SERVICES AGREEMENT BETWEEN
THE CITY OF SUNNYVALE AND SAVANT SOLUTIONS, INC.
FOR IMPLEMENTATION OF AN INFORMATION TECHNOLOGY SECURITY OPERATIONS
CENTER WITH MANAGED DETECTION AND RESPONSE PLATFORM AND TECHNICAL
SERVICES
THIS AGREEMENT dated ______________________________ is by and between the CITY OF SUNNYVALE, a California chartered municipal corporation of the State of California ("CITY"), and SAVANT SOLUTIONS, INC., a Wyoming corporation ("CONTRACTOR").
WHEREAS, CITY advertised a Request for Proposals (RFP) on July 27 2021; and WHEREAS, CITY accepted CONTRACTOR’s proposal submitted on Augu st 25, 2021; and WHEREAS, CITY desires to implement an information technology se curity operations center with a managed detection and response platform; and
WHEREAS, CONTRACTOR possesses the skill and expertise to provi de the required services.
NOW, THEREFORE, THE PARTIES ENTER INTO THIS AGREEMENT.
1. Contract Documents
The complete Contract consists of this Agreement and the following documents: Request for Qualifications No. F21-005, Request for Proposals No. 2021-07-27-003, Instructions to Proposers, Specifications, Terms and Conditions and CONTRACTOR's completed Proposal submitted to City on August 25, 2021. These documents are all incorporated by reference into this Agreement. In the event of a conflict between the Contract documents, the terms of this Agreement shall govern. The documents comprising the complete contract are collectively referred to as the Contract Documents.
Any and all obligations of the CITY and the CONTRACTOR are ful ly set forth and described in the Contract Documents.
All of the above documents are intended to cooperate so that a ny work called for in one and not mentioned in the other or vice versa is to be executed the same as if mentioned in all documents.
2. Services by CONTRACTOR
It is understood and agreed that tools, equipment, apparatus, facilities, labor, transportation, and material shall be furnished and work performed and completed as required in the bid documents under the sole direction and control of the CONTRACTOR, and subject to approval of the City.
3. Time for Performance
The term of this Agreement shall be from May 2, 2022 to June 1, 2025. The schedule of performance may be revised by the mutual agreement of CONTRACTOR and the CITY.
4. Compensation
In no event shall the total amount of compensation paid by CITY to CONTRACTOR under this agreement exceed the sum of Five Hundred Four Thousand Three Hu ndred Fourteen Dollars ($504,314.00), unless upon written modification of this Agreeme nt. CONTRACTOR shall submit Attachment 1
invoices to CITY no more frequently than monthly for services provided to date, and in accordance with the compensation schedule outline in Exhibit “C”. All invoices, including detailed backup, shall be sent to City of Sunnyvale, attention Accounts Payable, P.O. Box 3707 , Sunnyvale, CA 94088-3707 or [email protected]. Payment shall be made within thirty days upon receipt of an accurate itemized invoice by CITY’s Accounts Payable unit.
5. Conflict of Interest
CONTRACTOR shall avoid all conflicts of interest, or appearance of conflict, in performing the services and agrees to immediately notify CITY of any facts that may give rise to a conflict of interest.
CONTRACTOR is aware of the prohibition that no officer of CITY shall have any interest, direct or indirect, in this Agreement or in the proceeds thereof. During the term of this Agreement CONTRACTOR shall not accept employment or an obligation which i s inconsistent or incompatible with CONTRACTOR’S obligations under this Agreement.
6. Confidential Information
CONTRACTOR shall maintain in confidence and at no time use, ex cept to the extent required to perform its obligations hereunder, any and all proprietary or confidential information of CITY of which CONTRACTOR may become aware in the performance of its services.
7. Compliance with Laws
(a) CONTRACTOR shall not discriminate against, or engage in th e harassment of, any City employee or volunteer or any employee of CONTRACTOR or applicant for employment because of an individual’s race, religion, color, sex, gender identity, sexual orientation (including heterosexuality, homosexuality and bisexuality), eth nic or national origin, ancestry, citizenship status, uniformed service member status, marital status, family relationship, pregnancy, age, cancer or HIV/AIDS-related medica l condition, genetic characteristics, and physical or mental disability (whether per ceived or actual). This prohibition shall apply to all of CONTRACTOR’s employment pract ices and to all of CONTRACTOR’s activities as a provider of services to the City. (b) CONTRACTOR shall comply with all federal, state and city laws, statutes, ordinances, rules and regulations and the orders and decrees of any courts or administrative bodies or tribunals in any manner affecting the performance of the Agreement.
8. Independent Contractor
CONTRACTOR is acting as an independent contractor in furnishin g the services or materials and performing the work required by this Agreement and is not an agent, servant or employee of CITY.
Nothing in this Agreement shall be interpreted or construed as creating or establishing the relationship of employer and employee between CITY and CONTRACTOR. CONTRACTOR is responsible for paying all required state and federal taxes.
9. Indemnity
I. General Hold Harmless
CONTRACTOR shall indemnify, defend, and hold harmless the CITY , its officers, officials, employees and volunteers from and against all claims, damages, losses and expenses, including attorney fees, arising out of the performance of the services described herein, caused in whole or in part Attachment 1
by any negligent act or omission of CONTRACTOR, any subcontract or, anyone directly or indirectly employed by any of them or anyone for whose acts any of them may be liable, except where caused by the active negligence, sole negligence or willful misconduct of the CITY.
II. Intellectual Property Indemnification
CONTRACTOR hereby certifies that it owns, controls, or license s and retains all right, title, and interest in and to any intellectual property it uses in rel ation to this Agreement, including the design, look, feel, features, source code, content, and other t echnology relating to any part of the services it provides under this Agreement and including all related patents, inventions, trademarks, and copyrights, all applications therefor, and all trade names, service marks, know how, and trade secrets (collectively referred to as “IP Rights,” Exhibit D) ex cept as otherwise noted by this Agreement. CONTRACTOR warrants that the services it provides under this Agreement do not infringe, violate, trespass, or constitute the unauthorized use or misappropriation of any IP Rights of any third party. CONTRACTOR shall defend, indemnify, and hold h armless CITY from and against all liabilities, costs, damages, losses, and expenses (including reasonable attorney fees) arising out of or related to any claim by a third party that the services provided under this Agreement infringe or violate any third-party’s IP Rights provided any such right is enforceable in the United States.
CONTRACTOR’s duty to defend, indemnify, and hold harmless under this Section applies only provided that:
A. CITY notifies CONTRACTOR promptly in writing of any notice of any such third-party claim; B. CITY cooperates with CONTRACTOR, at CONTRACTOR’s expense, in all reasonable respects in connection with the investigation and defense of any such third-party claim; C. CONTRACTOR retains sole control of the defense of any action on any such claim and all negotiations for its settlement or compromise (provided CONTRAC TOR shall not have the right to settle any criminal action, suit, or proceeding without CITY’S prior written consent, not to be unreasonably withheld, and provided further that any sett lement permitted under this Section shall not impose any financial or other obligation on C ITY, impair any right of CITY, or contain any stipulation, admission, or acknowledgement of wrongdoing on the part of CITY without CITY’s prior written consent, not to be unreasonably withheld); and D. should services under this Agreement become, or in CONTRACTO R’S opinion be likely to become, the subject of such a claim, or in the event such a thi rd party claim or threatened claim causes CITY’s reasonable use of the services under this A greement to be seriously endangered or disrupted, CONTRACTOR shall, at CONTRACTOR’s opti on and expense, either:
a. procure for CITY the right to continue using the services wi thout infringement or b. replace or modify the services so that they become non-infri nging but remain functionally equivalent. Notwithstanding anything in this Secti on to the contrary, CONTRACTOR will have no obligation or liability to CITY under t his Section to the extent any otherwise covered claim is based upon:
i. any aspects of the services under this Agreement which have been modified by or for CITY (other than modification performed by, or at the direction of, CONTRACTOR) in such a way as to cause the alleged infringement at issue; and/or
ii. any aspects of the services under this Agreement which have been used by CITY in a manner prohibited by this Agreement.
10. Insurance
The City requires that all contractors maintain insurance requ irements on the Pacific Insurance Network System (PINS). CONTRACTOR shall take out and maintain during the life of this Agreement Attachment 1
policies of insurance as specified in Exhibit "B" attached and incorporated by reference, and shall provide all certificates or endorsements as specified in Exhibit "B."
11. CITY Representative
Eddie Soliven, Information Technology Manager, as the City Man ager's authorized representative, shall represent CITY in all matters pertaining to the services to be rendered under this Agreement. All requirements of CITY pertaining to the services and materials to be rendered under this Agreement shall be coordinated through the CITY representative.
12. CONTRACTOR Representative
Caleb Kwong, Chief Executive Officer, shall represent CONTRACT OR in all matters pertaining to the services and materials to be rendered under this Agreement; all requirements of CONTRACTOR pertaining to the services or materials to be rendered under this Agreement shall be coordinated through the CONTRACTOR representative.
13. Notices
All notices required by this Agreement, other than invoices fo r payment which shall be sent directly to Accounts Payable, shall be in writing, and sent by first class with postage prepaid, or sent by commercial courier, to addressed below.as follows:
Nothing in this provision shall be construed to prohibit communication by more expedient means, such as by email or fax, to accomplish timely communication. Each party may change the address by written notice in accordance with this paragraph. Notices deli vered personally shall be deemed communicated as of actual receipt; mailed notices shall be deemed communicated as of three business days after mailing.
To CITY: Kathleen Boutté Foster, Chief Information Officer I n f o r m a t i o n T e c h n o l o g y D e p a r t m e n t
C I T Y O F S UNNYVALE
P . O . B o x 3 7 0 7
S u n n y v a l e , C A 9 4 0 8 8 - 3 7 0 7
To CONTRACTOR: Caleb Kwong, Chief Executive Officer
S A V A N T S O L U T I O N S , I N C .
1 0 3 0 G S t r e e t
S a c r a m e n t o , C A 9 5 8 1 4
14. Assignment
Neither party shall assign or sublet any portion of this Agreement without the prior written consent of the other party.
15. Termination
A. If CONTRACTOR defaults in the performance of this Agreement, or materially breaches any of its provisions, CITY at its option may terminate this Agreement by giving written notice to CONTRACTOR. In the event of such termination, CONTRACTOR shall be compensated in proportion to the percentage of satisfactory services performed or materials furnished (in relation to the total which would have been performed or furnis hed) through the date of Attachment 1
receipt of notification from CITY to terminate. CONTRACTOR shall present CITY with any work product completed at that point in time.
B. Without limitation to such rights or remedies as CITY shall otherwise have by law, CITY also shall have the right to terminate this Agreement for any reason upon ten (10) days' written notice to CONTRACTOR. In the event of such termination, CONTRACTOR shall be compensated in proportion to the percentage of services performed or materials furnished (in relation to the total which would have been performed or furnished) through the date of receipt of notification from CITY to terminate. CONTRACTOR shall present CITY with any work product completed at that point in time.
C. If CITY fails to pay CONTRACTOR, CONTRACTOR at its option ma y terminate this Agreement if the failure is not remedied by CITY within (30) days after written notification of failure to pay.
16. Entire Agreement; Amendment
This writing constitutes the entire agreement between the part ies relating to the services to be performed or materials to be furnished hereunder. No modification of this Agreement shall be effective unless and until such modification is evidenced by writing signed by all parties.
17. Governing Law, Jurisdiction and Venue
This Agreement shall be governed by and construed in accordanc e with the laws of the State of California, excluding its conflict of law principles. Proper venue for legal actions will be exclusively vested in a state court in the County of Santa Clara. The parties agre e that subject matter and personal jurisdiction are proper in state court in the County of Santa Clara, and waive all venue objections.
18. Miscellaneous
Time shall be of the essence in this Agreement. Failure on th e part of either party to enforce any provision of this Agreement shall not be construed as a waiver of the right to compel enforcement of such provision or any other provision.
Attachment 1
IN WITNESS WHEREOF, the parties have executed this Agreement.
A T T E S T : C I T Y O F S UNNYVALE ("CITY")
By ___________________________ By _____________________________ C i t y C l e r k C i t y M anager
APPROVED AS TO FORM: SAVANT SOLUTIONS, INC. (“CONTRACTOR”)
By ___________________________ By _____________________________ City Attorney
________________________________
N a m e and Title
By_______________________________
N a m e a n d T i t l e
Attachment 1
Exhibit A
Scope of Services
This Scope of Services describes a broad set of contractor responsibilities to support the Information Technology Department’s security program. The principal purpose of these responsibilities is to provide comprehensive expert cybersecurity support to:
1. Provide Information Security and Privacy program management support.
2. Guide creation of and review produced Incident Response documents for the City’s applications and infrastructure.
3. Effectively manage agency risk by maintaining visibility acr oss the agency.
4. Maintain comprehensive situational awareness of global cyber threat landscape as it relates to the City’s lines of business for all of its departments.
5. Reduce cost and optimize agency Security Posture through com plexity reduction and automation.
6. Deliver measurable (as defined by the vendor and accepted by the City) Information Security and Privacy.
7. Effectively communicate with all parties, especially key stakeholders.
8. Improve Regulatory and Policy Alignment.
A. The contractor shall perform tasks in the following areas:
1. Program and Project Management
a. Provide support of the IT security program for the City. b. Provide security reviews for new system implementation and a pplication installation projects or projects changing the IT Infrastructure.
c. Provide a Transition-In and Readiness Test plan for informat ion security aspects of IT projects.
d. Develop weekly Situational Reports and monthly status reports related to the state of IT Security – industry-wide and City specific.
e. Review and provide recommendations for information security budgets. f. Participate in monthly status meetings as needed.
2. Information Security and Privacy Program
a. Establish and/or evaluate Security Policies and Procedures to govern the security of Sunnyvale’s network, data, and applications.
b. Develop and enhance an Information Security Management frame work based on industry best practices such as National Institute of Standards and Technology (NIST).
c. Ensure that security programs comply with relevant laws, reg ulations, and policies to minimize or eliminate risk and audit findings.
d. Facilitate a matrix and reporting framework to measure the e fficiency and effectiveness of the program.
e. Develop, implement, and monitor a strategic, comprehensive enterprise information security management program.
f. Create a process for vendor risk management, including the a ssessment and treatment for risks that may result from partners, consultants, or other service providers.
g. Determine the impact of new technology or policy (e.g., CDM technologies, anomaly- based tools, virtual environments, etc.) on the City’s information security and privacy program.
h. Develop and implement information security and privacy program strategic and tactical goals and objectives.
Attachment 1
i. Identify and develop an IT Security Performance Management P rogram that includes performance measures, tracking metrics, and trend analysis. j. Generate regular and ad-hoc dashboards, reports, and metrics . k. Recommend, develop, and maintain monthly, quarterly, and annual security reports. l. Provide comprehensive operational cybersecurity situational awareness and response readiness by performing 24x7 cybersecurity monitoring and advanced analytics for all Sunnyvale systems across the data centers. m. Monitor, defend and protect every perimeter interface for ma licious network activity. n. Monitor, defend and protect every host within the network fo r malicious activity or activity that could indicate movement within the environment. o. Monitor security events and data center feeds from the CoLo facility and DR facility. p. Prepare meeting agenda’s, minutes, presentation material as required.
3. Information Security and Privacy Policy and Documentation Support a. Recommend, review, and update existing, and/or develop new Information Security and Privacy policies, handbooks, standards, and procedures. b. Identify and mitigate City’s vulnerabilities to information systems from internal and external threats.
c. Itemize, quantify, and rank City’s information security risks, based upon potential impacts to the organization.
d. Draft, review, and/or comment on CIO directives and other po licies, procedures, and correspondence.
e. Provide documentation and comprehensive system security planning and lifecycle management.
f. Produce security documentation or input on relevant documentation which includes expedited lifecycle documentation, training material, standard operating procedures (SOPs), network diagrams, system level security requirements, security specifications, and metrics for product/system testing evaluation and assessment. g. Perform security tools and documentation inventory review an d update plan with schedule monthly.
4. Information Security and Privacy Subject Matter Expertise Technical Advisory Services a. Provide overall subject matter expertise in Information Security and Privacy. b. Ensure all assessment and audit reports are completed in a t imely manner. c. Provide continuous monitoring of systems, both applications and infrastructure. d. Provide document support for events and responses to incidents/concerns. e. Establish contingency plans where needed.
f. Provide expertise and guidance to City stakeholders with regard to secure development, implementation and operation of systems or enhancement of systems.
5. Information Security and Privacy Risk Assessment
a. Establish the process and frequency for Information Security Risk Assessments. b. Conduct Information Security Risk Assessments at established frequency and according to process established.
c. Manage and communicate risks to the CIO.
d.
Identify areas of risk and establish remediation plans. e. Monitor the external threat environment for emerging threats and advise on the appropriate course of action.
6. Ad Hoc Security and Privacy Engineering Subject Matter Exper tise a. Prepare situational awareness briefings regarding informatio n security. b. Recommend alternatives of system designs and/or architecture s describing trade-offs between security requirements, functional/operational requirements, and cost.
Attachment 1
c. Determine the impact of new or changing applicable federal, state, or local policy changes.
d. Determine the impact of new or revised legislation and regulations (HIPAA, FEDRAM, etc.).
e. Conduct technical reviews and briefings related to future st ate enterprise architecture updates and proposed information security mechanisms (via PowerPoint briefings, email or white papers addressing information security architecture vulnerabilities, risks, mitigation response and emerging opportunities). f. Conduct Third-Party (vendor) Reviews – assess systems of con trols in both on- premises and cloud-based solutions, and align with the City’s risk tolerance. Conduct security reviews and audits of third-party solutions.
g. Conduct research and present analyses to evaluate and/or det ermine emerging industry technology trends, govern agency best practices and security issues. h. Network Vulnerability Assessments and Web Applications Scans – Conduct testing, complete scans and assessments and prioritize remediation steps in alignment with the City’s risk tolerance.
i. Provide recommendation and guidance for an evaluation of an incident response plan specific to the City’s environment.
j. Conduct tabletop exercises to practice incident response plan. k. Provide cyberthreat intelligence reports that include source or origination of the attack; type of attack; targeted entity (agency, department, user); extent of damage or compromise of data and specific vulnerabilities in the program, code configurations, social engineering, etc. that are being exploited.
l. Provide intelligence on IT vulnerabilities being reported across the public and private sectors.
m. Provide information about exploited vulnerabilities in syste ms to include:
i. Objectives – goal of threat
ii. Timeliness – time spent probing/accessing the target system /environment iii. Resources – level of knowledge, expertise, tools used iv. Risk Tolerance – extent to which the threat remains undetec ted v. Skills/Methods – tools and techniques used throughout the event vi. Actions – precise actions taken
vii. Attack origination Point – point(s) where the event origin ated viii. Numbers involved – value indicating the number of systems (internal and external) involved, to include system sensitivity.
ix. Knowledge source – ability to discern any information regarding any of the specific threats through online information gathering
7. Compliance
a. Ensure the City is compliant with standards for PCI, HIPAA, GDPR, CJIS etc.
8. Information Security and Privacy Awareness
a. Assess and provide recommendations for security and privacy training materials. b. Develop, deliver, and maintain outreach and marketing strate gy to ensure ongoing security and privacy adherence.
9. Audit Management
a. Maintain a log of audit requests, perform requested audits, p rovide recommended
response, and maintain response tracking sheet.
b. Maintain a findings list and follow the findings through rem ediation and closure. c. Manage each audit engagement in collaboration with all stake holders. d. Maintenance of metrics to show progress of audit.
e. Report on audit and risk as required.
Attachment 1
10. Annual Penetration Testing
a. Work with target system personnel to obtain test plans and final reports. b. Conduct penetration testing.
c. Conduct vulnerability analysis, perimeter testing, IP addres ses testing, lateral movement testing and other related activities.
d. Document all findings; produce a plan of action with milesto nes accounting for level of complexity and risk.
e. Maintain a library of documentation related to each test and risk mitigation strategy. f. Conduct ad hoc security briefs as needed and provide report to CIO. g. Continually develop, maintain, and optimize all program docu mentation related to penetration testing and other tests upon innovation, industry techniques, policies, laws, and regulations.
h. Perform operations, maintenance, administration, and optimization activities to maintain and enhance the security tools, processes, and procedures. i. Provide constant situational awareness, and maintain high le vel of responsiveness.
11. Forensics and Malware
a. Conducts network and media forensics in support of incident and compromise response activities to include, but not limited to malware detection, lateral movement detection, data collection detection and data exfil detection. b. Monitors industry threat intelligence sources to proactively tune tools. c. Develop, maintain, and optimize malware analysis.
d. Maintains digital evidence Chain of Custody in support of fo rensic activity, congruent with policy, industry standards and the law.
e. Prepares and provides network and media forensics, malware a nalysis, and advanced hunting reports.
f. Utilizes industry standard evidence acquisition, transport, storage, and destruction to prevent unauthorized disclosure of data.
g. Provide risk analysis for vulnerabilities, incidents, and ch ange requests as appropriate.
h. Provide subject matter expertise on policies, industry trend s, techniques related to Forensics, Malware Analysis, and other related areas.
B. Deliverables
a. Executive Summary (upon contract initiation and annually thereafter): Develop a one-page executive summary, highlighting the key findings of the penetration analysis and Information Security Program review.
b. Penetration Analysis Report (annually): Report and document highlights and key engagement findings, conclusions, and recommendations regarding the vulnerabilities found during testing.
c. Annual Report (annually): Prepare a yearly report in presentation mode to review the following: Penetration analysis results; overview of the current environment security posture; document highlights and key findings, conclusions and recommendations and recommendations regarding the vulnerabilities found in all systems; detail exposures associated with the security infrastructure and systems; document current threats and items blocked, recommended action plan.
d. Security Policies and Procedures (ongoing): Produce policies and procedures relevant to the City’s environment to reduce, transfer and mitigate risk to the network and company data, and/
or recommend enhancements to existing policies and
procedures. Update based on current threats.
Attachment 1
e. Security Governance and Oversight (ongoing): Provide monthly report on security metrics reflecting how well the security program is operating, report on overall City risk posture and new threats to the City.
f. Incident Response Plan (upon contract initiation and annuall y thereafter): Develop Incident Response Plan with key City staff, including incident response plan documentation and procedures developed specifically for the City’s infrastructure.
C. Roles and Responsibilities
a. City will provide a point of contact to support the engageme nt. b. City’s CIO will be the Executive Sponsor and key stakeholder. c. City will confirm IP address ranges, network equipment, tele phone equipment, applications inventory and supply target lists as needed. d. City will provide access to necessary personnel for data gat hering activities, such as interviews to obtain insight into procedures, as well as the nature of the City’s IT infrastructure, systems, and data.
e. Contractor will provide a primary Security professional, and two backups assigned to the City account.
f. City has the authority to review resumes and interview all s ecurity professionals prior to being assigned to the City and to reject as appropriate. g. All Security professionals assigned to the City will be full-time employees of the selected vendor.
h. All Security Professionals assigned to the City account must have:
i. Minimum of five (5) years professional experience working as a Security Professional
ii. Experience in penetration testing for organizations of simi lar size or area of government
iii. Experience developing and evaluating security policies and procedures iv. Experience reviewing security configurations within an exis ting infrastructure, such as for firewall network switching and firewall routing v. Experience evaluating security risks for organizations of si milar size or area of government
vi. Experience evaluating threats in an IT environment
vii. Knowledge and understanding of relevant legal and regulato ry requirements, such as Health Insurance Portability and Accountability Act (HIPAA), Payment Card Industry/Data Security Standard (PCI) and Criminal Justice Information Systems (CJIS)
viii. Knowledge of National Institute of Standards and Technolo gy (NIST) and how to best apply them in organizations of similar size or area of government ix. Maintains Professional security management certification, such as a Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA) or other similar credentials
x. Experience with contract and vendor negotiations and architecture review i. Contractor will provide a trouble reporting and customer ser vice number which is answered by a human representative, employed by the company. This service must be provided 24 hours per day, 7 days per week.
j. Contractor will provide remote support via the City’s VPN or onsite support within agreed upon severity levels.
Attachment 1
EXHIBIT B
INSURANCE REQUIREMENTS FOR CONTRACTORS
Contractor shall procure and main tain for the duration of the c ontract insurance against claims for injuries to persons or damages to property which may arise from or in connection with the performance of the work by the Contractor, his agents, representatives, or employees.
Minimum Scope and Limits of Insurance. Contractor shall maintain limits no less than:
1. Commercial General Liability : $2,000,000 per occurrence and $4,000,000 aggregate for bodily injury, personal injury and property damage. ISO Occurrence Form CG 0001 or equivalent is required.
2. Automobile Liability: $2,000,000 per accident for bodily injury and property damage . ISO Form CA 0001 or equivalent is required.
3. Workers’ Compensation: Statutory Limits and Employer's Liability: $1,000,000 per accident for bodily injury or disease. This policy must be endorsed with a waiver of subrogation in favor of the City of Sunnyvale.
Industry Specific Coverages. If checked below, the following insurance is also required:
☒ Professional Liability Insurance / Errors and Omissions Liabil ity in the minimum amount of $1,000,000 per occurrence.
☐ If working directly with children, the Certificate of Insuranc e must include coverage for molestation and sexual abuse in the minimum amount of $1,000,000 per occurrence and $2,000,000 aggregate. In the event that Abuse & Molestation Liability coverage is provided via a Claims Made Policy, the coverage shall include a minimum of a five year extended reporting clause.
☐ Pollution Liability Insurance in the minimum amount of $1,000,000 per occurrence ☐ MCS-90 Endorsement to Business Automobile insurance for transp ortation of hazardous materials and pollutants
☐ Builder’s Risk / Course of Construction Insurance in the minimum amount of $__________. ☒ Cyber Liability Insurance in the minimum amount of $2,000,000 per occurrence. ☒ Data Breach Defense and Liability Insurance in the minimum amount of $1,000,000 per occurrence.
Deductibles and Self-Insured Retentions:
Any deductibles or self-insured retentions must be declared and approved by the City of Sunnyvale, Risk Manager. The Contractor shall guarantee payment of any losses and related investigations, claim administration and defense expenses within the deductible or self-insured retention.
Other Insurance Provisions:
The general liability and automobile liability policies (and if applicable, pollution liability, sexual abuse and molestation, and builder’s risk policies) shall contain, or be endorsed to contain, the following provisions:
1. The City of Sunnyvale, its officials, employees, agents and volunteers are to be covered as additional insureds with respects to liability arising out of activities performed by or on behalf of the Contractor; products and completed operations of the Contractor; premises owned, occupie d or used by the Contractor; or automobiles Attachment 1
owned, leased, hired or borrowed by the Contractor. The coverage shall contain no special limitations on the scope of protection afforded to the City of Sunnyvale, its officers, employees, agents or volunteers.
2. For any claims related to this project, the Contractor's insurance shall be primary. Any insurance or self- insurance maintained by the City of Sunnyvale, its officers, officials, employees, agents and volunteers shall be excess of the Contractor's insurance and shall not contribute with it.
3. Any failure to comply with reporting or other provisions of the policies including breaches of warranties shall not affect coverage provided to the City of Sunnyvale, it s officers, officials, employees, agents or volunteers.
4. The Contractor's insurance shall apply separately to each in sured against whom claim is made or suit is brought, except with respect to the limits of the insurer's liability.
5. Each insurance policy required by this clause shall be endorsed to state that coverage shall not be suspended, voided, cancelled by either party, reduced in coverage or in li mits except after thirty (30) days' prior written notice by certified mail, return receipt requested, has been given to the City of Sunnyvale.
6. The policy limits of coverage shall be made available to the full limits of the polic y. The minimum limits stated above shall not serve to reduce the CONTRACTOR’S policy limits of coverage. Therefore, the requirements for coverage and limits shall be (1) the minimum coverage and limits specified in this agreement, or (2) the broader coverage and maximum limits of coverage of any insurance policy or proceeds available to the named insured, whichever is greater.
Acceptability of Insurers:
Insurance is to be placed with insurers with a current A.M. Best's rating of not less than A:VII, unless otherwise acceptable to the City of Sunnyvale, Risk Manager.
Verification of Coverage:
Contractor shall furnish the City of Sunnyvale with original a Certificate of Insurance effecting the coverage required. The certificates are to be signed by a person authorized by that insurer to bind coverage on its behalf.
All certificates are to be received and approved by the City of Sunnyvale, Risk Manager prior to commencement of work.
The aforementioned insurance requirements can be met through any combination of primary and excess/umbrella policies that fulfill the stipulated coverage as cited above.
Subcontractors
CONTRACTOR shall require all subcontractors to procure and main tain insurance policies subject to these requirements. Failure of CONTRACTOR to verify existence of sub- contractor’s insurance shall not relieve CONTRACTOR from any claim arising from sub-contractors work on behalf of CONTRACTOR.
Attachment 1
EXHIBIT C
COMPENSATION SCHEDULE
Rate Sheet
Line Part Number Description Quantity Unit Price Extended Price
1 AW-MSPP-MDR-U Arctic Wolf MDR 1014 user license - MSPP 1 $78,000.00 $78,000.00 2 AW-MSPP-MDR-SE Arctic Wolf MDR server license - MSPP 210 $75.00 $15,750.00 3 AW-MSPP-MDR-
90DAY
Arctic Wolf MDR Log Retention - 90 days - MSPP
(Longer retention available for additional cost)
1 $0.00 $0.00
4 AW-MSPP-MDR-2XX-
S-10G
Arctic Wolf 200 Series Sensor - 2 x 10G Multimode
fiber SFP+ modules with LC connector - MSPP
1 $2,160.00 $2,160.00
5 AW-MSPP-MDR-
10XX-S-10GFNB
Arctic Wolf 1000 Series Sensor - 4 x 10G Multi-
Mode Fiber LC Connectors Non-Bypass - MSPP
1 $3,600.00 $3,600.00
6 AW-MSPP-MDR-2XX-
S
Arctic Wolf 200 Series Sensor - MSPP 1 $1,080.00 $1,080.00 7 AW-MSPP-MDR-
O365
Arctic Wolf MDR Office 365 user license - MSPP 1,342 $9.00 $12, 078.00 8 AW-MSPP-MDR-OB Arctic Wolf M DR Onboarding - MSPP (One-time fee)
1 $6,000.00 $6,000.00
9 AW-MSPP-MR-U Arctic Wolf Managed Risk user license - MSPP 1,014 $35.00 $35,490.00 10 AW-MSPP-MR-SE Arctic Wolf Managed Risk server license - MSPP 210 $35.00 $7,350.00 11 W-MSPP-MR-OB Arctic Wolf Managed Risk Onboarding - MSPP (One-time fee)
1 $0.00 $0.00
12 AW-MSPP-
PLATFORM
Arctic Wolf Platform - MSPP 1,224 $2.00 $2,448.00
Annual costs are indicated below:
Total negotiated cost for Year 1, including
shipping of leased equipment ($360.00) $164,316.00
Total negotiated cost for Year 2 $165,853.00
Total negotiated cost for Year 3 $174,145.00
Attachment 1
EXHIBIT D
Intellectual Property (IP) Rights
1. The City of Sunnyvale (“CITY”) shall and does own all titles, rights and interests in all Work Products created by Contractor and its subcontractors (collectively “Vendors”) for the CITY under this Agreement. Contractor may not sell, transfer, or permit the use of any Work Products without the express written consent of the CITY.
2. “Work Products” are defined as all materials, tangible or not, created in whatever medium pursuant to this Agreement, including without limitation publications, promotional or educational materials, reports, manuals, specifications, drawings and sketches, computer programs, software and databases, schematics, marks, logos, graphic designs, notes, matters and combinations thereof, and all forms of intellectual property.
3. Contractor shall not dispute or contest, directly or indirectly, the CITY’s exclusive right and title to the Work Products nor the validity of the intellectual property embodied therein. Contractor hereby assigns, and if later required by the CITY, shall assign to the CITY all titles, rights and interests in all Work Products. Contractor shall cooperate and cause subcontractors to cooperate in perfecting CITY’s titles, rights or interests in any Work Product, including prompt execution of documents as presented by the CITY.
4. To the extent any of the Work Products may be protected by U.S. Copyright laws, Parties agree that the CITY commissions Vendors to create the copyrightable Work Products, which are intended to be work-made-for-hire for the sole benefit of the CITY and the copyright of which is vested in the CITY.
5. In the event that the title, rights, and/or interests in any Work Products are deemed not to be “work-made-for-hire” or not owned by the CITY, Contractor hereby assigns and shall require all persons performing work pursuant to this Agreement, including its subcontractors, to assign to the CITY all titles, rights, interests, and/or copyrights in such Work Product. Should such assignment and/or transfer become necessary or if at any time the CITY requests cooperation of Contractor to perfect the CITY’s titles, rights or interests in any Work Product, Contractor agrees to promptly execute and to obtain execution of any documents (including assignments) required to perfect the titles, rights, and interests of the CITY in the Work Products with no additional charges to the CITY beyond that identified in this Agreement or subsequent change orders. The CITY, however, shall pay all filing fees required for the assignment, transfer, recording, and/or application.
6. Contractor agrees that before commencement of any subcontract work it will incorporate this Exhibit D to contractually bind or otherwise oblige its subcontractors and personnel performing work under this Agreement such that the CITY’s titles, rights, and interests in Work Products are preserved and protected as intended herein.
Attachment 1