ACTION:
____________________________
Clerk/Secretary
Department: City Manager Item No: C12
Prepared by: Chris Mitchell, Information Technology Manager Meeting Date: June 14, 2022 Approved by: Patrick Johnson, City Manager Agenda Location: Consent Calendar SUBJECT: INFORMATION TECHNOLOGY POLICIES & PLANNING
RECOMMENDATION: Adopt City Council Resolution No. 2022- , approving the agreement with SDI Presence LLC.
CORRELATION TO CITY COUNCIL GOALS: Operational item not corresponding to a specific City Council goal.
PRIOR ACTION: On March 8, 2022, adopted City Council Resolution 2022-46, amending the Operating Budget for Fiscal Years 2021/22 and 2022/23.
STATEMENT ON THE SUBJECT: On March 8, 2022, City Council received an update on the Second Quarter Financial Report and amended the Operating Budget, which included an appropriation of $300,000 for the Information Technology (IT) Cybersecurity, Business Continuity, Disaster Recovery Project (project).
This project will create an IT Cybersecurity Plan, Business Continuity & Disaster Recovery Plan, and update current IT Policies and Procedures to conform with industry best practices. It will also create a GIS Roadmap and setup a network penetration testing program. This project was identified as a top staff priority during a recent third-party review of the City’s IT systems.
The project will be completed in four phases. The first phase will include an IT Asset Inventory project to build the foundation for all additional project work. This project will assist in identifying City technology devices that need support, which will lead into the IT Best Practices, Policy & Procedure, and Service Level Agreement discussions, as part of phase two. Ultimately, the Cybersecurity Plan in phase three will be developed around knowledge of which assets need defending. The fourth phase will consist of the creation of a GIS Roadmap.
Staff recommends purchasing these services from SDI Presence LLC through the California Multiple Award Schedules (CMAS) purchasing program. Vista Municipal Code Section 3.08.060 (C) states that the Purchasing Officer has the authority to join with other public agencies in a cooperative purchasing program for the purchase of equipment as long as the administering agency has made its purchase(s) in a competitive manner, and it is in the City's best interest to participate. CMAS is a municipal contracting agency and cooperative that competitively bids contracts to promote volume and competitive pricing. The contracts promoted through CMAS for the purchase of specialized products and services are then made available to public agencies.
AGENDA
REPORT
CITY COUNCIL
COMMUNITY DEVELOPMENT COMMISSION
SUCCESSOR AGENCY
BUENA SANITATION DISTRICT
JOINT POWERS FINANCING AUTHORITY
06/14/2022 C12 Page 1 of 30
Approved above recommendation, adopted City Council Resolution No. 2022-87.
Vote: 5-0
MEETING DATE: June 14, 2022 PAGE 2
SUBJECT: INFORMATION TECHNOLOGY POLICIES & PLANNING
FISCAL IMPACT: The agreement price with SDI Presence LLC is $ $200,900. Sufficient funds are budgeted and available in the Fiscal Year 2021/22 Operating Budget in the IT Technology Purchases and Services (Use of Reserves: Yearend Fund Balance) Account (No. 6040135.531530.YEFB).
EXHIBITS:
1. City Council Resolution No. 2022- , approving the agreement with SDI Presence LLC
2. Proposal from SDI Presence LLC
3. Agreement with SDI Presence LLC
06/14/2022 C12 Page 2 of 30
00107837 2
RESOLUTION NO. 2022-
A RESOLUTION OF THE CITY COUNCIL OF THE CHARTERED CITY OF
VISTA, CALIFORNIA, APPROVING THE AGREEMENT WITH
SDI PRESENCE LLC
The City Council of the City of Vista does resolve as follows:
1.Findings. The City Council hereby finds and declares the following:
A.At the March 8, 2022, the City Council adopted Resolution 2022-46, amending the Operating Budget for Fiscal Years 2021/22 and 2022/23, which included funding for the Information Technology (IT) Cybersecurity, Business Continuity, Disaster Recovery Project (Project).
B.The Project will create an IT Cybersecurity Plan, Business Continuity & Disaster Recovery Plan, and update current IT Policies and Procedures to conform with industry best practices.
C.The Project will also create a GIS Roadmap and setup a network penetration testing program. This project was identified as a top staff priority during a recent third- party review of the City's information technology systems.
D.Staff recommends purchasing services from SDI Presence LLC through the California Multiple Award Schedules(CMAS) purchasing program with a contract ceiling of $200,900.
E.Vista Municipal Code Section 3.08.060 (C) states that the Purchasing officer has the authority to join with other public agencies in a cooperative purchasing program for the purchase of equipment as long as the administering agency has made its purchase(s) in a competitive manner and it is in the City's best interest to participate. [Continued on page 2.]
06/14/2022 C12 Page 3 of 30EXHIBIT 1
RESOLUTION NO. 2022-
CITY COUNCIL OF THE CHARTERED CITY OF VISTA
PAGE 2
00107837 200107837.DOCX
2.Action.
A.The Agreement between the City of Vista and SDI Presence LLC is approved with a contract ceiling of $200,900, and the Mayor is authorized to sign the Agreement on behalf of the City.
B.The City Manager is authorized to execute all amendments.
3.Adoption. PASSED AND ADOPTED at a meeting of the City Council of the City of Vista held on June 14, 2022, by the following vote:
AYES:
NOES:
ABSTAIN:
APPROVED AS TO FORM:
WALTER C. CHUNG, ACTING CITY ATTORNEY
By:
APPROVED
Darold Pieper
20220601153747
JUDY RITTER, MAYOR
ATTEST:
KATHY VALDEZ, CITY CLERK
By:
06/14/2022 C12 Page 4 of 30
1 IT Project Planning Implementation Plan
The following document outlines the SDI Presence LLC (SDI) plan for conducting IT projects as a follow on to findings in the IT Strategic Planning exercise. The projects are presented in sequence.
NOTE: Of the list of potential projects presented to the City on January 28th, the City did not ask SDI to plan tasks associated with the Network Penetration Testing and the SharePoint Implementation projects.
Total estimated cost: $200,900 – Not to Exceed
Phase 1
IT Asset Inventory – SDI recommends beginning with the IT Asset Inventory project in order to build the foundation for all additional project work. This project will assist in identifying all City technology devices that need support, which will lead into the IT Best Practices, Policy & Procedure, and Service Level Agreement discussions, as part of Phase 2. Ultimately, the Cybersecurity Plan in Phase 3 will be developed around knowledge of which assets need defending. •Methodology - SDI will work with the City to deploy discovery tools (e.g., VSA, N-Able, and/or Auvik) on to the City’s network to do a technology-based inventory. SDI will review the discovery tool findings with the City and conduct physical verification of assets to (a) spot check findings and (b) physically verify any areas of the network that may not have been properly captured due to device downtime or connectivity issues. •Resources – SDI resources may include Greta Davis, Delivery Executive, Phil Danie (SVP of Operations), Jason Hennessey (Senior Project Manager), and Chris Cao (Technical Lead) •Deliverable – Inventory report listing IT assets.
•Project Timeline – SDI anticipates 25 days for the effort. o Kick off and planning meetings – 2 days
o Discovery tool deployment – 3 days (assumes the City can provide SDI with network access prior to the start of this task; this duration is for testing and tuning the tools) o Network scanning – 6 days
o Initial Inventory Report build – 9 days
o Physical sampling/validation – 4 days
o Report readout and review with the City – 1 day
•Cost – 200 hours at $175/hr = $35,000
06/14/2022 C12 Page 5 of 30
EXHIBIT 2
Phase 2
IT Process and Plans – SDI will use the information gathered during the IT Strategic Planning interviews and refined during the asset inventory, to build documentation for IT Best Practices, IT Policies and Procedures, IT Service Level Agreements, and the Business Continuity/Disaster Recovery (BC/DR) Plan.
Methodology - SDI will leverage its library of best practices and policies/procedures to adapt specific recommendations for the City, based on the specific assets discovered in Phase 1. This can include approaches to staff technology use, procurement approaches, endpoint protection (that will be incorporated into the Cybersecurity Plan), and other elements. Based on our knowledge of the IT environment from the IT Strategic Plan and additional conversations as part of this effort, SDI will work with the City to establish Service Level Agreements (SLAs) based on the number of assets and possible staff support available. SDI will assist the City with outreach about the new policies around these best practices, policies, and SLAs.
The BC/DR Plan will include policy elements (who/what is contacted when) in addition to technical work to establish backups and recurring jobs and tasks to keep the environment protected. This effort will include a recovery test to validate the BC/DR planning. •Resources – SDI resources may include Greta Davis, Delivery Executive, Phil Danie (SVP of Operations), Jason Hennessey (Senior Project Manager), and Chris Cao (Technical Lead) •Deliverable – SDI will deliver individual documents on IT Best Practices, IT Policies and Procedures (e.g., IT procurement policy, end user access policy, etc.), and a documented IT Service Level Agreement write up. The BC/DR Plan will include a written plan plus a runbook of backups jobs that will be executed as part of the test recovery task. •Project Timeline – SDI anticipates 36 days total for all Phase 2 items (BC/DR tasks running concurrently with the IT policy items).
o IT Best Practices (discussions and documentation) – 20 days o IT Policies and Procedures (discussions and documentation) – 8 days o IT SLAs (discussion and documentation) – 5 days
o BC/DR (18 days total)
▪Discuss and review needed backups, build backup jobs where appropriate – 7 days
▪Setup offline/cloud backups where appropriate – 5 days ▪Test the recovery plan – 3 days
▪Finalize and update the BC/DR policy document – 3 days •Cost – total of 408 hours at $175/hr = $71,400
o IT Best Practices: 160 hours at $175/hr = $28,00
o IT Policies and Procedure Development: 64 hours at $175/hr = $11,200 06/14/2022 C12 Page 6 of 30
o IT SLA Establishment: 40 hours at $175/hr = $7,000
o BC/DR Plan: 144 hours at $175/hr = $25,200
Phase 3
Cybersecurity Plan – SDI will use the IT asset inventory to determine what and how the City’s network- connected IT assets will be protected.
•Methodology - SDI will review the types of City IT assets to build specific cybersecurity defense plans against common intrusions, build an incident response plan, and work with the City of Vista ensuring staff are trained and aware of the elements of the plan. •Resources – SDI resources may include Greta Davis, Delivery Executive, Phil Danie (SVP of Operations), Jason Hennessey (Senior Project Manager), and Chris Cao (Technical Lead) •Deliverable – SDI will deliver a Cybersecurity Plan based around current IT assets and defensive technologies.
•Project Timeline – SDI anticipates the plan development and discussions to take 34 days for the entire effort.
•Cost – 270 hours at $175/hr = $47,250
Phase 4
GIS Roadmap – SDI will partner with Argis Solutions, Inc. to deliver a GIS roadmap to document the current state, assess “to be” implementation needs, and document a technical roadmap to transition to that “to be” / desired state.
•Methodology – The SDI Team (SDI PM with Argis Solutions GIS Subject Matter Experts) will interview City staff, review the City’s GIS software configuration/data, underlying hardware, network, and integration points to define an “as is” GIS state. Based on these findings, best practices, and current GIS trends, the SDI Team will work with the City to define a future development and plan roadmap.
•Resources – SDI resources may include Greta Davis, Delivery Executive, Phil Danie (SVP of Operations), Jason Hennessey (Senior Project Manager), and Chris Cao (Technical Lead) 06/14/2022 C12 Page 7 of 30
•Deliverable – The SDI Team will deliver a Current State Assessment document, a Future State Planning document, and a GIS Roadmap to map activities between the current and future state. •Project Timeline – SDI anticipates 40 days for the effort, divided equally between the three stages/deliverables.
•Cost - 270 hours at $175/hr = $47,250
06/14/2022 C12 Page 8 of 30
5 Estimated Project Schedule
The following GANTT represents the recommended sequencing and estimated durations of the above project tasks. Note that the GIS roadmap is not part of this sequence, as it will be performed in parallel and not dependent on any other tasks. 06/14/2022 C12 Page 9 of 30
City Services (Non-Construction) (No RFP) 1 of 9 SDI PRESENCE LLC 00107729 4
CONTRACT FOR SERVICES
THIS “CONTRACT” is entered into by and between the “Parties” as of ___________________ (“Contract Date”).
1.0 THE “PARTIES”
The “City”:
CITY OF VISTA, a chartered municipal
corporation
200 Civic Center Drive
Vista, CA 92084
Working Contact: Chris Mitchell
Billing Contact: Faye Gray
The “Contractor”
SDI PRESENCE LLC., a Delaware limited
liability company
200 E. Randolph Street, Suite 3550
Chicago, IL 60601
Contact: Greta Davis
2.0 BASIC TERMS
2.1 Contractor has submitted to City a Proposal to perform certain “Services” (“Exhibit A”).
2.2 The “Project” for which the Services are required is described in Exhibit A.
2.3 Contractor desires to enter into this “Contract” with City for the Services.
2.4 The “Contract Ceiling Price” is $200,900.
3.0 CONTRACT TERM
3.1 This Contract shall take effect as of the Contract Date.
3.2 This Contract shall be in effect for 12 calendar months (“Term”). The Term may be extended at the City’s option for an additional 24 months, in increments of City’s choice, for a maximum Term of 36 from the Contract Date.
3.3 City may terminate this Contract upon 30-days’ written notice to Contractor. In such event, or upon request of City, Contractor shall assemble all City documents in the Contractor's possession, put them in order for proper filing and closing, and deliver the documents to City. In the event of termination, Contractor shall be paid for work performed to the termination date. City shall make the final determination as to the portion of tasks completed and the compensation to be paid.
4.0 SCOPE
Contractor shall perform all Services including, labor, materials, software, supplies, reports, and documents for as may be required from time to time, in accordance with Exhibit A. The Services shall be complete, and all work, material and services not expressly called for in the Proposal which may be necessary to carry out the Contract in good faith, shall be performed by the Contractor at no increase in cost to City. In the event of a conflict between the provisions this Contract text and Exhibit A, this Contract text shall control. 06/14/2022 C12 Page 10 of 30EXHIBIT 3
City Services (Non-Construction) (No RFP) 2 of 9 SDI PRESENCE LLC 00107729 4
5.0 COMPENSATION
5.1 City shall pay Contractor on a time and material rate as set forth in Exhibit A for the Services to be performed. City shall pay Contractor within thirty (30) days after receipt of Contractor's invoice.
5.2 An invoice for payment shall be submitted in a form satisfactory to City. At a minimum, the invoice shall include: the purchase order number, the work order number, a description of the work performed, and a total amount.
5.3 Changes in, additions to, or deductions from the Services, including increases or decreases in the quantity of any item or portion of the Services, shall be set forth in a written change order executed by City and by the Contractor which shall specify:
5.3.1 The changes, additions, and deductions to be made.
5.3.2 The increase or decrease in compensation due the Contractor, if any.
5.3.3 Adjustment in the time of completion, if any.
5.4 Contract Ceiling Price
5.4.1 In no event shall City be liable for paying more than the Contract Ceiling Price for Contractor's services rendered under this Contract.
5.4.2 If it becomes foreseeable that Contractor will need to perform services such that the cumulative total of costs to City will exceed the maximum permitted by this Contract, any such cost overrun will be handled pursuant to the change order procedure in Chapter 3.08. City and Contractor recognize that City lacks authority to exceed the cost ceiling without the express authorization of the City Council. If the maximum cost to City for this Contract is exceeded unexpectedly, payment shall be made as mutually agreeable and disputes shall be handled pursuant to this Contract, but work shall cease as soon as is reasonably feasible once the cost ceiling plus allowable change orders, if any, is exceeded.
5.5 Except as provided in Exhibit A, Contractor shall not be reimbursed for any expenses incurred in rendering services under this Contract.
6.0 CONTRACT DOCUMENTS
The Contract comprises the following documents including all additions, deletions, modifications and appendices and all addenda setting forth any modifications or interpretations of any of these documents: Documents required under Exhibits A–E.
7.0 TIME FOR COMPLETION AND COMMENCEMENT OF SERVICES
All Services under the Contract must be completed in compliance with the schedule in Exhibit A.
06/14/2022 C12 Page 11 of 30
City Services (Non-Construction) (No RFP) 3 of 9 SDI PRESENCE LLC 00107729 4
8.0 ASSISTANCE BY CITY
All information, data, records, reports and maps as are in possession of City and necessary for the carrying out of this work shall be available to Contractor without charge. City shall make available to Contractor members of its staff for consultation with Contractor in the performance of this Contract. City does not warrant that the information data, records reports and maps heretofore or to be provided to Contractor are complete or accurate and Contractor should satisfy itself as to accuracy and completeness. City and Contractor agree that City shall have no liability should any information, data, records reports, and maps be inaccurate, incomplete or misleading. Unless provided in Exhibit A, no other assistance shall be provided by City to Contractor.
9.0 STANDARD OF PERFORMANCE
9.1 Contractor represents and warrants that it has the training, qualifications, experience and facilities necessary to properly perform the Services required under this Contract in a thorough, competent and professional manner. At all times Contractor shall faithfully, competently and to the best of its ability, experience and talent, perform all services described herein. In meeting its obligations under this Contract, Contractor shall employ, at a minimum, generally accepted standards and practices utilized by persons engaged in providing services similar to those required of Contractor under this Contract.
9.2 Contractor shall keep itself informed of and comply with all applicable federal, state and local laws, statutes, codes, ordinances, regulations and rules in effect during the Term of this Contract. Contractor shall obtain any and all licenses, permits and authorizations necessary to perform the services set forth in this Contract, including any business licenses required by City. Neither City, nor any elected or appointed boards, officers, officials, employees or agents of City, shall be liable, at law or in equity, as a result of any failure of Contractor to comply with this Section.
10.0 CONTRACTOR’S STATUS; CONTRACTOR’S EMPLOYEES
10.1 Contractor shall perform the services provided for herein in Contractor's own way as an independent contractor and in pursuit of Contractor's independent calling. Contractor is not to be considered an employee of City, nor shall any employees of Contractor be considered employees of City, for any purpose. Contractor shall be under the direction and control of City staff only as to the results to be accomplished. This Contract is not intended to create the relationship of partnership, joint venture, or association between City and Contractor.
10.2 Contractor represents and warrants that all design professional services, if any, shall be provided by a person or persons duly licensed by the State of California to provide the type of services described in Exhibit A.
10.3 Neither Contractor, nor any of Contractor's officers, employees or agents, shall obtain any rights to retirement, health care or any other benefits which may otherwise accrue to City’s employees. Contractor expressly waives any claim Contractor may have to any such rights.
10.4 Contractor is aware of the requirements of the Immigration Reform and Control Act of 1986 and shall comply with those requirements, including, but not limited to, verifying the eligibility for employment of all of Contractor’s officers, employees, agents and subcontractors that are included in this Contract.
06/14/2022 C12 Page 12 of 30
City Services (Non-Construction) (No RFP) 4 of 9 SDI PRESENCE LLC 00107729 4
10.5 The payment made to Contractor pursuant to this Contract shall be the full and complete compensation to which Contractor and Contractor’s officers, employees, agents, and subcontractors are entitled for performance of any work under this Contract. Neither Contractor nor Contractor’s officers or employees are entitled to any salary or wages, or retirement, health, leave or other fringe benefits applicable to employees of the City. City will not make any federal or state tax withholdings on behalf of Contractor. City shall not be required to pay any workers' compensation insurance on behalf of Contractor.
10.6 Contractor agrees to defend and indemnify City for any obligation, claim, suit or demand for tax, retirement contribution including any contribution to the Public Employees Retirement System (PERS), social security, salary or wages, overtime payment, or workers' compensation payment which City may be required to make on behalf of Contractor or any employee of Contractor, or any employee of Contractor construed to be an employee of City, for work done under this Contract. This is a continuing obligation that survives the termination of this Contract.
11.0 CIVIL RIGHTS
11.1 Contractor agrees to comply with Title VII of the Civil Rights Act of 1964, as amended, the California Fair Employment Practices Act, the Americans with Disabilities Act of 1990, any other applicable federal and state laws and regulations hereinafter enacted.
11.2 Contractor shall not knowingly deny an opportunity or benefit, discriminate against or harass, any employee or applicant for employment on account of the person’s race, color, ethnicity, national origin, ancestry, religion, creed, veteran status, physical disability, mental disability, medical condition, marital status, sex, sexual orientation, age, or other status protected from workplace discrimination by state or federal law.
11.3 Contractor shall not knowingly give preferential treatment to any applicant for employment on the basis of race, color, ethnicity, national origin, ancestry, religion, creed, physical disability, mental disability, medical condition, marital status, sex, or sexual orientation.
11.4 This section shall be interpreted in a manner that is consistent with the California and United States Constitutions and applicable state and federal statutes governing workplace discrimination. The terms used in this section shall have the same meaning as defined in state statutes governing the same subject matter.
11.5 Nothing in this section shall be interpreted as prohibiting bona fide occupational qualifications consistent with applicable state and federal law and reasonably necessary to the normal operation of Contractor. Nothing in this section shall be interpreted as prohibiting regulations and policies to prevent nepotism or conflicts of interest.
11.6 Nothing in this Section shall be interpreted as prohibiting action taken to establish or maintain eligibility for any federal program, where ineligibility would result in a loss of federal funds to City.
11.7 To the fullest extent permitted by law and without limitation by the other provisions of this Contract relating to indemnification and insurance, Contractor shall also indemnify, defend and hold harmless City, and its directors, officers, employees and agents from and against all liability (including without limitation all claims, damages, penalties, fines, 06/14/2022 C12 Page 13 of 30
City Services (Non-Construction) (No RFP) 5 of 9 SDI PRESENCE LLC 00107729 4
and judgments, associated investigation and administrative expenses, and defense costs, including but not limited to reasonable attorneys' fees, court costs, and costs of alternative dispute resolution) resulting from any claim of discrimination or harassment, including but not limited to sexual harassment, arising from the conduct of the Contractor or any of the Contractor’s officers, employees, agents, licensees, or subcontractors. In the event of a discrimination or harassment complaint against any employee, agent, licensee or subcontractors of Contractor or its subcontractors, Contractor shall take immediate and appropriate action in response to such complaint, including, but not limited to termination or appropriate discipline of any responsible employee, agent, licensee or subcontractors. The provisions of this Section survive completion of the services or termination of the Contract.
12.0 CONTROL OF SERVICES
Each Party shall appoint a representative who shall have the authority to represent and act for that Party (“Representative”). Any written or verbal directions or requests of City's Representative delivered to the Contractor’s Representative shall have the same force and effect as if delivered to the Contractor. The Contractor's Representative shall have the authority to sign any change order, coordinate the work of all subcontractors and make other decisions pertaining to the Contract.
13.0 ASSIGNMENT AND SUBCONTRACTING
13.1 Neither this Contract nor any interest herein may be transferred, assigned, conveyed, hypothecated or encumbered voluntarily or by operation of law, whether for the benefit of creditors or otherwise, without the prior written approval of the City. Transfers restricted hereunder shall include the transfer to any person or group of persons acting in concert of more than twenty-five percent (25%) of the present ownership and/or control of Contractor, taking all transfers into account on a cumulative basis. In the event of any such unapproved transfer, including any bankruptcy proceeding, this Contract shall be void. No approved transfer shall release the Contractor or any surety of Contractor of any liability hereunder without the express consent of City.
13.2 Contractor shall be fully responsible to the City for any acts and omissions of Contractor's subcontractor, including persons either directly or indirectly employed by subcontractor, in the event Contractor subcontracts any of the work to be performed under this Contract. Contractor's responsibility under this paragraph shall be identical to Contractor's liability for acts and omissions of Contractor and employees of the Contractor. Nothing contained in this Contract shall create any contractual relationship between City and any subcontractor of Contractor, but Contractor shall bind every subcontractor and every subcontractor of a subcontractor by the terms of this Contract applicable to Contractor's work, unless such change, omission, or addition is approved in advance in writing by the City Manager or the City Manager’s designee. All subcontractors are subject to the prior written review and approval of the City Manager or the City Manager’s designee.
14.0 LICENSES
If a license of any kind, which term is intended to include evidence of registration, is required of Contractor, its employees, agents, or subcontractors by federal, state or local law, Contractor warrants that such license has been obtained, is valid and in good standing, and that any required bond has been posted in accordance with all applicable laws and regulations.
06/14/2022 C12 Page 14 of 30
City Services (Non-Construction) (No RFP) 6 of 9 SDI PRESENCE LLC 00107729 4
15.0 FINANCIAL RECORDS
15.1 Contractor shall maintain any and all documents, ledgers, books of account, invoices, vouchers, canceled checks, or records demonstrating or relating to Contractor’s performance of services pursuant to this Contract or evidencing or relating to expenditures and disbursements charged to City pursuant to this Contract. Any and all such documents or records shall be maintained in accordance with generally accepted accounting principles and shall be sufficiently complete and detailed so as to permit an accurate evaluation of the services provided by Contractor pursuant to this Contract. Any and all such documents or records shall be maintained for three years from the date of execution of this Contract and to the extent required by laws relating to audits of public agencies and their expenditures. It is expressly understood and agreed that the provisions of this Section will survive termination of this Contract.
15.2 Any and all records or documents required to be maintained pursuant to this Section shall be made available for inspection, audit and copying, at any time during regular business hours, upon request by City or its Representative. Copies of such documents or records shall be provided directly to the City for inspection, audit and copying when it is practical to do so; otherwise, unless an alternative is mutually agreed upon, such documents and records shall be made available at Contractor's address indicated for receipt of notices in this Contract or the primary location from which services are rendered, whichever is closer.
16.0 OWNERSHIP OF DOCUMENTS
16.1 Upon delivery, the work product, including without limitation, all original reports, writings, recordings, drawings, files, computer code, and detailed calculations developed under this contract, are the property of City. Contractor agrees that all copyrights which arise from creation of the work pursuant to this contract shall be vested in City and hereby assigns, waives and relinquishes all claims to copyright or other intellectual property rights in favor of City.
Notwithstanding anything to the contrary in the foregoing and for the purposes of clarity, Contractor, including Contractor's subcontractors and third-party vendors, shall retain ownership of any pre-existing intellectual property used and/or delivered to City in the performance of the Services under this contract. City acknowledges that its use of the work product is limited to the purposes contemplated by the scope of Services and that Contractor makes no representation of the suitability of the work product for use in or application to circumstances not contemplated by the scope of Services. If Contractor is providing copyrighted, proprietary materials in the performance of the Services, then the intellectual property provisions of Exhibit B shall prevail over the provisions of this section.
16.2 Contractor represents that it has secured all necessary licenses, consents or approvals to use the components of any intellectual property, including computer software, used in the rendering of services and the production of the work product produced under this Contract, and that City has full legal title to and the right to reproduce such materials. The Contractor covenants to defend, indemnify and hold City harmless of any third-party loss, claim or liability in any way related to a claim that they are violating or have violated any federal, state or local laws, or any contractual provisions, relating to trade names, licenses, franchises, patents or other means of protecting interests in products or inventions. Contractor shall bear all costs arising from the use of patented, copyrighted, trade secret or trademarked materials, equipment, devices or processes used on or incorporated in the services and materials produced under this Contract. In case such materials, equipment, devices or processes are held to constitute an infringement and their use is enjoined, Contractor, at its expense, shall: (a) secure for City the right to continue using the materials by suspension of any injunction or by 06/14/2022 C12 Page 15 of 30
City Services (Non-Construction) (No RFP) 7 of 9 SDI PRESENCE LLC 00107729 4
procuring a license or licenses for the City; or (b) modify the materials so that they become non- infringing.
17.0 CONFIDENTIALITY
17.1 Contractor shall treat all information obtained from City in the performance of this Contract as confidential and proprietary to City. Contractor shall treat all records and work product prepared or maintained by Contractor in the performance of this Contract as confidential.
17.2 Contractor agrees that it will not use any information obtained as a consequence of the performance of work for any purpose other than fulfillment of Contractor’s scope of Services. Contractor will not disclose any information prepared for City, or obtained from City or obtained as a consequence of the performance of work to any person other than City, or its own employees, agents or subcontractors who have a need for the information for the performance of Services under this Contract unless such disclosure is specifically authorized in writing by City.
18.0 CONFLICT OF INTEREST REQUIREMENT
Contractor agrees that, to the extent applicable, it shall comply with and be bound by all laws and regulations deriving from the relationship of the Contractor to the City, including the Political Reform Act (Government Codes Section 87100 et seq.) Chapters 2.32 or 2.33 of the Vista Municipal Code, the Community Redevelopment Act (Health & Safety Code 33000 et seq.) and all regulations promulgated thereunder (collectively “Conflict Laws”). As a condition precedent to the formation of this Contract, Contractor warrants and covenants that it is adequately informed regarding the obligations and duties imposed by the Conflict Laws and that to the best of Contractor's knowledge and belief, there exists no conflict of interest (under the laws) that would disqualify the Contractor from participation in any decisions arising out of the performance of this Contract. Prior to commencement of any work in the performance of this Contract, Contractor shall comply with any applicable requirements of Chapter 2.32 of the Vista Municipal Code, including any requirement to file a financial disclosure statement with the City Clerk.
Contractor further agrees that no employee, agent or subcontractor for Contractor shall perform any work for the City pursuant to this Contract which will violate the Conflict Laws.
19.0 PROHIBITION OF FINANCIAL INTEREST BY CITY OFFICIAL Contractor warrants and covenants to City that no City Official has or will have any current or future financial interest in this Contract as of the date approved, nor shall Contractor promise, offer, or enter into any written, oral or implied Contract, to provide any financial interest or remuneration of any kind or manner to any City official with respect to this Contract. For purposes of this Section, the term “City Official” shall mean and include any elected or appointed officer of City, any employee of City, or any spouse or financial dependent of a City official or employee. A violation of this provision shall render this Contract null and void and Contractor shall be subject to restitution of all fees or money paid or earned under this Contract.
20.0 INDEMNIFICATION
20.1 Contractor shall defend, indemnify and hold City and its officers, officials, employees, and volunteers (collectively, “Indemnitees”) harmless against any and all third-party liability, loss, damage, fine, penalty, expense, claim or cost (including without limitation costs and fees of litigation) of every nature (collectively, “Liability”) arising out of or in connection with the negligent acts or omissions or willful misconduct of Contractor in its performance of the 06/14/2022 C12 Page 16 of 30
City Services (Non-Construction) (No RFP) 8 of 9 SDI PRESENCE LLC 00107729 4
services under this Contract, including defects in design, except: (1) Liability caused by Indemnitees’ sole negligence or willful misconduct; or (2) for Liability caused by Indemnitees’ active negligence, in which case the indemnity received by Indemnitees shall be reduced by the amount: (i) that Indemnitees’ active negligence contributed to the Liability on a comparative basis; or (ii) such other amount as may be required by law (“Duty of Indemnification”).
20.2 Contractor, on behalf of itself and all parties claiming under or through it, hereby waives all rights of subrogation and contribution against Indemnitees, while acting within the scope of their duties, from all claims, losses and liabilities arising out of or incident to activities or operations performed by or on behalf of the Contractor regardless of any prior, concurrent, or subsequent active or passive negligence by the Indemnitees. In the event there is more than one person or entity named in the Agreement as a Contractor, then all obligations, liabilities, covenants and conditions under this instrument shall be joint and several.
21.0 INSURANCE AND BONDS
Contractor shall comply with the insurance provisions set forth in Exhibit C.
22.0 SERVICE OF NOTICE
22.1 Any notice, which either Party may desire to give to the other Party, must be in writing and may be given by personal delivery to the Party’s Representative, email, or by overnight courier service to the Party’s address set forth in Section 1.0. Notice may also be given by mailing it by registered or certified mail, return receipt requested, to the other Party at the address set forth in Section 1.0. Any notice given by mail will be deemed given 48 hours after such notice is deposited in the United States mail, addressed as provided with postage fully prepaid.
22.2 A Party may change its address by giving notice as provided above, and the changed address shall thereafter be deemed to be the address set forth in Section 1.0.
23.0 LABOR LAW COMPLIANCE
California Labor Code Sections 1860 and 3700 provide that every contractor will be required to secure the payment of compensation to its employees. In accordance with the provisions of California Labor Code Section 1861, Contractor hereby certifies as follows:
“I am aware of the provisions of Section 3700 of the Labor Code which require every employer to be insured against liability for worker’s compensation or to undertake self-insurance in accordance with the provisions of that code, and I will comply with such provisions before commencing the performance of the work of this contract.”
24.0 SURVIVAL OF COVENANTS
Contractor’s obligations under Sections 16, 17 and 20 shall survive the termination of this Contract.
25.0 SPECIAL PROVISIONS
This Contract is subject to, and Contractor shall comply with, the special provisions referenced in Exhibit E, if any.
06/14/2022 C12 Page 17 of 30
City Services (Non-Construction) (No RFP) 9 of 9 SDI PRESENCE LLC 00107729 4
26.0 EXHIBITS
All documents referenced as exhibits in this Contract, or referenced in an exhibit to this Contract, are incorporated herein.
27.0 APPLICABLE LAW, VENUE
This Contract shall be construed and enforced under the laws of the State of California. If any action is commenced by any Party to this Contract, such action shall be filed in a court of competent jurisdiction within the County of San Diego, California.
28.0 MODIFICATIONS
This Contract contains the entire agreement, between the Parties and supersedes all prior negotiations, discussions, obligations and rights of the Parties in respect of each other regarding the subject matter of this Contract. There is no other written or oral understanding between the Parties. No modification, amendment or alteration of this Contract shall be valid unless it is in writing and signed by all Parties.
29.0 EXECUTION
IN WITNESS WHEREOF; the Parties hereto have executed this Contract as of the Contract Date.
CITY OF VISTA, a chartered municipal
corporation
By:
PATRICK JOHNSON, CITY MANAGER
ATTEST:
KATHY VALDEZ, CITY CLERK
By:
APPROVED AS TO FORM:
DAROLD PIEPER, CITY ATTORNEY
By:
RISK MANAGEMENT REVIEW:
DOLORES GASCON, RISK MANAGER
By:
APPROVED
Darold Pieper
20220602142441
SDI PRESENCE LLC, a Delaware limited
liability company
By:
NAME/TITLE
By:
NAME/TITLE
06/14/2022 C12 Page 18 of 30
00107729 4 Exhibit A
EXHIBIT A
CONTRACTOR’S PROPOSAL
06/14/2022 C12 Page 19 of 30
1 IT Project Planning Implementation Plan
The following document outlines the SDI Presence LLC (SDI) plan for conducting IT projects as a follow on to findings in the IT Strategic Planning exercise. The projects are presented in sequence.
NOTE: Of the list of potential projects presented to the City on January 28th, the City did not ask SDI to plan tasks associated with the Network Penetration Testing and the SharePoint Implementation projects.
Total estimated cost: $200,900 – Not to Exceed
Phase 1
IT Asset Inventory – SDI recommends beginning with the IT Asset Inventory project in order to build the foundation for all additional project work. This project will assist in identifying all City technology devices that need support, which will lead into the IT Best Practices, Policy & Procedure, and Service Level Agreement discussions, as part of Phase 2. Ultimately, the Cybersecurity Plan in Phase 3 will be developed around knowledge of which assets need defending.
• Methodology - SDI will work with the City to deploy discovery tools (e.g., VSA, N-Able, and/or Auvik) on to the City’s network to do a technology-based inventory. SDI will review the discovery tool findings with the City and conduct physical verification of assets to (a) spot check findings and (b) physically verify any areas of the network that may not have been properly captured due to device downtime or connectivity issues.
• Resources – SDI resources may include Greta Davis, Delivery Executive, Phil Danie (SVP of Operations), Jason Hennessey (Senior Project Manager), and Chris Cao (Technical Lead)
• Deliverable – Inventory report listing IT assets.
• Project Timeline – SDI anticipates 25 days for the effort.
o Kick off and planning meetings – 2 days
o Discovery tool deployment – 3 days (assumes the City can provide SDI with network access prior to the start of this task; this duration is for testing and tuning the tools) o Network scanning – 6 days
o Initial Inventory Report build – 9 days
o Physical sampling/validation – 4 days
o Report readout and review with the City – 1 day
• Cost – 200 hours at $175/hr = $35,000
06/14/2022 C12 Page 20 of 30
Phase 2
IT Process and Plans – SDI will use the information gathered during the IT Strategic Planning interviews and refined during the asset inventory, to build documentation for IT Best Practices, IT Policies and Procedures, IT Service Level Agreements, and the Business Continuity/Disaster Recovery (BC/DR) Plan.
Methodology - SDI will leverage its library of best practices and policies/procedures to adapt specific recommendations for the City, based on the specific assets discovered in Phase 1. This can include approaches to staff technology use, procurement approaches, endpoint protection (that will be incorporated into the Cybersecurity Plan), and other elements. Based on our knowledge of the IT environment from the IT Strategic Plan and additional conversations as part of this effort, SDI will work with the City to establish Service Level Agreements (SLAs) based on the number of assets and possible staff support available. SDI will assist the City with outreach about the new policies around these best practices, policies, and SLAs.
The BC/DR Plan will include policy elements (who/what is contacted when) in addition to technical work to establish backups and recurring jobs and tasks to keep the environment protected. This effort will include a recovery test to validate the BC/DR planning.
• Resources – SDI resources may include Greta Davis, Delivery Executive, Phil Danie (SVP of Operations), Jason Hennessey (Senior Project Manager), and Chris Cao (Technical Lead)
• Deliverable – SDI will deliver individual documents on IT Best Practices, IT Policies and Procedures (e.g., IT procurement policy, end user access policy, etc.), and a documented IT Service Level Agreement write up. The BC/DR Plan will include a written plan plus a runbook of backups jobs that will be executed as part of the test recovery task.
• Project Timeline – SDI anticipates 36 days total for all Phase 2 items (BC/DR tasks running concurrently with the IT policy items).
o IT Best Practices (discussions and documentation) – 20 days o IT Policies and Procedures (discussions and documentation) – 8 days o IT SLAs (discussion and documentation) – 5 days
o BC/DR (18 days total)
▪ Discuss and review needed backups, build backup jobs where appropriate – 7 days
▪ Setup offline/cloud backups where appropriate – 5 days ▪ Test the recovery plan – 3 days
▪ Finalize and update the BC/DR policy document – 3 days
• Cost – total of 408 hours at $175/hr = $71,400
o IT Best Practices: 160 hours at $175/hr = $28,00
o IT Policies and Procedure Development: 64 hours at $175/hr = $11,200 06/14/2022 C12 Page 21 of 30
o IT SLA Establishment: 40 hours at $175/hr = $7,000
o BC/DR Plan: 144 hours at $175/hr = $25,200
Phase 3
Cybersecurity Plan – SDI will use the IT asset inventory to determine what and how the City’s network- connected IT assets will be protected.
• Methodology - SDI will review the types of City IT assets to build specific cybersecurity defense plans against common intrusions, build an incident response plan, and work with the City of Vista ensuring staff are trained and aware of the elements of the plan.
• Resources – SDI resources may include Greta Davis, Delivery Executive, Phil Danie (SVP of Operations), Jason Hennessey (Senior Project Manager), and Chris Cao (Technical Lead)
• Deliverable – SDI will deliver a Cybersecurity Plan based around current IT assets and defensive technologies.
• Project Timeline – SDI anticipates the plan development and discussions to take 34 days for the entire effort.
• Cost – 270 hours at $175/hr = $47,250
Phase 4
GIS Roadmap – SDI will partner with Argis Solutions, Inc. to deliver a GIS roadmap to document the current state, assess “to be” implementation needs, and document a technical roadmap to transition to that “to be” / desired state.
• Methodology – The SDI Team (SDI PM with Argis Solutions GIS Subject Matter Experts) will interview City staff, review the City’s GIS software configuration/data, underlying hardware, network, and integration points to define an “as is” GIS state. Based on these findings, best practices, and current GIS trends, the SDI Team will work with the City to define a future development and plan roadmap.
• Resources – SDI resources may include Greta Davis, Delivery Executive, Phil Danie (SVP of Operations), Jason Hennessey (Senior Project Manager), and Chris Cao (Technical Lead)
06/14/2022 C12 Page 22 of 30
• Deliverable – The SDI Team will deliver a Current State Assessment document, a Future State Planning document, and a GIS Roadmap to map activities between the current and future state.
• Project Timeline – SDI anticipates 40 days for the effort, divided equally between the three stages/deliverables.
• Cost - 270 hours at $175/hr = $47,250
06/14/2022 C12 Page 23 of 30
5 Estimated Project Schedule
The following GANTT represents the recommended sequencing and estimated durations of the above project tasks. Note that the GIS roadmap is not part of this sequence, as it will be performed in parallel and not dependent on any other tasks.
06/14/2022 C12 Page 24 of 30
00107729 4 Exhibit B
EXHIBIT B
NOT APPLICABLE TO THIS CONTRACT
06/14/2022 C12 Page 25 of 30
00107729 4 Exhibit C, Page 1 of 3
EXHIBIT C
INSURANCE REQUIREMENTS
Contractor shall procure and maintain for the duration of the contract insurance against claims for injuries to persons or damages to property which may arise from or in connection with the performance of the work hereunder by the Contractor, his agents, representatives, employees, or subcontractors. Nothing in these provisions shall limit Contractor’s Duty of Indemnification.
MINIMUM SCOPE AND LIMIT OF INSURANCE
Coverage shall be at least as broad as:
1. Commercial General Liability (“CGL”): Insurance Services Office Form CG 00 01 covering CGL on an “occurrence” basis, including products, completed operations, property damage, bodily injury, and personal & advertising injury with limits no less than $2,000,000 per occurrence. If a general aggregate limit applies, either the general aggregate limit shall apply separately to this Project/location or the general aggregate limit shall be twice the required occurrence limit.
2. Automobile Liability: Insurance Services Office Form Number CA 0001 covering Code 1 (any auto), with limits no less than $2,000,000 per accident for bodily injury and property damage.
3. Workers’ Compensation insurance as required by the State of California, with Statutory Limits, and Employers’ Liability insurance with a limit of no less than $1,000,000 per accident for bodily injury or disease.
Contractor shall also provide the additional coverages checked below and at least as broad as:
4. Professional Liability, with limits no less than $1,000,000 per occurrence or claim, and $2,000,000 policy aggregate.
If the Contractor maintains higher limits than the minimums shown above, City requires and shall be entitled to coverage for the higher limits maintained by the Contractor. Any available insurance proceeds in excess of the specified minimum limits of insurance and coverage shall be available to City.
Deductibles and Self-Insured Retentions
Any deductibles or self-insured retentions must be declared to and approved by City. At the option of City, either: the Contractor shall cause the insurer to reduce or eliminate such deductibles or self-insured retentions as respects City, its officers, officials, employees, and volunteers; or the Contractor shall provide a financial guarantee satisfactory to City guaranteeing payment of losses and related investigations, claim administration, and defense expenses.
Other Insurance Provisions
The insurance policies are to contain, or be endorsed to contain, the following provisions:
1. The City, its officers, officials, employees, and volunteers are to be covered as additional insureds on the CGL policy with respect to liability arising out of with respect 06/14/2022 C12 Page 26 of 30
00107729 4 Exhibit C, Page 2 of 3
to liability arising out of work or operations performed by or on behalf of the Contractor including materials, parts, or equipment furnished in connection with such work or operations and automobiles owned, leased, hired, or borrowed by or on behalf of the Contractor. General liability coverage can be provided in the form of an endorsement to the Contractor’s insurance (at least as broad as ISO Form CG 20 10, CG 11 85 or both CG 20 10 and CG 20 37 forms if later revisions used), unless otherwise approved in advance by City.
2. For any claims related to this Project, the Contractor’s insurance coverage shall be primary insurance as respects City, its officers, officials, employees, and volunteers.
Any insurance or self-insurance maintained by City, its officers, officials, employees, and volunteers shall be excess of the Contractor’s insurance and shall not contribute with it.
3. Each insurance policy required by this clause shall provide that coverage shall not be canceled, except with notice to City.
Claims Made Policies
If any coverage required is written on a claims-made coverage form:
1. The retroactive date must be shown, and this date must be before the execution date of the contract or the beginning of contract work.
2. Insurance must be maintained and evidence of insurance must be provided for at least five (5) years after completion of contract work.
3. If coverage is canceled or non-renewed, and not replaced with another claims-made policy form with a retroactive date prior to the contract effective, or start of work date, the Contractor must purchase extended reporting period coverage for a minimum of five (5) years after completion of contract work.
4. A copy of the claims reporting requirements must be submitted to City for review.
Acceptability of Insurers
Insurance is to be placed with insurers with a current A.M. Best rating of no less than A: VII, unless otherwise acceptable to City.
Waiver of Subrogation
Contractor hereby agrees to waive rights of subrogation which any insurer of Contractor may acquire from Contractor by virtue of the payment of any loss. Contractor agrees to obtain any endorsement that may be necessary to affect this waiver of subrogation. The Workers’ Compensation policy shall be endorsed with a waiver of subrogation in favor of City for all work performed by the Contractor, its employees, agents and subcontractors.
Verification of Coverage
Contractor shall furnish City with original certificates and amendatory endorsements, or copies of the applicable insurance language, effecting coverage required by this contract. All certificates and endorsements are to be received and approved by City before work commences. However, failure to obtain the required documents prior to the work beginning shall not waive the Contractor’s obligation to provide them. City reserves the right to require 06/14/2022 C12 Page 27 of 30
00107729 4 Exhibit C, Page 3 of 3
complete, certified copies of all required insurance policies, including endorsements, required by these specifications, at any time.
Subcontractors
Contractor shall require and verify that all subcontractors maintain insurance meeting all the requirements stated herein, and Contractor shall ensure that City is an additional insured on insurance required from subcontractors. For CGL coverage, subcontractors shall provide coverage with a format least as broad as CG 20 38 04 13.
Special Risks or Circumstances
City reserves the right to modify these requirements, including limits, based on the nature of the risk, prior experience, insurer, coverage, or other circumstances.
06/14/2022 C12 Page 28 of 30
00107729 4 Exhibit D
AGREEMENT TO COMPLY WITH CALIFORNIA LABOR LAW REQUIREMENTS [Labor Code §§ 1720, 1771.1, 1773.8, 1775, 1776, 1777.5, 1813, 1860, 1861, 3700]
NOT APPLICABLE TO THIS CONTRACT
06/14/2022 C12 Page 29 of 30
00107729 4 Exhibit E
EXHIBIT E
SPECIAL PROVISIONS
This Contract is subject to the following provisions, if checked:
1. State of California grant conditions, as attached.
2. Federal grant conditions, as attached.
3. Other conditions, as attached.
06/14/2022 C12 Page 30 of 30