3DCB1BFF-59C1-4739-878E-71A28A578808.pdf

02/25/2026 1

CONTRACT

FOR TECHNOLOGY SERVICES UNDER $50,000

*ANY ALTERATIONS OF CONTRACT LANGUAGE WILL RESULT IN REVOCATION OF CITY ATTORNEY APPROVAL.*

This Contract for _______________________ services is entered into by and between

___________________________ (herein referred to as “Contractor”), and the City of Columbus, Department of

____________________________ (herein referred to as “City”).

WITNESSETH

WHEREAS, the City has a need for ________________________________; and

WHEREAS, the Contractor has the necessary skill, experience and expertise to provide said service; and

NOW, THEREFORE, in consideration of the mutual promises as hereinafter set forth, the parties agree as follows:

ENTIRE AGREEMENT

The following are hereby incorporated into and made part of the Contract, and any conflict of terms and conditions will be resolved in the following order of precedence:

(1) City Contract for Technology Services Over $50,000

(2) City Request for Proposals, RFQ######

(3) Contractor License, Support, Service Level Agreements, SOW, etc.

(4) Contractor Proposal in response to RFQ (#2 above)

This Contract sets forth the entire agreement between the parties with respect to the subject matter hereof. Only the Contractor documents specified in the definition and precedence of this Contract and attached hereto shall be applicable to this Contract. Under no circumstances shall any other Contractor documents, including those incorporated by reference not specified in the definition and precedence of the Contract and attached be binding or controlling. Understandings, agreements, representations, warranties or amendments not contained in this

Contract and not attached hereto, shall not be binding on either party. No. alteration of any terms, conditions, delivery, price, quality, or specifications of this Contract shall be binding on either party without the written consent of both parties. Clicking “consent,” “agree” or any other equivalent electronically when accessing software or a website will not constitute a writing sufficient to bind the City. This Contract is subject to the

Ohio Public Records Act.

1. Contract Term

The term of this Contract shall be from ____________ to _________________. This Contract shall not automatically renew.

The Contract is for a five (5) year term subject to annual approval and appropriation by City Council.

Year 1 of the contract shall be one year from the date of a confirmed purchase order issued by the City

Auditor’s Office.

2. Maximum Obligation

The maximum amount to be paid under any purchase order associated with Year 1 shall not exceed unless additional funds are appropriated and authorized by Columbus City Council.

3. Pricing and Scope of Services

The Contractor agrees to perform and invoice the Scope of Services as set forth and as contained in the terms and conditions of this contract as set forth under Entire Agreement above.

02/25/2026 2

*Contract is NOT valid if the contract documents as defined under Entire Agreement are NOT attached, with the exception of already established publications, (2) City of Columbus RFQ###### RFP package, and (4) Contractor Proposal package to RFQ######.

No other costs, rates, or fees shall be payable to the Contractor for services performed hereunder. No other terms or conditions that are referenced or incorporated in any Contractor’s documents shall be binding or controlling unless identified in the Entire Section of the Contract and attached hereto. The terms and conditions specified in this Contract constitute the entire contract governing the purchase of services by the City from the Contractor.

4. Equal Opportunity Clause

Contractor agrees to abide by all of the terms, conditions and requirements set forth in Columbus City

Code Section 3906.02, Equal Opportunity Clause. Failure or refusal of a Contractor or Subcontractor to comply with the provisions of Title 39 may result in cancellation of this Contract.

5. Taxes

Federal or State taxes are not to be included on invoices for the described services. Contractor will be provided an exemption certificate, if needed.

6. City’s Contract Administrator/Contract Administration

______________________________will manage the Contract on behalf of the City and will be the principal point of contact for the City concerning the Contractor’s performance under this Contract.

Any notice or demand or other communication required or permitted to be given under this Contract or applicable law shall only be effective if it is in writing, properly addressed, and either delivered in person, or by a recognized courier service, or deposited with the United States Postal Services as first-class certified mail, postage prepaid and return receipt requested, to the parties at the following addresses:

(List names and addresses of City and Contractor contact persons below.)

7. Contractor as an Independent Contractor

The Contractor shall be and shall remain an Independent Contractor with respect to all services performed hereunder and neither Contractor nor its employees shall be considered “public employees” for purposes of OPERS membership. Contractor agrees to and does hereby accept full and exclusive liability for the payment of any and all contributions or taxes for Social Security, unemployment insurance or old age retirement benefits, pensions or annuities now or hereafter imposed under any state or federal law which are measured by the wages, salaries or other remunerations paid to the Contractor or persons employed by the Contractor for work performed under the terms of this Agreement and further agrees to obey all lawful rules and regulations and to meet all lawful requirements which are now, or hereafter may be, issued or promulgated under said respective laws.

Individuals utilizing a personal social security number for tax identification purposes and business entities with four (4) or fewer employees must complete and submit, as Exhibit D, the OPERS independent contractor acknowledgment form. THIS FORM CAN BE FOUND AT

WWW.OPERS.ORG

The parties hereto acknowledge that they are independent contractors of each other. Nothing in this

Contract shall be deemed to constitute a partnership or joint venture between the parties or constitute either party to be the agent of the other party for any purpose. The parties further acknowledge that neither they nor any party acting on their behalf shall have the right, power, or authority to obligate the other party to any agreement, term, or condition.

http://www.opers.org/

02/25/2026 3

8. Applicable Law, Remedies

This Agreement shall be governed in accordance with the laws of the State of Ohio and the ordinances, statutes and provisions of the Columbus City Code and Charter; specifically including, but not limited to

Charter Sections 159 and 161. All claims, counterclaims, disputes and other matters in question between the City, its agents and employees, and the Contractor arising out of or relating to this Agreement or its breach will be decided in a court of competent jurisdiction within the County of Franklin, State of Ohio.

Chapter 377 of the Columbus City Codes is hereby incorporated into the contract and Contractor is required to comply with said chapter. This includes, but is not limited to reporting requirements and the obligation to review the commission list of contractors and subcontractors that received an adverse determination. Penalties for failure to comply with the Labor Commission code includes suspension for three years, during which time the Contractor is prohibited from contracting with the City, up to permanent disbarment.

9. Payment/Invoice Submittal

Fees shall be paid for services rendered following: (1) the City’s receipt of a correct invoice, which designates the specific applicable charges, and (2) issuance of a certified purchase order. The City will not be subject to any late payment charges. Rates shall be firm during the term of this Contract. The

City will process correctly documented invoices for payment and Contractor should receive payment for such invoice within thirty (30) days from receipt and approval by the City.

Invoices: All invoices shall be submitted to the address listed on the Purchase Order.

10. Modifications

No modification, amendment, alteration, addition or waiver of any section or condition of this Contract shall be effective or binding unless it is in writing and signed by an authorized representative of the City and the Contractor and approved by Columbus City Council.

11. Contract Termination

If either the City or the Contractor violates any material term or condition of this Contract or fails to fulfill in a timely and proper manner its obligations under this Contract, then the aggrieved party shall give the other party (the “responsible party”) written notice of such failure or violation. The responsible party will correct the violation or failure within thirty (30) calendar days or as otherwise mutually agreed. If the failure or violation is not corrected, this Contract may be terminated immediately by written notice from the aggrieved party. The option to terminate shall be at the sole discretion of the aggrieved party.

When it is in the best interest of the City, the City may terminate this Contract, in whole or in part by providing seven (7) calendar days written notice to the Contractor prior to the effective date of termination. If this Contract is so terminated, the City is liable only for payments required by the terms of this Contract for services received and accepted by the City.

Notwithstanding anything herein to the contrary, the City may terminate this Contract without prior notice upon Contractor’s material violation of the HIPAA Business Associate Agreement, as set forth in

Exhibit D attached hereto.

12. Nonexclusive Remedies

The remedies provided for in this Contract shall not be exclusive but are in addition to all other remedies available under the law.

13. Survivorship

02/25/2026 4

All services executed pursuant to the authority of this Contract shall be bound by all of the terms, conditions, prices discounts and rates set forth herein, notwithstanding the expiration of the initial term of this Contract, or any extension thereof. Further, the terms, conditions, and warranties contained in this Contract that by their sense in context are intended to survive this completion of the performance, cancellation or termination of this Contract, shall so survive. The terms of this Contract will survive the expiration or termination of the time for completion of the Work and the time for meeting any final payment of compensation, except where such creates an absurdity.

14. Save Harmless/Indemnification

Contractor shall protect, indemnify and save the City harmless from and against any damage, cost, or liability, including reasonable attorneys’ fees, resulting from claims for any or all injuries to persons or damage to property arising from intentional, willful or negligent acts or omissions of Contractor, its officers, employees, agents, or Subcontractors.

Pursuant to Columbus City Charter Sec. 159, Ohio Revised Code Section 5705.41, and Ohio Attorney

General Opinion 2003-035, the City is prohibited from agreeing to any contract provision which requires indemnification. The City will not indemnify the contractor, is prohibited from doing so, and therefore does not agree to do so.

15. Severability

If any term or condition of this Contract or the application thereof to any person(s) or circumstances is held invalid, such invalidity shall not affect other terms, conditions, or applications which can be given effect without the invalid term, condition, or application; to this end the terms and conditions for the

Contract are declared severable.

16. Assignment

This Contract may not be assigned or otherwise transferred to others by the Contractor without the prior written consent of the City. Contractor may assign this Contract in its entirety only as part of a merger, acquisition, transfer or change in control so long as the assignee agrees to be bound by all of the terms and conditions of this Contract and such assignee has the necessary resources, skill and expertise to provide the services contemplated herein in the sole discretion of the City. Contractor shall provide reasonable information to the City demonstrating that the assignee has the requisite resources, skill and expertise to provide the Services to allow the City to make a determination of whether to approve or disapprove of the assignment.

If Contractor is subject to a merger, transfer or change in control, Contractor shall provide prior written notice to the City along with information demonstrating that the assignee has the resources, skill and experience to perform under the Contract within ninety (90) days of the effective date of such assignment, transfer or change in control. The City shall provide written notice within sixty (60) days of receipt from Contractor of the written notice of merger, transfer or change in control stating whether it approves or disapproves assignment. If the City approves, this Contract shall inure to the benefit of and be binding upon any respective successors and assigns (including successive, as well as immediate, successors and assignees) of the Contractor. If the City does not approve, this Contract shall terminate within thirty (30) days of receipt of such notice.

17. Authority to Bind

The signatories to this Contract represent that they have the authority to bind themselves and their respective organizations to this Contract.

18. Worker’s Compensation

02/25/2026 5

The Contractor shall comply with all Workers’ Compensation laws of the State of Ohio. Proof of coverage shall be attached to this Contract AS EXHIBIT B.

19. Insurance

Contractor shall carry at least the minimum amounts listed below of Commercial Liability Insurance

(Bodily Injury and Property Damage) naming the City as an additional insured. Contractor must attach a copy of the Certificate of Insurance to this Contract AS EXHIBIT C:

Bodily Injury Liability: Property Damage Liability:

Each Person $500,000 Each Accident $500,000

Each Accident $1,000,000 All Accidents $1,000,000

20. Campaign Contributions

Contractor hereby certifies the following: that it is familiar with Ohio Revised Code (“O.R.C.”) Section

3517.13; that it is in full compliance with Divisions (I) and (J) of that Section; that it is eligible for this contract under the law and will remain in compliance with O.R.C. Section 3517.13 for the duration of this contract and for one year thereafter.

21. City Income Taxes

Contractor hereby further agrees to withhold and pay all city income taxes due or payable under the provisions of Chapter 362, Columbus City Codes, for wages, salaries and commissions paid to its employees and further agrees that any of its subcontractors shall be required to agree to withhold and pay any such city income taxes due under said chapter for services performed under this Contract. If it has been determined by the Columbus Income Tax Division that Contractor, or any of its subcontractors, owes city income taxes, the Contractor agrees that the City may withhold the amount due to the City from any amount due to the Contractor for services performed under this Contract notwithstanding paragraph 9 hereinabove.

22. Subcontracts

The Contractor acknowledges and agrees that it shall not enter into subcontract agreements for the purpose of completing the Work after execution of the Contract without written approval from the City.

The City’s written approval is not required prior to the purchase of commercial goods by Contractor that are required for satisfactory completion of the Work. All subcontractor agreements and subcontracts shall be at the sole expense of the Contractor, unless otherwise specifically agreed to in writing by the

Parties prior to entering into any subcontract agreement.

23. Turnkey Solution: Responsibilities and Mutual Support

The Contractor is responsible for delivering a complete, fully functional, and highly available turnkey system that meets the objectives of the Work. All necessary components and services—whether or not specifically itemized—are included in the Contractor’s scope and price, unless expressly excluded in the

Contract.

“Work” means all tasks, deliverables, services, materials, and responsibilities required to fulfill the scope and objectives of this Contract, including but not limited to the provision, configuration, delivery, installation, integration, testing, and ongoing support of all hardware, software, licenses, systems, documentation, and data. The term includes project management, training, conversions, interfaces, security measures, business processes, technical support, updates, and warranties. The term also includes, but does not limit any “as-a-service” offerings (such as Software as a Service (SaaS), Infrastructure as a Service (IaaS), or Platform as a Service (PaaS)). The Work encompasses everything necessary to deliver a complete, functional, secure, and fully operational solution, whether or not each element is explicitly stated in the Contract, unless specifically excluded.

02/25/2026 6

The Contractor will lead and manage all aspects of the Work, coordinate daily activities, communicate progress and issues with the City, and ensure systems are properly documented and ready for use. This includes all relevant training, helpdesk functions, and technical support. If the project duration will exceed 90 days, the project schedule/Gantt must be managed in Microsoft Project and shared with the

City. Solutions other than Microsoft Project may be proposed by the Contractor, but must be approved by the City prior to use.

The City will, at no cost to the Contractor, provide reasonable office space, services, and access to technical resources in its possession necessary to support the Work. The City’s obligations are limited to those explicitly stated in the Contract.

If the Contractor requires support beyond what the City has agreed to provide, Contractor must clearly specify the nature and extent of those needs, including personnel, facilities, or services. It must also indicate whether such support is essential for completing the Work. The City will evaluate additional requests in good faith and collaborate where possible but may be unable to accommodate all items.

Any required elements not identified by the City or clearly included in the Contractor’s Statement of

Work will not be the City’s responsibility. If the City agrees to provide facilities or services, the

Contractor accepts them on an “as-is” basis, having either inspected or voluntarily waived inspection.

24. RESERVED.

24. Offshore

All Contractor employees or subcontractor employees working on the project must perform all related

Work in the United States. The City will consider proposals with a ‘follow-the-sun’ telephone support model. All locations of work to be performed, including subcontractor work, must be disclosed.

All City data must be maintained within the continental United States. City data may not be created, modified, transmitted, accessed, or otherwise held outside the continental United States.

25. Confidentiality

The Contractor holds a position of trust with the information received during performance of work under the Contract. The Contractor must recognize the responsibility entrusted to it for preserving the security and confidentiality of such information. The City has determined that information it treats as confidential may be disclosed to the Contractor in the performance of its work under the Contract. The

Contractor shall treat the data received and created by the systems used and developed as part of the

Work as confidential, and the City retains title to such data unless otherwise specifically agreed.

Therefore, the Contractor agrees to the following.

“Confidential Information” means information considered to be propriety and a secret of the City or disclosed to Contractor by the City and designated as confidential. This may include information in oral, written, graphic electromagnetic or other form, including but not limited to past, present and future business, financial and commercial information, business concepts, prices and pricing methods, marketing and customer information, financial forecasts and projections, technical data and information, formulae, analyses, trade secrets, ideas, methods, processes, know-how, computer programs, products, equipment, product road maps, prototypes, samples, designs, data sheets, schematics, configurations, 02/25/2026 7 specifications, techniques, drawings and any other data or information of the City that is delivered to, provided to, or accessed by Contractor.

“Confidential Information” does not include information previously known to Contractor, information independently developed or acquired through previous research, consulting, or expertise by Contractor, information that is known to the public (except as a result of a breach of this Contract), information received by Contractor without a non-disclosure obligation to the City (except as a result of a breach of this Contract), or information approved in writing by the City for release.

The City may disclose to the Contractor data or other information that the City treats as confidential.

Title to the City data and Confidential Information and all related materials and documentation the City delivers to the Contractor will remain the property of the City. The Contractor must treat such

Confidential Information as secret if it is so marked, otherwise identified as such, or when, by its very nature, it deals with matters that, if generally known, would be damaging to the best interests of the public, other contractors or potential contractors with the City, or individuals or organizations about whom the City keeps information. Information should be treated as confidential if it includes any information expressly excluded by Ohio law from public records disclosure requirements.

The Contractor agrees not to disclose any City data or Confidential Information to third parties and to use it solely in its performance under the Contract. The Contractor will restrict circulation of city data and Confidential Information within its organization and then only to people in the Contractor's organization that have a need to know to do the Project. The Contractor may disclose City data and

Confidential Information to its subcontractors on a need-to-know basis, but they will be obligated to the requirements of this agreement. The Contractor will be liable for the disclosure of such information whether the disclosure is intentional, negligent, or accidental, unless otherwise provided below.

The parties acknowledge and agree that the City is subject to public records disclosure requirements.

The parties likewise acknowledge that all documents received by the City are considered public records and are within the public domain. Subject to Ohio law, any information or data received by the City from Contractor in writing that is clearly marked “confidential” under this Contract will remain confidential for purposes of performing services under this Contract. The parties agree that information marked “confidential” shall not be controlling for purposes of Ohio’s Public Records Act or litigation discovery. If the City receives a request pursuant to Ohio’s Public Records Act or during litigation discovery for the release of Contractor information, City will delay release of the records for seven (7) calendar days after notifying Contractor to permit Contractor to pursue any legal option available to it to prevent release of the information. Failure to take timely action will result in the release of the information requested. Contractor may likewise choose to waive the pursuit of any legal option by notifying the City of such waiver within that same seven (7) calendar day period. Notwithstanding the foregoing, in the event that the City is served with a duly authorized governmental order, no prior notice shall be given before the requested information is released.

25.1 Reasonable Standard of Care - The City requires the Contractor to exercise at least a reasonable standard of care to safeguard the City’s data. Reasonable standard of care means following accepted industry standards for the protection of confidential information from unauthorized disclosure. The

Contractor will be liable for any unintentional disclosure of City data or Confidential Information when the Contractor has not established and/or followed reasonable policies and procedures or when the disclosure results in liability to the City.

25.2 Prohibited Use of City Data - Unless fully anonymized, the Contractor will not incorporate any portion of any City data or Confidential Information into any work or product, other than a project or service deliverable, and will have no proprietary interest. The Contractor will return all City data and

02/25/2026 8 originals of any Confidential Information and destroy any copies it has made on termination or expiration of its Contract with the City.

25.3 Exceptions - The Contractor's obligation to maintain the confidentiality of the City data and

Confidential Information will not apply where such information: (1) Was already in the Contractor's possession before disclosure by the City, and such information was received by the Contractor without obligation of confidence; (2) Is independently developed by the Contractor; (3) Is or becomes publicly available without breach of the Contract; (4) Is rightfully received by the Contractor from a third-party without an obligation of confidence; (5) Is disclosed by the Contractor with the written consent of the

City; or (6) Is released in accordance with a valid order of a court or governmental agency, provided that the Contractor (a) Notifies the City of such order immediately upon receipt of the order and (b) Makes a reasonable effort to obtain a protective order from the issuing court or agency limiting disclosure and use of the Confidential Information solely for the purposes intended to be served by the order.

26. Security

The City has determined that the Contractor’s solution is a public function and that the Contractor has a fiduciary responsibility for security for the solution and solution data. Therefore, the Contractor shall exercise due diligence to protect City data from unauthorized access, disclosure, modification, or destruction, and to prevent disruption of access to or use of the City’s data or the Contractor’s solution for the components it and its subcontractors control.

26.1 Definition of System - For the purposes of this section, "system" includes the Contractor's components, equipment, computers, hardware, software, telecommunications, services, subcontracted components, facilities, and personnel that collect, process, store, display, and disseminate City data, as well as the policies and procedures governing their use.

26.2 Security Plan - The Contractor must create, maintain, and comply with a written System Security

Plan (SSP) that contains administrative, technical, and physical safeguards for the protection of City confidential information and that reasonably conforms to an industry-recognized cybersecurity framework approved for use by the City.

26.3 Approved Frameworks - City approved, industry recognized frameworks are pursuant to ORC

1354.03 and include the following:

(a) The "framework for improving critical infrastructure cybersecurity" developed by the "national institute of standards and technology" (NIST);

(b) NIST special publication 800-171

(c) NIST special publications 800-53 and 800-53a (City preferred);

(d) Federal Risk and Authorization Management Program (FedRAMP) security assessment framework;

(e) The center for internet security critical security controls for effective cyber defense;

(f) The International Organization for Standardization (ISO)/International Electrotechnical

Commission (IEC) 27000 family - information security management systems.

26.4 City Security Assessments - No less frequently than annually, the City may conduct a security assessment of Contractor’s solution. This could include, but is not limited to the following: a) response to a security questionnaire and any related follow up, b) provide the results of an independent third party audit conducted within the previous twelve months that tested the operating effectiveness of the relevant security controls (e.g., SOC 2, Type 2 report), c) provide relevant documentation describing the security program, including the SSP and any related corrective action plans, or d) allow the City to conduct an on-site visual inspection of the relevant security controls.

02/25/2026 9

26.5 Independent Assessment - The Contractor shall conduct an independent assessment of its security controls at least annually and shall make the results available to the City for inspection.

26.6 Corrective Action Plan - The Contractor shall document and maintain a corrective action plan to address any controls identified as missing or ineffective, whether through independent assessment, self-assessment, City assessment, or other means. The Contractor shall promptly implement the necessary corrective actions or as otherwise agreed upon.

26.7 City Security Standards - The following City standards are intended to expand upon security framework practices required to be implemented. This list is not intended to replace any framework elements.

a. Multi-factor authentication: cloud-based or hosted solutions that will integrate with on-premises

City solutions that maintain sensitive data, or are mission-critical shall use single sign-on based

(SSO), multi-factor authentication utilizing City directory services or City Microsoft Azure tenant, with Microsoft Authenticator.

b. Encryption: Systems that maintain sensitive data, or are mission-critical (as specified in accompanying City bid document, or accompanying statement of work) shall implement encryption, for data in transit and at rest.

c. Data on Portable Devices: The Contractor may not allow the City’s data to be loaded onto portable computing devices or portable storage components or media unless necessary to perform its obligations properly under its Contract with the City. Even then, the Contractor may permit such only if adequate security measures are in place to ensure the integrity and security of the data. Those measures must include a policy on physical security for such devices to minimize the risks of theft and unauthorized access that includes a prohibition against viewing sensitive or confidential data in public or common areas.

At a minimum, portable computing devices must have anti-virus software, personal firewalls, and system password protection and be current with manufacturer and operating system patches. In addition, the City’s data must be encrypted when stored on any portable computing or storage device or media or when transmitted from them across any data network. The Contractor also must maintain an accurate inventory of all such devices containing City data and the individuals to whom they are assigned.

The Parties understand and agree that adherence to this Section does not provide an affirmative defense in the event that the confidentiality, integrity and availability of the City’s confidential data is compromised.

27. Regulatory Compliance

The City and its agents, not to include the Contractor, are subject to regulatory compliance in handling certain types of information, including data. The City has determined that the solution will manage criminal justice information, tax information, health information, personally identifiable information, personally identifiable student information, and electronic payment information. As such the Contractor has a fiduciary responsibility for regulatory compliance as it relates to the solution and solution data.

If the solution provided by the Contractor or its subcontractors handles any of the following types of information, the Contractor will ensure it is compliant with the terms of compliance of each information type referenced below and remains compliant. Copies of all attestations of compliance shall be promptly

02/25/2026 10 filed with the City as they occur. The Contractor shall promptly notify the City in writing of any lack of compliance upon its identification.

a. Criminal Justice Information, FBI FBI CJIS Security Policy v5.8 or later

b. Criminal Justice Information, LEADS LEADS Security Policy v4.7 or later

c. Federal Tax Information IRS Publication 1075

d. Health Information HHS HIPAA 45 CFR Parts 160, 162, 164

e. Personal Information Systems ORC 1347

f. Personally Identifiable Student Information FERPA - 20 U.S.C. Part 1232g

COPPA – 15 U.S.C. Part 6501-6506

ORC 3319.321

27.1 Electronic Payments

a. Electronic Payment Information PCI Data Security Standard v4.0 or later

The City and its agents, not to include the Contractor, are subject to regulatory compliance in handling electronic payments. The City has determined that the solution will manage electronic payment information. As such the Contractor has a fiduciary responsibility for regulatory compliance as it relates to the solution and solution data.

If the solution provided by the Contractor or its subcontractors handles electronic payments or electronic payment information, the Contractor will maintain continuous attestation of compliance with Payment

Card Information Data Security Standard v4.0 or later. The Contractor shall file with the City Treasurer an Attestation of Compliance certificate initially upon contract execution and annually thereafter. The

Contractor shall promptly notify the City in writing of any lack of compliance upon its identification.

27.2 Accessibility

a. Public Web Page Accessibility WCAG 2.0 Levels A/AA or Section 508

If the solution provided by the Contractor provides public-facing web pages, the Contractor will ensure compliance with the accessibility standards established by the Web Content Accessibility Guidelines

(WCAG) 2.0, Level A and Level AA or by Section 508 of the Rehabilitation Act of 1973.

The Contractor will provide an accessibility statement or link to such a statement on public-facing web pages identifying the accessibility standard used and level of compliance, and sufficiently describing the accessibility features and options.

28. Security Incident Response

The Contractor must ensure that there are no breaches of security that result in confidential information being shared with any entity other than the City or those approved by the City. Liquidated damages plus any costs incurred by the City associated with recovering the data may be assessed.

The Contractor must have reporting requirements for unauthorized access and for lost or stolen portable computing devices authorized for use with City data and must report any unauthorized access or loss or theft of such to the City in writing as quickly as reasonably possible. The Contractor also must maintain an incident response capability for all security breaches involving City data whether involving unauthorized access, mobile devices or media or not. The Contractor must have defined procedures for how the Contractor will detect, evaluate, and respond to adverse events that may indicate a breach or attempt to attack or access City data or the infrastructure associated with City data.

02/25/2026 11

In case of an actual security breach that may have accessed or compromised City data, including but not limited to unauthorized access, loss or theft of devices or media, the Contractor must notify the City in writing of the breach within 24 hours of the Contractor becoming aware of the breach, and fully cooperate with the City to mitigate the consequences of such a breach. This includes any use or disclosure of City data that is inconsistent with the intended use under the Contract with the City and of which the Contractor becomes aware, including but not limited to, any discovery of a use or disclosure that is not consistent with the Contract by an employee, agent, or subcontractor of the Contractor.

The Contractor must give the City full access to the details of the breach and assist the City in making any notifications that the City deems are necessary or appropriate. The Contractor must document all such incidents, including its response to them, and make that documentation available to the City on request.

28.1 City Cyber Security Incident – Notification – In the event that the City experiences a cyber security incident the City will i) assess the nature and scope of the security incident; ii) identify any confidential/protected information/data involved; iii) take appropriate steps to contain, control, and stop the security incident; iv) in the event confidential/protected data was compromised and it is reasonably suspected that misuse may result, promptly notify the Contractor of the security incident, subject to any request by law enforcement or other government agency to withhold such notice pending the completion of an investigation.

29. Cyber-liability

In the event Contractor, as part of the provision of technologies and services under the Contract, will control the City’s data, then Contractor shall provide Cyber-liability insurance of not less than

$5,000,000 per occurrence and $10,000,000 in the aggregate for liabilities for financial loss resulting or arising from acts, errors, or omissions, in connection with its work provided under the Contract such as:

• Breaches of security

• Data theft, damage, destruction, or corruption, including without limitation, unauthorized access, unauthorized use, theft of confidential information, transmission of a computer virus or other type of malicious code

• Participation in a denial of service attack on a third-party

• Violation or infringement of any breach of federal, state, or foreign security laws or regulations

• Intellectual property infringement arising out of software and/or content (excluding patent infringement and misappropriation of trade secrets)

• Technology errors and omissions

• Business interruption

• Cyber extortion

• Investigation and notification costs from any of the above.

The Contractor shall provide proof of such cyber-liability coverage.

30. Disentanglement

At the expiration of the Contract, or if at any time the City or Contractor should terminate the Contract, the Contractor will cooperate with the City or any subsequent contractor who might assume operation of the system or deploy a replacement system.

Upon request made and within 90 days after the effective date of termination or expiration of the

Contract unless otherwise agreed, the Contractor will make available to the City for download its City data in a format mutually-agreed at the professional services rates available under the Contract. After such 90-day period or otherwise agreed date, the Service Provider will have no obligation to maintain

02/25/2026 12 the City’s data covered by an expired Contract and must thereafter, unless legally prohibited, delete the applicable City data in its systems or otherwise in its possession or under its control.

The Contractor will provide to the City disentanglement services in connection with the termination or expiration without renewal of the Contract. To the extent the disentanglement services include any tasks that Contractor is not otherwise obligated to perform under the Contract, the charges will be based on the professional services rates available under the Contract.

Disentanglement services mean, to the extent requested by the City, the provisioning of such assistance, cooperation, and information as is reasonably necessary to enable a smooth transition of the system, related services and data to the City, its designated third-party provider, or to a replacement system. As part of disentanglement services, the Contractor will manage the migration, to the extent requested, and provide such information as the City may reasonably request.

Upon the City’s request, the Contractor will prepare a disentanglement plan with the input from the City and the successor, if there is one. The contents of the disentanglement plan will be as mutually agreed upon and will include at least the following activities, unless the City and Contractor agree otherwise:

• Documentation of existing and planned support activities.

• Identification of the system, related services, data, and related positions or functions that require transition and a schedule, plan, and procedures for the City or successor assuming or reassuming responsibility.

• Description of actions to be taken by the Contractor, City, and, if applicable, the successor in performing the disentanglement.

• Description of how the transfer of (i) relevant information regarding the system and related services,

(ii) resources (if any), (iii) data, and (iv) operations will be achieved.

• Description in detail of any dependencies the City and, if applicable, the successor must fulfill for the Contractor to perform the disentanglement services (including an estimate of the specific staffing and time required).

• Inventory of documentation and work products required to facilitate the transition of the system, related services, and responsibilities.

• Identification of significant potential risk factors relating to the transition and designing plans and contingencies to help mitigate the risks.

• A timeline for the transfer of each component (including key milestones to track the progress of the transfer).

• A schedule and plan for Contractor’s migration of (i) the systems held by the Contractor and belonging to the City, (ii) the systems held by the Contractor, used by the City, and not belonging to the City, (iii) all documents, records, files, tapes, and disks in Contractor’s possession that belong to the City or relate to the migrating system(s), and (iv) all City data.

31. Warranty

31.1 IN GENERAL. The Contractor is engaged under the scope of work in the Contract to design something to meet a particular need for the City and as such warrants that the Contractor’s Work will meet the stated purpose for that Work and therefore makes warranties of merchantability and fitness for the particular purpose in the Contract.

The Contractor warrants that the recommendations, guidance, practices, systems, and performance of the

Contractor under the Contract will: (1) be in accordance with sound professional standards and the requirements of the Contract and without any material defects; and (2) unless otherwise provided in the

Contract, be the work solely of the Contractor. The Contractor also warrants that: (1) no deliverable will infringe on the intellectual property rights of any third-party; and (2) the Contractor's work and the

02/25/2026 13 deliverables resulting from that work will be merchantable and fit for the particular purposes described in the Contract.

Additionally, with respect to the Contractor's activities under the Contract, the Contractor warrants that:

(1) the Contractor has the right to enter into this Contract; (2) the Contractor has not entered into any other contracts or employment relationships that restrict the Contractor's ability to perform the contemplated services; (3) the Contractor will observe and abide by all applicable laws and regulations, including those of the state and city regarding conduct on any premises under the City’s control; (4) the

Contractor has good and marketable title to any items delivered under this Contract and in which title passes to the City; and, (5) the Contractor has the right and ability to grant the license granted in any deliverable in which title does not pass to the City.

The warranties regarding material defects, merchantability, and fitness are one-year warranties. All other warranties will be continuing warranties. If any portion of the Work fails to comply with these warranties, and the Contractor is so notified in writing, the Contractor must correct such failure with all due speed or must refund the amount of the compensation paid for such portion of the Work.

The Contractor also must indemnify the City for any direct damages and claims by third parties based on a breach of these warranties. This obligation of indemnification will not apply where the City has modified or misused the deliverable and the claim is based on the modification or misuse.

The City will give the Contractor notice of any such claim as soon as reasonably practicable. If a successful claim of infringement is made, or if the Contractor reasonably believes that an infringement claim that is pending may actually succeed, the Contractor must do one of the following things: (1) modify the deliverable so that it is no longer infringing; (2) replace the deliverable with an equivalent or better item; (3) acquire the right for the City to use the infringing deliverable as it was intended for the

City to use under this Contract; or (4) remove the deliverable and refund the amount the City paid for the deliverable and the amount of any other deliverable or item that requires the availability of the infringing deliverable for it to be useful to the City.

31.2 SOFTWARE. On acceptance and for 12 months after the date of acceptance of any Deliverable that includes software, the Contractor warrants as to all software acquired, licensed or used under this

Contract that: (a) the software will operate on the device(s) for which the software is intended in the manner described in the relevant software documentation and the Contract ; (b) the software will be free of any material defects and security vulnerabilities; (c) the software will be free from any malicious components such as viruses or backdoors; (d) the developers will follow secure coding practices such as those promulgated by the OWASP Top 10; (e) the Contractor will deliver and maintain relevant and complete software documentation and commentary; and, (f) the software and all maintenance will be provided in a professional, timely, and efficient manner.

For Commercial Software licensed from a third-party that is incorporated in a Deliverable, the

Contractor represents and warrants that it has done 1 of the following 3 things: (a) obtained the right from the third-party licensor to commit to the warranties and maintenance obligations in this Section; (b) obtained a binding commitment from the licensor to make those warranties and maintenance obligations directly to the City; or (c) fully disclosed in the Contract any discrepancies between the requirements of this section and the commitment the third-party licensor has made.

In addition, for Commercial Software that is incorporated in a Deliverable, the Contractor will: (a) maintain or cause the third-party licensor to maintain the Commercial Software so that it operates in the manner described in the Contract and relevant Commercial Software documentation; (b) supply technical bulletins and updated user guides; (c) supply the City with updates, improvements, 02/25/2026 14 enhancements, and modifications to the Commercial Software and documentation and, if available, the commentary; (d) correct or replace the Commercial Software and/or remedy any material programming error that is attributable to the Contractor or the third-party licensee; (e) maintain or cause the third-party licensor to maintain the Commercial Software and documentation to reflect changes in the subject matter the Commercial Software deals with; and, (f) maintain or obtain a commitment from the third-party licensor to maintain the Commercial Software so that it will properly operate in conjunction with changes in the operating environment in which it is designed to operate.

For purposes of the warranties and the delivery requirements in this Contract, software documentation means well written, readily understood, clear, and concise instructions for the software's users as well as a system administrator. The software documentation will provide the users of the software with meaningful instructions on how to take full advantage of all of the capabilities designed for end users. It also means installation and system administration documentation for a system administrator to allow proper control, configuration, and management of the software.

32. Availability

The Contractor must maintain system monitoring that reliably tracks and reports system availability, and allows reporting of availability by month to the City. The system must be available for at least 99.5% of the time. No more than 0.5% of down time can occur in any month. Outages due to solution elements that are outside of the Contractor’s control, or outages due to force majeure are excluded from the City’s availability requirement. The Contractor will work with the City to map out the level of data loading

(input, output and reporting) to ensure the system can meet performance levels.

Upon receipt of City’s written notice to Contractor, if availability for a month is below the guaranteed level, Contractor will issue a credit to the City in accordance with the schedule below:

Availability Credit (% of monthly fee equivalent)

>= 99.0% and < 99.5% 5%

>= 95.0% and < 99.0% 10%

>= 90.0% and < 95% 15%

< 90% 2.5% for every 1% of lost availability*

* not to exceed total monthly fee equivalent

System maintenance outages must be scheduled at a mutually-agreed time.

In the event of partial or total system failure, the Contractor must be in communication with designated

City staff within 15 minutes and have a recovery plan in progress within 1 hour. Return to Operations

(RTO) must not exceed two (2) hours.

33. Acceptance

The acceptance procedure will be an informal review by the City Project Representative to ensure that each Deliverable and the Project as a whole comply with the requirements of this Contract. The City

Project Representative will have up to 30 calendar days to do this. No formal letter of acceptance will be issued, and passage of the 30 calendar days will imply acceptance, though the City will issue a notice of noncompliance if a Deliverable or the Project as a whole does not meet the…