2-Professional Services Agreement - Cyber (Standard) 3-26.docx

CONTRACT# ___________________

PROFESSIONAL SERVICES AGREEMENT – CYBER STANDARD Comment by Lisa Roadfuss: DRAFTING NOTE: Please remove all highlighting and drafting notes in the margin.

This Professional Services Agreement – Cyber Standard (“Agreement”) is between PARK CITY MUNICIPAL CORPORATION, a Utah municipal corporation (“PCMC”), and [insert NAME OF SERVICE PROVIDER], a [insert state of incorporation or formation] [insert “corporation,” “limited liability company,” or other entity type] (the “Service Provider”).

PCMC and Service Provider want to enter into an agreement for the Service Provider to perform the services and tasks as specified below.

The parties therefore agree as follows:

ARTICLE 1 – SCOPE OF SERVICES.

Scope of Services. Service Provider shall perform the services and tasks identified and designated as Service Provider responsibilities throughout this Agreement and as outlined in Schedule A attached to this Agreement (“Scope of Services”).

Service Provider shall abide by the requirements in Schedule B (“Technology Support, Infrastructure & Security”) which is attached to this Agreement and incorporated herein. Comment by Lisa Roadfuss: DRAFTING NOTE: Ensure that Schedule A reflects the scope of services and is not worded as a "proposal."

A. Service Provider Representative. Service Provider designates [insert name of Service Provider representative] as the authorized representative vested with the authority to act on behalf of the Service Provider. Service Provider may change its designated representative by providing written notice to PCMC.

B. PCMC Representative. PCMC designates [insert project manager name] or their designee as its representative who has the authority to act on behalf of PCMC.

ARTICLE 2 – TERM.

This Agreement will become effective as of the date the last party signed it as indicated by the date associated with that party’s signature. The term of this Agreement ends at midnight on [insert date in format MM/DD/YYYY] unless terminated sooner or extended as provided in this Agreement.

OPTIONAL: PCMC may at its sole option extend the term of this Agreement for [insert number] additional period(s) of [insert “year(s)” “month(s)” or other time period] each by notifying Service Provider in writing at least thirty days prior to the expiration of this Agreement.

ARTICLE 3 – COMPENSATION, INVOICING, AND PAYMENT.

A. Compensation. For performance of the Scope of Services, PCMC shall pay a total fee in an amount not to exceed $[insert numeric dollar amount]. Any work performed beyond the defined Scope of Services requires a written request from PCMC. Compensation for such additional work shall adhere to the terms outlined in Schedule C, if attached. In the absence of a Schedule C, any compensation for extra work shall be determined based on a mutually agreed-upon written agreement between both parties.

B. Invoicing and Payment. Service Provider shall invoice PCMC on a monthly basis for services completed during that period. PCMC shall pay Service Provider within 30 days of receipt of each invoice. Requests for earlier payment will be considered if a discount is offered for the earlier payment. For services that remain unpaid for a period exceeding 60 days, interest will accumulate at a rate of six percent per annum.

ARTICLE 4 – SERVICE STANDARDS AND COMPLIANCE WITH LAWS.

A. Service Standards. Service Provider shall be responsible for the quality of all services performed by its employees, agents, subcontractors, and all other persons (collectively, “Subcontractors”) performing any services under this Agreement. All services shall be executed with competence and in conformity with the standard of care, diligence, and skill typically exercised by professionals within the Service Provider’s field.

B. Conformance to Laws. In providing services under this Agreement, Service Provider and its Subcontractors shall comply with all applicable federal, state, PCMC, and other local laws, regulations, and ordinances, including applicable licensure and permit requirements, regulations for certification, operation of facilities, and accreditation, employment laws, and any other standards or criteria described in this Agreement.

C. E-Verify. Service Provider shall register and participate in E-Verify or an equivalent program for each employee employed within the state of Utah if this Agreement is entered into for the physical performance of services within Utah, unless exempted by Utah Code § 63G-12-302. Service Provider shall require that each of its Subcontractors, at every tier, certify under penalty of perjury that each Subcontractor has registered and is participating in E-Verify or an equivalent program, to the extent applicable.

ARTICLE 5 – RECORDS AND INSPECTIONS.

A. Records. Service Provider shall keep any records, documents, invoices, reports, data, information, and all other material regarding matters covered, directly or indirectly, by this Agreement for six years after expiration of this Agreement. This includes everything necessary to properly reflect all expenses related to this Agreement and records of accounting practices necessary to assure proper accounting of all expenses under this Agreement.

B. Inspection of Records. Service Provider shall make all of the records referenced in this section available for inspection to PCMC, its authorized representatives, the State Auditor, and other government officials authorized to monitor this Agreement by law. Service Provider must permit PCMC or its authorized representative to audit and inspect any data or other information relating to this Agreement. PCMC reserves the right to initiate an audit of the Service Provider's activities concerning this Agreement, at the expense of PCMC, utilizing an auditor selected by PCMC.

C. Government Records Access and Management Act. PCMC is subject to the requirements of the Government Records Access and Management Act, Title 63G, Chapter 2 of the Utah Code (“GRAMA”). All materials submitted by Service Provider related to this Agreement are subject to disclosure unless the materials are exempt from disclosure under GRAMA. The burden of claiming an exemption from disclosure rests solely with Service Provider. Any materials for which Service Provider claims an exemption from disclosure based on business confidentiality as provided in Utah Code § 63G-2-309 (or successor provision) must be marked as “Confidential” and accompanied at the time of submission by a statement from Service Provider explaining the basis for the claim. Generally, GRAMA only protects against the disclosure of trade secrets or commercial information that could reasonably be expected to result in unfair competitive injury. PCMC will make reasonable efforts to notify Service Provider of any requests made for disclosure of documents submitted under a claim of confidentiality. Service Provider specifically waives any claims against PCMC related to disclosure of any materials pursuant to GRAMA.

ARTICLE 6 – RELATIONSHIP OF PARTIES.

A. Independent Contractor. The parties intend that Service Provider is an independent contractor and not an employee of PCMC. Except as specifically provided in this Agreement, the parties intend that Service Provider has no authority to act on behalf of PCMC.

B. Subcontractor Relationship. The Service Provider shall have full control and authority over performance and activities of its Subcontractors throughout the execution of this Agreement. It is the sole responsibility of Service Provider to ensure that its Subcontractors adhere to the terms and conditions outlined in this Agreement. Furthermore, Service Provider shall bear full responsibility for any actions or omissions of its Subcontractors.

C. Treatment of Assets. Neither party will have an interest in the intellectual property owned or licensed by the other party, unless otherwise agreed by the parties in writing. PCMC will become the owner of all deliverables, work product, and other materials specifically created by the Service Provider and its Subcontractors under this Agreement.

ARTICLE 7 – INDEMNIFICATION.

A. Definitions. In this Agreement, the following definitions apply:

(1) “Indemnifiable Losses” means the aggregate of Losses and Litigation Expenses.

(2) “Litigation Expense” means any reasonable out-of-pocket expense incurred in defending a Proceeding or in any related investigation or negotiation, including court filing fees, court costs, arbitration fees, witness fees, and attorneys’ and other professionals’ fees and disbursements.

(3) “Loss” means any amount awarded in, or paid in settlement of, any Proceeding, including any interest but excluding any Litigation Expenses.

(4) “Proceeding” means any investigation, claim, judicial, administrative, or arbitration action or lawsuit, or other cause of action of every kind or character, brought by third parties against PCMC, its agents, employees, or officers, that arises out of this Agreement or the performance of this Agreement by Service Provider or its Subcontractors or subconsultants of any tier, or anyone acting under Service Provider’s direction or control, including after the expiration or termination of this Agreement.

B. Indemnification. Service Provider shall indemnify PCMC and its agents, employees, and officers against all Indemnifiable Losses arising out of a Proceeding, except to the extent the Indemnifiable Losses were caused by the negligence or willful misconduct of PCMC.

C. Obligation to Defend. Service Provider shall, at its sole cost and expense, defend PCMC and its agents, employees, and officers from and against all Proceedings, provided that Service Provider is not required to defend PCMC from any Proceeding arising from the sole negligence of PCMC or its agents, employees, or officers.

D. Tender. Service Provider’s obligation to defend will arise upon PCMC’s tender of defense to Service Provider in writing. If PCMC fails to timely notify Service Provider of a Proceeding, Service Provider will be relieved of its indemnification obligations to the extent that Service Provider was prejudiced by that failure. Upon receipt of PCMC’s tender of defense, if Service Provider does not promptly notify PCMC of its acceptance of the defense and thereafter duly and diligently defend PCMC and its agents, employees, and officers, then Service Provider shall pay and be liable for the reasonable costs, expenses, and attorneys’ fees incurred in defending the Proceeding and enforcing this provision.

E. Legal Counsel. To assume the defense, Service Provider must notify PCMC of their intent to do so. Promptly thereafter, Service Provider shall retain independent legal counsel that is reasonably acceptable to PCMC.

F. Settlement. After Service Provider assumes the defense of a Proceeding, Service Provider may contest, pay, or settle the Proceeding without the consent of PCMC only if that settlement (1) does not entail any admission on the part of PCMC that it violated any law or infringed the rights of any person, (2) provides as the claimant’s sole relief monetary damages that are paid in full by Service Provider, and (3) requires that the claimant release PCMC and its agents, employees, and officers from all liability alleged in the Proceeding.

G. Waiver. Service Provider expressly agrees that the indemnification provision herein constitutes the Service Provider’s waiver of immunity under Utah Code § 34A-2-105 for the purposes of this Agreement. This waiver has been mutually negotiated by the parties. The provisions of this section shall survive the expiration or termination of this Agreement. No liability shall attach to PCMC by reason of entering into this Agreement except as expressly provided herein.

H. No Limitation. The indemnification obligations of this Agreement shall not be reduced by a limitation on the amount or type of damages, compensation, or benefits payable by or for the Service Provider or Subcontractor under workers’ compensation acts, disability benefits acts, or other employee benefit acts.

I. Interpretation. The parties intend that the indemnity and defense provisions in this Article shall be interpreted so as to be enforceable to the fullest extent permitted by law, but nothing herein shall be interpreted to violate public policy.

J. Environmental Indemnity. Service Provider shall indemnify PCMC, its agents, employees, and officers for any Indemnifiable Losses from a Proceeding arising out of Service Provider’s violation of federal, state, or local environmental laws or regulations, and shall include but not be limited to all cleanup and remedial costs, diminution in value of property, and any fines or fees imposed as a result.

ARTICLE 8 – INSURANCE.

At its own cost and expense, Service Provider shall maintain the following mandatory insurance coverage to protect against claims for injuries to persons or property damage that may arise from or relate to the performance of this Agreement by Service Provider, its agents, representatives, employees, or Subcontractors for the entire duration of this Agreement or for such longer period of time as set forth below. Prior to commencing any work, Service Provider shall furnish a certificate of insurance as evidence of the requisite coverage. The certificate of insurance must include endorsements for additional insured, waiver of subrogation, primary and non-contributory status, and completed operations.

A. Commercial General Liability Insurance. Service Provider shall maintain commercial general liability insurance on a primary and non-contributory basis in comparison to all other insurance, including PCMC’s own policies of insurance, for all claims against PCMC. The policy must be written on an occurrence basis with limits not less than $1,000,000 per occurrence and $3,000,000 aggregate for personal injury and property damage. Upon request of PCMC, Service Provider must increase the policy limits to at least the amount of the limitation of judgments described in Utah Code § 63G-7-604, the Governmental Immunity Act of Utah (or successor provision), as calculated by the state risk manager every two years and stated in Utah Admin. Code R37-4-3 (or successor provision).

B. Automobile Liability Coverage. Service Provider shall maintain automobile liability insurance with a combined single limit of not less than $2,000,000 per accident for bodily injury and property damage arising out of the ownership, maintenance, and use of owned, hired, and non-owned motor vehicles. This policy must not contain any exclusion or limitation with respect to loading or unloading of a covered vehicle.

C. Professional Liability Insurance. [Delete if NOT applicable] Service Provider shall maintain professional liability insurance with annual limits not less than $1,000,000 per occurrence. If written on a claims-made basis, Service Provider shall maintain professional liability insurance coverage meeting these requirements for the applicable period of statutory limitation of claims (or statute of repose, if applicable) after completion of the Scope of Services or termination of this Agreement. Comment by Lisa Roadfuss: DRAFTING NOTE: WHEN DO YOU NEED? Professional liability insurance covers claims of actual or alleged negligence that arise from providing professional services, like giving incorrect advice, an omission or failing to deliver a service. Typically it is required for design and construction professionals, consultants, technology service providers, attorneys, finance and real estate services, marketing and public relations.

D. Workers’ Compensation Insurance and Employer’s Liability. Service Provider shall maintain workers’ compensation insurance with limits not less than the amount required by statute, and employer’s liability insurance limits of at least $1,000,000 each accident, $1,000,000 for bodily injury by accident, and $1,000,000 each employee for injury by disease. The workers’ compensation policy must be endorsed with a waiver of subrogation in favor of “Park City Municipal Corporation” for all work performed by the Service Provider, its employees, agents, and Subcontractors.

E. Data Breach and Privacy/Cyber Liability Insurance. Service Provider shall maintain data breach and privacy/cyber liability coverage, including coverage for failure to protect confidential information, and failure of the security of the Service Provider’s computer systems or the PCMC’s systems due to the actions of the Service Provider which results in unauthorized access to the PCMC’s data. The limit applicable to this policy shall be no less than $5,000,000 per occurrence, and must apply to incidents related to the Cyber Theft of the PCMC’s property, including but not limited to money and securities.

F. Technology Errors and Omissions Insurance. Service Provider shall maintain technology errors and omissions insurance with a limit of no less than $5,000,000 for damages arising from computer-related services including but not limited to the following:

· Software services;

· Consulting;

· Data processing;

· Programming;

· System integration;

· Hardware or software development;

· Installation;

· Distribution or maintenance;

· Systems analysis or design;

· Training; and

· Staffing or other support services.

This policy shall include coverage for third-party fidelity including cyber theft. Data Breach and Privacy / Cyber Liability Insurance and Technology Errors and Omissions insurance may be covered by the same policy.

G. Umbrella/Excess Coverage. The insurance limits required by this section may be met by either providing a primary policy or in combination with umbrella / excess liability policy(ies). To the extent that umbrella/excess coverage is used to satisfy the limits of coverage required hereunder, the terms of such coverage must be following form to, or otherwise at least as broad as, the primary underlying coverage, including amending the "other insurance" provisions as required so as to provide additional insured coverage on a primary and non-contributory basis, and subject to vertical exhaustion before any other primary, umbrella/excess, or any other insurance obtained by the additional insureds will be triggered.

H. Insured Parties. Each policy and all renewals or replacements, except those policies for Professional Liability, and Workers Compensation and Employer’s Liability, must name PCMC (and its officers, agents, and employees) as additional insureds on a primary and non-contributory basis with respect to liability arising out of work, operations, and completed operations performed by or on behalf of Service Provider.

I. Waiver of Subrogation. Service Provider waives all rights against PCMC and any other additional insureds for recovery of any loss or damages to the extent these damages are covered by any of the insurance policies required under this Agreement. Service Provider shall cause each policy to be endorsed with a waiver of subrogation in favor of PCMC for all work performed by Service Provider, its employees, agents, and Subcontractors.

J. Quality of Insurance Companies. All required insurance policies must be issued by insurance companies qualified to do business in the state of Utah and listed on the United States Treasury Department's current Department of Treasury Fiscal Services List 570, or having a general policyholders rating of not less than "A-" in the most current available A.M. Best Co., Inc.'s, Best Insurance Report, or equivalent.

K. Cancellation. Should any of Service Provider’s required insurance policies under this Agreement be cancelled before the termination or completion of this Agreement, Service Provider must deliver notice to PCMC within 30 days of cancellation. PCMC may request and Service Provider must provide within 10 days certified copies of any required policies during the term of this Agreement.

L. Additional Coverage. Notwithstanding anything to the contrary, if Service Provider has procured any insurance coverage or limits (either primary or on an excess basis) that exceed the minimum acceptable coverage or limits set forth in this Agreement, the broadest coverage and highest limits actually afforded under the applicable policy(ies) of insurance are the coverage and limits required by this Agreement and such coverage and limits must be provided in full to the additional insureds and indemnified parties under this Agreement. The parties expressly intend that the provisions in this Agreement will be construed as broadly as permitted to be construed by applicable law to afford the maximum insurance coverage available under Service Provider’s insurance policies.

M. No representation. In specifying minimum Service Provider’s insurance requirements, PCMC does not represent that such insurance is adequate to protect Service Provider from loss, damage or liability arising from its work. Service Provider is solely responsible to inform itself of types or amounts of insurance it may need beyond these requirements to protect itself.

ARTICLE 9 – NONDISCRIMINATION.

Service Professional shall not discriminate against any employee or applicant for employment because of race; ethnicity; color; pregnancy, childbirth, or pregnancy-related conditions; age, if the individual is 40 years of age or older; religion; national origin; disability; sexual orientation; gender identity; or military status.

A. Policy. Service Professional shall implement an employment nondiscrimination policy, if Service Professional does not already have such a policy, to effectuate the prohibition in this section; and

B. Subcontractor Flow-Through. Service Professional shall incorporate the foregoing non-discrimination provisions in all subcontracts or assignments under this Agreement and take action as required to ensure full compliance with the provisions of this non-discrimination policy.

ARTICLE 10 – ASSIGNMENT/SUBCONTRACTING.

A. Assignment. Service Provider shall not assign any portion of its performance under this Agreement without PCMC’s written consent. Consent must be sought in writing by the Service Provider not less than 30 days before the date of any proposed assignment. PCMC reserves the right to reject assignment without cause. Any purported transfer in violation of this section will be void.

B. Subcontracting. Service Provider shall obtain advance written consent from PCMC for any Subcontractor not identified in the Scope of Services.

ARTICLE 11 – TERMINATION.

A. Convenience. Either party may terminate this Agreement for any reason or no reason by giving the other party at least 30 days’ prior written notice. This Agreement will terminate at midnight at the end of the 30th day after that notice is effective. Service Provider must be paid its costs, including contract close-out costs, and profit on work performed up to the time of termination, according to the provisions of this Agreement.

B. For Cause. If Service Provider fails to comply with any provision of this Agreement and fails to correct noncompliance within three days of having received written notice, PCMC may immediately terminate this Agreement for cause by providing a notice of termination to Service Provider.

ARTICLE 12 – NOTICES.

A. Notice Addresses. For a notice or other communication to a party under this Agreement to be valid, it must be addressed using the information specified below for that party or any other information specified by that party in a notice delivered in accordance with this section.

To PCMC: Park City Municipal Corporation P.O. Box 1480 Park City, UT 84060-1480 Attn: City Attorney’s Office PCMC_Notices@parkcity.gov

With a copy to:

· PCMC’s Representative pursuant to Article 1.C.

· PCMC’s City Recorder at michelle.kellogg@parkcity.gov

To Service Provider: [Name] [Address Line 1] [Address Line 2] [Email address]

B. Delivery. A notice or other communication under this Agreement will be effective if it is in writing and received by the party to which it is addressed. It will be deemed to have been received as follows: (1) upon receipt as stated in the tracking system of a delivery organization that allows users to track deliveries; (2) when the intended recipient signs for the delivery; (3) when delivered by email to the intended recipient with a read receipt, an acknowledgement of receipt, or an automatic reply.

C. Refusal or Inability to Deliver. If the intended recipient rejects or otherwise refuses to accept delivery, or if it cannot be delivered because of a change of address for which no notice was given, then delivery is effective upon that rejection, refusal, or inability to deliver.

D. Time of Delivery. If a notice or other communication addressed to a party is received after 5:00 p.m. on a business day at the location specified in the address for that party, or on a day that is not a business day, then the notice will be deemed received at 9:00 a.m. on the next business day.

ARTICLE 13 – MISCELLANEOUS PROVISIONS.

A. Entire Agreement. This Agreement constitutes the entire understanding between the parties regarding the subject matter of this Agreement.

B. Modification and Waiver. To be effective, any modification to this Agreement or to the Scope of Services must be in writing and signed by both parties. No waiver under this Agreement will be effective unless it is in writing and signed by the party granting the waiver (in the case of PCMC, by an individual authorized by PCMC to sign the waiver). A waiver granted on one occasion will not operate as a waiver on other occasions.

C. Timely Performance. Service Provider shall complete the Scope of Services by any applicable deadline stated in this Agreement. Service Provider is liable for all reasonable damages to PCMC incurred as a result of Service Provider’s failure to timely perform the Scope of Services required under this Agreement.

D. Governing Law, Jurisdiction, Venue. Utah law governs all adversarial proceedings arising out of this Agreement or the subject matter of this Agreement. As the exclusive means of bringing adversarial proceedings to resolve any dispute arising out of this Agreement or the subject matter of this Agreement, a party may bring such a proceeding in courts of competent jurisdiction in Summit County, Utah.

E. Severability. The parties acknowledge that if a dispute between the parties arises out of this Agreement or the subject matter of this Agreement, it would be consistent with the wishes of the parties for a court to interpret this Agreement as follows: (1) with respect to any provision that it holds to be unenforceable, by modifying that provision to the minimum extent necessary to make it enforceable or, if that modification is not permitted by law, by disregarding that provision; (2) if an unenforceable provision is modified or disregarded in accordance with this section, by holding that the rest of the Agreement will remain in effect as written; (3) by holding that any unenforceable provision will remain as written in any circumstances other than those in which the provision is held to be unenforceable; and (4) if modifying or disregarding the unenforceable provision would result in failure of an essential purpose of this Agreement, by holding the entire Agreement unenforceable.

F. No Non-Party Rights. Nothing in this Agreement is intended to grant rights of any kind to any non-party or create third-party beneficiary rights of any kind.

G. Force Majeure. For purposes of this Agreement, a Force Majeure Event means any event or circumstance, regardless of whether it was foreseeable, that was not caused by that party and that prevents a party from complying with any of its obligations under this Agreement, but a Force Majeure Event will not include any strike or labor unrest, an increase in prices, a change in general economic conditions, or a change of law. A party that is prevented by the occurrence of a Force Majeure Event from performing any one or more obligations under this Agreement will not be liable for any failure or delay in performing those obligations, on condition that the non-performing party uses reasonable efforts to perform. The non-performing party shall promptly notify the other party of the occurrence of a Force Majeure Event and its effect on performance. Thereafter, the nonperforming party shall update the other party as reasonably necessary regarding its performance. The nonperforming party shall use reasonable efforts to limit damages to the other party and to complete its full performance under this Agreement.

Each party is signing this Agreement on the date stated opposite that party’s signature.

PARK CITY MUNICIPAL CORPORATION, a Utah municipal corporation

Attest:

City Recorder’s Office

Approved as to form:

City Attorney’s Office [insert NAME OF SERVICE PROVIDER] Tax ID #:

PC Business License #: BL Comment by Lisa Roadfuss: Service Providers with an address within the Park City limits must have a valid PC business license.

Date: ________________________ By: ________________________________ [insert name of individual signing] [insert title of individual signing] An authorized signer

Professional Services Agreement Cyber Standard (3-26) | pg. 6

SCHEDULE A – SCOPE OF SERVICES

Professional Services Agreement Cyber Standard (3-26) | pg. A-6

SCHEDULE B -- TECHNOLOGY SUPPORT, INFRASTRUCTURE & SECURITY

The Information Technology Department is responsible for the administration of this policy. If you have any questions regarding this policy, please contact the Information Technology Department 435-615-5123, 5123@parkcity.org

1. Definitions.

“City Data” / “Information” means any data provided, shared, created or managed by PCMC.

"Data Masking" means the process of modifying records to conceal City Data, especially when such records are copied from a production environment to a non-production environment.

“Personally Identifiable Information” or “PII” means any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means (e.g., name, SSN, mailing address, email address, phone number, vehicle plate number, passport number, driver’s license number, medical records).

“Process, Processed, or Processing” means any operation or set of operations performed upon City Data, whether or not by automatic means, such as creating, collecting, procuring, obtaining, accessing, recording, organizing, storing, adapting, altering, retrieving, consulting, using, disclosing or destroying the data.

“Provider” means any company supplying a service for Service Provider’s Information Processing System (such as a Data Center, Managed Service, or Data Circuit).

“Security Breach” means an unauthorized access to Service Provider’s software or Data Center facilities, Information Processing Systems or networks used to service, store, or access City Data.

“Sensitive Information” means any Personally Identifiable Information or any information not publicly available (e.g., clients, passwords, financial information, employee information, schedules, technology infrastructure, closed reports, draft notes, etc.).

“Service Provider” means the contract holder that manages employees, contractors or affiliates having access to Park City Municipal Corporation infrastructure or data for specific defined purpose.

“Service Provider’s Third-Party Security Auditor” means a third-party organization which provides security audits of Service Provider’s Information Processing Systems.

“Written Request of the City” means a request received by Service Provider by PCMC on official letterhead signed by an officer of PCMC.

2. Information Classification.

Classification is used to promote proper controls for safeguarding the confidentiality of information. Regardless of classification, the integrity and accuracy of all classifications of information must be protected. The classification assigned and the related controls applied are dependent on the sensitivity of the information. Information must be classified according to the most sensitive detail it includes. Information recorded in several formats (e.g., source document, electronic record, report) must have the same classification regardless of format.

The following levels are to be used when classifying information:

2.1. Sensitive Information (including PII)

Sensitive Information means any Personally Identifiable Information or any information not publicly available. Unauthorized disclosure of this information is not permitted.

2.2. Internal Information

Internal Information is intended for unrestricted use within PCMC, and in some cases within affiliated organizations such as Service Provider business partners for non-sales purposes. This type of information is already widely-distributed within PCMC, or it could be so distributed within the organization without advance permission from the information owner. Examples of Internal Information may include: personnel directories, internal policies and procedures, most internal electronic mail messages.

Any information not explicitly classified as Sensitive Information, PII or Public will, by default, be classified as Internal Information.

Unauthorized disclosure of this information is not permitted.

2.3. Public Information

Public Information has been specifically approved for public release by a designated authority within each entity of Service Provider. Examples of Public Information may include material posted to approved public internet web pages.

This information may be disclosed outside of Service Provider.

3. Formal Security Policy.

Consistent with the requirements of this Agreement, Service Provider will create and provide to PCMC an information security policy that is approved by Service Provider’s management, and published, communicated and agreed to be adhered to by all Service Provider’s employees, contractors and affiliates.

Service Provider will review the information security policy at planned intervals or if significant changes occur to ensure its continuing suitability, adequacy, and effectiveness and may revise such policy, from time to time. Changes resulting in a lower standard of security or service must be agreed to by PCMC prior to adoption.

4. Asset Management.

Acceptable Use: Service Provider will implement policies and procedures for the acceptable use of information and assets which is no less restrictive than industry best practice for the classification of such Information and consistent with the requirements of this Document.

Equipment Use While on PCMC Premises: While on PCMC’s premises, Service Provider will not connect hardware (physically or via a wireless connection) to PCMC internal systems or networks unless necessary for Service Provider to perform Processing under this Document. This hardware is subject to be inspected and, or, scanned by PCMC IT Department directly or by automated means before use.

Personally-owned Equipment: Sensitive Information, with the exception of Business Contact Information, may not be stored on any employee-owned equipment.

5. Human Resources Security.

Removal of Access Rights: The access rights of all Service Provider employees to Service Provider Information Processing Systems or media containing Sensitive Information will be removed immediately upon termination of their employment, contract or agreement, or adjusted upon a change of assignment.

6. Physical and Environmental Security.

Secure Areas: Service Provider will secure all areas, including loading docks, holding areas, telecommunications areas, cabling areas and off-site areas that contain Information Processing Systems or media containing information by the use of appropriate security controls in order to ensure that only authorized personnel are allowed access and to prevent damage and interference. The following controls will be implemented:

Visitors to secure areas shall be supervised.

7. Geographic Data Centers.

Service Provider’s data centers shall be geographically distributed and employ a variety of physical security measures. The technology and security mechanisms used in these facilities may vary depending on local conditions such as building location and regional risks. The standard physical security controls implemented at each Service Provider data center include the following: custom designed electronic card access control systems, alarm systems, interior and exterior cameras, and security guards. Access to areas where systems, or system components, are installed or stored are segregated from general office and public areas such as lobbies. The areas are centrally monitored for suspicious activity, and the facilities are routinely patrolled by security guards.

8. Environmental Security.

Service Provider will protect equipment from power failures and other disruptions caused by failures in supporting utilities. To minimize service interruption due to hardware failure, natural disaster, or other catastrophe, Service Provider shall implement a disaster recovery program at all of its data centers. This program includes multiple components to minimize the risk of any single point of failure.

9. Role Based Access.

Service Provider shall restrict access to its data centers based on role, not position. As a result, most senior executives at Service Provider do not have access to Service Provider data centers.

10. Communications and Operations Management.

Protections Against Malicious Code. Service Provider will implement detection, prevention, and recovery controls to protect against malicious software, which is no less than current industry best practice and perform appropriate employee training on the prevention and detection of malicious software.

Back-ups. Service Provider will perform appropriate back-ups of Service Provider Information Processing Systems and media containing City Data every business day with end-of-month copy stored for 1-year in order ensuring services and service levels described in this document. Service Provider maintains a plan for responding to a system emergency or other occurrence (for example, fire, vandalism, system failure and natural disaster) that damages systems that contain Sensitive Information and Internal Information.

Media Handling. Service Provider will protect against unauthorized access or misuse of City Data contained on media.

Media and Information Disposal. Service Provider will securely and safely dispose of media containing Sensitive Information and maintain a secured disposal log that provides an audit trail of disposal activities.

11. Exchange of Information.

To protect confidentiality and integrity of Sensitive Information in transit, Service Provider will:

Perform an inventory, analysis, and risk assessment of all data exchange channels (including, but not limited to, SFTP, HTTP, HTTPS, SMTP, modem and fax) to identify and mitigate risks to Sensitive Information from these channels.

Monitor and inspect all data exchange channels to detect unauthorized information releases.

Ensure that appropriate security controls using approved data exchange channels are employed when exchanging Sensitive Information.

12. Monitoring.

To protect against unauthorized access or misuse of Sensitive Information residing on Service Provider Information Processing Systems, Service Provider will:

Employ current industry best practice security controls and tools to monitor Information Processing Systems and log user activities, exceptions, unauthorized information processing activities, suspicious activities and information security events. Logging facilities and log information will be protected against tampering and unauthorized access. Logs will be kept for at least 180 days.

Perform frequent reviews of logs and take necessary actions to protect against unauthorized access and implement policy and infrastructure as needed.

At Written Request of the City, make logs available to PCMC to assist in investigations.

Ensure that the time clocks of all relevant Information Processing Systems are synchronized using a national or international time source.

Ensure common configuration and patch management information is maintained.

Based on the periodic assessment, measures will be implemented that reduce the impact of the threats by reducing the amount and scope of the vulnerabilities.

13. Access Control.

User Access Management. To protect against unauthorized access or misuse of Sensitive Information a formal user registration and de-registration procedure for granting and revoking access and access rights to all Service Provider Information Processing Systems.

Employ a formal password management process using authentication and authorization controls that are designed to protect against unauthorized access.

Perform recurring reviews of Service Provider employees’ access and access rights to ensure that they are appropriate for the users’ role.

14. User Responsibilities.

To protect against unauthorized access or misuse of Sensitive Information residing on Service Provider Information Processing Systems, Service Provider will:

Ensure that Service Provider Information Processing Systems users follow current security practices in the selection and use of sufficiently strong passwords.

Ensure that unattended equipment has appropriate protection to prohibit access and use by unauthorized individuals.

Ensure that Sensitive Information contained at employee workstations, including but not limited to paper and media display screens, is protected from unauthorized access and/or utilizes Data Masking.

15. Network Access Control.

Access to internal, external and public network services that allow access to Service Provider Information Processing Systems shall be controlled. Service Provider will:

Ensure that current industry best practice standard authentication mechanisms for network users and equipment are in place and updated as necessary.

Ensure electronic perimeter controls are in place to protect Service Provider Information Processing Systems from unauthorized access.

Ensure sufficient authentication methods are used to control access by remote users.

Ensure physical and logical access to diagnostic and configuration ports is controlled.

16. Operating System Access Control.

To protect against unauthorized access or misuse of Sensitive Information residing on Service Provider Information Processing Systems, Service Provider will:

Ensure that access to operating systems is controlled by a secure log-on procedure and limited to role based necessity.

Ensure that Service Provider Information Processing System users have a unique identifier (user ID). This account is used to identify each person’s activity on Service Provider’s Information Processing Systems network, including any access to employee or City Data.

Ensure that the use of utility programs that are capable of overriding system and application controls are highly restricted and tightly controlled, with access limited to those employees whose specific job function requires such access.

Ensure that inactive sessions are automatically terminated when technically possible after a defined period of inactivity.

Employ idle time-based restrictions on connection times when technically possible to provide additional security for high risk applications.

Ensure that current industry best practice standard authentication mechanisms for wireless network users and equipment are in place and updated as necessary.

Ensure authentication methods are used to control access by remote users, with unique User Identifiers.

17. Information Systems Acquisition, Development and Maintenance.

Security of System Files. To protect City Information Processing Systems and system files containing information, Service Provider will ensure that access to source code is restricted to authorized users whose specific job function necessitates such access.

Security in Development and Support Processes. To protect City information Processing Systems and system files containing Sensitive Information, Service Provider will:

Employ industry best practice security controls to minimize information dissemination.

Employ oversight quality controls and security management of outsourced software development.

Employ regular code reviews covering security vulnerabilities, including but not limited to buffer overflow, SQL injection, input validation, and commonly used vector attacks.

18. Information Security Incident Management.

Reporting Information Security Events and Weaknesses. To protect City Information Processing Systems and system files containing information, Service Provider will:

Implement a process to ensure that Information Security Events and Security Breaches are reported through appropriate management channels as quickly as possible.

Train all employees, contractors, users of information systems and services regarding the report of any observed or suspected Information Security Events and Security Breaches.

Notify PCMC by email or phone as soon as possible of all Information Security Events and Security Breaches. Following any such event or breach, Service Provider will promptly notify PCMC whether or not Sensitive Information was compromised or released to unauthorized parties, the data affected and/or the details of the event or breach.

19. Business Continuity Management.

Business Continuity Management Program. To ensure services and service levels described in this document, Service Provider will:

Develop and maintain a process for business continuity throughout the organization that addresses the information security requirements needed for Service Provider’s and its providers’ business continuity so that the provision of products and/or services provided is uninterrupted.

Maintain efforts to identify events that may cause interruptions to business processes, along with the probability and impact of such interruptions and the consequences for information security.

Develop and implement plans to maintain or restore operations and ensure availability of information at the required level and in the required time scales following interruption to, or failure of, critical business processes and provide PCMC a copy of the same upon Written Request of the City.

Disaster Recovery. Service Provider has appropriate and reasonable disaster recovery measures in place designed to prevent any interruptions in Service to PCMC. Service Provider has established disaster contingency plans governing processes following a breach incident, which in particular address the following issues: (i) safety of personnel and third parties, (ii) losses of communications capability (e.g., voice, fax, data), (iii) loss of computer processing capabilities, and (iv) loss of access to physical office facilities.

22. Security Assessments.

Initial and Recurring Security Assessments. Service Provider’s Third-Party Security Auditor shall perform weekly static scans, monthly dynamic scans, and annual penetration testing. The results of these audits are available to Service Provider and PCMC with execution of a Confidentiality Agreement with Service Provider.

Professional Services Agreement Cyber Standard (3-26) pg. B-6

SCHEDULE C – FEE SCHEDULE FOR EXTRA WORK

Note: Any work in addition to or outside the Scope of Services in Schedule A shall be approved in advance in writing by PCMC and shall not exceed the contract price reflected in Article 3 of the Agreement.

Professional Services Agreement Cyber Standard (3-26) | pg. C-6