Visalia City Council
November 18, 2024

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

CITY OF VISALIA, CALIFORNIA
REQUEST FOR PROPOSALS (RFP) NO. 24-25-03

CYBER SECURITY ASSESSMENT, CYBER RESILIENCE PROGRAM

AND IMPLEMENTATION PLAN

DESCRIPTION:

The City of Visalia is inviting proposals from qualified vendors for Cyber Security Assessment, Cyber Resilience Program and Implementation Plan as specified in this Request for Proposals.

This project is supported, in whole or in part, by federal award number SLFRP2005, awarded to City of Visalia by the U.S. Department of the Treasury. Federal Funds being utilized for this project is American Rescue Plan Act Funds (ARPA).

PROPOSER CONFERENCE:

On Wednesday, September 4, 2024, a virtual conference will be held via TEAMS at 10:00 A.M. (Pacific Standard Time). Interested Proposers are encouraged to participate by emailing their contact information to the Purchasing Division: [email protected] to be listed on the attendance roster and provided with the meeting log-in/call-in phone number. This is an opportunity to ask questions regarding the project and the Request for Proposal requirements.

SUBMITTAL DEADLINE:

One (1) unbound original, and four (4) copies, plus one (1) copy on flash drive must be received no later than: 2:00 P.M. (Pacific Standard Time) on Wednesday, September 18, 2024. Proposals received after the time and date stated above shall be returned unopened to the proposer. Emailed Proposals will not be accepted.

SUBMITTAL INSTRUCTIONS:

Addressed to: Purchasing Division
707 W. Acequia Avenue, Visalia, CA 93291

From: Proposer’s Name & Mailing Address

Mark envelope : RFP No. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

INQUIRIES: Questions/clarification of this document or the scope of services should be addressed to the Purchasing Division (559) 713-4334. To prevent misinterpretation, the Purchasing Division prefers that all questions be sent in writing via email [email protected]. Questions may be asked at any time prior to, but no later than Monday, September 9, 2024.

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

CITY OF VISALIA, CALIFORNIA

REQUEST FOR PROPOSALS
RFP 24-25-03

SEALED PROPOSALS will be received by the Purchasing Division located at 707 West Acequia, Visalia, CA 93291, until 2:00 P.M. (Pacific Standard Time) on Wednesday, September 18, 2024 for:

Cyber Security Assessment, Cyber Resilience Program and implementation Plan

The City of Visalia is inviting proposals from qualified vendors for its Request for Proposal (RFP) to fully audit and assess the security of the City’s current network and system environment, and then create a detailed Cyber Resilience Program and Implementation Plan to strengthen our technology security and meet appropriate standards.

This project is supported, in whole or in part, by federal award number SLFRP2005, awarded to City of Visalia by the U.S. Department of the Treasury. Federal Funds being utilized for this project is American Rescue Plan Act Funds (ARPA).

Informational Conference: On Wednesday, September 4, 2024, a virtual conference will be held via TEAMS at 10:00 A.M. (Pacific Standard Time). Interested Proposers are encouraged to participate by emailing their contact information to the Purchasing Division: [email protected] to be listed on the attendance roster and provided with the meeting log-in/call-in phone number. This is an opportunity to ask questions about the project and specifications.

RFP Documents: Contract documents may be obtained in the office of the Purchasing Division, 707 W. Acequia Ave., Visalia, California 93291 or by calling (559) 713-4334, or may be downloaded from BidNetdirect by registered users. To register with BidNetdirect, please see the City’s web site: www.visaliapurchasing.org.

Project Budget: The total approved budget for this project is approximately $200,000 which is an estimate of the total project delivery costs.

The City hereby affirmatively assures that Minority Business Enterprises and Disadvantaged Business Enterprises (DBE) will be afforded full opportunity to submit proposals in response to this notice. Individuals and/or entities submitting bids/proposals to the City of Visalia will not be discriminated against on the basis of age, race, religion, creed, color, national origin, ancestry, physical or mental disability, medical condition, genetic information, marital status, gender, gender identity or expression, sexual orientation, or military and veteran status in any consideration leading to the award of contract.

No qualified disabled person shall, on the basis of disability, be excluded from participating in, be denied the benefits of, or otherwise be subjected to discrimination under any program or activity leading to the award of a contract.

Executive Order N-6-22 – Russia Sanctions On March 4, 2022, Governor Gavin Newsom issued Executive Order N-6-22 (the EO) regarding Economic Sanctions against Russia and Russian entities and individuals. “Economic Sanctions” refers to sanctions imposed by the U.S. government in response to Russia’s actions in Ukraine, as well as any sanctions imposed under state law. By submitting a bid or proposal, Contractor represents that it is not a target of Economic Sanctions. Should the State determine Contractor is a target of Economic Sanctions or is conducting prohibited transactions with sanctioned individuals or entities, that shall be grounds for rejection of the Contractor’s bid/proposal any time prior to contract execution, or, if determined after contract execution, shall be grounds for termination by the State.

The right is reserved by the City of Visalia to reject any or all proposals, to waive any irregularities or informalities not affected by law, to evaluate the proposals submitted and to award the contract according to the proposal which best serves the interests of said City. Legal Ad Dates: 08/21/24 & 8/27/24

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

Title TABLE OF CONTENTS page I. Definitions .........................................................................................................................................5 II. Introduction ......................................................................................................................................5 A. Information .........................................................................................................................5 B. Background .........................................................................................................................6 C. Purpose and Objective ........................................................................................................7 D. RFP/Agreement Schedule ...................................................................................................7 III. Scope of Services/Project .................................................................................................................7 A. Project Overview .................................................................................................................7 B. Assessment .........................................................................................................................7 C. Cyber Resilience Program and Implementation Plan..........................................................8 D. City Responsibilities ............................................................................................................9 IV. Proposal Content and Format Requirements ..................................................................................9 A. General Information ...........................................................................................................9 B. Staff Qualifications and Related Experience .....................................................................10 C. Proposed Project Approach ..............................................................................................11 D. Proposed Fee Structure and Schedules ............................................................................12 E. General Contract Requirements .......................................................................................12 F. Conflict of Interest ............................................................................................................13 G. Required Documents ........................................................................................................13 V. Consultant Selection Procedure .....................................................................................................13 A. Criteria & Weight ..............................................................................................................13 B. Background Check .............................................................................................................14 C. Award of Contract .............................................................................................................14 VI. General Conditions ........................................................................................................................14 A. Important Notice ...............................................................................................................14 B. Contracting Agency ...........................................................................................................14 C. Legal Responsibilities ........................................................................................................15 D. Insurance ...........................................................................................................................15 VII. Contract Requirements ..................................................................................................................16 A. Withdrawal of Proposals ...................................................................................................17 B. Rejection of Proposals.......................................................................................................17 C. Evaluation/Award of Contract ..........................................................................................17 D. Proposal Pricing Guidelines ...............................................................................................18 E. Assignment of Contract.....................................................................................................18 F. Right to Require Performance ..........................................................................................18 G. Ethics in Public Contracting ...............................................................................................18 H. Equal Employment Opportunity .......................................................................................18 I. Venue ................................................................................................................................19 J. Proprietary Information ....................................................................................................19 K. Incurring Costs ..................................................................................................................19 L. Firearms Prohibited ..........................................................................................................19 M. Executive Order – Russian Sanctions ................................................................................19 VIII. Measurement and Payment ..........................................................................................................20 IX. Special Conditions Applicable to this Federally Funded Project ............................................... 20 A. Required Bonds ................................................................................................................20 B. Federal Uniform Guidance 2 CFR Part 200 .......................................................................20 C. Project Administrative Issues ............................................................................................20 X. Sample Professional Services Agreement ................................................................................ 22-29

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

Additional Attachments (must be completed and returned with Response to RFP) Attachment 1: Disclosures
Attachment 2: Federal Forms and Clauses with signature page.

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

I.

DEFINITIONS

For the purposes of RFP No. 24-25-03, the following terms shall have the meanings indicated:

1. “City” means the City of Visalia

2. “City Council” means the Council of the City of Visalia

3. “Bidder”, “Vendor”, “Supplier”, “Consultant”, “Contractor” and “Sub-recipient” are used interchangeably throughout this invitation to mean the person, firm, or corporation or other entity submitting a Bid in response to the Request for Bid.

4. “Bid” and “Proposal” are used interchangeably to mean an individual’s or entity’s offer in response to this Request for Proposal.

5. “RFP” means Request for Proposal No. 24-25-03.

II.

INTRODUCTION

A. Information
The City of Visalia (City) has issued this Request for Proposal (RFP) to solicit responses from qualified technology security consulting firms (Proposers) offering proven Cyber Security Assessment services and the creation of Cyber Resilience Programs and Implementation Plans.

The City seeks a qualified Proposer who can demonstrate organizational, functional, and technical capabilities, as well as the experience, expertise, and qualifications necessary to fully audit and assess the security of the City’s current network and system environment, and then create a detailed Cyber Resilience Program (CRP) and Implementation Plan to strengthen our technology security and meet appropriate standards.

This project is supported, in whole or in part, by federal award number SLFRP2005, awarded to City of Visalia by the U.S. Department of the Treasury. Federal Funds being utilized for this project is American Rescue Plan Act Funds (ARPA).

This Request for Proposals is being issued by the City of Visalia Purchasing Division. Unless otherwise directed, all communications regarding this Request for Proposals should be directed to the Purchasing Division, at (559) 713-4334. To avoid miscommunication, the Purchasing Division prefers that all questions be submitted in writing via email to [email protected]

Any revisions to the Request for Proposals will be issued and distributed as addenda. Proposers are encouraged to submit any questions or items for clarification in writing to the above email address.

B. Background
About the City
The City of Visalia, CA (“vy-sail-yah”) covers 37 square miles with a diverse population of nearly 145,000 that is growing at an estimated rate of two percent per year. Visalia is located in the San Joaquin Valley, a large and agriculturally rich basin that runs through the center of the state. It is located at the junction of Highways 99 and 198, on the western side of the majestic Sierra Nevada Mountain Range. Visalia sits 185 miles north of Los Angeles and 225 miles south of San Francisco.

Additionally, Visalia is surrounded by many opportunities to explore the great outdoors. Often referred to as the “Gateway to the Sequoias,” Visalia is the closest major city to Sequoia and Kings Canyon National Parks, home to some of the largest trees on Earth, the Giant Sequoias.

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

The City of Visalia has 683 allocated full-time positions and typically employs an additional 100-200 hourly (temporary/seasonal) employees throughout the year.

City’s Current Environment
In order to help Proposers prepare their RFP responses, this section documents the existing technology environment.

The City’s environment consists of:
 1000 Computers
 300 Mobile Devices (Phones and Tablets)
 200 Servers
 100 Copiers and Printers
 50 IP Addresses That are Publicly Accessible
 110 Switches, Routers, and Firewalls
 45 Buildings

The selected vendor will be required to execute a Non-Disclosure Agreement with the City of Visalia to receive high level network diagram of the City’s infrastructure, declaring that any information obtained as part of this study will not be released to anyone other than the City of Visalia.

C. Purpose, Objective and Services to be Provided

With this RFP, the City intends to fully assess and audit the security of all elements of the City’s technology environment. The City’s goal is to have a comprehensive and detailed review of the current environment, and then the creation of a Cyber Resilience Program (CRP) as well as an implementation plan to improve our overall technology security posture.

The Proposer should use IT industry standards to perform the assessment, including vulnerability assessments and penetration testing. A gap analysis should be used to demonstrate the effectiveness of current City IT infrastructure, security, and resourcing to identify and mitigate potential risk vulnerabilities.

The analysis will outline security weaknesses versus best practices and applicable policies and laws.

Proposer is to provide the following:

 Threat level (high, medium, low)
 Level of effort to mitigate threat (high, medium, low)  Estimated resource requirements to mitigate threats

The vendor’s response shall demonstrate an understanding of the subject matter and describe the approach that will be taken to accomplish the services requested.

In addition, the Proposer will need to provide a framework for a Cyber Resilience Program along with a Cyber Security Implementation Plan which together should include best practices guidance, needed technical configuration modifications, equipment, testing plans, and training. This plan should be tied to meeting, at a minimum, the Center for Internet Security (CIS) Controls.

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

D. RFP/Agreement Schedule

Activity Wed
RFP Available to the Public Wednesday, August 21, 2024
Proposer Conference @ 10:00 a.m. - Virtual Wednesday, September 4, 2024 Deadline for Written Questions Monday, September 9, 2024 RFP Submission Deadline @ 2:00 p.m. Wednesday, September 18, 2024 Review RFP responses, short list established, vendors
notified, and interviews and/or demonstrations September 18 – October 4, 2024 Consultant Interviews, presentations/demonstrations (if required) By or before October 18, 2024
Consultant Selection & fees negotiated By or before November 1, 2024 Council approval of contract & contract execution
November/December, 2024 (Estimated
Date)
Initial meeting with City staff December 2024 (Estimated Date) Work with City Staff - clarifications, programs, etc., if applicable tbd
Italicized items and dates are at the City’s option. The City reserves the right to award contract solely on the basis of proposal content.

III.

SCOPE OF SERVICES/PROJECT

A. Project Overview

 Ensure the City is meeting due diligence in achieving regulatory compliance with protecting the confidentiality, privacy, integrity and availability of critical data and systems  Develop comprehensive security policies based on CIS Controls, industry standards and best practices, and regulatory requirements
 Facilitate in implementing the security policies, software, hardware and CIS Controls which will serve as the foundation for more informed decision-making and increased security awareness among staff
 Provide Cyber Security Training to City staff in the form of Security Awareness Training and Phishing Simulations
 Identify any gaps or vulnerabilities in the City’s current organizational security controls and policies and make recommendations and necessary adjustments to correct them  Provide training and knowledge transfer to the City’s Information Systems staff as necessary to continue to improve the security of the City’s technology infrastructure

B. Assessment

The Cyber Security Assessment shall include, but not be limited to, a detailed review of the areas listed below. Vulnerability assessments and penetration testing should also be performed in the areas where appropriate. After completion, the vendor will be expected to provide a written report, an electronic copy of the report, and a presentation of its findings. The report shall address each item listed below and provide a summary of suggested remediation (if any).

Vulnerability assessments and penetration testing services will be used to identify and validate configuration and/or technical flaws within a given system or network (e.g. firewalls, routers, servers, operating systems, applications, databases, etc.).

The assessment should take into consideration the following:

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

 Policies, procedures and standards
 Network Device Configurations (core, edge)
 Network Architecture
 Wireless Infrastructure and Configuration
 Firewall Configuration
o VPN Configuration
o DMZ Configuration
 Server Environment and Configurations
 VMware Virtual Environment
 Data and Information Security
 VOIP Environment and Configuration
 Mobile Devices
 Desktop and Laptop Configurations
 Physical Security
 Publicly Accessible Websites and Services
 Cloud Environments, including Microsoft Entra Tenant Audit

C. Cyber Resilience Program (CRP) and Implementation Plan

 The CRP outlines and describes the processes, policies and roadmap for effectively addressing and correcting the above assessed areas.
 Prioritize and rank cyber resilience objectives, concerns, existing staffing, resources, services and programs based on the ability to achieve the City’s vision in conjunction with and in support of the City’s adopted plans – the Visalia Strategic Plan and the Information Systems Strategic Plan.  Evaluate the City’s current operations and governance, as well as organizational structure, budget, policies and vehicles to ensure that these best meet the City’s cyber resilience programs through the most effective processes, contract provisions, service agreements, resource allocations, employee staffing and development, and reporting relationships.  Assist in developing a process/plan/policies which stimulate organizational change and acceptance related to the implementation of new security program and policies.  Identify and estimate the initial implementation as well as ongoing lifecycle requirements in level- of-effort, skills, personnel and budget over the first three years.  Assist with developing strategies to plan for future exploits and unknown threats. o Identify Key Performance Indicators (KPI’s) and effectiveness metrics for continually evaluating the CRP effectiveness.
 The CRP should include a plan to establish and implement a training program for City of Visalia staff which will provide the knowledge and information necessary to effectively understand the security policies being implemented. Example: New hire security training, annual security awareness training et cetera.

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

o The CRP should also include a plan for training City Information Systems Staff. o Training for the managing and monitoring of any software or hardware used as part program.
o The CRP should include Cyber Security Awareness Training and Phishing Simulations.  The CRP should address effective methods for business recovery in the event of a Cyber Security incident.
 The CRP should provide methodologies and examples for tabletop and other practical exercises to train for responding to Cyber Security incidents.
 The CRP should address managing organizational culture changes in creating a security awareness program. The CRP should include staff at all levels.

D. City Responsibilities
 Compensate the consultant as provided in the contract agreement.  Provide a “City Representative”, who will represent the City and who will work with the consultant in carrying out the provisions of the RFP. The Consultant shall communicate with the City representative who will provide the following services:
 Provide consultant with or contact with the appropriate department or staff related to documentation, if recently completed, available, applicable and necessary for completion of Consultant’s work.
 Examine documents submitted to the City by the Consultant and render timely decisions pertaining thereto.
 Give reasonably prompt consideration to all matters submitted by the Consultant for approval to the end that there will be no substantial delays in the Consultant’s program of work.  Process invoices submitted by Consultant.
 Act as coordinator between Consultant and other City representatives.

IV.

PROPOSAL CONTENT AND FORMAT REQUIREMENTS

The following are proposal requirements. Respondents are requested to organize their proposal into sections with tabs corresponding to the listed selection criteria as follows. You must answer the following questions in the same sequence as below. A screening committee will evaluate the completeness of the response to the RFP.

Proposal submissions shall contain thorough description and analysis of the following information in the order presented below:

A. General Information

1. Brief Cover Letter/Letter of Introduction
 The cover letter shall include the name and address of the organization submitting the Proposal and the name, address, phone number, and email address of the contact person who will be authorized to make representations for the organization. The cover letter shall clearly identify the project the Vendor is proposing on.
 Specify type of organization (individual, partnership or corporation) and if applicable indicate whether you are:
o Small Business.
o Disadvantaged Business.
o Minority and/or Women-Owned Business.
 References and Referrals

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

2. Executive Summary
 An overview of your company with any third parties who will work with you on the delivery of this work. If you are using a third party, please list the roles each party will play in the overall delivery of the solution.
 Discussion regarding your experience serving organizations such as the City of Visalia

3. Lead Project Contact
 Name, title and telephone number of the prospective Vendor’s designated lead contact person for communications pertaining to this proposal.

B. Staff Qualifications and Related Experience

1. Project Team
 Description of team members assigned to the project and their respective roles. It is expected that once the analysis begins, the project team will remain in place until the work is completed. Please include statements regarding the length of commitment of the proposed staff if they are not available for the duration of this project.  Organizational chart illustrating team members assigned to the project and their respective roles.
 A brief biography or resume of each team member and their experience working with municipal departments, commissions, elected officials, and the community.  Provide a staffing matrix that identifies the specific roles/responsibilities to be filled by Proposer staff versus those to be filled by City staff. As part of this matrix, identify estimated level of effort for each staff person and when that person would be required.  Identification of specific sub-contractors who will be assigned to the project, and their specific roles and responsibilities.
 Note: Consultant may not substitute any member of the project team without prior written approval of the City.

2. Firm Experience and Qualifications
 A general description of the services provided by the proposer’s firm and sub-Vendor.  A list of at least three representative projects completed by the firms and individuals proposed to work on this project that best exemplify the work requested in this RFP.  For each project reference, include the project name, the client contact, the client’s phone number and email, the dates the work was accomplished, a brief description of the work accomplished, and the total contract amount awarded vs the final contract amount at the end of the project.
 Vendor and sub-Vendor document samples for similar projects.

3. Examples of Work
In this section, Proposer should provide samples of all documents and reports substantially similar projects prepared for at least two other organizations. These would ideally be California agencies of similar size to the City of Visalia.

We acknowledge and respect that other agencies likely would have requested non-disclosure agreements as we will request from selected vendor. We expect that vendors can provide ‘scrubbed’ versions of the samples.

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

C. Proposed Program Approach
Summarize your approach and understanding of the project and any special considerations of which the City of Visalia should be aware. Indicate clearly, the levels of participation you will expect from City of Visalia staff in the fulfillment of the contract.

Any exceptions to the requirements of the RFP should be clearly delineated in this section.

In addition, you are invited to include a maximum of two (2) pages of information not included, nor requested in this RFP, if you feel it may be useful and applicable to this project.

The information in this section will aid the City in the refinement of the scope of work during contract negotiations.

1. Cyber Assessment Approach
Describe assessment project in relation to the following:
o Provide a staffing matrix that identifies the specific roles/responsibilities to be filled by Proposer staff versus those to be filled by City staff. As part of this matrix, identify estimated level of effort for each staff person and when that person would be required.  Project Management
o Describe project management methodology/approach
o Provide a Project Schedule that identifies tasks, activities, dates, durations, resources, deliverables, and milestones
o Provide a Project Plan that describes your approach to Schedule Management, Scope Management, Communications Management, Issues Management, Risk Management, Change Management, etc.
o Identify any additional resource requirements for the project

 Technological Assessment Areas
o Describe the approach for evaluating all the areas listed in “Assessment”. o Describe recommendations for vulnerability and penetration testing.

2. Scope of Work including Tasks and Deliverables.
 A narrative describing the approach and work plan, including any studies for completing the scope of work.
 On a per task basis, the narrative should identify the designated team member(s) responsible for completing the work, specific deliverables, and the number of meetings to attend.  If additional services are required for successful implementation, please include those in the proposal. Include an explanation of all additional services proposed and indicate if pricing is one-time-only or ongoing and pricing terms and frequency.  Any additional suggestions Vendor believes would be valuable to include in this effort and any suggestions for further clarifying the scope or work and the usefulness of the product.  Provide an estimated schedule for completion of the project.  Please include a detailed work plan for the scope of work, as outlined in this RFP, including tasks and hours for each team member.

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

3. Project Schedule
 Include a project what timeline, that includes when the Vendor can begin the project once the contract is awarded, what is the estimated duration of each phase of the project and estimated public launch date.
 Include the timeframe for completion of tasks, including milestone dates for primary deliverables.
 Include discussion of where the project timeline may slip or is susceptible to delay if assumptions are not met relative to project task completion. As it is anticipated the project will have an assertive schedule, it is important for the City to understand the proposer’s expectations for City staff document review timeframes included in this schedule.  For project management purposes, the schedule should indicate how often there are meetings with City staff.

D. Proposed Fee Structure and Schedule (Under separate sealed cover) The Proposed Fee Structure and Schedule shall be provided under separate, sealed cover (envelope) as a part of the RFP submittal. Only one (1) sealed envelope containing Proposer’s Fees is requested.

Proposed fee structure must clearly list, in detail, what services will be provided, and the associated costs for each component. Provide proposed fees and cost information and recommend a budget plan for all services to be provided in the following format:

 A detailed budget estimate, including the hourly rates and time commitments for all team members and sub-Vendors by task for the project. Hourly rates included will be fixed for the duration of the project and will be applied to any change orders or additional work requests.  Indicate whether each pricing component is one-time-only or ongoing.  Indicate the payment terms and frequency.
 Denote any proposed optional tasks.
 Include similar information for any sub-contractor.
 Provide a sample billing invoice.
 Provide an estimate of travel expenses for completion of this project, if any.

Include a total cost to provide services, based on the consultant’s fee schedule and the scope of work as outlined in this RFP. This cost will be used as a basis for negotiations.

The fee proposal submitted under separate, sealed cover, along with the proposed project approach, will be used as a basis for any contract negotiations. The actual scope of services and fees included in the contract may be negotiated and may vary to satisfy the City’s actual needs.

E. General Contract Requirements
 Proof of Insurability: A brief statement or certificate of insurance from an acceptable insurance company setting forth that insurance coverage as required in the attached sample agreement, at a minimum, will be available at the time of commencement of the project. The City reserves the right to request additional insurance coverages and amounts through the final Agreement negotiated between the City and Vendor selected.
 Concurrence with contract provisions: A brief statement that the proposer concurs with the provisions of the City’s standard contract as attached to the RFP. Under certain circumstances, and subject to the discretion of the City, some provisions of the contract may be modified upon final contract negotiations with the selected Vendor.

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

F. Conflict of Interest
 Disclose any financial, business or other relationship with the City or any member of the City staff that may have an impact on the outcome of the project.
 List current clients who may have a financial interest in the outcome of the project.

G. Required Documents
 Complete and submit Attachment 1: Disclosures
 Complete and Submit Attachment 2: Federal Forms and Clauses with signature page.  A signed copy of all addenda issued for this RFP.

V.

CONSULTANT SELECTION PROCEDURE
Selection of the successful proposal shall be generally based on the information provided by the Consultant in response to the Request for Proposals and any subsequent interviews that may be conducted.

Consultant interviews will be held solely at the option and discretion of the City of Visalia.

The process for selection shall occur in the following sequence:

I. Review Proposals
II. Establish a “short list” of three or more firms
III. Interviews/Presentations by “short-listed” firms (at the option and discretion of the City) IV. Demonstration of products of top ranked Proposers
V. Identify best qualified firm
VI. Determine which, if any, alternates will be selected, and negotiate a fee VII. Award contract

A project Selection Committee, as deemed necessary, will be formed to evaluate the proposals and to make recommendation to the Visalia City Council. This committee may consist of representatives of the user department, members of other City Departments, and may include a representative knowledgeable in Cyber Security Assessment from outside of the community. Composition and creation of this committee, should one be formed, is at the sole discretion of the City. Names of the Committee members, should one be formed, will not be released prior to the time for interviews.

The Committee will review the proposals for format to ensure conformance with the requirements of the RFP and may select finalists to interview/make presentations or give demonstrations to the Committee as a part of the Committee’s evaluation process. The City does not guarantee that an interview will take place, thus reserving the right to select a consultant based solely on the information provided in the proposals received in response to the RFP. Should an interview take place, the key personnel responsible for fulfilling the requirements of the project shall be required to be present for the interview.

A. Criteria & Weight of Criteria
The Committee will address the following criteria in evaluation of proposals in order to gauge the ability of a consultant to perform the contract as specified. The same general criteria will be used to judge both the proposal and the presentation, should the City choose to conduct interviews with short-listed firms.

Criteria Explanation Weight/Points
Merit of Proposal Submitted /
Presentation
 Thoroughness of Proposal Submitted
 Required Forms completed & submitted 15
Experience, Qualifications of
the Firm
 Background information on
company/organization
 Adequacy of Staff to perform the work specified
 References
15 RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

 Ability to work effectively with City staff, other
public agencies and related parties
Experience & Qualifications of
Personnel & Record of Past
Performance
 Experience & qualifications of the Proposer’s
team in working on similar projects and with
local government
15 Experience- Specific to Time
and Attendance Applications
 Past Projects (size and similarity to those
specifications described in this RFP) 20
Responsiveness & Ability to
Provide Services and meet
needs of the City of Visalia
 Proposer Responses to Proposed Program
Approach 35

Prior to the award of contract, the City must be assured that the proposer selected has all of the resources required to successfully perform under the contract. This includes, but is not limited to, personnel with the skills required, equipment/materials and financial resources sufficient to provide services called for under this contract. If, during the evaluation process, the City is unable to assure itself of the proposer’s ability to perform under the contract, if awarded, the City has the option of requesting from the proposer, any information that the City deems necessary to determine the proposer’s capabilities. If such information is required, the proposer will be notified and will be permitted seven (7) working days to submit the requested information.

B. Background Check
The City reserves the right to conduct a background inquiry of each proposer which may include the collection of appropriate criminal history information, contractual and business associations and practices, employment histories and reputation in the business community. By submitting a proposal to the City, the proposer consents to such an inquiry and agrees to make available to the City such books and records as the City deems necessary to conduct the inquiry.

C. Award of Contract
The successful firm will be required to execute a contract with the City of Visalia. A Draft Agreement has been included in this RFP to alert proposers to the provisions generally found in City contracts. The Draft Agreement may be altered from the enclosed form at the discretion of the City and without notice to consultant prior to award of contract. The City does not guarantee that the Final Agreement will duplicate the enclosed Draft Agreement.

VI.

GENERAL CONDITIONS

A. Important Notice
The City of Visalia will not be responsible for oral interpretations given by any City employee, representative, or others. Proposers are cautioned that any statements made that materially change any portion of the proposal documents shall not be relied upon unless subsequently ratified by a formal written amendment to the proposal document. The issuance of a written addendum is the only official method whereby interpretation, clarification, or additional information can be given. If any addenda are issued to this Request for Proposals, the City will attempt to notify all prospective vendors who have secured same. However, it will be the responsibility of each vendor, prior to submitting their proposal, to contact the Purchasing Division, located at 707 W. Acequia, Visalia, CA 93291, (559) 713-4334 to determine if addendums were issued and to make such addendum a part of the proposal.

B. Contracting Agency
The contract resulting from this Request for Proposals will be administered by the City of Visalia Information Services Department and the Purchasing Division.

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

C. Legal Responsibilities
It is the responsibility of Contractor to comply with all local, state, and federal laws and regulations which apply to this project. This includes, but is not limited to, compliance with Uniform Building, Plumbing, Mechanical, Electric, and Fire Codes. Contractor shall provide a safe working environment in compliance with the Occupational Safety and Health Act, and California Health and Safety Code.

Contractor shall secure all necessary permits, licenses, and similar requirements to carry out the project (if any). Contractor shall comply with all applicable labor laws and ensure against discrimination.

Permits and Licenses

1. Business Tax Certificate
Possession of a City of Visalia Business Tax Certificate is not required to submit a proposal in response to this invitation. However, Consultant shall be required to possess, at his/her own expense, a valid and current City of Visalia Business Tax Certificate, prior to commencing work.

Fee is based on gross receipts for all business transactions in the City of Visalia. For additional information, contact the City of Visalia at (559) 713-4326.

1. Professional License
Consultant is to be licensed in accordance with the California Business and Professions Code and is to possess current professional registration and be licensed to perform work in the State of California.

2. Permits
Consultant shall be required to obtain and maintain at his/her own expense, any and all permits, licenses and certifications issued by any federal, state or local governmental agency, pertaining to, and necessary for providing the services required in this Request for Proposals.

D. Insurance

Indemnification and Insurance
As respects acts, errors, or omissions in the performance of services, CONTRACTOR agrees to indemnify and hold harmless CITY, its elected and appointed officers, employees, and CITY designated volunteers from and against any and all claims, demands, losses, defense costs, liability or consequential damages arising directly out of CONTRACTOR’s negligent acts, errors or omissions in the performance of his/her services under the terms of this Agreement; except to the extent those arise out of the negligence of CITY.

CITY agrees to indemnify and hold harmless CONTRACTOR, its officers, employees, and designated volunteers from and against any and all losses, defense costs, liability or consequential damages to the extent arising out of CITY’S negligent acts, errors or omissions in the performance of this Agreement.

As respects all acts or omissions which do not arise directly out of the performance of services, including but not limited to those acts or omissions normally covered by general and automobile liability insurance, CONTRACTOR agrees to indemnify, defend (at CITY’s option), and hold harmless CITY, its elected and appointed officers, agents, employees, representatives, and volunteers from and against any and all claims, demands, defense costs, liability, or consequential damages of any kind or nature arising out of or in connection with CONTRACTOR’s (or CONTRACTOR’s subcontractors, if any) performance or failure to perform, under the terms of this Agreement; except to the extent those which arise out of the negligence of CITY.

Without limiting CITY’s right to indemnification, it is agreed that CONTRACTOR shall secure prior to commencing any activities under this Agreement, and maintain during the term of this Agreement, insurance coverage as follows:

 Workers’ Compensation insurance as required by California statutes.

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

 Commercial general liability insurance with a combined single limit of not less than One Million Dollars ($1,000,000) per occurrence. Such insurance shall include coverage for Premises and Operations, Contractual Liability, Personal Injury Liability, Products and Completed Operations Liability, Broad Form Property Damage (if applicable), Independent Contractor’s Liability (if applicable).

 Professional Liability insurance coverage, in an amount not less than One Million Dollars ($1,000,000).

 Comprehensive Automobile Liability coverage with a combined single limit of not less than One Million Dollars ($1,000,000) per occurrence. Such insurance shall include coverage for owned, hired, and non-owned automobiles and shall be provided by a business automobile policy.

Each insurance policy required by this Agreement shall contain the following clause:

“This insurance shall not be canceled, limited in scope or coverage, or non-renewed until after thirty (30) days prior written notice has been given to the City Clerk, City of Visalia, 707 W. Acequia, Visalia, CA 93291, with the exception of cancellation for non-payment of premium, in which case ten (10) days’ notice shall be given”, In addition, the Commercial general liability and comprehensive automobile liability policies required by this Agreement shall contain the following clauses:

“It is agreed that any insurance maintained by the City of Visalia shall apply in excess of and not contribute with insurance provided by this policy.”

“The City of Visalia, its officers, agents, employees, representatives and volunteers are added as additional insureds as respects operations and activities of, or on behalf of the named insured, performed under contract with the City of Visalia.”

The successful bidder shall maintain the insurance for the life of the contract. Endorsements are to be received and approved by the City before work commences. Should contractor cease to have insurance as required during any time, all work by contractor pursuant to this agreement shall cease until insurance acceptable to the City is provided.

VII.

CONTRACT REQUIREMENTS AND ACCEPTANCE OF

PROPOSAL CONTENT
Before submitting a proposal, proposer’s must satisfy themselves by personal examination of the proposal requirements and other contract documents, and by any other means as they may believe necessary, as to the actual conditions, requirements, and difficulties under which the work must be performed and to verify any representations made by the City of Visalia, upon which the offeror will rely.

The submission of a proposal shall be considered conclusive evidence that the proposer has carefully investigated all conditions that affect, or may at some future date affect the performance of services covered by this solicitation, and is satisfied as to the character, quality, and quantities of work to be performed and as to the requirements of the proposal. Submission of a proposal shall also be evidence that the proposer is familiar with directives that in any way affect prosecution of the work or persons engaged or employed in the work.

No proposer shall at any time after submission of a proposal make any claim or assertion that there was any misunderstanding or lack of information regarding the nature or amount of work necessary for satisfactory performance under the contract. If the proposer receives an award as a result of this Request for Proposals, failure to have made such investigations and examinations will in no way relieve the proposer from its obligations to comply in every detail with all provisions and requirements of the contract documents, nor will a plea of ignorance of such conditions and requirements be accepted as a basis for claim

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

whatsoever by the proposer for additional compensation. Any errors, omissions, or discrepancies found in the specifications or other contract documents shall be called to the attention of the City and clarified prior to the submission of proposals.

Should the proposer feel there has been a supplemental or oral modification, it shall be his responsibility to verify said modification in writing prior to submission of the proposal.

The contents of the proposal of the successful proposer shall become contractual obligations if procurement action ensues. Failure to accept these obligations in a contractual agreement shall result in cancellation of award.

A. Withdrawal of Proposals
Any proposal may be withdrawn at any time prior to the time fixed in the public notice for the receipt of proposals, only by written request for the withdrawal of the proposal filed with the Purchasing Division. The request shall be executed by the proposer or his duly authorized representative. The withdrawal of a proposal does not prejudice the right of the proposer to file a new proposal. No proposal may be withdrawn after the time fixed in the public notice for the receipt of proposals.

B. Rejection of Proposals
Failure to meet the requirements of the RFP may be cause for rejection of the proposal. The City may reject the proposal if it is deemed incomplete, contains irregularities of any kind or is offered conditionally. The City reserves the right to reject any and all proposals without cause.

The proposal is to be prepared in such a way as to provide a straightforward, concise delineation of the information requested. Proposals which contain false or misleading statements, or which do not support an attribute or condition claimed by the proposer, may be cause for rejection of the proposal. If, in the opinion of the City, such information was intended to mislead the City in its evaluation of the proposal, it will be cause for rejection of the proposal.

C. Evaluation/Award of Contract
Evaluation and selection of proposals will be based on the information called for in this RFP. Brochures or other promotional presentations beyond that sufficient to submit a complete and effective proposal are not desired. Elaborate artwork, expensive paper or binders, and expensive visuals are not necessary.

Proposals will be evaluated by a Selection Committee. This committee may consist of representatives of the user department, members of the community, the Purchasing Division, and may include a representative knowledgeable in engineering services from outside of the community. In connection with its evaluation, the City may, at its option, invite one or more proposers to make an oral presentation to the Selection Committee. During these interviews, the proposers will be allowed to present such evidence as may be appropriate in order that the Committee can correctly analyze all materials and documentation submitted as a part of the proposals.

The award, if made, will be made within ninety (90) days from proposal closing date. Proposer agrees and so stipulates in submitting this proposal, as though stated therein, and in any subsequent award of contract that:

1. Proposer is an independent contractor, not an employee, agent, or officer of the City.

2. Contract, should it be awarded, shall be interpreted, construed, and given effect in all respects according to the laws of the State of California.

3. Should proposer be awarded contract, proposer shall not assign contract, or any part thereof, or any moneys due or to become due thereunder, without prior consent of the City.

Proposer shall indemnify and hold harmless the City, its officers, officials, employees, and agents from and against all claims, damages, losses, and expenses caused in whole or in part by any negligent act or

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

omission of the proposer, its consultants, subcontractor, anyone directly or indirectly employed by any of them, or anyone for whose acts any of them may be liable, except where caused by the active negligence, sole negligence, or willful misconduct by the City.

Proposer shall hold the City harmless from liability of any nature or kind, including cost and expenses for infringement or use of any copyrighted composition, secret process, patented or unpatented invention, article or appliance furnished or used in connection with the contract.

Proposer warrants that no gratuities, in the form of gifts, entertainment, or otherwise, were offered or given by the proposer, to any officer or employee of the City with a view toward securing the contract or securing favorable treatment with respect to any determination concerning the performance of the contract. For breach or violation of this warranty, the City shall have the right to terminate the contract, either in whole or in part. The rights and remedies of the City provided in this clause shall not be exclusive, and are in addition to any other rights and remedies provided by law or under the contract.

D. Proposal Pricing Guidelines
Proposer shall provide proposed fees and cost information as a part of this Request for Proposals.

Proposed fees shall be submitted under separate, sealed cover and in great detail.

E. Assignment of Contract
No assignment by the vendor of the contract or any part hereof, or of funds to be received there under, will be binding upon the City unless such assignment had prior written approval and consent of the City. In the event the City gives such consent, the terms and conditions of the agreement shall apply to, and bind the party or parties to whom such work is assigned, sublet or transferred.

F. Right of Requirement Performance
The failure of the City at any time to require performance by the proposer of any provisions hereof shall in no way affect the right of the City thereafter to enforce the same. Nor shall waiver by the City of any breach of any provision hereof be taken or held to be waiver of any succeeding breach of such provision or as a waiver of any provision itself.

G. Ethics in Public Contracting
Each proposer, by submitting a proposal, certifies that it is not a party to any collusive action or any action that may be in violation of the Sherman Antitrust Act by submitting a proposal, the proposer certifies that its proposal was made without fraud; that it has not offered or received any kickbacks or inducements from any other proposer in connection with the request for proposal; and that it has not conferred on any public employee, public member or public official having responsibility for this procurement transaction, any payment, loan, subscription, advance, deposit of money, services, or anything of more than nominal value.

The proposer further certifies that no relationship exists between itself and the City or another person or organization that interferes with fair competition or constitutes a conflict of interest with respect to a contract with the City of Visalia.

Prior to the award of any contract, the potential Consultant may be required to certify in writing to the Purchasing Division that no relationship exists between the proposer and any City employee, officer, official or agent that interferes with fair competition or is a conflict of interest with respect to a contract with the City of Visalia.

More than one proposal from an individual, firm, partnership, corporation or association under the same or different names may be rejected. Reasonable grounds for believing that a proposer has interest in more than one proposal for the work solicited may result in rejection of all proposals in which the proposer is believed to have an interest.

H. Equal Employment Opportunity
During the performance of the contract, proposer agrees to the following:

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

1. Proposer shall comply with all the requirements, when applicable, of the California Fair Employment Practice Commission and provisions of, when applicable, all Federal, State of California, County of Tulare and City of Visalia laws and ordinances related to employment practices.

2. Proposer shall not discriminate against any employee or applicant for employment on the basis of race, religion, color, gender, age, handicap, national origin or ancestry, except when such a condition is a bona fide occupational qualification reasonably necessary for the normal operations of the proposer. The proposer agrees to post in conspicuous places, visible to the employees and applicants for employment, notices setting forth the provisions of this nondiscrimination clause.

3. Proposer, in all solicitations or advertisements for employees, placed by, or on behalf of the proposer, shall state that proposer is an Equal Opportunity Employer.

I. Venue
Any contract resulting from this solicitation shall be governed by, and construed in accordance with, the laws of the State of California. Venue for any litigation arising out of the contract will be vested in Tulare County, California.

J. Proprietary Information
The proposals received shall become the property of the City of Visalia and are subject to public disclosure.

Proposal prices and information submitted by proposers will be made available to proposers after City Council has approved award of contract. Proposers are to indicate any restrictions on the use of data contained in their responses. Those parts of a proposal which are defined by the proposer as business or trade secrets, as that term is defined in California Government Code, Section 6254.7, and are reasonably marked as “Trade Secrets”, “Confidential” or “Proprietary” shall only be disclosed to the public if such disclosure is required or permitted under the California Public Records Act or otherwise by law. Proposers who indiscriminately and without justification identify most, or all, of their proposal as exempt from disclosure may be deemed non-responsive.

K. Incurring Costs
The City of Visalia is not liable for any cost incurred by proposers in responding to this Request for Proposals.

L. Firearms Prohibited
Guns may not be carried by contractors/vendors/consultants while working on City of Visalia premises without the expressed written approval of a City of Visalia Department Head, or an exemption in the contract. If a contractor/vendor/consultant is caught carrying a gun, without City permission, their contract will be terminated.

M. Executive Order N-6-22 – Russia Sanctions
On March 4, 2022, Governor Gavin Newsom issued Executive Order N-6-22 (the EO) regarding Economic Sanctions against Russia and Russian entities and individuals. “Economic Sanctions” refers to sanctions imposed by the U.S. government in response to Russia’s actions in Ukraine, as well as any sanctions imposed under state law. By submitting a bid or proposal, Contractor represents that it is not a target of Economic Sanctions. Should the State determine Contractor is a target of Economic Sanctions or is conducting prohibited transactions with sanctioned individuals or entities, that shall be grounds for rejection of the Contractor’s bid/proposal any time prior to contract execution, or, if determined after contract execution, shall be grounds for termination by the State.

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

VIII.

MEASUREMENT AND PAYMENT
A. Billing and Payment

Awarded Vendor is responsible for assuring that all services arising from the agreement are billed at the correct and applicable contract prices. The vendor is required to establish and maintain a process to monitor its billing practices and will refund all over-charges that may occur.

IX.

SPECIAL CONDITIONS APPLICABLE TO THIS FEDERALLY

FUNDED CONTRACT

A. Required Bonds
Awarded Consultant shall be required to submit a Performance Bond in the amount of one hundred percent (100%) of the agreement, as surety condition for the full, complete and faithful performance of the agreement. In addition, Awarded Consultant shall be required to furnish a Payment Bond in the amount of one hundred percent (100%) of the agreement if subcontractors are proposed to be used to complete this project.

According to City standards the surety company must be either a California Admitted Surety OR current Treasury Listed Surety (Federal Register) to its specified dollar limitation AND a current A.M. Best A: VIII rated surety.

B. Federal Uniform Guidance 2 CFR Part 200.

All federal procurement requirements provided in Uniform Guidance 2 CFR Part 200 shall be in effect.

Attachment 2 of this RFB “Federal Forms and Clauses” with signature page, outlines the applicable Federal Requirements. This project is supported, in whole or in part, by federal award number SLFRP2005, awarded to City of Visalia by the U.S. Department of the Treasury. Federal Funds being utilized for this project are American Rescue Plan Act Funds (ARPA).

C. Project Administrative Issues

1. Complete Project
The successful consultant shall be responsible for providing all materials, labor, equipment, and services necessary to fulfill the requirements of this RFP. It is the intent of this RFP and related agreement to describe a functionally complete project.

2. Quantities/Change Orders
The City reserves and shall have the right to make such changes to the work as may be necessary and desirable to complete the work originally intended in an acceptable manner. Unless otherwise specified herein, the Project Manager shall be and is hereby authorized to make such changes in the work as may increase or decrease the originally awarded contract quantities and/or total contract cost. The Contract Price, or the amount due the Contractor will only be reduced/increased after the price change is reviewed and authorized by the City of Visalia Change Order Committee.

Should the Contractor disagree with any terms or conditions set forth in an approved contract change order not executed by the Contractor, the Contractor shall submit a written protest to the Engineer within 15 days after the receipt of the approved contract change order and the procedures outlined in Section 4-1.03 of the Standard Specifications apply.

If a requested change order is sent back to the Contractor for revisions, the Contractor has 15 (fifteen) calendar days to resubmit.

Changes shall not invalidate the contract nor release the surety, and the Contractor agrees to accept payment for such changes as if the altered work had been a part of the original contract.

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

These changes which are for work within the general scope of the contract shall be covered by Change Orders issued by the City. Change orders for altered work shall include extensions of contract time where, in the Project Manager’s opinion, such extensions are commensurate with the amount and difficulty of added work.

Excessive altered work shall be covered by supplemental agreement that is subject to funding agency approval as applicable. If the City and the Contractor are unable to agree on a unit adjustment for any contract item that requires a supplemental agreement, the City reserves the right to terminate the contract with respect to the item and to make other arrangements for its completion.

3. Omitted Items
Project Manager is authorized to omit minor contract items. Major items must be omitted by supplemental agreement.

4. Extra Work
Contractor is prohibited from doing extra work, unless authorized in writing by Project Manager before the work is done. The Project Manager should obtain authorization from the Change Order Committee before agreeing to extra work requested by the Contractor. In the instances where it is necessary for the work to be done immediately, the Project Manager may authorize the work prior to taking the additions to the Change Order Committee. Payment for approved Extra Work shall be as agreed to in writing by the Project Manager prior to the Extra Work being completed or the Change Order Committee shall approve an increase in a Change Order issued after the Extra Work is completed. No additional payment is due for unauthorized Extra Work.

If the Project Manager authorizes Extra Work but the payment for the Extra Work has not been agreed to in writing prior to the work being completed, then Contractor shall submit to the Project Manager the documentation required for a Change Order within forty-five (45) days of completing the Extra Work. The Project Manager will submit a Change Order request for review and approval by the Change Order Committee. If the Contractor does not submit any documentation within that time period, the Project Manager may move forward with issuing a Change Order to adjust the contract price.

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

X. SAMPLE AGREEMENT

PROFESSIONAL SERVICES AGREEMENT FOR

CYBER SECURITY ASSESSMENT, CYBER RESILIENCE PROGRAM AND IMPLEMENTATION PLAN

This Agreement, entered into this ________ day of ________________, 20____, by and between the City of Visalia, hereinafter referred to as the “CITY”, and ____________________________ hereinafter referred to as the “CONSULTANT”.

W I T N E S S E T H

WHEREAS, the CITY is authorized and empowered to employ consultants and specialists in the performance of its duties and functions; and

WHEREAS, the CITY has the desire to secure certain technical and professional services to assist in the completion of the items of work described as “Scope of Services” in RFP No. 24-25-03, which along with the response submitted by CONSULTANT is attached as Exhibit “A”, and hereinafter referred to as the “PROJECT”; and

WHEREAS, the CONSULTANT represents it is licensed, qualified and willing to provide such services pursuant to terms and conditions of this Agreement; and

WHEREAS, this project will be supported, in whole or in part, by federal award number SLFRP2005, awarded to City of Visalia by the U.S. Department of the Treasury. Federal Funds being utilized for this project are American Rescue Plan Act Funds (ARPA).

NOW, THEREFORE, CITY and CONSULTANT agree as follows:

I. SERVICES TO BE PERFORMED BY THE CONSULTANT

A. Authorized Scope of Work: The CONSULTANT agrees to perform all work necessary to complete in a manner satisfactory to the CITY those tasks described in Exhibit “A” - Scope of Services, which shall be the Scope of Work for the project as described in RFP No. 24-25-03 unless the parties agree in writing to modify the Scope of Work as stated in the RFP, for the cost identified in Exhibit “B” - Project Fee.

B. Additional Services: Incidental work related to the PROJECT and not provided for in Exhibit “A” may be needed during the performance of this Agreement. The CONSULTANT agrees to provide any and all additional services at the rates identified in attached Exhibit “C” – Consultant Schedule of Fees for Professional Services. Such additional services shall not be performed by CONSULTANT without the written consent of CITY.

II. TIME OF PERFORMANCE
The CONSULTANT shall commence performance of this Agreement within ten (10) days of the effective date on the Consultant’s written Notice to Proceed and shall complete the work within the timeframes outlined in Exhibit “B”, unless otherwise extended in writing by CITY, in its sole discretion.

If the CONSULTANT fails to complete the PROJECT within the time specified, plus any extensions of time which may be granted, the CITY shall determine the percent of each work item completed and shall pay the CONSULTANT on that basis.

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

CONSULTANT shall not be responsible for delays which are due to causes beyond the CONSULTANT’s reasonable control. In the case of any such delay, the time of completion shall be extended accordingly in a writing signed by both parties.

III. COMPENSATION
A. Total Compensation: For services performed pursuant to this Agreement, the CITY agrees to pay and the CONSULTANT agrees to accept, a lump sum amount of _______________________________________ dollars ($ ) as shown in Exhibit “B”. This amount shall constitute complete compensation, including document production and out-of-pocket expenses for all services for the work and PROJECT identified in Exhibits “A” and “B”. CONSULTANT agrees these amounts, as authorized, will constitute complete compensation, including document production and out-of-pocket expenses, for services authorized by CITY for the PROJECT per the Scope of Work, Project Fees, and Schedule identified in Exhibit “A”, “B”, and “C”, respectively. No other compensation is authorized by this Agreement without separate written amendment.

B. Payment of Compensation: The CONSULTANT shall be compensated no more than monthly, based on percentage of work of each noted phase completed to date. The CONSULTANT shall be paid no later than thirty (30) days following submission of a written, verified billing to the CITY. Said billing shall include the percentage of each task completed to date and since the date of the preceding billing, if any.

IV. AUTHORIZED REPRESENTATIVE

A. CITY: The _____________________ shall represent the CITY in all matters pertaining to the services to be rendered under this Agreement, except where approval of the City Council of the City of Visalia is specifically required.

B. CONSULTANT: ______________ shall represent and act as principle for CONSULTANT in all matters pertaining to the services to be rendered by it under this Agreement.

V. TERMINATION
The right to terminate this Agreement, with or without cause, may be exercised without prejudice to any other right or remedy to which the terminating party may be entitled at law or under this Agreement.

A. Termination Without Cause: The CITY may terminate this Agreement at any time by giving written notice to the other of such termination and specifying the effective date thereof, at least fifteen (15) days before the effective date of such termination.

B. Termination of Agreement for Cause: The CITY may by written notice to the CONSULTANT specifying the effective date thereof, at least fifteen (15) days before the effective date of such termination, terminate the whole or any part of this Agreement in any of the following circumstances:

1. If the CONSULTANT fails to perform the services called for by this Agreement within time(s) specified herein or any extension thereof; or

2. If the CONSULTANT fails to make progress under this Agreement as to endanger performance of this Agreement in accordance with its terms, and does not correct such failure within a period of ten (10) days (or longer period as the CITY may authorize in writing) after receipt of notice from the CITY specifying such failure.

C. Post-Termination:

1. In the event the CITY terminates this Agreement with or without cause, the CITY may procure, upon such terms and such manner as it may determine appropriate, services similar to those terminated.

2. Except with respect to defaults of sub-consultants, the CONSULTANT shall not be liable for any excess costs if the failure to perform this Agreement arises out of causes beyond the control and

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

without the fault or negligence of the CONSULTANT. Such causes include, but are not limited to, acts of God or of the public enemy, floods, epidemics, quarantine restrictions, strikes, and unusually severe weather; but in the event the failure to perform is caused by the default of a sub-consultant, the CONSULTANT shall not be liable for failure to perform, unless the services to be furnished by the sub-consultant were obtainable from other sources in sufficient time and within budgeted resources to permit the CONSULTANT to meet the required delivery schedule or other performance requirements.

3. Should the Agreement be terminated with or without cause, the CONSULTANT shall provide the CITY with all finished and unfinished documents, data, studies, services, drawings, maps, models, photographs, reports, etc., prepared by the CONSULTANT pursuant to this Agreement.

4. Upon termination, with or without cause, CONSULTANT will be compensated for the services satisfactorily completed to the date of termination according to compensation Provisions contained herein. In no event, shall the total compensation paid CONSULTANT exceed the total compensation agreed to herein.

5. If, after notice of termination of this Agreement, as provided for in this article, it is determined for any reason that the CONSULTANT was not in default under the provisions of this article, then the rights and obligations of the parties shall be the same as if the Agreement was terminated without cause.

6. Termination of this Agreement shall not terminate any obligation to indemnify, to maintain and make available any records pertaining to the Agreement, to cooperate with any audit, to be subject to offset, or to make any reports of pre-termination activities.

VI. INTEREST OF OFFICIALS AND THE CONSULTANT

A. No officer, member, or employee of the CITY who exercises any functions or responsibilities in the review or approval of this Agreement shall:

1. Participate in any decision relating to this Agreement which effects his personal interest or the interest of any corporation, partnership, or association in which he has, directly or indirectly, any interest; or

2. Have any interest, direct or indirect, in this Agreement or the proceeds thereof during his tenure or for one year thereafter.

B. The CONSULTANT hereby covenants that he has, at the time of the execution of this Agreement, no interest, and that he shall not acquire any interest in the future, direct or indirect, which would conflict in any manner or degree with the performance of services required to be performed pursuant to this Agreement. The CONSULTANT further covenants that in the performance of this work, no person having any such interest shall be employed.

VII. NO PERSONNEL, AGENCY OR COMMISSION
The CONSULTANT warrants, by execution of this Agreement, that no personnel agency has been employed or retained to solicit or secure this contract upon an agreement or understanding for a commission, percentage, brokerage or contingent fee, excepting bona fide established commercial or selling agencies maintained by the CONSULTANT for the purpose of securing business. For breach or violation of this warranty, the CITY shall have the right to annul this Agreement without liability or, in its discretion, to deduct from this Agreement price or consideration, or otherwise recover, the full amount of such fee, commission, percentage, brokerage fee, gift, or contingent fee.

VIII. SUBCONTRACTING

A. The CONSULTANT shall not subcontract or otherwise assign any portion of the work to be performed under

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

this Agreement without the prior written approval of the CITY.

B. In no event shall the CONSULTANT subcontract work in excess of 50% of the contract amount, excluding specialized services. Specialized services are those items not ordinarily furnished by a consultant performing the particular type of project.

IX. INDEPENDENT CONTRACTOR
In the performance of the services herein provided for, the CONSULTANT shall be, and is, an independent contractor and is not an agent or employee of the CITY. The CONSULTANT has and shall retain the right to exercise full control and supervision of all persons assisting the CONSULTANT in the performance of said services hereunder. The CONSULTANT shall be solely responsible for all matters relating to the payment of its employees including compliance with social security and income tax withholding and all other regulations governing such matters.

X. SPECIFICATIONS
All specifications, manuals, standards, data collection, analysis, etc., either attached to this Agreement or incorporated by reference, are binding as to the performance of the work specified in this Agreement unless they are changed by written amendment to this Agreement modified in writing to incorporate such changes.

XI. DOCUMENTS/DATA

A. Ownership of Documents: All original papers and documents, produced as a result of this Agreement, shall become the property of the CITY. In addition, CITY shall be provided with access and use of any other papers and documents consistent with the purpose and scope of services covered by this Agreement. Any additional copies, not otherwise provided for herein, shall be the responsibility of the CITY.

Documents, including drawings and specifications, prepared by CONSULTANT pursuant to this Agreement, are not intended or represented to be suitable for reuse by CITY or others on extensions of the PROJECT or on any other project. Any use of the completed documents for other projects and any use of incomplete documents without the specific written authorization from CONSULTANT will be at CITY’s sole risk and without liability to CONSULTANT. Further, any and all liability arising out of changes made to CONSULTANT’s deliverables under this Agreement by CITY or persons other than CONSULTANT is waived as against CONSULTANT, and the CITY assumes full responsibility for such changes unless the CITY has given CONSULTANT prior notice and has received from CONSULTANT written consent for such changes.

B. Publication: No report, information, or other data given or prepared or assembled by the CONSULTANT pursuant to this Agreement, shall be made available to any individual or organization by the CONSULTANT without the prior written approval of the CITY. Notwithstanding the foregoing, however, the CONSULTANT shall not be required to protect or hold in confidence and confidential information which (1) is or becomes available to the public with the prior written consent of the CITY; (2) must be disclosed to comply with law; or (3) must be disclosed in connection with any legal proceedings.

C. Copyrights: The CONSULTANT shall be free to copyright material developed under this Agreement with the provision that the CITY be given a nonexclusive and irrevocable license to reproduce, publish or otherwise use, and to authorize others to use the material for government or public purposes. Should CONSULTANT place a copyright notice on documents it must state, “City of Visalia holds a nonexclusive and irrevocable license to reproduce, publish, or otherwise use, and to authorize others to use the material for government or public purposes.”

XII. INDEMNIFICATION AND INSURANCE
As respects acts, errors, or omissions in the performance of services, CONSULTANT agrees to indemnify and hold harmless CITY, its elected and appointed officers, and employees from and against any and all claims, demands, losses, reasonable defense costs, or liability, whether actual, alleged, or threatened, that arise out of, pertain to, or relate to the negligence, recklessness, or willful misconduct of the CONSULTANT in the performance of his/her services under the terms of this Agreement, except to the extent those arise out of the negligence of CITY.

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

A. CITY agrees to indemnify and hold harmless CONSULTANT, its officers, employees, and designated volunteers from and against any and all losses, defense costs, or liability to the extent arising out of CITY’S negligent acts, errors or omissions in the performance of this Agreement.

B. As respects all acts or omissions which do not arise directly out of the performance of services, including but not limited to those acts or omissions normally covered by general and automobile liability insurance, CONSULTANT agrees to indemnify, defend (at CITY’s option), and hold harmless CITY, its elected and appointed officers, agents, employees, representatives, and volunteers from and against any and all claims, demands, reasonable defense costs, or liability of any kind or nature arising out of or in connection with CONSULTANT’s (or CONSULTANT’s subcontractors, if any) performance or failure to perform, under the terms of this Agreement; except to the extent those which arise out of the negligence of CITY.

C. Notwithstanding any other provision of this Agreement, and to the fullest extent permitted by law, neither the CITY nor the CONSULTANT, their respective officers, directors, partners, employees, contractors or sub consultants shall be liable to the other or shall make any claim for any remote or speculative breach of contract damages that the breaching party could not have reasonably foreseen when entering into this Agreement. To the extent this Agreement is considered a “Construction Contract” as defined by California Civil Code section 2783, CONSULTANT’s duty to indemnify CITY under this or any other provision of the Agreement shall not apply when to do so would be prohibited by California Civil Code section 2782.

D. Without limiting CITY’s right to indemnification, it is agreed that CONSULTANT shall secure prior to commencing any activities under this Agreement, and maintain during the term of this Agreement, insurance coverage as follows:

1. Workers’ compensation insurance as required by California statues.

2. Commercial general liability insurance with a combined single limit of not less than One Million Dollars ($1,000,000) per occurrence. Such insurance shall include coverage for Premises and Operations, Contractual Liability, Personal Injury Liability, Products and Completed Operations Liability, Broad Form Property Damage (if applicable), Independent Contractor’s Liability (if applicable).

3. Professional liability insurance coverage, in an amount not less than One Million Dollars ($1,000,000).

4. Comprehensive Automobile Liability coverage with a combined single limit of not less than One Million Dollars ($1,000,000) per occurrence. Such insurance shall include coverage for owned, hired, and non-owned automobiles and shall be provided by a business automobile policy.

E. CITY’S Risk Manager is hereby authorized to reduce the requirements set forth above in the event he/she determines that such reduction is in the CITY’S best interest.

F. CONSULTANT agrees to provide thirty (30) days written notice of any policy cancellation, limitation in scope or coverage, or non-renewal. Such notice shall be provided to the, City of Visalia, 707 W. Acequia, Visalia, CA 93291.

In addition, the commercial general liability and comprehensive automobile liability policies required by this Agreement shall contain the following clauses:

“It is agreed that any insurance maintained by the City of Visalia shall apply in excess of and not contribute with insurance provided by this policy.”

“The City of Visalia, its officers, agents, employees, representatives and volunteers are added as additional insureds as respects operations and activities of, or on behalf of the named insured, performed under contract with the City of Visalia.”

G. Prior to commencing any work under this Agreement, CONSULTANT shall deliver to CITY insurance certificates confirming the existence of the insurance required by this Agreement, and including the applicable

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

clauses referenced above. Within thirty (30) days of the execution date of this Agreement, CONSULTANT shall provide to CITY endorsements to the above-required policies, which add to these policies the applicable clauses referenced above. Said endorsements shall be signed by an authorized representative of the insurance company and shall include the signatory’s company affiliation and title. Should it be deemed necessary by CITY, it shall be CONSULTANT’s responsibility to see that CITY receives documentation acceptable to CITY which sustains that the individual signing said endorsements is indeed authorized to do so by the insurance company. CITY has the right to demand, and to receive within a reasonable time period, copies of any insurance policies required under this Agreement.

H. In addition to any other remedies CITY may have if CONSULTANT fails to provide or maintain any insurance policies or policy endorsements to the extent and within the time herein required, CITY may, at its sole option:

1. Obtain such insurance and deduct and retain the amount of the premiums for such insurance from any sums due under the Agreement; or

2. Order CONSULTANT to stop work under this Agreement and/or withhold any payment(s) which become due to CONSULTANT hereunder until CONSULTANT demonstrates compliance with the requirements hereof; or

3. Terminate this Agreement.

Exercise of any of the above remedies, however, is an alternative to other remedies CITY may have and is not the exclusive remedy for CONSULTANT’s failure to maintain insurance or secure appropriate endorsements.

Nothing herein contained shall be construed as limiting in any way the extent to which CONSULTANT may be held responsible for payments of damages to persons or property resulting from CONSULTANT’s or its subcontractor’s performance of the work covered under this Agreement.

XIII. NON-DISCRIMINATION
CONSULTANT and all subcontractors shall not discriminate against any employee or applicant for employment on the basis of race, color, national origin, or sex in the performance of this Agreement. The CONSULTANT shall carry out applicable requirements of 49 CFR part 26 in the award and administration of DOT-assisted contracts. Failure by the contractor to carry out these requirements is a material breach of this Agreement, which may result in the termination of this Agreement.

IV. MISCELLANEOUS PROVISIONS

A. Firearms Prohibited: Guns may not be carried by contractors/vendors/consultants while working on City of Visalia premises without the expressed written approval of a City of Visalia Department Head, or an exemption in the contract. If a contractor/vendor/consultant is caught carrying a gun, without City permission, their contract will be terminated.

B. Asbestos and Hazardous Materials: In providing its services hereunder, CONSULTANT shall not be responsible for identification, handling, containment, abatement, or in any other respect, for any asbestos or hazardous material if such is present in connection with the PROJECT. In the event the CITY becomes aware of the presence of asbestos or hazardous material at the jobsite, CITY shall be responsible for complying with all applicable federal and state rules and regulations, and shall immediately notify CONSULTANT, who shall then be entitled to cease any of its services that may be affected by such presence, without liability to CONSULTANT arising therefrom.

C. Successors and Assigns: This Agreement shall be binding upon and shall inure to the benefit of any successors to or assigns of the parties.

D. Prohibition of Assignment: Neither the CITY nor CONSULTANT shall assign, delegate or transfer their rights and duties in this Agreement without the written consent of the other party.

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

E. Dispute/Governing Law: Any dispute not resolvable by informal arbitration between the parties to this Agreement shall be adjudicated in a Court of Law under the laws of the State of California.

F. Notices: Notice shall be sufficient hereunder if personally served upon the City Clerk of the CITY or an officer or principal of the CONSULTANT, or if sent via the United States Postal Service, postage prepaid, addressed as follows:

G. Jurisdiction/Venue/Waiver Of Removal: This Agreement shall be administered and interpreted under the laws of the State of California. Jurisdiction of litigation arising from this Agreement shall be in that State. Any action brought to interpret or enforce this Agreement, or any of the terms or conditions hereof, shall be brought in Tulare County, California. The CONSULTANT hereby expressly waives any right to remove any action to a county other than Tulare County as permitted pursuant to Section 394 of the California Code of Civil Procedure.

H. Integration/Modification: This Agreement and each of the exhibits referenced herein, which are incorporated by reference, represents the entire understanding of the CITY and the CONSULTANT as to those matters contained herein. No prior oral or written understanding shall be of any force or effect with respect to those matters covered hereunder. This Agreement may not be modified or altered except in writing signed by the CITY and the CONSULTANT.

I. Conflict With Law: If any part of this Agreement is found to be in conflict with applicable laws, such part shall be inoperative, null and void insofar as it is in conflict with said law, but the remainder of the Agreement shall be in full force and effect.

J. Attorney’s Fees: In the event either party commences any action, arbitration or legal proceedings for the enforcement of this Agreement, the prevailing party, as determined by the court or arbitrator, shall be entitled to recovery of its attorney’s fees and court costs incurred in the action brought thereon.

K. Construction: This Agreement is the product of negotiation and compromise on the part of each party and the parties agree, notwithstanding Civil Code Section 1654, that in the event of uncertainty the language will not be construed against the party causing the uncertainty to exist.

L. Authority: Each signatory to this Agreement represents that it is authorized to enter into this Agreement and to bind the party to which its signature represents.

M. Headings: Section headings are provided for organizational purposes only and do not in any manner affect the scope or intent of the provisions thereunder.

N. Executive Order N-6-22 – Russia Sanctions Russia Sanctions On March 4, 2022, Governor Gavin Newsom issued Executive Order N-6-22 (the EO) regarding Economic Sanctions against Russia and Russian entities and individuals. “Economic Sanctions” refers to sanctions imposed by the U.S. government in response to Russia’s actions in Ukraine, as well as any sanctions imposed under state law. The EO directs state agencies to terminate contracts with, and to refrain from entering any new contracts with, individuals or entities that are determined to be a target of Economic Sanctions. Accordingly, should the State determine Contractor is a target of Economic Sanctions or is conducting prohibited transactions with sanctioned individuals or entities, that shall be grounds for termination of this agreement. The State shall provide Contractor advance written notice of such

CITY OF VISALIA
707 W. Acequia Ave.

Visalia, CA 93291
Attention: City Clerk

CONSULTANT
_____________________________
_____________________________
(Attention)
_____________________________
Phone:_______________________
Email:________________________

RFP NO. 24-25-03
Cyber Security Assessment, Cyber Resilience Program and Implementation Plan

termination, allowing Contractor at least 30 calendar days to provide a written response. Termination shall be at the sole discretion of the State.

IN WITNESS WHEREOF, this Agreement is executed on the day and year first above written.

CITY OF VISALIA CONSULTANT

__________________________________ ___________________________ City Manager Date Date

Approved as to Form

__________________________________
City Attorney Date

_________________________________
Risk Manager Date

_________________________________
Project Manager Date

Exhibit “A”: Accepted Scope of Work as Negotiated by the City and the Consultant Exhibit “B”: Accepted Project Schedule and Fee as Negotiated by the City and the Consultant Exhibit “C”: Consultant Schedule of Fees