place of business and at the project site. Consultant shall defend, indemnify and hold the City, its elected officials, officers, employees and agents free and harmless from any claim or liability arising out of any failure or alleged failure to comply with the Prevailing Wage Laws.
3.4 Accounting Records.
3.4.1 Maintenance and Inspection. Consultant shall maintain complete and accurate records with respect to all costs and expenses incurred under this Agreement. All such records shall be clearly identifiable. Consultant shall allow a representative of City during normal business hours to examine, audit, and make transcripts or copies of such records and any other documents created pursuant to this Agreement. Consultant shall allow inspection of all work, data, documents, proceedings, and activities related to the Agreement for a period of three (3) years from the date of final payment under this Agreement.
3.5 General Provisions.
3.5.1 Termination of Agreement.
3.5.1.1 Grounds for Termination. City may, by written notice to Consultant, terminate the whole or any part of this Agreement at any time and without cause by giving written notice to Consultant of such termination, and specifying the effective date thereof, at least seven (7) days before the effective date of such termination. Upon termination, Consultant 55414.00000\33020133.1 - 9 -
shall be compensated only for those services which have been adequately rendered to City, and Consultant shall be entitled to no further compensation. Consultant may not terminate this Agreement except for cause.
3.5.1.2 Effect of Termination. If this Agreement is terminated as provided herein, City may require Consultant to provide all finished or unfinished Documents and Data and other information of any kind prepared by Consultant in connection with the performance of Services under this Agreement. Consultant shall be required to provide such document and other information within fifteen (15) days of the request.
3.5.1.3 Additional Services. In the event this Agreement is terminated in whole or in part as provided herein, City may procure, upon such terms and in such manner as it may determine appropriate, services similar to those terminated.
3.5.2 Delivery of Notices. All notices permitted or required under this Agreement shall be given to the respective parties at the following address, or at such other address as the respective parties may provide in writing for this purpose:
Consultant:
Boys & Girls Clubs of Garden Grove
10540 Chapman Avenue
Garden Grove, CA 92840
Attn: Christina Sepulveda, Vice President of Community
Impact Programs
City:
City of Stanton
7800 Katella Avenue
Stanton, CA 90680
Attn: Zenia Bobadilla, Community Services Director
Such notice shall be deemed made when personally delivered or when mailed, forty-eight (48) hours after deposit in the U.S. Mail, first class postage prepaid and addressed to the party at its applicable address. Actual notice shall be deemed adequate notice on the date actual notice occurred, regardless of the method of service.
3.5.3 Ownership of Materials and Confidentiality.
3.5.3.1 Documents & Data; Licensing of Intellectual Property. This Agreement creates a non-exclusive and perpetual license for City to copy, use, modify, reuse, or sublicense any and all copyrights, designs, and other intellectual property embodied in plans, specifications, studies, drawings, estimates, and other documents or works of authorship fixed in any tangible medium of expression, including but not limited to, physical drawings or data magnetically or otherwise recorded on computer diskettes, which are prepared or caused to be prepared by Consultant under this Agreement (“Documents & Data”). Consultant shall require all subconsultants to agree in writing that City is granted a non-exclusive and perpetual license for any Documents & Data the subconsultant prepares under this Agreement. Consultant represents 55414.00000\33020133.1 - 10 -
and warrants that Consultant has the legal right to license any and all Documents & Data.
Consultant makes no such representation and warranty in regard to Documents & Data which were prepared by design professionals other than Consultant or provided to Consultant by the City. City shall not be limited in any way in its use of the Documents and Data at any time, provided that any such use not within the purposes intended by this Agreement shall be at City’s sole risk.
3.5.3.2 Confidentiality. All ideas, memoranda, specifications, plans, procedures, drawings, descriptions, computer program data, input record data, written information, and other Documents and Data either created by or provided to Consultant in connection with the performance of this Agreement shall be held confidential by Consultant. Such materials shall not, without the prior written consent of City, be used by Consultant for any purposes other than the performance of the Services. Nor shall such materials be disclosed to any person or entity not connected with the performance of the Services or the Project. Nothing furnished to Consultant which is otherwise known to Consultant or is generally known, or has become known, to the related industry shall be deemed confidential. Consultant shall not use City’s name or insignia, photographs of the Project, or any publicity pertaining to the Services or the Project in any magazine, trade paper, newspaper, television or radio production or other similar medium without the prior written consent of City.
3.5.3.3 Confidential Information. The City shall refrain from releasing Consultant’s proprietary information (“Proprietary Information”) unless the City’s legal counsel determines that the release of the Proprietary Information is required by the California Public Records Act or other applicable state or federal law, or order of a court of competent jurisdiction, in which case the City shall notify Consultant of its intention to release Proprietary Information.
Consultant shall have five (5) working days after receipt of the Release Notice to give City written notice of Consultant’s objection to the City’s release of Proprietary Information. Consultant shall indemnify, defend and hold harmless the City, and its officers, directors, employees, and agents from and against all liability, loss, cost or expense (including attorney’s fees) arising out of a legal action brought to compel the release of Proprietary Information. City shall not release the Proprietary Information after receipt of the Objection Notice unless either: (1) Consultant fails to fully indemnify, defend (with City’s choice of legal counsel), and hold City harmless from any legal action brought to compel such release; and/or (2) a final and non-appealable order by a court of competent jurisdiction requires that City release such information.
3.5.4 Cooperation; Further Acts. The Parties shall fully cooperate with one another, and shall take any additional acts or sign any additional documents as may be necessary, appropriate or convenient to attain the purposes of this Agreement.
3.5.5 Attorney’s Fees. If either party commences an action against the other party, either legal, administrative or otherwise, arising out of or in connection with this Agreement, the prevailing party in such litigation shall be entitled to have and recover from the losing party reasonable attorney’s fees and all other costs of such action.
3.5.6 Indemnification.
To the fullest extent permitted by law, Consultant shall defend (with counsel of City’s choosing), indemnify and hold the City, its officials, officers, employees, volunteers and 55414.00000\33020133.1 - 11 -
agents free and harmless from any and all claims, demands, causes of action, costs, expenses, liability, loss, damage or injury of any kind, in law or equity, to property or persons, including wrongful death, in any manner arising out of, pertaining to, or incident to any alleged acts, errors or omissions, or willful misconduct of Consultant, its officials, officers, employees, subcontractors, consultants or agents in connection with the performance of the Consultant's Services, the Project or this Agreement, including without limitation the payment of all damages, expert witness fees and attorneys fees and other related costs and expenses. Consultant's obligation to indemnify shall not be restricted to insurance proceeds, if any, received by the Consultant or the City, its officials, officers, employees, agents or volunteers.
If Consultant’s obligation to defend, indemnify, and/or hold harmless arises out of Consultant’s performance as a “design professional” (as that term is defined under Civil Code section 2782.8), then, and only to the extent required by Civil Code section 2782.8, which is fully incorporated herein, Consultant’s indemnification obligation shall be limited to claims that arise out of, pertain to, or relate to the negligence, recklessness, or willful misconduct of the Consultant, and, upon Consultant obtaining a final adjudication by a court of competent jurisdiction, Consultant’s liability for such claim, including the cost to defend, shall not exceed the Consultant’s proportionate percentage of fault.
3.5.7 Entire Agreement. This Agreement contains the entire Agreement of the parties with respect to the subject matter hereof, and supersedes all prior negotiations, understandings or agreements. This Agreement may only be modified by a writing signed by both parties.
3.5.8 Governing Law. This Agreement shall be governed by the laws of the State of California. Venue shall be in Orange County.
3.5.9 Time of Essence. Time is of the essence for each and every provision of this Agreement.
3.6 City’s Right to Employ Other Consultants. City reserves right to employ other consultants in connection with this Project.
3.7 Successors and Assigns. This Agreement shall be binding on the successors and assigns of the parties.
3.8 Assignment or Transfer. Consultant shall not assign, hypothecate, or transfer, either directly or by operation of law, this Agreement or any interest herein without the prior written consent of the City. Any attempt to do so shall be null and void, and any assignees, hypothecates or transferees shall acquire no right or interest by reason of such attempted assignment, hypothecation or transfer.
3.9 Construction; References; Captions. Since the Parties or their agents have participated fully in the preparation of this Agreement, the language of this Agreement shall be construed simply, according to its fair meaning, and not strictly for or against any Party. Any term referencing time, days or period for performance shall be deemed calendar days and not work days.
All references to Consultant include all personnel, employees, agents, and sub consultants of Consultant, except as otherwise specified in this Agreement. All references to City include its 55414.00000\33020133.1 - 12 -
elected officials, officers, employees, agents, and volunteers except as otherwise specified in this Agreement. The captions of the various articles and paragraphs are for convenience and ease of reference only, and do not define, limit, augment, or describe the scope, content, or intent of this Agreement.
3.10 Amendment; Modification. No supplement, modification, or amendment of this Agreement shall be binding unless executed in writing and signed by both Parties.
3.11 Waiver. No waiver of any default shall constitute a waiver of any other default or breach, whether of the same or other covenant or condition. No waiver, benefit, privilege, or service voluntarily given or performed by a Party shall give the other Party any contractual rights by custom, estoppel, or otherwise.
3.12 No Third Party Beneficiaries. There are no intended third party beneficiaries of any right or obligation assumed by the Parties.
3.13 Invalidity; Severability. If any portion of this Agreement is declared invalid, illegal, or otherwise unenforceable by a court of competent jurisdiction, the remaining provisions shall continue in full force and effect.
3.14 Prohibited Interests. Consultant maintains and warrants that it has not employed nor retained any company or person, other than a bona fide employee working solely for Consultant, to solicit or secure this Agreement. Further, Consultant warrants that it has not paid nor has it agreed to pay any company or person, other than a bona fide employee working solely for Consultant, any fee, commission, percentage, brokerage fee, gift or other consideration contingent upon or resulting from the award or making of this Agreement. For breach or violation of this warranty, City shall have the right to rescind this Agreement without liability. For the term of this Agreement, no member, officer or employee of City, during the term of his or her service with City, shall have any direct interest in this Agreement, or obtain any present or anticipated material benefit arising therefrom.
3.15 Equal Opportunity Employment. Consultant represents that it is an equal opportunity employer and it shall not discriminate against any subconsultant, employee or applicant for employment because of race, religion, color, national origin, handicap, ancestry, sex or age. Such non-discrimination shall include, but not be limited to, all activities related to initial employment, upgrading, demotion, transfer, recruitment or recruitment advertising, layoff or termination. Consultant shall also comply with all relevant provisions of City’s Minority Business Enterprise program, Affirmative Action Plan or other related programs or guidelines currently in effect or hereinafter enacted.
3.16 Labor Certification. By its signature hereunder, Consultant certifies that it is aware of the provisions of Section 3700 of the California Labor Code which require every employer to be insured against liability for Worker’s Compensation or to undertake self-insurance in accordance with the provisions of that Code, and agrees to comply with such provisions before commencing the performance of the Services.
3.17 Authority to Enter Agreement. Consultant has all requisite power and authority to conduct its business and to execute, deliver, and perform the Agreement. Each Party warrants 55414.00000\33020133.1 - 13 -
that the individuals who have signed this Agreement have the legal power, right, and authority to make this Agreement and bind each respective Party.
3.18 Counterparts. This Agreement may be signed in counterparts, each of which shall constitute an original.
3.19 Declaration of Political Contributions. Consultant shall, throughout the term of this Agreement, submit to City an annual statement in writing declaring any political contributions of money, in-kind services, or loan made to any member of the City Council within the previous twelve-month period by the Consultant and all of Consultant’s employees, including any employee(s) that Consultant intends to assign to perform the Services described in this Agreement.
3.20 Subcontracting.
3.20.1 Prior Approval Required. Consultant shall not subcontract any portion of the work required by this Agreement, except as expressly stated herein, without prior written approval of City. Subcontracts, if any, shall contain a provision making them subject to all provisions stipulated in this Agreement.
[Signatures on following page.]
55414.00000\33020133.1 - 14 -
IN WITNESS WHEREOF, the parties have executed this Professional Services Agreement on this ____ day of __________, 201__.
CITY OF STANTON [INSERT NAME OF CONSULTANT]
By:
___________________
City Manager
By:
Name:
Title:
[If Corporation, TWO SIGNATURES,
President OR Vice President AND Secretary,
AND CORPORATE SEAL OF
CONSULTANT REQUIRED]
ATTEST:
By:
Patricia Vazquez
City Clerk
By:
APPROVED AS TO FORM:
By:
Best Best & Krieger LLP
City Attorney
55414.00000\33020133. 1A-1
EXHIBIT “A”
SCOPE OF SERVICES
Counseling Services
The objectives of Counseling Services are as follows:
• Increase PARTICIPANT’s coping skills;
• Stabilize immediate crisis;
• Increase access to social support systems;
• Facilitate linkages to appropriate and needed treatment programs (e.g., domestic violence, substance use disorder, mental health, etc.);
• Reduce risk of violence, abuse, and/or neglect in the home; and • Improve individual and family functioning.
CONTRACTOR shall utilize evidence-based practices to provide Crisis, Individual, Family, and Group Counseling Services for a minimum of four hundred (400) sessions annually. • A completed Crisis, Individual, Family, and Group Counseling session shall be counted as one (1) session regardless of number of PARTICIPANTS. A session shall be defined as a minimum of fifty (50) minutes in length.
• A completed Group Counseling session exceeding ninety (90) minutes in length shall be counted as two (2) sessions regardless of the number of PARTICIPANTS. A Group Counseling session shall be sixty (60) to ninety (90) minutes each in duration.
CONTRACTOR Counseling Services shall be held primarily at the FRC, schools, or other mutually agreed upon community location, in an appropriate, private, and confidential space; and be provided to PARTICIPANTS who are not covered by Medi-Cal or health insurance or who may be experiencing an immediate crisis that is disrupting their level of functioning.
CONTRACTOR shall provide in-person counseling services during FRC operating hours and on days and times that are responsive to the needs of the community, including evenings and weekends.
Counseling Services may be provided via Telehealth Services as requested by PARTICIPANT or if held outside regular FRC hours.
CONTRACTOR shall provide qualified, bilingual Counselor staff as specified in Subparagraph
14.3.2 of this Attachment A. CONTRACTOR Counselor staff shall attend all CMT meetings.
Case Management Team
The objectives of CMT services are as follows:
• Increase collaboration among Contractor Partner Agencies by meeting on a weekly basis to effectively coordinate PARTICIPANT services;
• Encourage family attendance and participation in determining their service needs; • Increase and facilitate resource linkages;
• Improve individual and family functioning;
• Decrease duplication of PARTICIPANT services; and
• Foster the collaboration between the community, service providers, and FRCs to address the needs of children and families.
55414.00000\33020133. 1A-2
The CMT consists of an integrated multidisciplinary team, comprised of three (3) or more persons, trained and qualified to provide services. The CMT is responsible for identifying the educational, health, or social service needs of a child, and child’s family, and for developing a plan to address these multiple needs as identified in Welfare and Institutions Code section 18986.40.
CONTRACTOR shall ensure participants of the CMT include all FaCT funded FRC service providers and non-FaCT funded agency representatives that would benefit the family.
CONTRACTOR shall ensure at a minimum, CMT participants shall include Counselor and Family Support Advocate.
CONTRACTOR shall encourage attendance of PARTICIPANTS referred to CMT.
CONTRACTOR and Contractor Partner Agencies shall jointly provide CMT services for a minimum of seventy-five (75) unduplicated FAMILIES annually. FRC CMT services include, but are not limited to: identifying the educational, health, or social service needs of a child and child’s family; developing a plan to address these multiple needs; weekly reviews; team assessment; arranging and coordinating appropriate services; monitoring effectiveness of services; evaluating the outcome of services; and assigned clinician/intern, in conjunction with appropriate partners, will utilize clinical skills and knowledge of the community in order to access resources that are best suited to PARTICIPANT’s needs. FRC CMT services shall include, but are not limited to, the following components:
• Assessment: The CMT facilitator, based on input from the CMT, shall complete an assessment of PARTICIPANTS’ strengths and needs.
• Service Plan: On the basis of the assessment in Subparagraph 7.1.6.1, the CMT shall jointly develop an individualized service plan with the PARTICIPANT that identifies priorities, desired outcomes, strategies, and resources to be used in attaining the outcomes, follow up, and termination.
• Reassessment: The CMT facilitator and CMT shall jointly reassess the PARTICIPANT’s status, with input from Contractor Partner Agencies, in a weekly clinical review of cases.
CMT meetings shall provide weekly evaluations and assessment for PARTICIPANTS. • Termination: The CMT facilitator and CMT shall jointly terminate the case from the CMT when the desired outcomes have been attained, the PARTICIPANT is non-compliant, or the PARTICIPANT withdraws.
CMT meetings shall be facilitated by a qualified Counselor or staff person as specified in Subparagraph 14.2.1.2 of this Attachment A.
CONTRACTOR shall complete the CMT Tracking and Outcomes Log as well as the required forms referenced in Subparagraph 6.16 of this Attachment A.
55414.00000\33020133. 1B-1
EXHIBIT “B”
SCHEDULE OF SERVICES
Counseling Services
• Crisis Counseling Services: The duration of CONTRACTOR Crisis Counseling Services shall consist of a maximum of three (3) sessions for each PARTICIPANT. • Individual Counseling Services: CONTRACTOR shall provide Individual Counseling Services for a maximum of sixteen (16) sessions, for each PARTICIPANT. Additional sessions must be requested in advance and in writing for approval by ADMINISTRATOR.
Individual Counseling sessions shall be offered to PARTICIPANTS on a weekly basis. • Family Counseling Services: CONTRACTOR shall provide Family Counseling Services for a maximum of sixteen (16) sessions, for each family. Additional sessions must be requested in advance and in writing for approval by ADMINISTRATOR. Family Counseling sessions may be weekly or daily, based on PARTICIPANTS’ needs.
• Group Counseling Services: The duration of Group Counseling Services shall consist of a minimum of four (4) group counseling series, with a minimum of four (4) to a maximum of sixteen (16) sessions per series. A session shall be sixty (60) to ninety (90) minutes each in duration.
Case Management
CONTRACTOR and Contractor Partner Agencies shall jointly provide CMT services continuously throughout the term of this Contract. CMT meetings shall be scheduled a minimum of one (1) day per week for a minimum of one (1) hour in duration. CMT meetings shall be held in an appropriate, private, and confidential space.
55414.00000\33020133. 1C-1
EXHIBIT “C”
COMPENSATION
The annual budget for services provided pursuant to Exhibit A of this Agreement is set forth in the City’s procurement of the Stanton FRC FY25-28 Agreement for the Provision of Family Resource Center Services:
Position FTE Maximum Hourly Rate Budget
CMT Clinical Supervisor 0.05 $125.00 $9,750.00
Counselor 1.00 $33.50 $73,923.00
Counselor Benefits $5,175.09
Clinical Supervision $6,500.00
Group Program Supplies $1,000.00
Counseling Office Supplies $1,000.00
Indirect Costs $6,815.90
Total $104,163.99
CMT Clinical Supervisor
Duties: Facilitate CMT group process, ensure thorough assessment and linkages for families to resources, and ensure team and/or staff members follow up on all mandated reporting requirements. Responsibilities include, but are not limited to: verify and track attendance of required CMT members; ensure PARTICIPANT confidentiality/release forms are signed by PARTICIPANT and CMT members; review the laws of confidentiality and child and elder/dependent adult abuse reporting on an annual basis, and ensure compliance for each case presented; ensure all CMT cases conferenced are multiple needs cases (i.e., client needs Counseling and PEP); facilitate weekly review of CMT cases, including a thorough assessment of needs, service plan, follow up plan, and termination; encourage staff to invite FAMILIES to the CMT meetings; maintain weekly case logs and registration forms for each case conferenced at CMT; complete standardized CMT assessment tools, ensuring COUNTY required CMT data is accurately entered into FaCT database; and actively engage new collaborative partners and/or other COUNTY agency representatives to conference cases that would benefit families.
Qualifications: Counselor or staff person with a minimum of one (1) year of group/meeting facilitation experience and ability to perform CMT Facilitator duties listed above.
Counselor
Duties: Provide therapy, including assessment, treatment planning, termination, and documentation; communicate applicable case related information to SSA staff, as requested; attend weekly CMT meetings; and complete FaCT designated measurement tools and enter all required data into the FaCT database.
Qualifications: Licensed clinician registered with the State of California Department of Consumer Affairs, Board of Behavioral Sciences (BBS); or graduate behavioral science degree intern. All associates and interns must be receiving direct clinical supervision in accordance with BBS requirements. It is the responsibility of the licensed clinical supervisor to ensure that the extent, kind, 55414.00000\33020133. 1C-2
and quality of clinical services performed is consistent with the training and experience of the associate and/or intern. Proficiency in English is required. Based on community need, bilingual proficiency may be required.
55414.00000\33020133.1 - 1 -
CITY OF STANTON
PROFESSIONAL SERVICES AGREEMENT
FOR
Stanton FRC FY25-28 Agreement for the Provision of Family Resource Center Services
1. PARTIES AND DATE.
This Agreement is made and entered into this 1
st day of July , 2025__, by and between the
City of Stanton, a municipal organization organized under the laws of the State of California with its principal place of business at 7800 Katella Avenue, Stanton, California 90680 (“City”) and Interval House, a California Non-Profit Corporation with its principal place of business at 6615 East Pacific Coast Highway, Suite 170, Long Beach, CA 90803 (“Consultant”). City and Consultant are sometimes individually referred to herein as “Party” and collectively as “Parties.”
2. RECITALS.
2.1 Consultant.
Consultant desires to perform and assume responsibility for the provision of professional Personal Empowerment Program consultant services required by the City on the terms and conditions set forth in this Agreement. Consultant represents that it is experienced in providing professional Personal Empowerment Program services to public clients, is licensed in the State of California, and is familiar with the plans of City.
2.2 Project.
City desires to engage Consultant to render such services for the Stanton FRC FY25-28 Agreement for the Provision of Family Resource Center Services project (“Project”) as set forth in this Agreement.
3. TERMS.
3.1 Scope of Services and Term.
3.1.1 General Scope of Services. Consultant promises and agrees to furnish to the City all labor, materials, tools, equipment, services, and incidental and customary work necessary to fully and adequately supply the professional Personal Empowerment Program consultant services necessary for the Project (“Services”). The Services are more particularly described in Exhibit “A” attached hereto and incorporated herein by reference. All Services shall be subject to, and performed in accordance with, this Agreement, the exhibits attached hereto and incorporated herein by reference, and all applicable local, state and federal laws, rules and regulations.
3.1.2 Term. The term of this Agreement shall be from July 1, 2025 to June 30, 2028 unless earlier terminated as provided herein. The City Manager shall have the unilateral option, at its sole discretion, to renew this Agreement annually for no more than two additional one-year terms. Consultant shall complete the Services within the term of this Agreement, and shall meet any other established schedules and deadlines.
Attachment: C
Click here to return to the agenda.
55414.00000\33020133.1 - 2 -
3.2 Responsibilities of Consultant.
3.2.1 Control and Payment of Subordinates; Independent Contractor. The Services shall be performed by Consultant or under its supervision. Consultant will determine the means, methods and details of performing the Services subject to the requirements of this Agreement. City retains Consultant on an independent contractor basis and not as an employee.
Consultant shall complete, execute, and submit to City a Request for Taxpayer Identification Number and Certification (IRS FormW-9) prior to commencement of any Services under this Agreement. Consultant retains the right to perform similar or different services for others during the term of this Agreement. Any additional personnel performing the Services under this Agreement on behalf of Consultant shall also not be employees of City and shall at all times be under Consultant’s exclusive direction and control. Consultant shall pay all wages, salaries, and other amounts due such personnel in connection with their performance of Services under this Agreement and as required by law. Consultant shall be responsible for all reports and obligations respecting such additional personnel, including, but not limited to: social security taxes, income tax withholding, unemployment insurance, disability insurance, and workers’ compensation insurance.
3.2.2 Schedule of Services. Consultant shall perform the Services expeditiously, within the term of this Agreement, and in accordance with the Schedule of Services set forth in Exhibit “B” attached hereto and incorporated herein by reference. Consultant represents that it has the professional and technical personnel required to perform the Services in conformance with such conditions. In order to facilitate Consultant’s conformance with the Schedule, City shall respond to Consultant’s submittals in a timely manner. Upon request of City, Consultant shall provide a more detailed schedule of anticipated performance to meet the Schedule of Services.
3.2.3 Conformance to Applicable Requirements. All work prepared by Consultant shall be subject to the approval of City.
3.2.4 Substitution of Key Personnel. Consultant has represented to City that certain key personnel will perform and coordinate the Services under this Agreement. Should one or more of such personnel become unavailable, Consultant may substitute other personnel of at least equal competence upon written approval of City. In the event that City and Consultant cannot agree as to the substitution of key personnel, City shall be entitled to terminate this Agreement for cause. As discussed below, any personnel who fail or refuse to perform the Services in a manner acceptable to the City, or who are determined by the City to be uncooperative, incompetent, a threat to the adequate or timely completion of the Project or a threat to the safety of persons or property, shall be promptly removed from the Project by the Consultant at the request of the City.
The key personnel for performance of this Agreement are as follows: Carol Wiliams, Executive Director.
3.2.5 City’s Representative. The City hereby designates the City Manager, or his or her designee, to act as its representative for the performance of this Agreement (“City’s Representative”). City’s Representative shall have the power to act on behalf of the City for all purposes under this Contract. The City Manager hereby designates Zenia Bobadilla, Community Services Director, or his or her designee, as the City’s contact for the implementation of the 55414.00000\33020133.1 - 3 -
Services hereunder. Consultant shall not accept direction or orders from any person other than the City’s Representative or his or her designee.
3.2.6 Consultant’s Representative. Consultant hereby designates Carol Williams, Executive Director, or his or her designee, to act as its representative for the performance of this Agreement (“Consultant’s Representative”). Consultant’s Representative shall have full authority to represent and act on behalf of the Consultant for all purposes under this Agreement. The Consultant’s Representative shall supervise and direct the Services, using his best skill and attention, and shall be responsible for all means, methods, techniques, sequences and procedures and for the satisfactory coordination of all portions of the Services under this Agreement.
3.2.7 Coordination of Services. Consultant agrees to work closely with City staff in the performance of Services and shall be available to City’s staff, consultants and other staff at all reasonable times.
3.2.8 Standard of Care; Performance of Employees. Consultant shall perform all Services under this Agreement in a skillful and competent manner, consistent with the standards generally recognized as being employed by professionals in the same discipline in the State of California. Consultant represents and maintains that it is skilled in the professional calling necessary to perform the Services. Consultant warrants that all employees and subconsultants shall have sufficient skill and experience to perform the Services assigned to them. Finally, Consultant represents that it, its employees and subconsultants have all licenses, permits, qualifications and approvals of whatever nature that are legally required to perform the Services and that such licenses and approvals shall be maintained throughout the term of this Agreement.
As provided for in the indemnification provisions of this Agreement, Consultant shall perform, at its own cost and expense and without reimbursement from the City, any services necessary to correct errors or omissions which are caused by the Consultant’s failure to comply with the standard of care provided for herein. Any employee of the Consultant or its sub-consultants who is determined by the City to be uncooperative, incompetent, a threat to the adequate or timely completion of the Project, a threat to the safety of persons or property, or any employee who fails or refuses to perform the Services in a manner acceptable to the City, shall be promptly removed from the Project by the Consultant and shall not be re-employed to perform any of the Services or to work on the Project.
3.2.9 Laws and Regulations. Consultant shall keep itself fully informed of and in compliance with all local, state and federal laws, rules and regulations in any manner affecting the performance of the Project or the Services, including all Cal/OSHA requirements, and shall give all notices required by law. Consultant shall be liable for all violations of such laws and regulations in connection with Services. If the Consultant performs any work knowing it to be contrary to such laws, rules and regulations and without giving written notice to the City, Consultant shall be solely responsible for all costs arising therefrom. Consultant shall defend, indemnify and hold City, its officials, directors, officers, employees and agents free and harmless, pursuant to the indemnification provisions of this Agreement, from any claim or liability arising out of any failure or alleged failure to comply with such laws, rules or regulations.
3.2.10 Insurance.
55414.00000\33020133.1 - 4 -
3.2.10.1 Time for Compliance. Consultant shall not commence Work under this Agreement until it has provided evidence satisfactory to the City that it has secured all insurance required under this section. In addition, Consultant shall not allow any subconsultant to commence work on any subcontract until it has provided evidence satisfactory to the City that the subconsultant has secured all insurance required under this section.
3.2.10.2 Types of Insurance Required. As a condition precedent to the effectiveness of this Agreement for work to be performed hereunder and without limiting the indemnity provisions of the Agreement, the Consultant in partial performance of its obligations under such Agreement, shall procure and maintain in full force and effect during the term of the Agreement, the following policies of insurance. If the existing policies do not meet the Insurance Requirements set forth herein, Consultant agrees to amend, supplement or endorse the policies to do so.
(a) Commercial General Liability: Commercial General Liability Insurance which affords coverage at least as broad as Insurance Services Office “occurrence” form CG 0001, with minimum limits of at least $1,000,000 per occurrence, and if written with an aggregate, the aggregate shall be double the per occurrence limit.
Defense costs shall be paid in addition to the limits.
The policy shall contain no endorsements or provisions limiting coverage for (1) contractual liability; (2) cross liability exclusion for claims or suits by one insured against another; or (3) contain any other exclusion contrary to the Agreement.
(b) Automobile Liability Insurance: Automobile Liability Insurance with coverage at least as broad as Insurance Services Office Form CA 0001 covering “Any Auto” (Symbol 1) with minimum limits of $1,000,000 each accident.
(c) Contractors Pollution Liability: [Include only if there is a pollution liability exposure.]
Contractors Pollution Liability Insurance covering all of the contractor’s operations to include onsite and offsite coverage for bodily injury (including death and mental anguish), property damage, defense costs and cleanup costs with minimum limits of $5 million per loss and $10 million total all losses. The policy shall contain no endorsements or provisions limiting contractual liability or coverage for cross liability of claims or suits by one insured against another.
If coverage is written on a claims-made basis, the retroactive date shall precede the effective date of the initial Agreement and continuous coverage will be maintained or an extended reporting 55414.00000\33020133.1 - 5 -
period will be exercised for a period of at least three (3) years from termination or expiration of this Agreement.
(d) Professional Liability: Professional Liability insurance with minimum limits of $1,000,000. Covered professional services shall specifically include all work to be performed under the Agreement and delete any exclusions that may potentially affect the work to be performed (for example, any exclusions relating to lead, asbestos, pollution, testing, underground storage tanks, laboratory analysis, soil work, etc.).
If coverage is written on a claims-made basis, the retroactive date shall precede the effective date of the initial Agreement and continuous coverage will be maintained or an extended reporting period will be exercised for a period of at least three (3) years from termination or expiration of this Agreement.
(e) Workers’ Compensation: Workers’ Compensation Insurance, as required by the State of California and Employer’s Liability Insurance with a limit of not less than $1,000,000 per accident for bodily injury and disease.
3.2.10.3 Endorsements. Required insurance policies shall not be in compliance if they include any limiting provision or endorsement that has not been submitted to the City for approval.
(a) The policy or policies of insurance required by Section 3.2.10.2 (a) Commercial General Liability and (c) Contractor’s Pollution Liability shall be endorsed to provide the following:
(1) Additional Insured: The City, its officials, officers, employees, agents, and volunteers shall be additional
insureds with regard to liability and defense of suits or claims arising out of the performance of the Agreement.
Additional Insured Endorsements shall not (1) be restricted to “ongoing operations”; (2) exclude “contractual liability”; (3) restrict coverage to “sole” liability of Consultant; or (4) contain any other exclusions contrary to the Agreement. (2) Cancellation: Required insurance policies shall not be canceled or the coverage reduced until a thirty (30) day written notice of cancellation has been served upon the City except ten (10) days shall be allowed for non-payment of premium.
55414.00000\33020133.1 - 6 -
(b) The policy or policies of insurance required by Section 3.2.10.2 (b) Automobile Liability and (d) Professional Liability shall be endorsed to provide the following:
(1) Cancellation: Required insurance policies shall not be canceled or the coverage reduced until a thirty (30) day written notice of cancellation has been served upon the City except ten (10) days shall be allowed for non-payment of premium.
(c) The policy or policies of insurance required by Section 3.2.10.2 (e) Workers’ Compensation shall be endorsed to provide the following:
(1) Waiver of Subrogation: A waiver of subrogation stating that the insurer waives all rights of subrogation against the indemnified parties.
(2) Cancellation: Required insurance policies shall not be canceled or the coverage reduced until a thirty (30) day written notice of cancellation has been served upon the City except ten (10) days shall be allowed for non-payment of premium.
3.2.10.4 Primary and Non-Contributing Insurance. All insurance coverages shall be primary and any other insurance, deductible, or self-insurance maintained by the indemnified parties shall not contribute with this primary insurance. Policies shall contain or be endorsed to contain such provisions.
3.2.10.5 Waiver of Subrogation. Required insurance coverages shall not prohibit Consultant from waiving the right of subrogation prior to a loss. Consultant shall waive all subrogation rights against the indemnified parties. Policies shall contain or be endorsed to contain such provisions.
3.2.10.6 Deductible. Any deductible or self-insured retention must be approved in writing by the City and shall protect the indemnified parties in the same manner and to the same extent as they would have been protected had the policy or policies not contained a deductible or self-insured retention.
3.2.10.7 Evidence of Insurance. The Consultant, concurrently with the execution of the Agreement, and as a condition precedent to the effectiveness thereof, shall deliver either certified copies of the required policies, or original certificates and endorsements on forms approved by the City. The certificates and endorsements for each insurance policy shall be signed by a person authorized by that insurer to bind coverage on its behalf. At least fifteen (15 days) prior to the expiration of any such policy, evidence of insurance showing that such insurance coverage has been renewed or extended shall be filed with the City. If such coverage is cancelled or reduced, Consultant shall, within ten (10) days after receipt of written notice of such cancellation or reduction of coverage, file with the City evidence of insurance showing that the required 55414.00000\33020133.1 - 7 -
insurance has been reinstated or has been provided through another insurance company or companies.
3.2.10.8 Failure to Maintain Coverage. Consultant agrees to suspend and cease all operations hereunder during such period of time as the required insurance coverage is not in effect and evidence of insurance has not been furnished to the City. The City shall have the right to withhold any payment due Consultant until Consultant has fully complied with the insurance provisions of this Agreement.
In the event that the Consultant’s operations are suspended for failure to maintain required insurance coverage, the Consultant shall not be entitled to an extension of time for completion of the Services because of production lost during suspension.
3.2.10.9 Acceptability of Insurers. Each such policy shall be from a company or companies with a current A.M. Best’s rating of no less than A:VII and authorized to do business in the State of California, or otherwise allowed to place insurance through surplus line brokers under applicable provisions of the California Insurance Code or any federal law.
3.2.10.10 Insurance for Subconsultants. All Subconsultants shall be included as additional insureds under the Consultant’s policies, or the Consultant shall be responsible for causing Subconsultants to purchase the appropriate insurance in compliance with the terms of these Insurance Requirements, including adding the City as an Additional Insured to the Subconsultant’s policies.
3.2.11 Safety. Consultant shall execute and maintain its work so as to avoid injury or damage to any person or property. In carrying out its Services, the Consultant shall at all times be in compliance with all applicable local, state and federal laws, rules and regulations, and shall exercise all necessary precautions for the safety of employees appropriate to the nature of the work and the conditions under which the work is to be performed. Safety precautions as applicable shall include, but shall not be limited to: (A) adequate life protection and life saving equipment and procedures; (B) instructions in accident prevention for all employees and subconsultants, such as safe walkways, scaffolds, fall protection ladders, bridges, gang planks, confined space procedures, trenching and shoring, equipment and other safety devices, equipment and wearing apparel as are necessary or lawfully required to prevent accidents or injuries; and (C) adequate facilities for the proper inspection and maintenance of all safety measures.
3.3 Fees and Payments.
3.3.1 Compensation. Consultant shall receive compensation, including authorized reimbursements, for all Services rendered under this Agreement at the rates set forth in Exhibit “C” attached hereto and incorporated herein by reference. The total compensation shall not exceed TWENTY FOUR THOUSAND DOLLARS ($24,000) per fiscal year (“Total Compensation”) without written approval of the City Manager. Extra Work may be authorized, as described below, and if authorized, will be compensated at the rates and manner set forth in this Agreement.
3.3.2 Payment of Compensation. Consultant shall submit to City a monthly itemized statement which indicates work completed and hours of Services rendered by Consultant. 55414.00000\33020133.1 - 8 -
The statement shall describe the amount of Services and supplies provided since the initial commencement date, or since the start of the subsequent billing periods, as appropriate, through the date of the statement. City shall, within 45 days of receiving such statement, review the statement and pay all approved charges thereon.
3.3.3 Reimbursement for Expenses. Consultant shall not be reimbursed for any expenses unless authorized in writing by City.
3.3.4 Extra Work. At any time during the term of this Agreement, City may request that Consultant perform Extra Work. As used herein, “Extra Work” means any work which is determined by City to be necessary for the proper completion of the Project, but which the Parties did not reasonably anticipate would be necessary at the execution of this Agreement.
Consultant shall not perform, nor be compensated for, Extra Work without written authorization from the City.
3.3.5 Prevailing Wages. Consultant is aware of the requirements of California Labor Code Section 1720, et seq., and 1770, et seq., as well as California Code of Regulations, Title 8, Section 16000, et seq., (“Prevailing Wage Laws”), which require the payment of prevailing wage rates and the performance of other requirements on “public works” and “maintenance” projects. If the Services are being performed as part of an applicable “public works” or “maintenance” project, as defined by the Prevailing Wage Laws, and if the total compensation is $1,000 or more, Consultant agrees to fully comply with such Prevailing Wage Laws. City shall provide Consultant with a copy of the prevailing rates of per diem wages in effect at the commencement of this Agreement. Consultant shall make copies of the prevailing rates of per diem wages for each craft, classification or type of worker needed to execute the Services available to interested parties upon request, and shall post copies at the Consultant’s principal place of business and at the project site. Consultant shall defend, indemnify and hold the City, its elected officials, officers, employees and agents free and harmless from any claim or liability arising out of any failure or alleged failure to comply with the Prevailing Wage Laws.
3.4 Accounting Records.
3.4.1 Maintenance and Inspection. Consultant shall maintain complete and accurate records with respect to all costs and expenses incurred under this Agreement. All such records shall be clearly identifiable. Consultant shall allow a representative of City during normal business hours to examine, audit, and make transcripts or copies of such records and any other documents created pursuant to this Agreement. Consultant shall allow inspection of all work, data, documents, proceedings, and activities related to the Agreement for a period of three (3) years from the date of final payment under this Agreement.
3.5 General Provisions.
3.5.1 Termination of Agreement.
3.5.1.1 Grounds for Termination. City may, by written notice to Consultant, terminate the whole or any part of this Agreement at any time and without cause by giving written notice to Consultant of such termination, and specifying the effective date thereof, at least seven (7) days before the effective date of such termination. Upon termination, Consultant 55414.00000\33020133.1 - 9 -
shall be compensated only for those services which have been adequately rendered to City, and Consultant shall be entitled to no further compensation. Consultant may not terminate this Agreement except for cause.
3.5.1.2 Effect of Termination. If this Agreement is terminated as provided herein, City may require Consultant to provide all finished or unfinished Documents and Data and other information of any kind prepared by Consultant in connection with the performance of Services under this Agreement. Consultant shall be required to provide such document and other information within fifteen (15) days of the request.
3.5.1.3 Additional Services. In the event this Agreement is terminated in whole or in part as provided herein, City may procure, upon such terms and in such manner as it may determine appropriate, services similar to those terminated.
3.5.2 Delivery of Notices. All notices permitted or required under this Agreement shall be given to the respective parties at the following address, or at such other address as the respective parties may provide in writing for this purpose:
Consultant:
Interval House
6615 East Pacific Coast Highway, Suite 170
Long Beach, CA 90803
Attn: Carol Williams, Executive Director
City:
City of Stanton
7800 Katella Avenue
Stanton, CA 90680
Attn: Zenia Bobadilla, Community Services Director
Such notice shall be deemed made when personally delivered or when mailed, forty-eight (48) hours after deposit in the U.S. Mail, first class postage prepaid and addressed to the party at its applicable address. Actual notice shall be deemed adequate notice on the date actual notice occurred, regardless of the method of service.
3.5.3 Ownership of Materials and Confidentiality.
3.5.3.1 Documents & Data; Licensing of Intellectual Property. This Agreement creates a non-exclusive and perpetual license for City to copy, use, modify, reuse, or sublicense any and all copyrights, designs, and other intellectual property embodied in plans, specifications, studies, drawings, estimates, and other documents or works of authorship fixed in any tangible medium of expression, including but not limited to, physical drawings or data magnetically or otherwise recorded on computer diskettes, which are prepared or caused to be prepared by Consultant under this Agreement (“Documents & Data”). Consultant shall require all subconsultants to agree in writing that City is granted a non-exclusive and perpetual license for any Documents & Data the subconsultant prepares under this Agreement. Consultant represents and warrants that Consultant has the legal right to license any and all Documents & Data. 55414.00000\33020133.1 - 10 -
Consultant makes no such representation and warranty in regard to Documents & Data which were prepared by design professionals other than Consultant or provided to Consultant by the City. City shall not be limited in any way in its use of the Documents and Data at any time, provided that any such use not within the purposes intended by this Agreement shall be at City’s sole risk.
3.5.3.2 Confidentiality. All ideas, memoranda, specifications, plans, procedures, drawings, descriptions, computer program data, input record data, written information, and other Documents and Data either created by or provided to Consultant in connection with the performance of this Agreement shall be held confidential by Consultant. Such materials shall not, without the prior written consent of City, be used by Consultant for any purposes other than the performance of the Services. Nor shall such materials be disclosed to any person or entity not connected with the performance of the Services or the Project. Nothing furnished to Consultant which is otherwise known to Consultant or is generally known, or has become known, to the related industry shall be deemed confidential. Consultant shall not use City’s name or insignia, photographs of the Project, or any publicity pertaining to the Services or the Project in any magazine, trade paper, newspaper, television or radio production or other similar medium without the prior written consent of City.
3.5.3.3 Confidential Information. The City shall refrain from releasing Consultant’s proprietary information (“Proprietary Information”) unless the City’s legal counsel determines that the release of the Proprietary Information is required by the California Public Records Act or other applicable state or federal law, or order of a court of competent jurisdiction, in which case the City shall notify Consultant of its intention to release Proprietary Information.
Consultant shall have five (5) working days after receipt of the Release Notice to give City written notice of Consultant’s objection to the City’s release of Proprietary Information. Consultant shall indemnify, defend and hold harmless the City, and its officers, directors, employees, and agents from and against all liability, loss, cost or expense (including attorney’s fees) arising out of a legal action brought to compel the release of Proprietary Information. City shall not release the Proprietary Information after receipt of the Objection Notice unless either: (1) Consultant fails to fully indemnify, defend (with City’s choice of legal counsel), and hold City harmless from any legal action brought to compel such release; and/or (2) a final and non-appealable order by a court of competent jurisdiction requires that City release such information.
3.5.4 Cooperation; Further Acts. The Parties shall fully cooperate with one another, and shall take any additional acts or sign any additional documents as may be necessary, appropriate or convenient to attain the purposes of this Agreement.
3.5.5 Attorney’s Fees. If either party commences an action against the other party, either legal, administrative or otherwise, arising out of or in connection with this Agreement, the prevailing party in such litigation shall be entitled to have and recover from the losing party reasonable attorney’s fees and all other costs of such action.
3.5.6 Indemnification.
To the fullest extent permitted by law, Consultant shall defend (with counsel of City’s choosing), indemnify and hold the City, its officials, officers, employees, volunteers and agents free and harmless from any and all claims, demands, causes of action, costs, expenses, 55414.00000\33020133.1 - 11 -
liability, loss, damage or injury of any kind, in law or equity, to property or persons, including wrongful death, in any manner arising out of, pertaining to, or incident to any alleged acts, errors or omissions, or willful misconduct of Consultant, its officials, officers, employees, subcontractors, consultants or agents in connection with the performance of the Consultant's Services, the Project or this Agreement, including without limitation the payment of all damages, expert witness fees and attorneys fees and other related costs and expenses. Consultant's obligation to indemnify shall not be restricted to insurance proceeds, if any, received by the Consultant or the City, its officials, officers, employees, agents or volunteers.
If Consultant’s obligation to defend, indemnify, and/or hold harmless arises out of Consultant’s performance as a “design professional” (as that term is defined under Civil Code section 2782.8), then, and only to the extent required by Civil Code section 2782.8, which is fully incorporated herein, Consultant’s indemnification obligation shall be limited to claims that arise out of, pertain to, or relate to the negligence, recklessness, or willful misconduct of the Consultant, and, upon Consultant obtaining a final adjudication by a court of competent jurisdiction, Consultant’s liability for such claim, including the cost to defend, shall not exceed the Consultant’s proportionate percentage of fault.
3.5.7 Entire Agreement. This Agreement contains the entire Agreement of the parties with respect to the subject matter hereof, and supersedes all prior negotiations, understandings or agreements. This Agreement may only be modified by a writing signed by both parties.
3.5.8 Governing Law. This Agreement shall be governed by the laws of the State of California. Venue shall be in Orange County.
3.5.9 Time of Essence. Time is of the essence for each and every provision of this Agreement.
3.6 City’s Right to Employ Other Consultants. City reserves right to employ other consultants in connection with this Project.
3.7 Successors and Assigns. This Agreement shall be binding on the successors and assigns of the parties.
3.8 Assignment or Transfer. Consultant shall not assign, hypothecate, or transfer, either directly or by operation of law, this Agreement or any interest herein without the prior written consent of the City. Any attempt to do so shall be null and void, and any assignees, hypothecates or transferees shall acquire no right or interest by reason of such attempted assignment, hypothecation or transfer.
3.9 Construction; References; Captions. Since the Parties or their agents have participated fully in the preparation of this Agreement, the language of this Agreement shall be construed simply, according to its fair meaning, and not strictly for or against any Party. Any term referencing time, days or period for performance shall be deemed calendar days and not work days.
All references to Consultant include all personnel, employees, agents, and sub consultants of Consultant, except as otherwise specified in this Agreement. All references to City include its elected officials, officers, employees, agents, and volunteers except as otherwise specified in this 55414.00000\33020133.1 - 12 -
Agreement. The captions of the various articles and paragraphs are for convenience and ease of reference only, and do not define, limit, augment, or describe the scope, content, or intent of this Agreement.
3.10 Amendment; Modification. No supplement, modification, or amendment of this Agreement shall be binding unless executed in writing and signed by both Parties.
3.11 Waiver. No waiver of any default shall constitute a waiver of any other default or breach, whether of the same or other covenant or condition. No waiver, benefit, privilege, or service voluntarily given or performed by a Party shall give the other Party any contractual rights by custom, estoppel, or otherwise.
3.12 No Third Party Beneficiaries. There are no intended third party beneficiaries of any right or obligation assumed by the Parties.
3.13 Invalidity; Severability. If any portion of this Agreement is declared invalid, illegal, or otherwise unenforceable by a court of competent jurisdiction, the remaining provisions shall continue in full force and effect.
3.14 Prohibited Interests. Consultant maintains and warrants that it has not employed nor retained any company or person, other than a bona fide employee working solely for Consultant, to solicit or secure this Agreement. Further, Consultant warrants that it has not paid nor has it agreed to pay any company or person, other than a bona fide employee working solely for Consultant, any fee, commission, percentage, brokerage fee, gift or other consideration contingent upon or resulting from the award or making of this Agreement. For breach or violation of this warranty, City shall have the right to rescind this Agreement without liability. For the term of this Agreement, no member, officer or employee of City, during the term of his or her service with City, shall have any direct interest in this Agreement, or obtain any present or anticipated material benefit arising therefrom.
3.15 Equal Opportunity Employment. Consultant represents that it is an equal opportunity employer and it shall not discriminate against any subconsultant, employee or applicant for employment because of race, religion, color, national origin, handicap, ancestry, sex or age. Such non-discrimination shall include, but not be limited to, all activities related to initial employment, upgrading, demotion, transfer, recruitment or recruitment advertising, layoff or termination. Consultant shall also comply with all relevant provisions of City’s Minority Business Enterprise program, Affirmative Action Plan or other related programs or guidelines currently in effect or hereinafter enacted.
3.16 Labor Certification. By its signature hereunder, Consultant certifies that it is aware of the provisions of Section 3700 of the California Labor Code which require every employer to be insured against liability for Worker’s Compensation or to undertake self-insurance in accordance with the provisions of that Code, and agrees to comply with such provisions before commencing the performance of the Services.
3.17 Authority to Enter Agreement. Consultant has all requisite power and authority to conduct its business and to execute, deliver, and perform the Agreement. Each Party warrants 55414.00000\33020133.1 - 13 -
that the individuals who have signed this Agreement have the legal power, right, and authority to make this Agreement and bind each respective Party.
3.18 Counterparts. This Agreement may be signed in counterparts, each of which shall constitute an original.
3.19 Declaration of Political Contributions. Consultant shall, throughout the term of this Agreement, submit to City an annual statement in writing declaring any political contributions of money, in-kind services, or loan made to any member of the City Council within the previous twelve-month period by the Consultant and all of Consultant’s employees, including any employee(s) that Consultant intends to assign to perform the Services described in this Agreement.
3.20 Subcontracting.
3.20.1 Prior Approval Required. Consultant shall not subcontract any portion of the work required by this Agreement, except as expressly stated herein, without prior written approval of City. Subcontracts, if any, shall contain a provision making them subject to all provisions stipulated in this Agreement.
[Signatures on following page.]
55414.00000\33020133.1 - 14 -
IN WITNESS WHEREOF, the parties have executed this Professional Services Agreement on this ____ day of __________, 201__.
CITY OF STANTON [INSERT NAME OF CONSULTANT]
By:
___________________
City Manager
By:
Name:
Title:
[If Corporation, TWO SIGNATURES,
President OR Vice President AND Secretary,
AND CORPORATE SEAL OF
CONSULTANT REQUIRED]
ATTEST:
By:
Patricia Vazquez
City Clerk
By:
APPROVED AS TO FORM:
By:
Best Best & Krieger LLP
City Attorney
55414.00000\33020133. 1A-1
EXHIBIT “A”
SCOPE OF SERVICES
Personal Empowerment Program (Certified Domestic Violence Prevention and Treatment Education Program)
The objectives of Personal Empowerment Program (PEP) are as follows:
• Raise awareness of the various types of domestic violence and its short and long term effects; • Develop or enhance safety plan for domestic violence victims; • Increase victim’s understanding of the effects domestic violence has on children; and • Promote safety and permanency in homes and communities through prevention efforts aimed at child abuse and domestic violence.
PEP services shall be an evidence-based ten (10) week educational support program designed to help victims break the cycle of domestic violence through education on the dynamics of domestic violence, effects of violence on victims and their children, and to help victims protect children who live in domestic violence homes. Topics shall include, but not be limited to, safety planning, boundaries, anger management, legal aspects of domestic violence, working through denial, and maintaining healthy relationships.
CONTRACTOR shall provide PEP services continuously during the term of this Contract.
During the entire term of this Contract, PEP providers must be approved by the PEP Program Collaborative of Orange County.
CONTRACTOR shall offer PEP services at the FRC and other community locations at dates and times convenient for PARTICIPANTS and as approved by ADMINISTRATOR. CONTRACTOR may refer PARTICIPANTS to attend PEP services at any CONTRACTOR facilitated location that fits their language preference and schedule availability.
PEP instructors shall administer the FaCT-approved pre/post measurement tools and enter the results into the FaCT database.
CONTRACTOR shall ensure completion of required paperwork when providing PEP to PARTICIPANTS receiving child welfare services, including, but not be limited to, verification of attendance, issuance of certificates of completion, and verbal and/or written reports to COUNTY social workers.
55414.00000\33020133. 1B-1
EXHIBIT “B”
SCHEDULE OF SERVICES
CONTRACTOR shall provide PEP services to a minimum of forty-five (45) unduplicated PARTICIPANTS annually via a ten (10) week educational support program. 55414.00000\33020133. 1C-1
EXHIBIT “C”
COMPENSATION
The annual budget for services provided pursuant to Exhibit A of this Agreement is set forth in the City’s procurement of the Stanton FRC FY25-28 Agreement for the Provision of Family Resource Center Services:
Position FTE Maximum Hourly Rate Budget
PEP Instructor 0.225 $35 $16,380
PEP Instructor Benefits $4,095
Group Program Supplies $200
Indirect Costs $2,398
Total $23,073
Personal Empowerment Instructor
Duties: Provide PEP groups that are ten (10) week educational support programs covering a variety of topics designed to help victims break the cycle of domestic violence; administer the FaCT approved pre/post measurement tools and enter all required data into the FaCT database; complete paperwork when providing PEP to participants receiving child welfare services, including but not limited to verification of attendance; issuance of certificates of completion; and provide verbal and/or written reports to County social workers.
Qualifications
Option One (1): A minimum of two (2) years of experience working with domestic violence families; forty (40) hours of Domestic Violence Prevention training, eight (8) hours of Child Abuse Prevention and Reporting Training, and completion of PEP Training; experience in curriculum development, instruction/teaching experience, or training preferred; ability to communicate effectively. A valid Domestic Violence Advocate Certificate is required. Proficiency in English is required. Based on community need, bilingual proficiency may be required; or Option Two (2): Bachelor’s degree in Sociology, Human Services, Psychology, Education or related field. Minimum of one (1) year of professional experience in the Social Services sector, serving diverse communities; experience in curriculum development, instruction/teaching, or training preferred. Ability to communicate effectively. Proficiency in English is required. Based on community need, bilingual proficiency may be required. Must be California State 40-Hour Domestic Violence and Human Trafficking Training certified within six (6) months of hire.
CITY OF STANTON
REPORT TO CITY COUNCIL
TO: Honorable Mayor and Members of the City Council
DATE: April 8, 2025
SUBJECT: ORDINANCE OF THE CITY COUNCIL OF THE CITY OF STANTON, CALIFORNIA, ADDING CHAPTER 9.50 (NITROUS OXIDE AND
INHALANTS) TO TITLE 9 (PEACE, SAFETY, AND MORALS) OF THE
STANTON MUNICIPAL CODE, RELATED TO THE SALE OF NITROUS
OXIDE WITHIN THE CITY
REPORT IN BRIEF:
Orange County has seen an increase in the recreational use and abuse of nitrous oxide, an odorless, colorless chemical that can be inhaled and is often colloquially known as “laughing gas,” “NOX,” or “whippits.” Nitrous oxide is legitimately used as a pain reliever and sedative for dental and medical procedures, as a performance enhancer for cars, and as a culinary ingredient. While it is unlawful to inhale nitrous oxide recreationally or provide nitrous oxide to another when a seller knows, or should know, that the buyer intends to inhale or ingest the substance recreationally, it is prevalent in smoke shops around Orange County as sellers use a “don’t ask, don’t tell” approach. To empower local law enforcement to take additional action against irresponsible nitrous oxide sellers, the City Council will consider adopting regulations prohibiting the sale of nitrous oxide, except when sold for legitimate uses permitted under State law.
RECOMMENDED ACTION:
1. City Council find that the Ordinance is not subject to CEQA pursuant to State CEQA Guidelines section 15061(b)(3) and section 15378(b)(5); and
2. Introduce, by title only, and waive further reading of proposed Ordinance No. 1162, adding Chapter 9.50, “Nitrous Oxide and Inhalants” to Title 9 of the Stanton Municipal Code, entitled:
“AN ORDINANCE OF THE CITY COUNCIL OF THE CITY OF STANTON, CALIFORNIA, ADDING CHAPTER 9.50 (NITROUS OXIDE AND
INHALANTS) TO TITLE 9 (PEACE, SAFETY, AND MORALS) OF THE
STANTON MUNICIPAL CODE, RELATED TO THE SALE OF NITROUS
OXIDE WITHIN THE CITY”; and
3. Set second reading and adoption of Ordinance No. 1162 at the April 22, 2025, regular City Council meeting.
Item: 12B
Click here to return to the agenda.
BACKGROUND:
Earlier this year, the County of Orange Board of Supervisors adopted an ordinance to prohibit the sale of nitrous oxide in the county, except when sold for culinary use, wholesale, for use in a vehicle, for the purpose of providing medical or dental care, or by a pharmacist. Nitrous oxide is an odorless, colorless chemical that can be inhaled and is often colloquially known as “laughing gas,” “NOX,” or “whippits.” It is legitimately used as a pain reliever and sedative for dental and medical procedures, as a performance enhancer for cars, and as a culinary ingredient and tool (for example, to make whipped cream).1 However, the recreational misuse and abuse of nitrous oxide is becoming more prevalent in Orange County, partly because it is relatively inexpensive and easy to purchase from retail vendors due to loopholes in State law.
1 Arianna Johnson, What to Know About Whippets: Substance Used in Laughing Gas, Whipped Cream Growing in Popularity Among Young People, FORBES.COM, August 19, 2024, https://www.forbes.com/sites/ariannajohnson/2024/08/19/what-to-know-about-whippets-substance-used-inlaughing-gas-whipped-cream-growing-in-popularity-among-young-people/ Recreational users commonly breathe, inhale, or ingest nitrous oxide through a nozzle at the top of a nitrous oxide canister either directly into their airways, or into a balloon which can then be inhaled. Inhaling nitrous oxide can make one feel numb, sedated, giddy, dizzy, euphoric, and create a sensation of being “high.” The recreational misuse and abuse of nitrous oxide can cause permanent vitamin deficiencies in the blood, and can cause long-term neurological effects, including paralysis and death. 2 The possession and sale of nitrous oxide is currently regulated under the California Penal Code.
• It is illegal to possess nitrous oxide with the intent to breathe, inhale, or ingest the substance in order to get intoxicated under Penal Code section 381b. • It is illegal to sell, furnish, administer, distribute, or give away nitrous oxide, or offer to do so, to a person under 18 years of age under Penal Code section 381c. Also, Penal Code section 381e requires that a person dispensing or distributing nitrous oxide keep records of each transaction, available for inspection to law enforcement and employees of the California Board of Pharmacy.
• Finally, under Penal Code section 381d, a person who dispenses or distributes nitrous oxide to any person, and knows or should know that the person to whom they are dispensing or distributing nitrous oxide intends to breathe, inhale, or ingest the substance, is guilty of a misdemeanor if that person causes great bodily injury or death to themselves or another person.
Despite these regulations, the recreational misuse and abuse of nitrous oxide is on the rise. Nitrous oxide is commonly sold in smoke shops, liquor stores, and corner stores, as well as in big-box grocery stores and through online retailers. Auto body shops occasionally sell nitrous oxide systems, commonly known as “NOS,” for use in cars in order to temporarily increase engine power. To try and avoid violating State law, irresponsible sellers do not ask buyers about how they intend to use the nitrous oxide in order to argue that they had no reason to know that a buyer would breathe, inhale, or ingest the substance. This “don’t ask, don’t tell” practice makes it difficult for law enforcement and the Orange County District Attorney to arrest and prosecute alleged violators, because State law places the burden of proof on an agency to show that sellers knew, or should have known, that a buyer intended to use the substance recreationally.3 Additionally, the buyer must have caused great bodily injury or death to themselves or another person in order for a seller to be liable under state statute; simply selling the substance, even if a seller knows the buyer intends to use it recreationally, is not a violation of state law.
2 Drug Fact Sheet: Inhalants, DEPARTMENT OF JUSTICE/DRUG ENFORCEMENT ADMINISTRATION, https://www.dea.gov/sites/default/files/2025-01/Inhalants-Drug-Fact-Sheet.pdf 3 Gigi Gradillas, Orange County Supervisors Look to Ban Whippets, VOICE OF OC, December 9, 2024, https://voiceofoc.org/2024/12/orange-county-supervisors-look-to-ban-whippets/ When sold wholesale, for auto use, or for medical use, nitrous oxide is commonly sold in tanks which resemble oxygen tanks. When sold for culinary use, nitrous oxide is often sold in small chargers labeled as “food grade” which are then loaded into a canister designed for whipping liquids. However, Public Safety Services staff have observed a rise in the number of colorful nitrous oxide canisters with names such as “Galaxy Gas,” in amounts that are incompatible for wholesale, auto, or medical use. Additionally, Public Safety Services staff have observed flavored canisters which, while marketed for culinary use, are not designed as chargers compatible for commonly used culinary whipping canisters (Attachment B).
4 Staff have seen firsthand canisters for sale at almost all of the smoke shops in the City, in addition to at some liquor stores. While it appears highly likely that these nitrous oxide canisters are being sold for recreational use, staff has struggled to take action against irresponsible sellers due to the “don’t ask, don’t tell” loophole in state law.5
ANALYSIS:
The proposed ordinance mirrors the County’s ordinance regulating nitrous oxide and has been modified for the City’s municipal code.
The proposed ordinance would prohibit the sale of nitrous oxide, a devise to dispense or administer nitrous oxide, or any device that contains any quantity of nitrous oxide, except when sold:
• For culinary use;
• For medical and dental use;
• Wholesale;
• For use in a vehicle to enhance performance;
• By a pharmacy or pharmacist; or
• For any other use permitted by law.
These regulations are proposed pursuant to the City’s police power and are designed to place additional responsibility on sellers to close the “don’t ask, don’t tell” loophole in State law.
Under the proposed ordinance, a seller would not need to know that a buyer intends to breathe, inhale, or ingest nitrous oxide in order to violate the proposed ordinance. Instead, a seller would be required to prove that they are selling nitrous oxide for legitimate, legally permitted uses. Additionally, a seller may be liable under the proposed ordinance even if a buyer did not cause great bodily harm or death to themselves or another. The ordinance would allow local public safety staff and law enforcement to crack down on the sale of nitrous oxide in quantities, containers, and flavors that have no reasonable, legally permitted use.
4 Amogh Dimri, The Illegal Drug at Every Corner Store, THE ATLANTIC, February 3, 2025, https://www.theatlantic.com/ideas/archive/2025/02/nitrous-oxide-drug-loophole/681532/?utm_source=copylink&utm_medium=social&utm_campaign=share 5 See, The Illegal Drug at Every Corner Store, THE ATLANTIC, February 3, 2025.
Violations of the proposed ordinance would be a misdemeanor punishable by a fine of up to $1,000 or imprisonment in County Jail for not more than 6 months, or both. The ordinance would not prevent the City from pursuing other legal remedies or actions, such as administrative citations and civil actions. Additionally, a violation of the ordinance would be grounds for revocation of a business license pursuant to the requirements and processes of Chapter 5.04 of the Stanton Municipal Code.
FISCAL IMPACT:
There is no fiscal impact associated with the recommended action.
ENVIRONMENTAL IMPACT:
The proposed action is not subject to the California Environmental Quality Act (“CEQA”) pursuant to State CEQA Guidelines Section 15061(b)(3) in that the proposed Ordinance is not anticipated to result in a direct or reasonably foreseeable indirect physical change in the environment, nor will the proposed changes have the potential for causing a significant effect on the environment. Additionally, the proposed action is not a “project” under State CEQA Guidelines Section 15378(b)(5), which excludes the “organizational or administrative activities of governments that will not result in direct or indirect physical changes in the environment,” as the proposed Ordinance is not anticipated to result in a direct or indirect physical change in the environment.
PUBLIC NOTIFICATION:
Notification and advertisement were performed as prescribed by law.
STRATEGIC PLAN OBJECTIVES:
Obj. No. 1: Provie a safe community.
Obj. No. 5: Provide a high quality of life.
Prepared by: HongDao Nguyen, City Attorney
Approved by: Hannah Shin-Heydorn, City Manager
ATTACHMENTS:
A. Ordinance No. 1162
B. Amogh Dimri, The Illegal Drug at Every Corner Store, THE ATLANTIC, February 3, 2025, https://www.theatlantic.com/ideas/archive/2025/02/nitrous-oxide-drugloophole/681532/?utm_source=copy-link&utm_medium=social&utm_campaign=share ORDINANCE NO. 1162
PAGE 1 OF 6
ORDINANCE NO. 1162
AN ORDINANCE OF THE CITY COUNCIL OF THE CITY OF STANTON, CALIFORNIA, ADDING CHAPTER 9.50 (NITROUS OXIDE AND INHALANTS) TO TITLE 9 (PEACE,
SAFETY, AND MORALS) OF THE STANTON MUNICIPAL CODE, RELATED TO THE
SALE OF NITROUS OXIDE WITHIN THE CITY
WHEREAS, the City of Stanton, California (“City”) is a municipal corporation, duly organized under the constitution and laws of the State of California, authorized under its police powers to make and enforce within its limits all local, police, sanitary, and other ordinances and regulations not in conflict with general laws; and WHEREAS, nitrous oxide is an odorless, colorless chemical that can be inhaled for legitimate purposes associated with medical or dental procedures in a clinical setting, and is legitimately used for industrial purposes and as a propellant for food products; and WHEREAS, nitrous oxide is also subject to recreational misuse and abuse, in part, because it is easy to purchase from retail vendors and relatively inexpensive; and WHEREAS, the recreational misuse and abuse of nitrous oxide can cause permanent vitamin deficiencies in the blood, and can cause long-term neurological effects, including paralysis and death; and
WHEREAS, possession of nitrous oxide with the intent to breathe, inhale, or ingest for the purpose of causing intoxication is a misdemeanor pursuant to California Penal Code section 381b; and
WHEREAS, selling, furnishing, administering, distributing, or giving away nitrous oxide, or offering to do so, to a person under 18 years of age is a misdemeanor offense under California Penal Code section 381c. Additionally, a person who dispenses or distributes nitrous oxide to any person, and knows or should know that the person to whom they are dispensing or distributing nitrous oxide intends to breathe, inhale, or ingest the substance, is guilty of a misdemeanor if that person causes great bodily injury or death to themselves or another person, under California Penal Code section 381d; and WHEREAS, California Penal Code section 381e also requires that a person dispensing or distributing nitrous oxide maintain a record of each transaction, signed by the purchaser, and make such records available for inspection to law enforcement and employees of the California Board of Pharmacy; and
WHEREAS, despite state regulation of the sale and use of nitrous oxide, sellers who know or should know that their customers purchasing nitrous oxide intend to breathe, inhale, or ingest the substance, continue to sell nitrous oxide using a “don’t ask, don’t tell” approach. Often, the amounts of nitrous oxide being sold are too small for legitimate medical, industrial, or culinary use. Nitrous oxide is also sold in colorful canisters with names such as “Galaxy Gas,” which come in a variety of flavors; and Attachment: A
Click here to return to the agenda.
ORDINANCE NO. 1162
PAGE 2 OF 6
WHEREAS, the rise in recreational abuse and misuse of nitrous oxide, as well as the “don’t ask, don’t tell” approach of sellers, has been documented by the County of Orange in its October 29, 2024 Investigative Hearing on substance abuse, public hearings held by the County of Orange Board of Supervisors on February 11, 2025 and February 25, 2025, and national publications such as The Atlantic1 and Los Angeles Times2; and WHEREAS, on February 25, 2025, the County of Orange Board of Supervisors adopted Ordinance No. 25-004, adding Division 19 to Title 3 of the Codified Ordinances of the County of Orange to prohibit the sale of nitrous oxide in the county, except when sold for culinary use, wholesale, for use in a vehicle, for the purpose of providing medical or dental care, or by a pharmacist. The ordinance was supported by Orange County District Attorney Todd Spitzer, the Orange County Sheriff’s Department, and the Costa Mesa Police Department; and
WHEREAS, the City does not currently regulate the sale of nitrous oxide and finds and declares that in the absence of local regulation, nitrous oxide remains subject to significant risk of misuse and abuse through sale to individuals who intend to misuse or abuse the product; and
WHEREAS, City staff have seen nitrous oxide for sale at the majority of smoke shops within the City as well as some liquor stores; and
WHEREAS, the City desires to similarly regulate the sale of nitrous oxide in order to preserve and protect public health and to dissuade sellers of nitrous oxide products from selling to individuals which they know or have reason to know intend to use the products for illegal purposes (i.e., recreational ingestion and/or inhalation); and WHEREAS, on April 8, 2025, the City Council considered the staff report, recommendations by staff and the City Attorney, and public comment regarding the adoption of Chapter 9.50 related to the sale of nitrous oxide within the City; and WHEREAS, all other legal prerequisites to the adoption of this Ordinance have occurred.
NOW, THEREFORE, THE CITY COUNCIL OF THE CITY OF STANTON, CALIFORNIA, DOES RESOLVE, DECLARE, DETERMINE AND ORDER AS FOLLOWS:
SECTION 1: The foregoing Recitals are true and correct and are incorporated herein by this reference.
SECTION 2: Chapter 9.50 is added to Title 9 (Peace, Safety, and Morals) of the Stanton Municipal Code to read in its entirety as follows:
1 Amogh Dimri, The Illegal Drug at Every Corner Store, THE ATLANTIC, February 3, 2025, https://www.theatlantic.com/ideas/archive/2025/02/nitrous-oxide-drug-loophole/681532/?utm_source=copylink&utm_medium=social&utm_campaign=share 2 Sara Cardine, Costa Mesa Police Bust 2 Smoke Shops for Nitrous Oxide Sales, As County Supports Ban, LOS ANGELES TIMES, February 21, 2025, https://www.latimes.com/socal/daily-pilot/news/story/2025-02-21/costa-mesapolice-bust-2-smoke-shops-for-nitrous-oxide-sales-as-county-supports-ban ORDINANCE NO. 1162
PAGE 3 OF 6
“CHAPTER 9.50 NITROUS OXIDE AND INHALANTS
§ 9.50.010 – Authority and Purpose
§ 9.50.020 – Definitions
§ 9.50.030 – Prohibition on Sale or Distribution of Nitrous Oxide § 9.50.040 – Exceptions to Prohibition
§ 9.50.050 – Violations and Penalties
§ 9.50.060 – Severability
§ 9.50.010 – Authority and Purpose
This article is enacted pursuant to the City's plenary police powers to protect the public safety, health and welfare. The express purpose of this article is to protect the public health and safety by eliminating retail access for recreational use of nitrous oxide, a dangerous gas that is illicitly used as an intoxicant, and other unsafe inhalants. § 9.50.020 – Definitions
For purposes of this article, the following definitions apply.
A. "Device” means any cartridge, compressed gas cylinder, apparatus, container, balloon, attachment, nozzle, or other object used to contain, dispense or administer nitrous oxide.
B. “Nitrous oxide” means the colorless nonflammable gas sometimes identified as N2O, which is sometimes used in aerosols and sometimes used as an anesthetic, and which, when inhaled, produces loss of sensibility to pain, often preceded by exhilaration and laughter and often used as an anesthetic in dentistry. Nitrous oxide is often informally or colloquially referred to as “laughing gas,” “NOX,” “galaxy gas,” “whippits,” amongst others.
C. “Person” means any individual or legal entity however constituted or organized.
D. “Wholesale capacity” means sale of or distribution of nitrous oxide or a device to dispense nitrous oxide to a person that will use nitrous oxide or the device in service or products for resale. Examples include, but are not limited to, commercial sale of dentistry supplies to dentists or dentistry offices, commercial sale of devices for the use in food production or in a commercial kitchen, and/or commercial sale of nitrous oxide for the purpose of producing food
products for commercial sale (e.g., whipped cream canisters).
ORDINANCE NO. 1162
PAGE 4 OF 6
§ 9.50.030 – Prohibition on Sale or Distribution of Nitrous Oxide Except as otherwise authorized by law or allowed under this article, it is unlawful for any person to sell, attempt to sell, offer for sale, permit to be sold, display for sale, distribute or otherwise provide to any person nitrous oxide, a device to dispense or administer nitrous oxide, or any device that contains any quantity of nitrous oxide. § 9.50.040 – Exceptions to Prohibition
This article does not apply to the sale, attempt to sell, offer for sale, permit to be sold, display for sale, distribution, or any other manner of providing nitrous oxide, or a device containing nitrous oxide, in the following circumstances:
A. If the nitrous oxide is contained in a food product for use as a propellant.
B. If the nitrous oxide or device is being sold, attempted to be sold, offered, or distributed in a wholesale capacity, for uses similar to those described in subsection (D) of section 9.50.020. This exemption only applies if the wholesaler does not know or have reason to know that the recipient intends to use the nitrous oxide or device in violation of section 9.50.030.
C. If the nitrous oxide or device that is being sold, attempted to be sold, offered, or distributed is specifically designed for use in a vehicle to enhance the performance of the vehicle.
D. If the nitrous oxide is being sold, attempted to be sold, offered, or distributed specifically for the purpose of providing medical or dental care, by or at the direction and under the supervision of, a medical or dental practitioner licensed by the State of California and in accordance with all applicable rules and regulations.
E. If the nitrous oxide or device is being sold, attempted to be sold, offered, distributed, or dispensed by a pharmacist, pharmacist intern, or pharmacy as defined by California Business & Professions Code §§ 4030, 4036, and 4037, as may be amended, in the course of their duties as a pharmacist or pharmacist intern, or wholesalers licensed by the Board of Pharmacy.
F. Any other circumstances exempted under law.
§ 9.50.050 – Violations and Penalties
Any person who violates section 9.50.030 is guilty of a misdemeanor and upon conviction thereof may be punished by a fine of not more than one thousand dollars ($1,000.00) or by imprisonment in the County Jail for a period of not more than six (6) months or by both such fine and imprisonment. This section shall not serve to limit any other legal remedies or actions that the City may have to address violations of section 9.50.030. A violation of section 9.50.030 is grounds for a revocation of a business license, if applicable, pursuant to section 5.04.206 of the Stanton Municipal Code.
ORDINANCE NO. 1162
PAGE 5 OF 6
§ 9.50.060 – Severability
If any section, paragraph, sentence, clause, phrase or portion of this article is held invalid or unconstitutional by any court of competent jurisdiction, such portion shall be deemed severable and such holding shall not affect the validity of the remaining portions hereof.
The City Council hereby declares that it would have adopted this article irrespective of the invalidity of any particular portion thereof and intends that the invalid portions should be severed, and the balance of the article be enforced.” SECTION 3: CEQA. This Ordinance is exempt from the California Environmental Quality Act (“CEQA”) pursuant to State CEQA Guidelines Section 15061(b)(3) in that the proposed Ordinance is not anticipated to result in a direct or reasonably foreseeable indirect physical change in the environment, nor will the proposed changes have the potential for causing a significant effect on the environment. Additionally, the City Council finds that the proposed Ordinance is not a “project” under State CEQA Guidelines Section 15378(b)(5), which excludes the “organizational or administrative activities of governments that will not result in direct or indirect physical changes in the environment,” as the proposed Ordinance is not anticipated to result in a direct or indirect physical change in the environment.
SECTION 4: Severability. If any section, subsection, subdivision, sentence, clause, phrase, or portion of this Ordinance for any reason is held to be invalid or unconstitutional by the decision of any court of competent jurisdiction, such decision shall not affect the validity of the remaining portions of this Ordinance. The City Council hereby declares that it would have adopted this Ordinance, and each section, subsection, subdivision, sentence, clause, phrase, or portion thereof, irrespective of the fact that any one or more sections, subsections, subdivisions, sentences, clauses, phrases, or portions thereof be declared invalid or unconstitutional.
SECTION 5: Effective Date. This Ordinance No. 1162 shall be effective 30 days after its adoption.
SECTION 6: Publication. The City Clerk shall certify as to the adoption of this Ordinance and shall cause a summary thereof to be published within fifteen (15) days of the adoption and shall post a Certified copy of this Ordinance, including the vote for and against the same, in the Office of the City Clerk, in accordance with Government Code Section 36933.
PASSED, APPROVED, AND ADOPTED this 22nd day of April, 2025. ______________________________________
DAVID J. SHAWVER, MAYOR
ORDINANCE NO. 1162
PAGE 6 OF 6
ATTEST:
PATRICIA A. VAZQUEZ, CITY CLERK
APPROVED AS TO FORM:
HONGDAO NGUYEN, CITY ATTORNEY
STATE OF CALIFORNIA )
COUNTY OF ORANGE ) ss.
CITY OF STANTON )
I, Patricia A. Vazquez, City Clerk of the City of Stanton, California, do hereby certify that the foregoing Ordinance No. 1162 was introduced at a regular meeting of the City Council of the City of Stanton, California, held on the 8th day of April, 2025 and was duly adopted at a regular meeting of the City Council held on the 22nd day of April, 2025, by the following roll-call vote, to wit:
AYES: COUNCILMEMBERS:
NOES: COUNCILMEMBERS:
ABSENT: COUNCILMEMBERS:
ABSTAIN: COUNCILMEMBERS:
PATRICIA A. VAZQUEZ, CITY CLERK
More From The New Rules Explore This Series
IDEAS
The Illegal Drug at Every Corner Store
Nitrous oxide is widely available as long as everyone pretends it’s being used for whipped cream. An industry has arisen to exploit that loophole.
By Amogh Dimri
Illustration by The Atlantic. Source: Getty.
FEBRUARY 3, 2025 SHARE SAVE
Sign In Subscribe
Attachment: B
Click here to return to the agenda.
T
- 1.0x +
11:04
Listen
0:00
Produced by ElevenLabs and News Over Audio (Noa) using AI narration. Listen to more stories on the Noa app.
o judge by the shelves of America’s vice merchants, the nation is in the grips of a whipped-cream frenzy. Walk into any vape store or sex shop, and you’ll find canisters of nitrous oxide showcased in window displays—ostensibly to catch the eye of bakers and baristas, who use the gas to aerate creams and foams. At the bodega near my apartment, boxes of up to 100 mini-canisters are piled up to eye level, next to Baby Yoda bongs.
In fact, culinary professionals generally don’t shop for equipment at stores with names like Puff N Stuff or Condom Sense. The true clientele inhales the gas to get high. A dangerous and technically illegal drug, nitrous oxide is widely available as long as everyone pretends it’s destined for use as a food product. Indeed, a whole industry appears to have built its business model around exploiting this loophole. Large distributors brand and flavor nitrous in ways that attract young inhalers, stock it with retailers catering to other vices, and sell it in quantities that are implausible for N
culinary use but ideal for huffing. The gas can even be ordered from Walmart, Amazon, and eBay. Without meaningful regulation, getting high on nitrous will remain as convenient as picking up a bag of chips.
itrous oxide has been recreationally inhaled since the 1800s. It induces a euphoric head rush and tingling in the user’s fingers and toes, often followed by giddy laughter. Almost as soon as it starts, it’s over. The effects of a single hit typically last for less than a minute.
The modern version of the drug, known colloquially as a “whippet” or “whip-it,” has recently climbed the youth-popularity ranks. (These products are distinct from the Reddi-Wip cans found at the supermarket, which contain cream and nitrous oxide together. The canisters proliferating now contain the gas alone.) Although pandemicera lockdown protocols hampered illicit drugs’ supply chains, nitrous oxide remained broadly available by comparison. In 2018, about 12.5 million Americans over age 12 reported having ever used it, a number that rose to nearly 14 million in 2022. Social media is full of clips of young people ripping hits before falling on their faces (so much so that TikTok eventually banned nitrous-related search terms). Fans of the drug have created gas-tank accessories in the video game Roblox; one rapper’s song “Whippet” features him and his entourage ripping hits of nitrous from tanks tucked in their waistbands between verses. A recent Columbia graduate told me that, back in college, one friend’s birthday party featured a salad bowl “full to the brim” with used nitrous canisters. (He spoke on condition of anonymity in order to discuss illegal drug use.)
Malcolm Ferguson: Marijuana is too strong now
As you might imagine, depriving your brain of oxygen in favor of laughing gas is not wise. Heavy nitrous users can suffer severe health consequences, including, occasionally, death. Varun Vohra, an emergency-medicine professor at Wayne State University, in Detroit, told me that heavy users experience symptoms including irregular walking, bodily weakness, and severe limb pain. (Nitrous-oxide-related emergency-room visits in Michigan more than doubled from 2022 to 2023.) Inhaling the gas deactivates vitamin B12, which harms nerves in the brain and the spinal cord.
Among chronic users, this can eventually induce paralysis. Users also report depression, anxiety, mood swings, and even hallucination. A senior at Tulane University, who also spoke on condition of anonymity, told me that he’d quit the drug after one night when he took a deep inhale and blacked out. He awoke on the floor a few seconds later, unable to remember what had happened; his friends told him he’d had a seizure.
Perhaps the greatest danger arises from what people do while huffing the drug. Ed Scott, a city-council member in Rialto, California, told me that his son, Myles, died in a car accident after his friend inhaled the gas while driving and passed out at the A
RECOMMENDED READING
wheel. This inspired Scott to investigate the drug’s use in California. He told me that he found many other fatal car accidents in which nitrous-oxide products were discovered at crash sites but police—who thought they were helium canisters—did not register the crashes as DUIs.
Given the health and safety risks, the sale and use of nitrous oxide for recreational purposes is technically illegal. The key word here is technically. Businesses can generally get away with selling nitrous oxide over the counter as long as they say it’s for culinary use—and pretend not to know what customers are really doing with it. (Some states prohibit sales to anyone under 21 or 18.) If, that is, they even bother pretending. The Tulane senior told me that the clerks at his local smoke shop greeted him with shouts of “whip-it boy!” when he visited to restock. major industry has grown out of the regulatory vacuum. In 2020, Marissa Politte’s family sued United Brands, the Silicon Valley–based company that distributes the brand Whip-It!, after she was killed by an unconscious nitrous-huffing driver. Documents revealed by the lawsuit suggest that the players involved know they’re benefiting from a legal loophole. A former warehouse employee estimated that three-quarters of United Brands’ customers were smoke shops, not bakeries or cafés. The client list named retailers including Mary Jane’z Novelties, Herban Legend Smoke Shop, Smoke 420, and Precious Slut 1. In a seven-year span, documents show, the company sold about 52,000 “chargers,” or miniature nitrous capsules, to Kaldi’s Coffee—and more than 1 million to the It’s A Dream smoke shop.
Internal emails between United Brands
and retailers, uncovered by the lawsuit,
suggest a certain cynicism around legal
compliance. One United Brands
employee emailed a retailer requesting
that the Whip-It! chargers “are used
properly and legally.” The retailer
responded: “yah man we know the deal
we put a disclaimer… you know we all
When Are You Really an
Adult?
JULIE BECK
got to cover our asses, better safe than
sorry.” (United Brands did not respond
to multiple requests for comment.)
Meanwhile, many other companies
market nitrous in ways that seem
conspicuously ill-tailored to professional
pastry chefs. A variety of gas tanks are
sold with names that evoke marijuana
strains, not whipped cream—Monster
Gas (slogan: “Become easy, Become happy!”), Hippie Whippy, Baking Bad, Cosmic Gas—and in flavors such as mango smoothie and tropical punch. Colorful labels feature fruits, unicorns, women in bathing suits, or sports cars. (Hervé Malivert, the director of culinary affairs at the Institute of Culinary Education, told me that many food professionals are loyal to iSi chargers, which they order from the company’s website—not at a gas station. Malivert said he has never heard of a chef using flavored gas or gas tanks.)
One of the most prominent nitrous companies is Galaxy Gas, which was founded in 2021 by three brothers who ran Cloud 9, an Atlanta-based smoke-shop chain. A Cloud 9 executive told New York magazine that Galaxy Gas at one time made up nearly 30 percent of all nitrous sales nationwide. Asked by CBS to explain why Three Theories for Why
You Have No Time
DEREK THOMPSON
The Life in The Simpsons Is
No Longer Attainable
DANI ALEXIS RYSKAMP
anyone would need to buy a tank with enough nitrous oxide to make thousands of servings of whipped cream, a Galaxy Gas spokesperson claimed that the product was for customers seeking an “erotic culinary lubricant.” (The company’s rising profile in the world of whip-its has brought legal scrutiny. According to New York, its trademark was recently sold for $1 to a newly registered corporate owner, and it has paused direct sales. Galaxy Gas did not respond to requests for comment.) Mike Riggs: Congress accidentally legalized weed six years ago In response to the spread of nitrous-oxide use, states and the federal government have begun taking steps toward more effective regulation. The most notable example is Louisiana, where the drug used to be outlawed only if sold for the purpose of being inhaled. Legislation enacted last May made its sale presumptively illegal, with carveouts for genuine industrial and culinary use. Jeanette Brick, the president of iSi North America, told me that her company does not oppose the Louisiana law. “These laws are intended to prevent misuse, and they have not negatively impacted our ability to serve the culinary community in the state,” she said in an email. She also noted that “iSi does not sell large tanks of nitrous oxide, as they have no culinary application and are increasingly associated with misuse. We strongly advocate for additional restrictions on these large tanks to help curb their growing misuse among teenagers.”
Outside Louisiana, however, legislative efforts have yet to deliver significant change.
In 2017, for example, then–California State Senator Jim Nielsen proposed a bill to ban nitrous-oxide sales in stores selling tobacco or tobacco-related products. Industry lobbyists opposed the bill, and it eventually failed to pass.
In the absence of effective regulation, litigation has emerged as the best tool to achieve accountability. In 2023, a Missouri jury found United Brands liable for conspiring to sell nitrous oxide as a drug. The company was ordered to pay $720 million to Marissa Politte’s family for her wrongful death. The novel jury verdict and the large courtmandated payout might set a lasting precedent. “You have companies whose full-time scheme it is to pour this stuff onto our streets,” Johnny Simon, the Politte family’s attorney, told me. “That’s who we need to go after.”
Still, case-by-case litigation can push only so hard against countervailing market forces. Nor should it have to, when the blueprint for lifesaving regulation exists. Had something like Nielsen’s California bill been federal law in 2020, Politte might still be alive. The driver who killed her bought his nitrous oxide from a smoke shop.
Support for this project was provided by the William and Flora Hewlett Foundation.
ABOUT THE AUTHOR
Explore More Topics
California, Louisiana, Michigan
Amogh Dimri
Amogh Dimri is an assistant editor at The Atlantic.
CITY OF STANTON
REPORT TO CITY COUNCIL
TO: Honorable Mayor and Members of the City Council
DATE: April 8, 2025
SUBJECT: CONSIDERATION OF AN ORDINANCE RELATED TO SOCIAL HOST
LIABILITY FOR ILLEGAL FIREWORKS AND ADMINISTRATIVE
CITATIONS
REPORT IN BRIEF:
The City currently regulates the sale, storage, and discharge of fireworks within the City, consistent with State Fireworks Law (Health & Safety Code § 12500 et seq.) and guidance from the State Fire Marshall under Chapter 17.04 of the Stanton Municipal Code. In order to allow law enforcement and City code enforcement to better enforce Chapter 17.04, the City desires to adopt “social host” regulations, which would make a property owner or a person in control of property on which fireworks are sold, stored, or discharged in violation of Chapter 17.04 strictly liable for the illegal sale, storage, or discharge. The proposed ordinance would also revise the City’s administrative citations regulations regarding notice requirements.
RECOMMENDED ACTION:
1. City Council declare that the project is not subject to CEQA pursuant to State CEQA Guidelines section 15061(b)(3) and section 15378(b)(5); and
2. Introduce, by title only, and waive further reading of proposed Ordinance No. 1163, entitled:
“AN ORDINANCE OF THE CITY COUNCIL OF THE CITY OF STANTON, CALIFORNIA, AMENDING CHAPTER 1.12 (ADMINISTRATIVE CITATIONS) OF TITLE 1 (GENERAL PROVISIONS) RELATED TO SERVICE OF
CITATIONS AND CHAPTER 17.04 (SAFE AND SANE FIREWORKS) OF TITLE 17 (FIRE) OF THE STANTON MUNICIPAL CODE, RELATED TO SOCIAL HOST LIABILITY AND ILLEGAL FIREWORKS”; and
3. Set the Ordinance for second reading and adoption at the April 22, 2025, regular meeting of the City Council.
Item: 12C
Click here to return to the agenda.
BACKGROUND:
The City currently regulates the sale, storage, and discharge of fireworks within the City under Chapter 17.04, “Safe and Sane Fireworks,” of the Stanton Municipal Code, consistent with State Fireworks Law (Health & Safety Code § 12500 et seq.) and guidance from the State Fire Marshall. Under Chapter 17.04, “safe and sane” fireworks may be discharged between July 1 and July 4 between 10 AM and 11 PM. The City also restricts who may sell fireworks and requires fireworks sellers to obtain a license to sell from the City and abide by certain terms and conditions of the license, including restrictions on when, where, and what types of fireworks may be sold.
Under the Chapter, it is unlawful for any person, firm, or corporation to use or discharge any fireworks under the following circumstances:
• “Safe and sane” fireworks outside of July 1 through July 4 between 10 AM and 11 PM;
• “Dangerous fireworks,” as defined in Part 2 of Division 11 of the California Health and Safety Code, at any time (except with valid pyrotechnic license); • In violation of any block party permit;
• On any public property without a block party permit;
• On any property within a commercial district of the City, except on residential use; and
• On any property within an industrial/manufacturing district of the City, except on residential use.
Violations of the Chapter constitute a misdemeanor. In addition to, or in lieu of, prosecuting violations of the Chapter as a misdemeanor, any person, firm or corporation violating the provisions of the Chapter may be issued an administrative citation. The amount of the citation depends on the severity of the violation – for example, whether “safe or sane” fireworks were discharged, or whether “dangerous” fireworks were discharged. Additionally, citations for storing, selling, displaying, and/or possessing “dangerous” fireworks increase depending on the amount of “dangerous” fireworks stored, sold, displayed, or possessed.
Pursuant to Government Code section 53069.4, Health and Safety Code section 12557, and the City's police power, the City has adopted heightened administrative fines due to the severe public health and safety concerns associated with the illegal discharge of fireworks, including the serious threat of fire or injury.
ANALYSIS/JUSTIFICATION:
The use of illegal fireworks up to, and following the Fourth of July holiday, continues to generate concerns for Stanton residents and businesses. Each year, illegal fireworks are associated with serious injuries and property damage, including fires, severe burns, amputations, and occasionally, deaths. Additionally, the loud noises generated by illegal fireworks impact the quality of life of residents, particularly infants, small children, the elderly, pets, and those who suffer from post-traumatic stress disorder.
Following the Fourth of July holiday, the Orange County Fire Authority (OCFA) annually gathers data to analyze the overall impact of fireworks throughout Orange County.
According to the “2024 Independence Day After Action Report” prepared by the OCFA:
• County-wide injuries associated with fireworks increased by 43% from 2023; • 32% of county-wide fireworks-related injuries were due to dangerous fireworks while 1% of injuries were due to safe and sane fireworks; • Most reported injuries within Orange County were burns to the hands and/or fingers. There were an astonishing 9 reported hand/finger amputations in 2024 that were caused by illegal mortars (four were for minors);
• County-wide fireworks-related property loss in 2024 increased exponentially at a reported $1,622,300 (an almost 800% increase from 2023); and • There were 4 homes that caught fire due to fireworks in Santa Ana, Lake Forest, Westminster, and Mission Viejo.
Law enforcement and code enforcement face challenges adequately identifying and citing violators associated with illegal, “dangerous” fireworks, which are defined by the State.
The City’s current regulations do not hold property owners responsible for the sale or discharge of fireworks on their property if the property owner is not also the person actually selling or discharging the fireworks.
To increase enforcement mechanisms to address the increasing prevalence of injury and property damage associated with illegal fireworks, the proposed Ordinance would implement “social host” regulations. Those regulations would impose strict liability on a property owner or person in charge of a property when illegal fireworks are sold, possessed, ignited, exploded, or projected from the property. Meaning, the property owner or person controlling the property would be legally responsible even if the person had no intent or knowledge of the violation or otherwise acted negligently.
The Ordinance provides that each violation of the social host regulations would be treated as a separate and distinct offense and would be subject to a separate penalty. For example, if five dangerous fireworks were found to have been sold, possessed, ignited, exploded, projected, fired, or otherwise used at the same property on the same day, the property owner or person in control of the property may be subject to five separate penalties.
Each offense related to dangerous fireworks and social host liability would incur a $1,000 fine. Each offense for safe and sane fireworks and social host liability would begin at a $100 fine, then $200 for a second offense, then $500 for a third and subsequent offenses.
This difference in penalty amounts is due to the exponential risks associated with dangerous fireworks, their threat to property and life, and the City’s compelling interest in protecting the public health, welfare, and safety against those risks.
Additionally, the Ordinance would amend SMC section 1.12.050, “Service Procedures,” to remove the requirement that any notice, notice of violation, or administrative citation must be served via personal service. Instead, any notice, notice of violation, or administrative citation may be served via personal service or certified mail. This amendment would allow the City to demonstrate that service has been met in instances where a violation of Chapter 17.04 has occurred without the property owner or the person in charge of the property having been present – for example, when the property is being rented, house-sat, or when the owners are otherwise not home at the time of the violation.
FISCAL IMPACT:
The fiscal impact of enforcing the proposed ordinance, if approved, is unknown at this time. The recommended action may result in a modest increase in revenues to the City, particularly in the months following the adoption of the proposed ordinance as the City begins citing violators and collecting administrative citations. However, it is staff’s hope that as the City enforces the proposed regulations, property owners will bring themselves into compliance with the Municipal Code and violations will decrease.
ENVIRONMENTAL IMPACT:
The proposed action is not subject to the California Environmental Quality Act (“CEQA”) pursuant to State CEQA Guidelines Section 15061(b)(3) in that the proposed Ordinance is not anticipated to result in a direct or reasonably foreseeable indirect physical change in the environment, nor will the proposed changes have the potential for causing a significant effect on the environment. Additionally, the proposed action is not a “project” under State CEQA Guidelines Section 15378(b)(5), which excludes the “organizational or administrative activities of governments that will not result in direct or indirect physical changes in the environment,” as the proposed Ordinance is not anticipated to result in a direct or indirect physical change in the environment.
PUBLIC NOTIFICATION:
Notifications were performed through the normal agenda process.
STRATEGIC PLAN OBJECTIVE:
Obj. No. 1: Provide a safe community.
Prepared by: HongDao Nguyen, City Attorney
Approved by: Hannah Shin-Heydorn, City Manager
ATTACHMENT:
A. Ordinance No. 1163
ORDINANCE NO. 1163
PAGE 1 OF 7
ORDINANCE NO. 1163
AN ORDINANCE OF THE CITY COUNCIL OF THE CITY OF STANTON, CALIFORNIA, AMENDING CHAPTER 1.12 (ADMINISTRATIVE CITATIONS) OF TITLE 1 (GENERAL PROVISIONS) RELATED TO SERVICE OF CITATIONS AND CHAPTER 17.04 (SAFE AND SANE FIREWORKS) OF TITLE 17 (FIRE) OF THE STANTON MUNICIPAL CODE,
RELATED TO SOCIAL HOST LIABILITY AND ILLEGAL FIREWORKS
WHEREAS, the City of Stanton, California (“City”) is a municipal corporation, duly organized under the constitution and laws of the State of California, authorized under its police powers to make and enforce within its limits all local, police, sanitary, and other ordinances and regulations not in conflict with general laws; and WHEREAS, the City may enact an ordinance regulating fireworks within its jurisdiction that is compatible with the State Fireworks Law (Health & Safety Code, § 12500 et seq.); and
WHEREAS, the City currently regulates fireworks pursuant to Chapter 17.04 of the Stanton Municipal Code. Chapter 17.04 has been periodically updated to reflect changes in state law and guidance from the State Fire Marshall; and WHEREAS, the City Council has identified the discharge of illegal fireworks as a nuisance, and finds that there should be an increase in enforcement and penalties for the discharge of illegal fireworks; and
WHEREAS, each year following the Fourth of July holiday, the Orange County Fire Authority (“OCFA”) gathers data to analyze the overall impact of fireworks throughout Orange County. According to the “2024 Independence Day After Action Report” prepared by OCFA, County-wide injuries associated with fireworks increased by 43 percent from 2023. Thirty-two percent of County-wide fireworks-related injuries were due to dangerous fireworks, while 1 percent of injuries were due to safe and sane fireworks. County-wide fireworks-related property loss in 2024 increased exponentially, at a reported $1,622,300 (an almost 800 percent increase from 2023); and
WHEREAS, City code enforcement and law enforcement have faced challenges correctly identifying and citing violators of Chapter 17.04 when fireworks are discharged at private residences or block parties during crowded gatherings. To increase enforcement mechanisms available to law enforcement and code enforcement, the City desires to adopt “social host” regulations. These regulations which would make the property owner or person in charge of a property strictly liable for allowing any person to sell, possess, ignite, explode, project, or otherwise fire or make use of fireworks on the property owned by such person or under the control of such person in violation of this chapter, irrespective of such person's intent, knowledge, or negligence; and
WHEREAS, serious threat of fire or injury is posed by violations of Chapter 17.04 to surrounding properties, individuals, and to the general public. The amendments to the City's fireworks ordinance are intended to impose strict civil liability upon the violator and the property owner or person in charge of a property. Moreover, each use, display and/or Attachment: A
Click here to return to the agenda.
ORDINANCE NO. 1163
PAGE 2 OF 7
possession of fireworks on a property shall constitute a separate violation, and each violation is intended to be subject to a separate administrative fine. Fines associated with “dangerous fireworks,” as defined by the Ordinance, are higher than the illegal discharge of “safe and sane fireworks,” given the exponential risks to life and property associated with “dangerous fireworks”; and
WHEREAS, the administrative fines described in this Ordinance are imposed under authority of Government Code Section 53069.4 and Health and Safety Code Section 12557, in addition to the City's police power; and
WHEREAS, the City additionally desires to remove the requirement that administrative citations must be personally served, and instead provide that administrative citations may be personally served or served by first class mail. This amendment is intended to streamline the City’s ability to provide notice of a citation while ensuring a person’s due process right to receiving notice; and
WHEREAS, on April 8, 2025, the City Council considered the staff report, recommendations by staff and the City Attorney, and public comment regarding the amendment of Chapter 17.04; and
WHEREAS, all other legal prerequisites to the adoption of this Ordinance have occurred.
NOW, THEREFORE, THE CITY COUNCIL OF THE CITY OF STANTON, CALIFORNIA, DOES RESOLVE, DECLARE, DETERMINE AND ORDER AS FOLLOWS:
SECTION 1: The foregoing Recitals are true and correct and are incorporated herein by this reference.
SECTION 2: Section 17.04.072 is hereby added to Chapter 17.04 (Safe and Sane Fireworks) of Title 17 (Fire) of the Stanton Municipal Code to read in its entirety as follows:
Ҥ 17.04.072 Liability of Property Owners or Persons in Control of Property.
A. It is unlawful for any property owner or person in control of property to allow any person to sell, possess, ignite, explode, project, or otherwise fire or make use of fireworks on the property owned by such person or under the control of such person in violation of this chapter, irrespective of whether the property owner or the person in control of the property had the intent or knowledge of such violation or otherwise acted negligently. Thus, said violation is hereby expressly declared a strict liability offense. In addition to any other penalties provided by law, any person who commits a violation of this section shall be subject to an administrative fine in the amount set forth in this chapter. A property owner or person in control of property shall not be in violation of this section if they seek immediate assistance from the Stanton Police Services or Orange County Sheriff’s Department to report a violation of this chapter.
ORDINANCE NO. 1163
PAGE 3 OF 7
B. When the property owner or person in control of property did not sell, possess, ignite, explode, project, or otherwise fire or make use of fireworks on the property, penalties under this chapter may be assessed against both the property owner or person in control of the property and the person who did sell, possess, ignite, explode, project, or otherwise fire or make use of fireworks on the property.
Nothing in this section shall be interpreted to limit liability and penalties under any other violations present under this Code, state law, federal law, or any other applicable law, rule, provision, or regulation.”
SECTION 3: Section 17.04.090 of Chapter 17.04 (Safe and Sane Fireworks) of Title 17 (Fire) of the Stanton Municipal Code is hereby amended as follows, with deletions shown in strikethrough and additions shown in bold underline:
Ҥ 17.04.090 Penalty for Violations.
The violations of any of the provisions of this chapter shall constitute a misdemeanor, and the penalty for violation shall be as set forth in Section
1.04.0801.10.030 of the Stanton Municipal Code.”
SECTION 4: Subsection 17.04.100(H) is hereby amended in its entirety and restated as follows, below; and Subsections (J), (K), and (L) are hereby added to Section 17.04.100 of Chapter 17.04 (Safe and Sane Fireworks) of Title 17 (Fire) of the Stanton Municipal Code. Deletions are shown in strikethrough and additions are shown in bold underline, and except as specified below, the remainder of Section 17.04.100 is otherwise unchanged:
Ҥ 17.04.100 Administrative Penalty.
...
H. Each property owner or person in control of property who allows any person to sell, possess, ignite, explode, project, or otherwise fire or make use of dangerous fireworks on the property owned by such person or under the control of such person in violation of this chapter, as provided in Section
17.04.072, shall be subject to the imposition and payment of an administrative fine or fines as provided below:
Amount of Administrative Penalty for each
violation in 1-year period
Disposal Charge
(if applicable)
$1,000.00 $250.00
In the case of a violation relating to dangerous fireworks, the citee shall be required to abate the violation and surrender all dangerous fireworks to the enforcement officer, immediately.
ORDINANCE NO. 1163
PAGE 4 OF 7
I. Each property owner or person in control of property who allows any person to sell, possess, ignite, explode, project, or otherwise fire or make use of safe and sane fireworks on the property owned by such person or under the control of such person in violation of this chapter, as provided in Section
17.04.072, shall be subject to the imposition and payment of an administrative fine or fines as provided below:
Number of offence in
1-year period
Amount of
Administrative
Penalty
Disposal Charge
(if applicable)
First $100.00 $25.00
Second $200.00 $50.00
Third and each
subsequent violation
$500.00 $125
Payment of the administrative fine shall not excuse or discharge a citee from the duty to immediately abate and correct a violation of the Code, nor from any other responsibility or legal consequences for a continuation or a repeated occurrence(s) of a violation of this code
J. In the case of a violation relating to dangerous fireworks, the citee shall be required to abate the violation and surrender all dangerous fireworks to the enforcement officer, immediately.
K. Payment of the administrative fine shall not excuse or discharge a citee from the duty to immediately abate and correct a violation of the Code, nor from any other responsibility or legal consequences for a continuation or a repeated occurrence(s) of a violation of this code.
L. In the case of a violation of Section 17.04.072, each sale, possession, ignition, explosion, projection, or otherwise firing or use of fireworks on a property shall be treated as a separate and distinct offense that is subject to a separate penalty. For example, if five dangerous fireworks were found to have been sold, possessed, ignited, exploded, projected, fired, or otherwise used at the same property on the same day, the property owner or person in control of the property may be subject to five separate penalties for each separate and distinct offense under this Chapter.”
SECTION 5: Section 1.12.50 of Chapter 1.12 (Administrative Citations) of Title 1 (General Provisions) of the Stanton Municipal Code is hereby amended in its entirety and restated to read as follows, with deletions shown in strikethrough and additions shown in bold underline:
ORDINANCE NO. 1163
PAGE 5 OF 7
Ҥ 1.12.050 Service procedures.
Any notice, notice of violation, or administrative citation shall be issued in accordance with this chapter on a form approved by the city manager to a responsible party in the following manner:
A. Personal Service. In any case where an administrative citation is issued, the enforcement officer may attempt to locate and personally serve the responsible party and obtain the signature of the responsible party on the administrative citation. If the responsible party served refuses or fails to sign the administrative citation, the failure or refusal to sign shall not affect the validity of the citation or of subsequent proceedings.:
1. The enforcement officer shall attempt to locate and personally serve the responsible party and obtain the signature of the responsible party on the administrative citation.
2. If the responsible party served refuses or fails to sign the administrative citation, the failure or refusal to sign shall not affect the validity of the citation or of subsequent proceedings.
B. Service of Citation by Mail. If the enforcement officer is unable to locate the responsible party, the The administrative citation shallmay be served by mailed to the responsible party by certified mail, postage prepaid with a requested return receipt. If the citation is served by mail, Tthe administrative citation shall be mailed to the responsible party's address shown on the county's last equalized property tax assessment rolls for a property-related violation, or to any address known by the city for the responsible party for all other violations. Simultaneously, the citation shall be sent by first class mail. If the citation sent by certified mail is returned unsigned, then service shall be deemed effective pursuant to first class mail, provided the citation sent by first class mail is not returned.
C. Service of Citation by Posting Notice. If the enforcement officer does not succeed in personally serving the responsible party, or by certified mail or regular mail, the enforcement officer shall post the administrative citation on any real property within the city in which the city has knowledge that the responsible party has a legal interest, and such posting shall be deemed effective service. An enforcement officer may post a copy of the administrative citation on the property in a conspicuous place for a property-related violation when the responsible person resides at an unknown address other than where the violation occurs. Alternatively, for any violation, the enforcement officer may post the administrative citation on any real property within the city in which the city has knowledge that the responsible party has a legal interest. If service of a citation is through posting notice, then a copy of the administrative citation must also be mailed by first class mail to the responsible person at the property address where the notice was posted. Such posting and mailing shall be deemed effective service.
ORDINANCE NO. 1163
PAGE 6 OF 7
D. The failure of any responsible party to receive any notice served in accordance with this section shall not affect the validity of any proceedings taken under this code.”
SECTION 6: CEQA. This Ordinance is exempt from the California Environmental Quality Act (“CEQA”) pursuant to State CEQA Guidelines Section 15061(b)(3) in that the proposed Ordinance is not anticipated to result in a direct or reasonably foreseeable indirect physical change in the environment, nor will the proposed changes have the potential for causing a significant effect on the environment. Additionally, the City Council finds that the proposed Ordinance is not a “project” under State CEQA Guidelines Section 15378(b)(5), which excludes the “organizational or administrative activities of governments that will not result in direct or indirect physical changes in the environment,” as the proposed Ordinance is not anticipated to result in a direct or indirect physical change in the environment.
SECTION 7: Severability. If any section, subsection, subdivision, sentence, clause, phrase, or portion of this Ordinance for any reason is held to be invalid or unconstitutional by the decision of any court of competent jurisdiction, such decision shall not affect the validity of the remaining portions of this Ordinance. The City Council hereby declares that it would have adopted this Ordinance, and each section, subsection, subdivision, sentence, clause, phrase, or portion thereof, irrespective of the fact that any one or more sections, subsections, subdivisions, sentences, clauses, phrases, or portions thereof be declared invalid or unconstitutional.
SECTION 8: Effective Date. This Ordinance No. 1163 shall be effective 30 days after its adoption.
SECTION 9: Publication. The City Clerk shall certify as to the adoption of this Ordinance and shall cause a summary thereof to be published within fifteen (15) days of the adoption and shall post a Certified copy of this Ordinance, including the vote for and against the same, in the Office of the City Clerk, in accordance with Government Code Section 36933.
PASSED, APPROVED, AND ADOPTED this 22nd day of April, 2025.
DAVID J. SHAWVER, MAYOR
ATTEST:
PATRICIA A. VAZQUEZ, CITY CLERK
ORDINANCE NO. 1163
PAGE 7 OF 7
APPROVED AS TO FORM:
HONGDAO NGUYEN, CITY ATTORNEY
STATE OF CALIFORNIA )
COUNTY OF ORANGE ) ss.
CITY OF STANTON )
I, Patricia A. Vazquez, City Clerk of the City of Stanton, California, do hereby certify that the foregoing Ordinance No. 1163 was introduced at a regular meeting of the City Council of the City of Stanton, California, held on the 8th day of April, 2025 and was duly adopted at a regular meeting of the City Council held on the 22nd day of April, 2025, by the following roll-call vote, to wit:
AYES: COUNCILMEMBERS:
NOES: COUNCILMEMBERS:
ABSENT: COUNCILMEMBERS:
ABSTAIN: COUNCILMEMBERS:
PATRICIA A. VAZQUEZ, CITY CLERK