20242007_A1_Managed Security Operations Center and Managed Detection and Response Services.pdf

Request for Information

Managed Security Operations Center and Managed Detection and Response Services

Solicitation No. RFI 20242007

Due Date and Time:

Thursday, December 7, 2023 @ 2:30 PM

CITY OF EUGENE

Central Services Finance Division/Purchasing

100 West 10th Avenue, Suite 400 Eugene, Oregon 97401

The Purchasing Office is currently closed to the public.

RFI 20242007 Managed Security Operations Center & Managed Detection and Response Services page 2

I. INVITATION TO SUBMIT INFORMATION

INVITATION TO SUBMIT INFORMATION

Notice to Suppliers Letters of Interest, including high-level price range information for Managed Security Operations Center (MSOC) and Managed Detection and Response Services will be accepted by the Purchasing Office until Thursday, December 7, 2023 @ 2:30PM. This Request for Information (RFI) may directly result in a contract award.

Project Description The City of Eugene is requesting Letters of Interest from suppliers that provide a Managed Security Operations Center (“MSOC”) and Managed Detection and Response (“MDR)” services that can detect intrusion, malware, and malicious activity in the City of Eugene’s networks. The City wishes to compile information about suppliers who can provide MSOC and MDR services and establish a budget and a list of interested suppliers for consideration.

After reviewing the Letters of Interest submitted in response to this RFI the City may, in its sole discretion, invite selected Offeror(s) to demonstrate the functionality of their offered software. Provide a sample demonstration agenda, including the recommended amount of time to review modules and/or core software functionalities and features.

Solicitation Documents Solicitation documents may be examined electronically by logging in to OregonBuys. To view City of Eugene solicitations:

• Scroll to Supplier Activities

• Click the Open Bids icon

• Click the Advanced Search button

• Click Select Organization

• Select City of Eugene

• Click Search\Click the Bid Solicitation # to view solicitation details and documents

A copy of the Solicitation may also be obtained by emailing the Purchasing Analyst shown below.

Offerors shall submit an electronic response, including Letter of Interest and accompanying information, in PDF format via email to the Purchasing Analyst referenced below.

Letters of Interest with all accompanying information shall be submitted before the due date and time specified in the Request for Information.

Single Point of Contact City of Eugene Purchasing is the issuing office. Address all concerns or questions regarding this solicitation to the Purchasing Analyst identified below.

Dated: October 27, 2023

Michelle Hahn Purchasing Analyst MHahn@eugene-or.gov https://oregonbuys.gov/bso/ mailto:MHahn@eugene-or.gov

RFI 20242007 Managed Security Operations Center & Managed Detection and Response Services page 3

II. INSTRUCTIONS TO OFFERORS

1. Fill out and return the attached Standard Request for Information Form with Offeror Letter of Interest and responses to the questions outlined in Section IV. Questions for Offerors.

2. Offerors shall submit an electronic response, including Letter of Interest and accompanying information, in pdf format by emailing the City’s Purchasing Analyst.

Letters of Interest with all accompanying information shall be submitted before the due date and time specified in the RFI. Offeror shall bear all risks associated with delays in email or file sharing services.

3. Letters of Interest may be withdrawn by written notification on company letterhead signed by an authorized person and received prior to the deadline for submitting Letters of Interest.

4. This RFI does not commit the City to pay any costs incurred by any Offeror in the submission of Letters of Interest.

5. PUBLIC RECORDS: This RFI and one copy of each Letter of Interest received in response to it, shall be kept by the City of Eugene Purchasing Office and made a part of a file or record which shall be open to public inspection, excepting any information that is considered trade secret under ORS 192.501(2), each sheet of such information must be marked with the following legend:

“This data constitutes a trade secret under ORS 192.501(2), and shall not be disclosed except in accordance with the Oregon Public Records Law, ORS 192.”

The Oregon Public Records Law exempts from disclosure only bona fide trade secrets, and the exemption from disclosure applies only "unless the public interest requires disclosure in the particular instance." ORS 192.501(2). Therefore, non-disclosure of documents or any portion of a document submitted as part of a letter of interest may depend upon official or judicial determinations made pursuant to the Public Records Law.

6. Questions or clarification requests shall be submitted by email to the City’s Purchasing Analyst no later than 3:00 PM Monday, November 27, 2023. Contents of questions and clarifications should include a reference to the page or item being addressed, the reason and any proposed alterations.

The City may limit the number of responses it provides in response to Offerors’ questions.

Therefore, the City asks Offerors to prioritize questions asked. Do not include questions with the response to the RFI. Questions will be answered via Addendum(s) posted on OregonBuys.

7. Statements by City staff or its representatives are not binding on City, unless confirmed by written addendum. Addenda will issue and Offerors shall receive Addenda as follows: City will not mail notice of Addenda but will publish notice of any Addenda on OregonBuys. Addenda may be downloaded from OregonBuys. Interested Offerors should frequently check OregonBuys until closing.

RFI 20242007 Managed Security Operations Center & Managed Detection and Response Services page 4

III. REQUIREMENTS / SPECIFICATIONS

1. INTRODUCTION

It is the intent of this solicitation to determine the company most responsive to provide a Managed Security Operations Center (“MSOC”) and Managed Detection and Response (“MDR)” provider that will be responsible for detecting intrusion, malware, and malicious activity in the City of Eugene’s networks, including on-premises, cloud, SaaS applications and platforms, by eliminating false positives, identifying real threats, and assisting in rapid response to eliminate and mitigate those threats.

We are seeking an MSOC and MDR, but we realize with the advancement of new technologies, different approaches may meet the same required functions described in paragraph 1 of this section in a different manner. When answering the questions, please explain how your service meets those requirements.

2. PROJECT DESCRIPTION

The City of Eugene is evaluating all solutions to meet its Managed Security Operations Center (“MSOC”) and Managed Detection and Response (“MDR)” needs. The City of Eugene is currently utilizing Rapid7 for these services. To assist with understanding the current City technical environment, additional details have been provided below.

3. Technical Environment

3.1 Technical Infrastructure

The City of Eugene currently operates in a Microsoft technical environment. The City manages its own complex, multi-tiered network with over 350 servers, 1800+ PCs and fiber distributed to facilities throughout the city.

3.2 Network Architecture

The City of Eugene network consists of 50+ sites connected via fiber optics, with a few exceptions. Most site connections are 1Gbps, with some 10Gbps connections. Workstations connect to the network at 1Gbps. The City has a 1Gbps internet connection for general City business use. The City also utilizes 802.11b/g at the majority of sites and requires domain joined machines with active domain users to access the business network. There is also a publicly available wireless network that is throttled to a symmetrical 4Mbps that goes over a separate connection to the internet, due to its nature, it has no guarantee of uptime. The City uses a combination of perimeter firewalls and inspection at various places in the network as well as URL Filtering capabilities. VPN access is achieved via Cisco AnyConnect or NetMotion Mobility. Cisco Phones are utilized on the network and QoS/CoS are implemented as such.

The City utilizes the Microsoft Defender suite of security tools. The City has compliance obligations in regards to HIPAA, CJIS, and PCI. Minimum password requirements meet minimum CJIS requirements of 8 characters with complexity.

3.3 Servers

The City of Eugene utilizes a regional data center to house the majority of server and network assets. The server environment at the City consists of 80% virtualized servers running in a highly available Hyper-V cluster on Dell PowerEdge AX-750 servers with Nimble SANs

RFI 20242007 Managed Security Operations Center & Managed Detection and Response Services page 5 providing storage. Physical general use servers are HP ProLiant or Dell PowerEdge servers with local storage. The City also manages servers hosted in the Microsoft Azure cloud.

Servers run Windows 2016, 2019, and 2022 and are patched regularly. The City SQL servers are 2016, 2019, and 2022. Application servers run IIS v10. The City utilizes Active Directory and ADFS and email services are provided via Office 365. General practice stipulates installing applications to a data drive and not to the C: drive of any server.

3.4 Standard Workstations

City of Eugene workstations run on Intel-based chipsets with a minimum of 8GB of memory and a large storage drive. Laptops are mostly Dell Latitude or Precision machines. Desktops are supplied by Dell and include OptiPlex and Precision Tower PC’s. All PCs run Windows 10 or 11 Enterprise Edition. All PCs are managed by SCCM 2303 or Microsoft Intune and are regularly patched with the most current Microsoft security patches. The City uses Microsoft Defender for virus and threat protection. Microsoft Edge, Chrome, and Firefox are the standard web browsers in use.

3.5 Mobile Platforms

The City of Eugene currently has many Microsoft ActiveSync capable smartphones for integration with Office 365. In addition, the City of Eugene has created iPhone Applications for iPad and iPhone devices.

RFI 20242007 Managed Security Operations Center & Managed Detection and Response Services page 6

IV. QUESTIONS FOR OFFERORS

(Submit responses with Letter of Interest)

Please answer the following questions as thoroughly as possible. If a question asks about a feature or function not included in your service, please explain how you could still meet the requirement of the feature or function referenced.

Service Provider Overview

01. How long has your company been in business?

02. How long have you offered Managed Detection and Response (MDR) services to your clients?

03. Is MSOC or MDR your primary business offering? If not, what is your primary business offering?

04. Approximately how many clients do you have fully implemented in your MDR offering?

05. Are you willing to demonstrate your services in a proof of concept implementation?

06. What is your client retention rate?

07. What is your Net Promotor Score (NPS)?

08. Please provide at least two references we can contact, preferably from clients with similar size and scope of operations.

09. Please describe what you feel differentiates your offering from your competitors.

Compliance

10. What level of Security Operations Center (SOC) compliance does your SOC maintain?

11. Do you have experience with acting as a processor for General Data Protection Regulation

(GDPR) controllers?

12. Do you use subcontractors to support your environment? If yes, how do you ensure the subcontractors operate securely and effectively?

13. Have you suffered a breach, either from an internal or external actor, in any of the preceding 36 months? Please describe and indicate what was learned from this event?

Architecture, Implementation and Tuning

14. Describe your implementation and tuning process for a new customer.

15. Describe the overall level of effort and engagement of our internal team to assist in the point of contact and implementation of your Services.

RFI 20242007 Managed Security Operations Center & Managed Detection and Response Services page 7

16. What points of technical integration do you expect we will need to perform?

17. Does your solution require a SIEM solution be in place already?

18. What are the network bandwidth requirements for your solution?

19. Does your solution require an appliance to collect or forward log data?

20. Are there any third-party licensed products that we will need to purchase? What might these be and what are the associated costs?

21. What type of access will you need to our network?

22. How many SOCs does your company have and where are they located?

23. Are clients homed out of a specific monitoring center or is activity shared across your centers?

24. How do you address failover?

25. Do you threat hunt 24/7?

26. During off hours, is your service supported with on-call staffing or by analysts who are live in your SOC 24/7?

27. Are there times you do not provide monitoring services?

28. How many analysts and engineers do you have on staff?

29. Are analysts and engineers allocated evenly over shifts?

30. Will you provide to us a dedicated engineer or service delivery manager?

31. What security certifications are held by your staff?

32. How do you keep your staff current with technology?

33. Do you allocate time for your staff to attend training and/or obtain additional certifications?

34. What’s your average response time?

35. What’s your average time to resolution?

36. Can we call into your SOC?

37. When we call into your SOC, will we speak to an automated phone tree or scheduler?

38. Do you perform background checks on your employees with access to customer information?

39. Will anyone ever access my data or perform investigations outside a secure environment (i.e.

home office, etc.)?

RFI 20242007 Managed Security Operations Center & Managed Detection and Response Services page 8

Threat Intelligence

40. Does your SOC proposal include any threat intelligence or threat feeds? If so, what are these, and are they external or internal?

41. Do you have a dedicated internal threat intelligence team?

42. Do you apply threat intelligence to customer security alerts as part of your process for vetting or determining if an alert should be escalated to security event status and action taken?

43. Is security event data shared across your customer base? How is this handled to ensure confidentiality?

44. Do you categorize threat intelligence by industry or sector?

45. Do you recommend/require your clients subscribe to threat feeds?

MDR Approach

46. Do you offer different service level options for security monitoring/alerting?

47. If yes, what service level would you typically recommend for an organization of our size?

48. Does your service include a process for adding new rules/event correlations? If yes, please explain your approach for communicating and gaining approval for these recommendations.

49. How often are signatures and threat intelligence updated?

50. Can you update your technologies during production hours without a shutdown window?

51. How do you monitor endpoints? Please be thorough.

52. How do you monitor networks? Does your solution require hardware to be purchased? Please be thorough.

53. What (if any) access to or configuration of firewalls is necessary to adequately monitor?

54. How do you classify/prioritize security events?

55. What is your process for detecting and responding to a threat?

56. How are events sorted between positive and false positive?

57. What service level agreements or service level objectives do your SOCs offer?

58. What is the turnaround time from detection to remediation, on average?

59. How do you teach your clients to improve their security postures?

60. How do you improve monitoring capabilities over time based on event history?

RFI 20242007 Managed Security Operations Center & Managed Detection and Response Services page 9

61. Please describe your approach and investment to AI and ML in assisting your threat hunting.

MDR Threat Hunting

62. Does your proposal include hunting for threats (including zero day threats) within our environment?

63. How do you perform this hunting?

64. How often do you perform hunting?

65. Is there any special software we need to deploy to support this hunting?

66. What part do humans play in the threat hunting lifecycle?

Incident Analysis and Response

67. Do you perform real-time inspection of every packet utilizing full packet capture? If you do full packet capture please explain how long you do it for, when it starts, and how long you retain it for?

68. Does your solution detect unknown threats and attacks leveraging patterns and behavioral analytics?

69. Does your solution detect based on signatures and indicator of compromise (IOCs)?

70. Do you do full forensic analysis to confirm threats and eliminate false positives?

71. Are you able to do near real-time communication disruption and isolation of threats on client’s behalf?

72. If so, are these placed autonomously or by human decision? If both please specify when and how the decision is derived.

73. Please describe the level of support provided until incident is remediated and threat actor is eliminated.

74. Do you charge retainers or extra fees on top of your base costs for this incident response capability? If so, please elaborate on what this entails and how you charge for these services.

75. What would constitute a variable bill?

76. At what point do you engage us to assist in mitigation?

77. What does your normal escalation and notification process look like?

78. Does your service provide full response reports on investigations?

RFI 20242007 Managed Security Operations Center & Managed Detection and Response Services page 10

Metrics, Reporting and Dashboards

79. Do you provide operational reports to your customers?

80. What is the frequency for customer reporting?

81. Can you provide sample reports? If so, please provide a sample as part of this response.

82. What is your preferred method for delivery of customer reports?

83. Are real time data and operational reports exportable? If so, what formats are supported?

Data Management

84. Where do you store customer data? Include geographic region(s).

85. Data retention: How long will your company store data collected/created for us?

86. Data destruction: What is the process for purging or destroying historical data after use?

87. In the event we need comprehensive forensic data for an investigation, can you provide it and what can you provide? What is the typical cost?

Pricing

88. What services from your offerings are being proposed?

89. What is the pricing model for each component?

90. If your solution requires the installation of additional hardware or software, please detail the additional costs of that requirement in responding to this RFI.

91. What is your standard contract term?

92. Are additional discount rates available for longer duration contracts? If so, what are they and for what duration?

93. Please provide detailed cost breakdowns of your proposal including any additional startup costs, maintenance costs, ongoing support costs, incident retainers and other fees or required payments associated to your solution.

If third party software or subscription services are required, include these in this assessment.

Client Satisfaction

94. How do you track your customer satisfaction?

95. Do you have SLAs or SLOs? If so, please provide the matrix.

RFI 20242007 Managed Security Operations Center & Managed Detection and Response Services page 11

96. Do you conduct leadership briefings? If so, how often?

97. Do you ever participate in meetings with clients and regulators regarding due diligence questionnaires?

Additional Questions

98. If the security tool/suite is capable of replacing Microsoft Defender’s functionality, please indicate that functionality in detail.

After reviewing the Letters of Interest submitted in response to this RFI the City may, in its sole discretion, invite selected Offeror(s) to demonstrate the functionality of their offered software. Provide a sample demonstration agenda, including the recommended amount of time to review modules and/or core software functionalities and features.

Required Submittals Initials

Letter of Interest

Signed Standard Request for Information Form

Completed Questions For Offerors Form

RFI 20242007 Managed Security Operations Center & Managed Detection and Response Services page 12

IV. STANDARD REQUEST FOR INFORMATION FORM

Due Date and Time: Thursday, December 7, 2023 @ 2:30PM

I, the undersigned, and authorized representative of ________________________________ (Firm Name) which is a sole proprietor __________, partnership __________, or corporation __________ have read and thoroughly understand the specifications, the RFI instructions, and all other conditions of the Request for Information solicitation as well as all addenda issued for this solicitation by the City of Eugene for Managed Security Operations Center and agree that the information submitted is accurate and correct.

Name: Title:

Signature: Date:

Company Name:

Tax ID Number (TIN): ___________________________________________________________

Address:

Phone: Fax:

E-mail Address: ________________________________________________________________

Company contact for this project (if different from above):

Name: Title: ______

Phone: E-mail:__________________________________

Rev 04/23 Contract XXXX-XXXX page 1

V. SAMPLE CONTRACT

CITY OF EUGENE SOFTWARE SERVICES CONTRACT

Managed Security Operations Center & Managed Detection and Response Services

BETWEEN: The City of Eugene, (City) an Oregon Municipal Corporation

AND: _________, (Contractor) an __________ organized and existing under the laws of the State of __________

CONTRACT NO.: __________ - __________

EXPIRATION DATE:

1 RECITALS

A. Contractor is engaged in the business of ________________.

B. City desires to engage Contractor to provide the Services described in this Agreement and Contractor is willing to provide such Services on the terms and conditions set forth herein.

C. The Contract described herein was awarded under the exemption or procedure authorized by City of Eugene Administrative Order 44-23-01-F, Public Contracting Rules 2022, Exemption E-10, Information Technology.

2 AGREEMENT

1. Incorporation of Exhibits; Definitions; Contractor’s Representations and Warranties.

1.1 Exhibits. The Contract between the parties (the “Contract”) includes and incorporates into this document (this “Agreement”) all of the following:

Exhibit A summarizes certain federal, state, and municipal laws that apply to government contracts. The provisions of Exhibit A are statements of law and may not be modified and take precedence in the event of an inconsistency with the Agreement.

Other Exhibits. The Contract also includes and incorporates the following exhibits, which are listed in order of precedence. The provisions of this Agreement will have priority over all conflicting provisions of the following exhibits:

Exhibit B: Statement of Work / Service Deliverables Exhibit C: Compensation Add other Exhibits as necessary

1.2 Definitions. With the exception of proper nouns, capitalized terms not otherwise defined herein shall have the following meanings.

“Agreement” means this document, entitled Personal Services Contract and ending with the signatures of all parties.

“Contract” means the written statement of the parties’ mutual and respective agreements, promises, undertakings and rights as set forth in this Agreement and all incorporated exhibits.

Rev 04/23 Contract XXXX-XXXX page 2

“Services” means all of the products, properties, and Services to be provided by Contractor under this Contract, as described in Exhibit B.

1.3 Contractor’s Representations and Warranties. Contractor makes the following representations and warranties to City:

1.3.1 Contractor and Contractor’s personnel are, and will at all times hereunder be, fully qualified by all necessary education, training, experience, licensure, and certification to perform the Services.

1.3.2 As of the date of execution hereof, there are no claims or suits or proceedings, or threats thereof, seeking to enjoin the execution of the Contract by Contractor or the effect of which could prevent Contractor from performing or having the authority to perform the Services.

1.3.3 Neither the execution of the Contract nor the performance of the Services will constitute a breach or violation of any other contract, agreement, or law by which Contractor is bound or to which Contractor or any of its personnel who will perform the Services are subject.

2. Services.

2.1 Commencement. Contractor shall begin to provide the Services on __________, or, if later, as soon as this Contract has been executed by all parties.

2.2 Key Personnel. Contractor has agreed that certain key personnel shall be assigned to perform certain parts of the Services, as described below. Removal of these key personnel from the specified tasks without the prior approval of City will be a material breach of the Contract.:________.

2.3 Security. If the Services will be performed on City property, Contractor will comply with all of

City’s security policies and procedures.

3. Term.

3.1 Initial Term. The initial term of the Contract shall expire, unless terminated or renewed, on the expiration date shown in the caption of this Agreement.

3.2 Renewal. Upon completion of the initial term, the City may elect to extend the Contract for up to four (4) additional one-year terms by mutual agreement of the parties.

4. Compensation. Subject to City’s right of offset for breach, Contractor will bill City for the Services by submitting periodic invoices that conform to the requirements of Exhibit C. City will make payments net 30 days of receipt of a properly submitted invoice. Notwithstanding the foregoing, City will have the right to withhold payment for any item which City disputes in good faith, provided that City pays for all non-disputed items and takes commercially reasonable action to resolve the dispute.

MACIEL Erica A INSERT NAMES OF KEY PERSONNEL (IF ANY) OR “NONE” AND WHAT PART OF THE SERVICES THEY WILL PERFORM

Rev 04/23 Contract XXXX-XXXX page 3

5. Termination. Notwithstanding any other provisions hereof to the contrary, the Contract may be terminated as follows:

5.1 The parties, by mutual written agreement, may terminate the Contract at any time.

5.2 Either party may terminate the Contract if the other party is in breach of any provision hereof which breach continues for more than 30 days after a notice describing the breach has been given unless, in the case of a breach which cannot be cured within such 30-day period, the breaching party immediately initiates and diligently prosecutes a plan of curative action that is acceptable to the non-breaching party. Notwithstanding the foregoing, termination for a recurring breach may be made if the breach is uncured within seven days after the second notice in any twelve-month period and immediately, without opportunity for cure, in the third or any subsequent notice of breach in any twelve-month period.

5.3 The City may terminate the Contract on any date specified in a notice if funding for the

Services becomes unavailable or if the City determines that termination of the Contract is required by the public interest.

5.4 City may terminate the Contract immediately and without prior notice upon Contractor's failure to have in force any insurance required by the Contract, if Contractor breaches the City's security requirements, if Contractor fails to maintain any certificate or license required for performance of the Services, or as provided in Exhibit A.

6. Force Majeure. Neither City nor Contractor are responsible for any failure to perform or for any delay in the performance of any obligation under this Contract caused by public health emergency, fire, riot, acts of God, terrorism, war, or any other cause which is beyond the breaching party’s reasonable control. Contractor shall, however, make all reasonable efforts to remove or eliminate the cause of Contractor’s delay or breach and shall, upon the cessation of the cause, continue performing under this contract. City may terminate this Contract upon written notice to Contractor after City reasonably determines that the delay or breach will likely prevent successful performance of the Contract.

7. Criminal Background Check. A successful criminal background check is required for all Contractors before a person is allowed to work on any of the City’s computer software projects. All Contractor(s) who have been selected for the project(s) will be considered in pending status until they have passed the criminal background check. Depending on the nature of the project and the sensitivity of data, either the Human Resources and Risk Services Department or the Eugene Police Department will perform the necessary background check.

8. Use of Regional Information System (RIS) Equipment. The Contractor agrees to use any RIS-supplied or City-supplied software, equipment and/or facilities exclusively for the completion of the Contract. Other use shall be grounds for Contract termination. The City may deduct from any amounts payable to the Contractor or may bill the Contractor for the value of any unauthorized usage of RIS and City equipment and facilities.

9. Acceptance Criteria. Final acceptance of the project will be decided by the City based on functionality, reliability, and performance during the 60-day acceptance period. The City shall check the system for completeness and compliance with the Contract specifications. The City shall test the

Rev 04/23 Contract XXXX-XXXX page 4 system for completeness and error-free work. After these inspections prove satisfactory, the system shall be turned over to the City. The acceptance period shall commence following the turnover of the completed project to the City. At that time, the operational control becomes the responsibility of the City. The City shall give written notice of the start of the 60-day acceptance period. If any part of the system does not perform according to the analysis and design specifications during the acceptance period, the Contractor at the Contractor's expense shall correct the problem. The acceptance period shall restart at day one when the problem is corrected by the Contractor. Resetting the duration of the acceptance period after the problem is corrected may be negotiable depending upon the severity of the problem. The City shall make the final determination for resetting the acceptance period. If successful completion of the acceptance period is not attained 120-days from the turnover date, the City shall have the option of terminating the Contract with the Contractor forfeiting the 15 percent retainage or continuing the performance test.

10. Successful Completion. This Contract will be considered to be successfully completed when the City provides written notification of completion to the Contractor. This notification will be given to the Contractor within 15 days after the system has run error-free for 60 consecutive days. This assumes that in the opinion of the City, the product meets the requirements as specified in this Contract. On final acceptance of the Contract, the City shall pay the remaining 15 percent of the Contract cost. If the products do not meet the requirements, the Contract will not be considered to be successfully completed.

11. Remedies.

11.1 In the event of a termination of this Contract by City because of a breach by Contractor, City may complete the Work either by itself or by contracting with other persons, or any combination thereof. Contractor shall be liable to City for any costs or losses incurred by City arising out of or related to the breach, including costs incurred in selecting other contractors, time-delay losses, attorney fees and the like, less the remaining unpaid balance of the consideration provided in this Contract. City may withhold payment of sums due Contractor for work performed to the date of termination until City's costs and losses have been determined, at which time City may offset any such amount due Contractor against the costs and losses incurred by City.

11.2 The foregoing remedies provided to City for breach of this Contract by Contractor shall not be exclusive. City shall be entitled to exercise any one or more other legal or equitable remedies available because of Contractor's breach with or without termination.

11.3 In the event of breach of this Contract by City, Contractor's remedy shall be limited to termination of this Contract and payment for Services performed to the date of termination less any offset to which City is entitled.

12. Records/Inspection. Contractor shall maintain records of its charges to City under this Contract for a period of not less than three full fiscal years following Contractor's completion of this Contract. Upon reasonable advance notice, City or its authorized representatives may from time to time inspect, audit, and make copies of any of Contractor's records that relate to this Contract. If any audit by City discloses that payments to the Contractor were in excess of the amount to which Contractor was entitled under this Contract, Contractor shall promptly pay to City the amount of such excess. If the excess is greater than two percent of the Contract amount, Contractor shall also reimburse City its reasonable costs incurred in performing the audit.

Rev 04/23 Contract XXXX-XXXX page 5

13. Indemnification. Contractor shall indemnify and hold City, its officers, agents, and employees, harmless from and against any and all claims, actions, liabilities, costs including costs of defense, arising out of or in any way related to the work or other actions or failure to act by Contractor and Contractor's employees, agents, officers, and contractors. In the event any such action or claim is brought against City, Contractor shall, if City so elects upon tender by City, defend the same at Contractor's sole cost and expense, promptly satisfy any judgment adverse to City, or to City and Contractor jointly, and reimburse City for any loss, cost, damage, or expense (including legal fees) suffered or incurred by City.

14. Insurance Contractor shall have and maintain the insurance policies specified below. Each policy of insurance shall be written as a primary policy, not contributing with or in excess of any coverage which City may carry. A copy of each policy or a certificate satisfactory to City shall be delivered to City prior to commencement of the Services. The adequacy of all insurance policies for compliance with this Section 12 shall be subject to approval by City’s Risk Manager. Failure to maintain any insurance coverage required by the Contract shall be cause for immediate termination of the Contract by City.

Unless otherwise specified, each policy shall be written on an “occurrence” form with an admitted insurance carrier licensed to do business in the state of Oregon; and shall contain an endorsement entitling City to not less than 30 days prior written notice of cancellation. In the event the statutory limit of liability of a public body for claims arising out of a single accident or occurrence is increased above the combined single limit coverage requirements specified below, City shall have the right to require that Contractor increase the coverage limits of all liability policies by the amount of the increase in the statutory limit.

14.1 Commercial General Liability. Contractor shall maintain a broad form commercial general liability insurance policy with coverage of not less than $2,000,000 combined single limit per occurrence, with aggregate of $3,000,000, for bodily injury, personal injury or property damage. Such policy shall contain a contractual liability endorsement to cover Contractor's indemnification obligations under this Contract. The policy shall also contain an endorsement naming City as an additional insured, in a form satisfactory to City, and expressly providing that the interest of City shall not be affected by Contractor's breach of policy provisions.

14.2 Workers' Compensation Insurance. Contractor shall comply with the Oregon Workers' Compensation law by qualifying as a carrier-insured employer or as a self-insured employer and shall strictly comply with all other applicable provisions of such law. Contractor shall provide City with such further assurances as City may require from time to time that Contractor is in compliance with these Workers' Compensation coverage requirements and the Workers' Compensation law. Contractor is a subject employer that will comply with ORS 656.017.

14.3 Automobile Liability. Contractor shall maintain an automobile liability insurance policy with coverage of not less than $2,000,000 combined single limit per occurrence for bodily injury, personal injury, or property damage. The coverage shall include both hired and non-owned auto liability. The policy shall also contain an endorsement naming City as an additional insured, in a form satisfactory to City, and expressly providing that the interest of City shall not be affected by Contractor’s breach of policy provisions.

Rev 04/23 Contract XXXX-XXXX page 6

14.4 Professional Liability. Contractor shall maintain a professional liability insurance policy reflecting limits of not less than $2,000,000 for claims for professional acts, errors or omissions arising from the Work. The policy may be written on a “claims made” form. Contractor shall maintain the professional liability insurance coverage for at least one year after the completion of the work. The policy shall contain an endorsement entitling the City not less than 60 days prior written notice of cancellation of such policy.

14.5 Cyber Liability. Contractor shall maintain a cyber liability insurance policy reflecting limits of not less than $2,000,000 for claims for data breach, or technical errors or omissions arising from the Work. The policy may be written on a “claims made” form. Contractor shall maintain the cyber liability insurance coverage for at least one year after the completion of the work.

The policy shall contain an endorsement entitling the City not less than 60 days prior written notice of any material change, nonrenewal or cancellation of such policy.

15. Subcontracting. Contractor was selected for its special knowledge, skills, and expertise, and shall not subcontract the Services, in whole or in part, without City’s prior written approval, which may be withheld for any reason. Contractor shall require any approved subcontractor to agree, as to the portion subcontracted, to comply with all obligations of Contractor specified in the Contract.

Notwithstanding City’s approval of a subcontractor, Contractor shall remain obligated for full performance of the Contract and City shall incur no obligation to any subcontractor. Contractor shall indemnify, defend, and hold City harmless from all claims of subcontractors.

16. Assignment. Contractor shall not assign the Contract, in whole or in part, or any right or obligation hereunder, without City’s prior written approval, which approval shall not be subject to a reasonableness standard. If Contractor is a corporation or partnership, a change in ownership of Contractor resulting from a voluntary transfer of stock or partnership interests, or a transfer upon death or disability of any owner, shall not constitute an assignment unless the transferor is one of the key personnel specified in Section 2.2 of this Agreement.

17. Independent Contractor. Whether Contractor is a corporation, partnership, other legal entity or an individual, Contractor is an independent contractor. If Contractor is an individual, Contractor's duties will be performed with the understanding that Contractor is a self-employed person, has special expertise as to the Services which Contractor is to perform and is customarily engaged in the independent performance of the same or similar services for others. The manner in which the Services are performed shall be controlled by Contractor; however, the nature of the Services and the results to be achieved shall be specified by City. Contractor is not to be deemed an employee or agent of City and has no authority to make any binding commitments or obligations on behalf of City except to the extent expressly provided herein.

18. Confidential Information. To be considered “Confidential Information” under the Contract, information must be clearly marked as “confidential information,” in a manner that will be obvious immediately upon access. Each party will limit its use of Confidential Information to the purpose for which it was disclosed by the other party and will use a reasonable level of care to prevent the intentional or inadvertent misuse, theft, or inappropriate disclosure of such information. Contractor understands that all records held by the City are public records and subject to public disclosure under public records law, and Contractor agrees that City shall have no liability for the disclosure of any Confidential Information properly disclosed under the law or under a court order in response to a

Rev 04/23 Contract XXXX-XXXX page 7 public records request. Contractor also understands and agrees that the Contract documents and all records of Contractor’s fees and charges may not be considered Confidential Information and are public records for which no exemption to public disclosure applies.

19. Compliance with Laws. Contractor shall comply with all applicable Federal, State, and local laws, rules, ordinances, and regulations at all times and in the performance of the Work.

20. Ownership of Work Product.

20.1 All tangible or electronic copies of compilations, reports, plans, drawings, techniques, formulas, works of art, literature, music, or other personal property produced or created specifically for City under the Contract (“Work Products”) shall be delivered to the City prior to the completion or termination of the Services and shall be the sole and exclusive property of the City.

20.2 In addition to ownership of the Work Products, City shall also be the owner of all copyrights, if any, existing in any Work Product under the federal copyright act except for those rights of attribution and integrity described in 17 USC 106A.

20.3 Unless expressly provided to the contrary herein, Contractor waives all rights of attribution and integrity with respect to any work of visual art except the right to prevent the use of his or her name as the author of the work of visual art in the event of a distortion, mutilation, or other modification of the work which would be prejudicial to his or her honor or reputation.

20.4 With the exception of Work Products that incorporate City’s databases or City’s Confidential

Information, Contractor may retain and display copies of any Work Product for marketing or demonstration purposes, and Contractor shall have the right to make derivative products based on a Work Product, but Contractor may not sell or commercially exploit any Work Product or reproduction of a Work Product.

20.5 Nothing in this Section 20 is intended to appropriate to City any personal property not created for City under the Contract, or any property used or incorporated into a Work Product that was owned by Contractor or a third party prior to its use for the Services, or that is merely a minor development or enhancement of Contractor’s pre-existing proprietary process, formula or technology.

20.6 City shall remove Contractor’s name and trademarks, if any, from any copy of a Work Product that is modified except when modified by Contractor, and Contractor shall have no responsibility for any modification of a Work Product that is not made under Contractor’s supervision.

21 Notices. Any notice permitted or required by the Contract shall be deemed given when personally delivered or upon deposit in the United States mail, postage fully prepaid, certified, and with return receipt requested, to the persons and addresses shown below. In addition, if directions for electronic transmission (email) are set forth below, notices may be delivered by email. Notices sent by certified mail will be deemed delivered three business days after placement in the mail and notices sent by email will be deemed delivered when successful transmission is electronically confirmed. Except as

Rev 04/23 Contract XXXX-XXXX page 8 expressly provided in the Contract, required notices must be signed by the person designated to receive notices, or that person’s designee or attorney.

Contractor: _________ City: ________ _________ Department/Division _________ Eugene, Oregon 9740x

Email / phone Email / phone Each party shall notify the other of any change in the name, address, or email instructions to be used for delivery of notices.

22. Dispute Resolution.

22.1 Continued Performance. Unless the Contract is terminated, neither party shall suspend performance of its obligations hereunder pending the resolution of a dispute.

22.2 Negotiation/Mediation. The parties shall use all reasonable attempts to resolve disputes informally through conferral and negotiation. In the event such efforts are unsuccessful, the parties may mutually agree to voluntary mediation. The parties shall share equally in all common costs of mediation.

22.3 Forum. Any litigation between the City and the Contractor that arises from or relates to this Contract shall be brought and conducted solely and exclusively within the Lane County Circuit Court; provided, however, if a dispute must be brought in a federal forum, then it shall be brought and conducted solely and exclusively within the United States District Court for the District of Oregon, Eugene Division. In no event shall this Subsection be construed as a waiver by the City of Eugene of any form of defense or immunity, whether sovereign immunity, governmental immunity, or otherwise, from any claim or from the jurisdiction of any court.

CONTRACTOR, BY EXECUTION OF THE CONTRACT HEREBY CONSENTS TO THE IN

PERSONAM JURISDICTION OF THE COURTS REFERENCED IN THIS SECTION.

23. Waiver. No waiver of any breach of this Contract shall be held to be a waiver of any other or subsequent breach of this Contract. The failure of either party to insist upon any of its rights, shall not be deemed a waiver of such rights on any subsequent occasions.

24. Interpretation. This Contract shall be governed by and interpreted in accordance with the laws of the State of Oregon without regard to principles of conflict of laws.

25. Severability. If any portion of this Contract is held or declared by a court of competent jurisdiction to be void, invalid, illegal, or otherwise not fully enforceable, it shall not affect any other section of this Contract and the remainder of the Contract shall continue to be binding and of full force and effect.

26. Survival. Any duty, liability, or obligation of a party which arises under this Contract, including without limitation, obligations with respect to indemnification, shall survive the termination or expiration of this Contract and shall be legally enforceable until satisfied by performance or payment, or until enforcement is legally precluded by lapse of time.

Rev 04/23 Contract XXXX-XXXX page 9

27. No Third-Party Beneficiaries. There are no third-party beneficiaries of this Contract. The parties agree and intend that this Contract shall be enforceable only by the parties and their duly authorized representatives.

28. Integration. The Contract embodies the entire agreement of the parties concerning the Services.

There are no promises, terms, conditions. or obligations other than those contained herein. The Contract shall supersede all prior communications, representations, or agreements, either oral or written, between the parties. The Contract shall not be amended except in writing, signed by both parties.

29. Effective Date. The effective date of this Contract shall be the latest date of signature by the parties.

City of Eugene

Print Name:

Title:

Certifications of Contractor: Pursuant to ORS 305.385, Contractor hereby certifies that it is not in violation of any tax laws as defined in ORS 305.380. If Contractor is other than one or more individuals who have signed below, the individual(s) signing on behalf of Contractor hereby further certifies and swears under penalty of perjury and warrants to City that: (a) the full legal name and status of Contractor are as set forth in the caption to this Agreement, and (b) s/he is authorized to execute and deliver this Agreement and the Contract to City of behalf of, and as the act of Contractor.

Contractor

Print Name:

Title:

Rev 04/23 Contract XXXX-XXXX page 10

EXHIBIT A

CITY OF EUGENE - STANDARD CONTRACT PROVISIONS

Contracts Subject to ORS Chapter 279B

Goods and Services including Personal Services OTHER THAN Architects, Engineers, Land Surveyors on Public Improvements

The following provisions, if applicable, are hereby included in and made a part of the attached contract between the City of Eugene and the Contractor named thereon as provided for in the Eugene Code, 1971, the Eugene Public Contracting Rules, the revised statutes of the State of Oregon, and Federal laws, rules, regulations, and guidelines. The Contractor AND EVERY SUBCONTRACTOR shall include these provisions in every subcontract SO THAT THESE PROVISIONS WILL APPLY TO, AND BE BINDING ON EVERY SUBCONTRACTOR.

Failure to comply with any of the applicable provisions below shall be a material breach of the contract and may result in debarment of the Contractor or subcontractor from City contracts for up to three (3) years.

1. Fair Employment Practice Provisions (Eugene Code, 1971, Section 4.625 and Eugene Public Contracting Rule 137-046-0500(1))

1.1 Non-Discrimination Requirements. During the performance of this contract, the Contractor and each subcontractor agrees to comply with sections 4.613 to 4.655 of the Eugene Code, 1971, and as follows:

(a) The Contractor and each subcontractor will not discriminate against any employee or applicant for employment because of an individual’s race, religion, color, sex, national origin, marital…