CITY OF CHANDLER

NOTICE OF REQUEST FOR PROPOSAL PW4-920-4773

SOLICITATION TITLE: Utility Services Customer Portal

SOLICITATION NO.: PW4-920-4773

PROPOSAL DUE DATE: August 1, 2024

PROPOSAL DUE TIME: 4:00 pm local Arizona time

SUBMIT TO: Via email to:

christina.pryor@chandleraz.gov Email and attachments may not exceed 50 MB

PRE-PROPOSAL CONFERENCE: July 16, 2024 2:00 pm local Arizona time

CONFERENCE ATTENDANCE: Dial in number: 415-655-0001

Event number: 2660 748 4495

CONTACT: Christina Pryor, CPPO Procurement and Supply Senior Manager Phone: (480) 782-2403 Email: christina.pryor@chandleraz.gov

ISSUE DATE: July 2, 2024

Proposals for the commodity or service specified will be received by the Purchasing Division, City of Chandler, via email to christina.pryor@chandleraz.gov, until the time and date cited above. The City does not accept proposals submitted through the Arizona Procurement Portal. Proposals must be submitted via email to the Procurement Officer.

Proposals must be received in the email inbox of the responsible Procurement Officer on or prior to the exact time and date indicated above.

Instructions for preparing proposals are provided on the following pages.

RFP Summary: The City is requesting proposals from qualified offerors to provide the City with a utility services customer portal pursuant to the attached agreement.

INFORMATION AND INSTRUCTIONS TO PROPOSERS

1. Vendor Registration. Proposers must register via the on-line vendor registration system to automatically receive notification of addenda to this solicitation or notice of other solicitation opportunities. Visit https://www.chandleraz.gov/business/vendor-services/purchasing, select Vendor Registration and Management.

2. Addendum. This RFP may only be modified by a written addendum. Proposers are responsible for obtaining all addenda. A Proposer must not rely on verbal responses to inquiries. A verbal reply to an inquiry does not constitute a modification of the solicitation.

3. Late Proposals. Late proposals will not be accepted. It is the sole responsibility of the Proposer to ensure that its proposal is received at or prior to the exact date and time indicated on the Notice Page. The time stamp of the City’s email system will govern timeliness of submission.

4. Cost of Proposal Preparation. The City will not reimburse any Proposer the cost of responding to a solicitation.

5. Duty to Examine. It is the responsibility of each Proposer to examine the entire solicitation, seek clarification and make inquiries, and examine its proposal for accuracy before submitting it. Lack of care in preparing a proposal will not be grounds for modifying or withdrawing the proposal after the due date and time, nor will it give rise to any claim.

6. Inquiries. Any inquiry related to this solicitation, including any requests for or inquiries regarding standards referenced in the solicitation must be directed solely to the Procurement Officer listed on the cover page of the solicitation. Proposers will not contact or direct inquiries concerning this solicitation to any other City employee unless the solicitation specifically identifies a person other than the Procurement Officer as a contact.

All inquiries, except those at the Pre-Proposal Conference, should be submitted in writing and refer to the appropriate solicitation number, page and paragraph. The City will consider the relevancy of all inquiries but is not required to respond in writing.

Any inquiry must be submitted as soon as possible and should be submitted at least ten days before the proposal due date and time for review and determination by City. Failure to do so may result in the inquiry not being addressed in a solicitation addendum.

7. Remote Attendance at Pre-Proposal Conference. The City may offer remote attendance at the Pre-Proposal Conference via a City-hosted dial-in meeting. If remote attendance is offered, meeting details will be provided on the Notice Page. Interested Offerors attending remotely may be required to register and provide, at a minimum, attendee name and company name.

Remote attendance is provided as a courtesy. Attendees are responsible for all aspects of their attendance. The City will not provide technical support for remote attendance.

https://www.chandleraz.gov/business/vendor-services/purchasing

8. Exceptions to the Solicitation. Any exception to the solicitation must be submitted as soon as possible and should be submitted at least ten days before the proposal due date and time for review and determination by City. Failure to do so may result in the exception not being addressed in a solicitation addendum.

9. Proposal Amendment or Withdrawal. A proposal may be withdrawn at any time before the due date and time. A proposal may not be amended or withdrawn after the due date and time except as otherwise provided by applicable law.

10. Unit Price Prevails. In the case of discrepancy between the unit price or rate and the extension of that unit price or rate, the unit price or rate will govern.

11. Non-Collusion and Non-Discrimination. By signing and submitting the proposal, the Proposer certifies that the Proposer did not engage in collusion or other anti-competitive practices in connection with the preparation or submission of its proposal; and the Proposer does not discriminate against any employee or applicant for employment or person to whom it provides services because of race, color, religion, age, sex, national origin, or disability, and that it complies with all applicable Federal, state and local laws and executive orders regarding employment.

14. Waiver and Rejection Rights. The City reserves the right to waive any immaterial defect or informality; or reject any or all proposals, or portions thereof; or reissue the Request for Proposal;

and will be the sole judge of the merits of the proposals received.

15. Proposal Opening. Proposals will be opened as indicated on the Notice Page, unless amended in writing by the Procurement Officer issuing the solicitation. The name of each Proposer will be public information following the proposal opening. No other information will be publicly disclosed at that time.

16. Public Record. All proposals submitted in response to this solicitation and all evaluation related records will become property of City and will become a matter of public record for review, subsequent to publication by the City of the proposed award in the agenda for the City Council Meeting, or upon award by the appropriate approving authority or as otherwise required by law.

17. Confidential Information. A request for nondisclosure of data such as trade secrets or other proprietary information must be submitted with the proposal and must contain the basis for the request. Any information included in the request must be submitted as a separate file. Price is not confidential and will not be withheld. A blanket statement of confidentiality will not be considered.

It is the Proposer’s responsibility to identify and segregate the information in the proposal provided to the City.

The City will review all requests for confidentiality and may approve or deny all or portions of the request. Information denied confidentiality will be released as public information. In the event of a public records request for information granted confidentiality, the City will endeavor provide 48-hours’ notice before releasing materials in order for the Proposer to apply for a court order blocking the release of the information.

18. Proposal Acceptance Period. All proposals will remain valid for 120 days after the day of the opening of proposals. The City may, at its sole discretion, release any proposal and return any security (as applicable) prior to that date. No Proposer may withdraw a proposal during this period without written permission from the City. Should any Proposer refuse to enter into an agreement, under the terms and conditions of the procurement, the City may retain any security (as applicable) as liquidated damages.

19. Discussions with Proposers and Revisions to Proposals. Discussions and additional investigations may be conducted with responsible Proposers who submit proposals determined to be reasonably susceptible of being selected for award for the purpose of clarification to assure full understanding of, and responsiveness to, the solicitation requirements. Proposers will be accorded fair and equal treatment with respect to any opportunity for discussion and revision of proposals, and such revisions may be permitted after submissions and prior to award for the purpose of obtaining best and final proposals. In conducting discussions, there will be no disclosure of any information derived from proposals submitted by competing Proposers. The purposes of such discussions will be to: determine in greater detail such Proposer’s qualifications; explore with the Proposer the scope and nature of the project, the Proposer’s proposed method of performance, and the relative utility of alternate methods of approach; determine that the Proposer will make available the necessary personnel and facilities to perform within the required time; agreeing upon compensation, which is fair and reasonable, taking into account the estimated value of the required services, and the scope, complexity and nature of such services.

20. Clarifications. City reserves the right to obtain Proposer clarifications where necessary to arrive at full and complete understanding of Proposer’s product, service, and solicitation response.

Clarification means a communication with a Proposer for the purpose of eliminating ambiguities in the proposal and does not give Proposer an opportunity to revise or modify its proposal.

21. Agreement Negotiations. City reserves the right to conduct exclusive or concurrent negotiations with responsible Proposer(s) for the purpose of agreeing to the conditions, terms and price of the proposed agreement unless prohibited. Proposers will be accorded fair and equal treatment in conducting negotiations and there will be no disclosure of any information derived from proposals submitted by competing Proposers. Exclusive or concurrent negotiations will not constitute an agreement award nor will it confer any property rights to the successful Proposer. In the event the City deems that negotiations are not progressing, the City may formally terminate these negotiations and may enter into subsequent concurrent or exclusive negotiations with the next most qualified Proposer(s).

22. Payment. Proposers may agree to accept the City Procurement Card (Mastercard) for payment.

Proposers should indicate on the Proposer Information and Offer Section of this RFP, their willingness to accept City Procurement Card payments. The inability to accept payment by City Procurement Card will not disqualify a Proposer’s response.

Proposers may also agree to accept other traditional payment methods, including automated clearinghouse (ACH). Payment terms for traditional payment methods are Net 30 upon receipt of an accurate invoice. Proposers may propose additional discounts for early payment within their proposal.

23. Local Business Consideration. Where the Chandler Administrative Regulation MS-16 Local Business Consideration is applicable, any applicable Chandler Transaction Privilege Tax will be deducted from the net cost for the purpose of evaluation.

24. Protests. A protest must be in writing and be filed with the Purchasing Division. To be considered filed, a protest must be submitted via email to the Procurement Officer identified on the Notice Page.

A protest of a solicitation must be received not less than five days before the solicitation opening date.

A protest of a proposed award requiring City Council approval must be filed within five calendar days of the first posting of the award recommendation. Award recommendations are posted on the Purchasing web site at www.chandleraz.gov/purchasing and/or the City Clerk web site at http://www.chandleraz.gov/default.aspx?pageid=1007 If the protest due date occurs on a weekend or holiday, the protest must be filed the next business day.

A protest of an award not requiring City Council approval (less than $50,000 or $30,000 for Consultants) must be submitted within ten calendar days of the date the protester knows or should have known the basis of the protest.

A protest must include:

• The name, address and telephone number of the protester;

• The signature of the protester or its representative;

• Identification of the project and the solicitation or agreement number;

• A detailed statement of the legal and factual grounds of the protest including copies of relevant documents; and the form of relief requested.

The City will review the protest and may issue a written response.

25. Award. Unless otherwise provided in this solicitation, the City reserves the right to make multiple awards, award by item, group or as a total, as is deemed most advantageous to the City.

26. Execution of Agreement. Within ten days of notice that Proposer is the recommended awardee, Proposer will execute and return the Agreement to Purchasing.

27. Persons with Disabilities. Persons with a disability may request a reasonable accommodation, such as a sign language interpreter, by contacting the Procurement Officer. Requests must be made as early as possible to allow time to arrange the accommodation.

http://www.chandleraz.gov/purchasing http://www.chandleraz.gov/default.aspx?pageid=1007

PROPOSAL CONTENT

Proposers must submit one copy of the proposal via email to the responsible Procurement Officer. The REQUEST FOR PROPOSAL TITLE, NUMBER AND OFFEROR NAME should be in the subject line of the email.

Emails and attachments may not exceed 50 MB in size. Attachments should be in .pdf format and named with the RFP number and Offeror name. A single email is preferred, however multiple emails are permissible provided that all are received prior to the due date and time.

Proposals should include the following information in the order listed:

1. Completed Proposer Information and Offer Section. Complete and submit the Proposer Information and Offer Section in the format provided in this solicitation. Failure to do so may result in the proposal being rejected as non-responsive. The Proposer Information and Offer Section within the solicitation must include a signature by a person authorized to sign the proposal. The signature must signify the Proposer’s intent to be bound by its Proposal and the terms of the solicitation and that the information provided is true, accurate and complete.

2. Responses to Proposal Evaluation Criteria. Submit information requested in the Evaluation Criteria Section provided in this solicitation. Forms, such as pricing forms, must be completed in the format provided in the solicitation. Failure to do so may result in the proposal being rejected as non-responsive.

3. Exceptions to Agreement. The City’s standard Agreement is included as a part of this solicitation.

By submitting a proposal, the Proposer acknowledges having reviewed the Agreement. Any exceptions to the Scope of Work or Specifications or to Agreement terms and conditions must be included with the proposal and be clearly identified. Exceptions not included in the proposal may not be introduced in the future. Any exceptions to the Scope of Work, Specifications or the Agreement language will be considered and included in City’s evaluation of the proposal. A proposal that takes exception to a material requirement of any part of the Scope of Work, Specifications or Agreement language may be rejected as non-responsive.

4. Disclosure. If the Proposer has been debarred, suspended or otherwise lawfully precluded from participating in any public procurement activity, including being disapproved as a subcontractor with any Federal, state or local government, or if any such preclusion is currently pending, the Proposer must make disclosure. In the proposal, the Proposer must include information including the name and address of the governmental entity, the effective date and duration of this suspension or debarment, and the relevant circumstances. The City reserves the right to reject a proposal received from a Proposer, including each of its principals, who is currently debarred, suspended or otherwise lawfully prohibited from any public procurement activity.

PROPOSER INFORMATION AND OFFER SECTION

Company Name

Business Type (Corporation, Partnership, etc.)

State of Incorporation (if applicable)

Federal Tax I.D. No.

Address

City, State, Zip

Authorized Signature

Name and Title

Contact Name

Title

Telephone

E-mail

Chandler Transaction Privilege Tax (TPT) No. (if applicable) Date of issue:

Is proposed purchase subject to TPT? _______yes _______no

Will you accept a City Procurement Card (MasterCard) for payment of invoices? _______yes _______no

If you accept a MasterCard for payment, do you charge a fee?

_______yes _______no If yes, what is the fee?______

Will you accept automated clearinghouse (ACH) for payment of invoices? _______yes _______no

Prompt Payment Terms Offered _______% Net _________ days

Disclosure of Debarment or Suspension

_______yes _______no

(If yes, please attach description of the circumstances)

Exceptions Taken

_______yes _______no

(If yes, please attach a clearly identified section) Date Addendum #1 Acknowledged/Received Date Addendum #2 Acknowledged/Received

SCOPE OF WORK

Project Scope & Technical Provisions

1. Project Overview & Purpose

The City of Chandler is soliciting proposals for a qualified customer portal solution and implementation professional services. The city is in process of transitioning about 86,000 AMR endpoints to AMI using Neptune Technologies AMI solution. With this initiative in progress, the city desires to provide a better customer experience through a robust customer engagement portal which provides self-serve capabilities for each customer’s personal online account, bill related interactions, customer communications, customer request transactions including solid waste, and water conservation programs. The city’s vision for the customer portal is:

Provide a self-serve customer portal that engages the city’s residents and businesses with an outstanding customer experience and provides My Account capabilities such as bill presentment, bill pay, etc., as well as helpful information through personalized insights about water consumption, leak analytics, conservation program opportunities and user-friendly customer transactions.

2. City’s Existing Operational Systems Overview The City’s operational systems that are relevant to this project are detailed in the table below.

Type Description Version Date Installed/Upgraded

1 AMI Headend Neptune 360 Software March 2023

2 CIS & Billing Advanced Utility Systems (AUS) CIS Infinity 3.1 (Build 3.1.25bQA)

Upgrade in process.

Target completion Dec

3 Payment Invoice Cloud

Multi-tenant cloud deployment model (Microsoft Azure StateRAMP)

3. Technical Requirements

The technical requirements for the proposed Solution and related services that must be met are detailed in Appendix B.

4. Business Requirements The business requirements for the proposed Solution and related services that must be met are detailed in Appendix C.

5. Scope of Work Requirements The City anticipates the project will include the following:

4.1 Project Management

4.2. Project Initiation

4.3. Design and Requirements Gathering

4.4. Setup and Portal Configuration (including Interfaces)

4.5. System Testing Cycles

4.6. Training

4.7. Go Live and Post-Production Support

6. Project Schedule / Duration

The city and the contractor will establish and document a project schedule and duration. Project timeline will coordinate with the following deadlines for the expenditure of grant funds.

Grant Funding Date to be Spent $7,500 December 2, 2024

$75,000 December 31, 2025 $112,000 March 31, 2026

EVALUATION CRITERIA

Business Requirements 40% Project Approach and Technical Specifications 25% References, Qualifications and Experience 20% Price Proposal 15%

PROPOSAL FORMAT

Section Proposal Section Instructions, Attachment References and Forms

1 Letter of Transmittal

2 Table of Contents 3 Executive Summary

Qualifications, and Client References

Complete Appendix A. All requirements must include a response.

Proposed Project Team Resumes

Maximum two pages for each resume provided. It is expected that the proposed Project Manager will be identified.

Project Approach and Technical Specifications

Complete Appendix B. All requirements must include a response.

Project Schedule / Gantt

Provide a Gantt chart graphic that illustrates the project duration and key tasks and high-level task relationships.

Maximum two pages.

Business Requirements Response

Complete Appendix C. All requirements must include a response and a description of how your solution meets requirement.

9 Price Proposal Complete Appendix D. Use the Price proposal template for your pricing. Sections 1 – 5 are mandatory.

Offeror Standard Agreements Hosted Services Agreement / Annual Support Agreement

City Clerk Document No.

City Council Meeting Date:

CITY OF CHANDLER SOFTWARE AS A SERVICE AGREEMENT

UTILITY SERVICES CUSTOMER PORTAL

CITY OF CHANDLER AGREEMENT NO. PW4-920-4773

THIS AGREEMENT (Agreement) is made and entered into by and between the City of Chandler, an Arizona municipal corporation (City), and (Contractor), (City and Contractor may individually be referred to as Party and collectively referred to as Parties) and made , 2024 (Effective Date).

RECITALS

A. City proposes to enter an agreement for a utility services customer portal as more fully described in Exhibit A, which is attached to and made a part of this Agreement by this reference.

B. Contractor is ready, willing, and able to provide the services described in Exhibit A for the compensation and fees set forth therein.

C. City desires to contract with the Contractor to provide these services under the terms and conditions set forth in this Agreement.

AGREEMENT

NOW, THEREFORE, in consideration of the mutual agreements below, and intending to be legally bound, the Parties agree:

1.0 DEFINITIONS.

The following definitions apply to the parties’ Services Agreement.

A.R.S. means Arizona Revised Statutes, as amended.

Access Information means any information relating to City, its Resellers and/or End Users' use of the Services, including without limitation, (a) navigational information, including usage of hyperlinks within or available through the Services; (b) transactional or processing information, including billing information and method of payment; and/or (c) Internet or I/P addresses, demographic information (like age, profession, or gender), domain names, computer type, browser types, and other anonymous statistical data arising from such use of the Services and access to the Facilities.

Agreement means this legal agreement executed between the City and the Contractor

Affiliate means with respect to any person or entity, any other person or entity that directly or indirectly controls, is controlled by, or is under common control with the specified person or entity, and for the purposes of this definition “control” of an entity means the ownership of 50% of the outstanding shares or other equity interests in such entity, or the right to elect or appoint a majority of the board of directors or governing body of such entity.

Base Programs means each version of a computer program used by Contractor to perform the Services, including the object code and source code, and all Upgrades, Documentation, workarounds, error-corrections, patches, and bug fixes.

City means the City of Chandler, Arizona.

City Confidential Information means: (a) all information related to the business of City and any of its City’s and other third parties, to which Contractor has access, whether in oral, written, graphic or machine-readable form, in the course of or in connection with this Agreement; (b) all notes, analyses and studies prepared by Contractor or any of its Representatives, during the term of this Agreement or anytime thereafter, incorporating any of the information described in this Section 3; (c) the Access Information; and

(d) the City Data.

City Data means all Confidential Information, all personal data and any other information relating to the employees, City or customers of City, or End Users or relating to the businesses of City or its Affiliates, including third party information, operations, facilities, products, services and markets, all as and to the extent provided to or obtained by Contractor or its Representatives from City, Resellers, or End Users, or derived from any of the foregoing. Usage data of End Users who are customers of City shall be considered City Data. City Data includes any such information in any form (tangible or electronic), regardless of the form or method by which such information is created, stored, maintained or communicated, and includes all data maintained by Contractor for City. Unless otherwise indicated, City Data includes all Access Information.

Contractor means the person or business organization named in the Agreement.

Crisis means an extraordinary event affecting Contractor that requires emergency response measures to be taken, including any event that may result in the Services, Software or Facilities becoming unavailable for a significant amount of time.

Confidential Information means City Confidential Information and/or Contractor Confidential Information, as the context may require.

Custom Software means the modifications and enhancements to the Software Programs and new computer programs, including application program interfaces, developed from time to time by Contractor for the exclusive use of City.

Days means calendar days.

Documentation means the user, operations and training manuals, marketing materials, proposals, and responses to requests for information or proposals pertaining to the Services or the Software Programs, as well as any specifications reviewed by City, concerning the relevant Software licensed hereunder.

End User means any person or entity that receives and uses the Services.

Error means any error in the code of any Software Programs which prevents such Software Programs from operating in accordance with the relevant Documentation.

Exit Plan means the plan set forth in Exhibit F hereto.

Facilities means the hardware, application software, operating system software, firmware, networks, communication devices and lines and all other equipment, software, devices and related materials provided by or used by Contractor to host the Software Programs and provide the Services. Unless otherwise indicated, the Facilities shall be construed to include the Software Programs.

Implementation Date means the implementation date set forth in an applicable Schedule for the respective Services.

Intellectual Property Rights means all: (a) patents, patent applications, patent disclosures and inventions (whether patentable or not), (b) copyrights and copyrightable works (including computer programs) and registrations and applications therefor, (c) semiconductor chip “mask” works, and registrations and applications for registration thereof, (d) trade secrets, know-how and other confidential information, (e) unregistered and registered design rights and any applications for registration thereof, (f) database rights, and (g) all other forms of intellectual property, including waivable or assignable rights of publicity or moral rights, and any right to bring suit or collect damages for the infringement, misappropriation or violation of the foregoing, anywhere in the world. For purposes of the IP License, the Intellectual Property Rights shall be construed to include all Intellectual Property Rights of Contractor and its Affiliates existing on the date of grant of the IP License, plus all Intellectual Property Rights of Contractor and its Affiliates subsequently developed or acquired by Contractor or its Affiliates through the time of the occurrence of an Interruption.

Interruption means any material, or continuing, or repeated suspension or interruption in the supply of the Services by or on behalf of Contractor to City, the Resellers, or End Users, or any other material, or continuing, or repeated failure of Contractor to meet its obligations under this Agreement in regard to the Services, whether resulting from breach, termination, partial or complete cessation of business, disruption of business, bankruptcy or other insolvency proceedings, or otherwise, or termination of this Agreement.

Licensed Materials means all engineering, testing and design documentation, schematics, source code, and other materials necessary for City or its Representatives to exercise the IP License.

May or Should means something that is not mandatory but is permissible.

On Premises Equipment means Facilities provided by Contractor to City, Resellers, or End Users of the

Services for receiving, managing, maintaining or using the Services.

Contractor Confidential Information means Contractor nonpublic financial information.

Reseller(s) means one or more independent sales or support companies engaged to sell, support or implement the Services to End Users.

Representatives means each party's officers, directors, employees, consultants, attorneys, accountants, agents and independent subcontractors (and their employees) and other representatives.

Shall, Will, or Must means a mandatory requirement.

Software Programs means the Base Programs and Custom Programs.

Upgrades has the meaning stated in Exhibit A.

2.0 SERVICES

2.1 Services under Schedules. Contractor will perform and deliver Services described in this Agreement and any Schedules hereto, in accordance with the milestones, delivery dates, specifications and requirements as set forth herein.

2.2 Grant of License, On Premises Equipment. Contractor hereby grants City and its respective Representatives a nonexclusive, paid-up, worldwide license to install, access and use the On Premises Equipment in order to receive, manage, maintain and use the Services.

2.3 Reports. On a quarterly basis or more frequently as may be specified in a Schedule, Contractor will provide to City a written report summarizing Contractor's performance of the Services with respect to all metrics and categories of description set forth in an applicable Schedule, and any other information reasonably requested by City.

2.4 Services Audit. City may on 30 days' notice conduct audits and reviews of the Facilities on Contractor's premises with respect to the Services.

2.5 Activation and Installation. Unless otherwise stated in the applicable Schedule, construction, maintenance and operation of the Facilities, and activation and performance of the Services are and shall be the responsibility of Contractor.

2.6 City Data. Notwithstanding any other provision in this Agreement or Schedules, Contractor shall make all City Data (complete and unaltered) available at any time to City, in a format reasonably requested by City, at no additional charge. As between the parties, City Data shall be and remain the property of City.

Contractor shall use the City Data solely to perform Contractor's obligations under the Services Agreement and this Agreement. Except as expressly permitted in this Agreement, Contractor shall not sell, assign, lease, disseminate, or otherwise dispose of the City Data or any part thereof to any other person, nor shall Contractor commercially exploit any part of the City Data. Contractor shall not possess or assert any property interest in or any lien or other right against or to any City Data.

2.7 City Affiliates. City's rights under the Services Agreement and this Agreement may be exercised by and for the benefit of City and, as applicable, End Users, and their respective Affiliates. For this purpose, “Affiliates” may include any person or organization that is party to any Business Collaboration with City or its other Affiliates. “Business Collaboration” means any strategic alliance, partnership, joint venture, broker-dealer, sales representative, investment advisor, or other marketing or business arrangement between City or its other Affiliates and any such person or organization through which City or such Affiliates derive revenue or profit or conduct business involving financial services.

2.8 Offshore Performance of Work Prohibited. Due to security and identification protection concerns, direct Services under this Agreement must be performed within the borders of the United States. Any Services that are described in the scope of work that directly serve the City and may involve access to secure or sensitive data or personal client data or development or modification of software for the City must be performed within the borders of the United States. Notwithstanding anything to the contrary, and unless stated otherwise in the scope of work, this definition does not apply to indirect or "overhead" services, redundant back-up services, or services that are incidental to the performance of this Agreement.

3. BACKUP IP LICENSE

3.1 Sufficiency of Intellectual Property; Further Assurances. Contractor represents and warrants that the IP License and the Intellectual Property Rights licensed to City thereunder are and will be sufficient for City or its Representatives to manage, maintain, perform and deliver the Services for present and future End Users, to produce, copy, install, operate, manage, maintain, and improve the Services or the Software Programs and Facilities of City's own choosing in order to do so, without infringement of Intellectual Property Rights owned or held by others. Promptly upon request by City, Contractor shall, at its expense, sign and deliver such further agreements, certificates and other documents and give City such other assistance as City may reasonably require to evidence more fully and give full and proper effect to the IP License. To the extent that Contractor or its Affiliates' Intellectual Property Rights include any U.S. patents or copyrights that are owned by third-party licensors, Contractor will at City's request, provide City with written confirmation from such third-party owner that such owner will give effect to the terms of Section

3.1 without any further condition, payment or other obligation. The IP License and the terms of Section 3.1 shall not be impaired or diminished by the occurrence or continuance of any breach of this or any other agreement between the Parties, any lack of capacity or authority, any reorganization, liquidation, dissolution, merger, or consolidation of either Party, or any other change of circumstances of either Party.

4. NON-DISCLOSURE

4.1 Restrictions. Each party, as recipient of the other party's Confidential Information, will receive, hold and protect in confidence the Confidential Information of the other party. The receiving party may disclose the Confidential Information of the disclosing party to its Representatives who have a need to know such Confidential Information solely in connection with this Agreement. The receiving party will cause such Representatives to comply with this Agreement and will assume full responsibility for any breach of this Agreement by any such Representatives. The receiving party will not transfer or disclose any Confidential Information of the disclosing party to any third party without the disclosing party's prior written permission and without such third party having a contractual obligation (consistent with this Section 4 (“Non- Disclosure”) to keep such Confidential Information confidential. The receiving party will not use any Confidential Information of the disclosing party for any purpose other than in connection with this Agreement. Notwithstanding any confidentiality restrictions set forth herein, City may disclose Contractor Confidential Information to third parties in connection with such third party's provision of software or services to City. Such disclosures will be made under an obligation of confidentiality limiting the use of such Confidential Information by such third parties to the provision of services to City.

4.2 Exclusions. Confidential Information will not include information that: (i) is in the public domain at the time of disclosure; (ii) was in the possession of or demonstrably known by the receiving party prior to its receipt from the disclosing party without restriction on its use or disclosure; (iii) is independently developed by the receiving party without use of or reference to or reliance on the disclosing party's Confidential Information; or (iv) becomes known by the receiving party from a source other than the disclosing party without breach of this Agreement and is not subject to an obligation of confidentiality. Notwithstanding anything to the contrary, City may disclose Contractor Confidential Information as required to satisfy any request by any governmental or regulatory body.

4.3 Legal Requirements. If the receiving party is requested or required to disclose any of the disclosing party's Confidential Information under a subpoena, court order, statute, law, rule, regulation or other similar requirement (a “Legal Requirement”), the receiving party will, to the extent not precluded by law, provide prompt notice of such Legal Requirement to the disclosing party so the disclosing party may seek an appropriate protective order or other appropriate remedy or waive compliance with the provisions of this Agreement. If the disclosing party is not successful in obtaining a protective order or other appropriate remedy and the receiving party is, in the reasonable opinion of its counsel, legally compelled to disclose such Confidential Information, or if the disclosing party waives compliance with the provisions of this Agreement in writing, the receiving party may disclose, without liability hereunder, such Confidential Information in accordance with, but solely to the extent necessary, in the reasonable opinion of its counsel, to comply with the Legal Requirement.

4.4 Disposition of Confidential Information on Termination or Expiration. Upon termination or expiration of the Services Agreement and this Agreement or upon the disclosing party's written request and where practicable, the receiving party will return to the disclosing party all copies of Confidential Information already in the receiving party's possession or within its control. Following its return, and upon notice from the disclosing party, and unless otherwise required by law, the receiving party must destroy such Confidential Information using means to protect against unauthorized access to or use of the information, including, where appropriate, burning, shredding, or pulverizing such information, or by taking such other means as to assure that such information will not be recoverable following its disposal.

In such case an officer of the receiving party will certify in writing to the disclosing party that all such

Confidential Information has been so destroyed. Notwithstanding the foregoing, the receiving party may retain copies of such Confidential Information as required by applicable law, and, to the extent such copies are electronically stored in accordance with the receiving party's retention or back-up policies or procedures (including, without limitation, those regarding electronic communication), so long as such Confidential Information is kept confidential as required under this Agreement.

4.5 Privacy. For all City Information collected, stored or processed by Contractor, Contractor shall: (a) maintain safeguards against destruction, loss, alteration of or unauthorized access to such City Information; and (b) not, without City's prior approval, modify or discontinue any such safeguards without comparable or better replacement safeguards. Contractor acknowledges the sensitivity and confidentiality of personally identified information which may be contained in the City Information and the applicability of the Gramm-Leach-Bliley Act and/or other applicable privacy laws, regulations and guidelines (“Privacy Laws”). Contractor agrees to comply with all applicable legal and contractual requirements relating to the privacy and confidentiality of personally identified information applicable to Contractor in the performance of its obligations under this Agreement.

5. SECURITY

5.1 Security. Contractor represents and warrants that it shall at all times adhere to and comply with, in all material respects, the minimum security standards to ensure that there is no unauthorized access to or use of City information described in this Section, which security standards may be mutually amended by the parties from time to time (the “Security Standards”).

5.2 Security Standards. Contractor will use reasonable efforts to prevent unauthorized access to restricted areas of its servers and any databases or other material generated from or used in conjunction with the Service. Contractor will respond immediately to remedy any known security incidents or breaches.

(a) External Segment Security. Contractor's external connections to the Internet will have appropriate security measures and controls applied to its systems and will include an Intrusion Detection System (IDS) that will monitor all inbound and outbound communications and information. The IDS is intended to detect, record, alert, and terminate unauthorized activity.

(b) Web Site Segment Security. All Internet accessible systems will reside behind Firewalls. The Firewalls will enforce secure access between all Web servers and the Internet. The Firewalls will allow only specific types of data to pass from the Internet to the systems on the Web Segment. An IDS device is used to scan all data that passes within the Web Server segment and will detect, report and terminate any unauthorized activity prior to it reaching the Web Servers.

(c) Internal Network Segment Security. All data entering the Service's internal data network from any external source (Web Segment and Internet) must pass through Firewalls. The Firewalls will enforce secure connections between internal and external systems and will only allow specific types of data to pass through. Access to customer data by Contractor employees will be limited to authorized personnel only.

All Contractor employees will follow the security policies regarding access and use of internal systems.

(d) Physical Site Security. All systems containing customer or company related data will be contained in locked data cabinets and will reside in a secure Data Center. Only authorized personnel will have access to the Data Center and/or Operations area via an internal security system. The entire physical facility, internal and external, will be monitored 24/7/365.

(e) General Data Security and Network Monitoring. All printed documents containing customer, confidential, financial, or sensitive information that is no longer needed will be shredded. Any printed material of this nature that is retained will be secured in cabinets. All data backups will be locked and secure both on-site and off-site as documented in the Security Policy Document and the Backup/Disaster Recovery Guide. Contractor will actively monitor the IDS systems, Local Area Network/Wide Area Network, (LAN/WAN) equipment and all critical servers. Encryption techniques will be used for data transmissions where applicable.

(f) Assessments. City reserves the right to conduct risk assessments, vulnerability assessments, black box penetration tests or hire a third party to conduct risk assessments, vulnerability assessments, and black-box penetration tests of the Contractor’s environment. Contractor will be alerted in advance and arrangements made for an agreeable time. Contractor shall respond to all Critical, High, and Medium severity vulnerabilities discovered by providing an acceptable timeframe to resolve the issue and/or implement compensating control(s).

(g) Audit Logging. Contractor will provide to the City system, audit, and other logs required by the City from the Contractor’s environment and service offering upon request.

(h) StateRAMP Authorization. StateRAMP Authorization. Any Contractor who will be storing, processing, and/or transmitting City data in external, non-City environments (Cloud), are required to attain verified StateRAMP (www.stateramp.org) Authorized status for the cloud products the City will be utilizing, at the security category level required by the City. The Contractor must attain StateRAMP Ready status within 12 months of Agreement execution and StateRAMP Authorized status within 18 months of Agreement execution. Any Contractor without StateRAMP Ready or Authorized status at the time of Agreement execution must complete a StateRAMP Security Snapshot within three months of Agreement execution and must provide monthly progress reporting to StateRAMP until StateRAMP Ready or StateRAMP Authorization status is obtained. The Contractor will be required to maintain StateRAMP authorization at the required category level throughout the contract term and partnership with the City.

The City will provide StateRAMP sponsorship to the Contractor for the purpose of this contract engagement.

5.3 Updates to Security Standards. If a change or addition to the Security Standards is required by law, rule, regulation, order, judgment or decree, Contractor shall comply with such amended Security Standards as soon as possible but in no event later than the time period for compliance indicated in such law, rule, regulation, order, judgment or decree. If the event Contractor adopts changes to the Security Standards, Contractor will provide the Services in accordance with such new Security Standards; provided that if such new Security Standards are of a level which is less than the level of the Security Standards previously required by this Agreement, and if City does not agree with such new Security Standards, City may terminate and this Agreement upon written notice to Contractor. If City accepts such new security standards, such new security standards shall be deemed to be “Security Standards” for purposes of this Agreement.

5.4 Security and Supervision. Contractor's personnel, when on City's premises or accessing City's networks or providing maintenance services hereunder, will comply with all of City's security, supervision, and other standard procedures applicable to such personnel, including, if applicable, City's Internet and Electronic Communications Usage Policy.

5.5 Audit. City reserves the right to conduct, either itself or through a third-party independent contractor selected by City at City's expense, an on-site audit and review of Contractor's architecture, systems and procedures used in connection with the Services and the Software Programs. Such audit and review shall be conducted upon City's reasonable request. After conducting an audit, City shall be entitled to notify Contractor of the manner in which Contractor does not comply with any of the security, confidentiality or privacy obligations herein, if applicable. Upon such notice, Contractor shall use commercially reasonable efforts to make any necessary changes to ensure compliance with such obligations. If Contractor is unable to remedy the defects or deficiencies causing its noncompliance with any obligation, City may terminate this Agreement upon written notice to Contractor. Any audits described in this Section shall be conducted during reasonable times and upon reasonable advance notice to Contractor and shall be of reasonable duration and shall not unreasonably interfere with Contractor's day-to-day operations. Further, City shall not conduct an audit more than twice per year unless City determines in its reasonable discretion that additional audits are necessary. In the event that City conducts an audit through a third-party independent contractor, such independent contractor shall be required to enter into a non-disclosure agreement containing confidentiality provisions substantially similar to those set forth herein to protect Contractor's proprietary information. In addition to and not in lieu of City's rights to conduct an audit as described in this Section, once per year during the term of this Agreement, Contractor will provide City with a written certification that Contractor has tested its architecture, systems and procedures and that it is in full compliance with the security, confidentiality and privacy obligations herein. Such certification shall be signed by an officer of Contractor.

5.6 Information Security Incident Management. Contractor must adhere to a formally documented incident management process, must cooperate with City personnel in the diagnosis, investigation and response of any security incidents or faults that impact City data. Contractor must notify the City within 24 hours of suspicion, detection or confirmation of a breach or unauthorized access to City information that is hosted, stored, processed, or transmitted by the Contractor. Notification will be made using City provided email and phone as identified in the Notices section of this contract.

5.7 Business Continuity and Disaster Recovery Management. Contractor must have business continuity and disaster recovery plans and processes in place to ensure the service for the City is adequately maintained in the event of any negative impact on the Contractor´s service. Contractor will regularly backup City data and retain such City backup data copies according to City data retention requirements or otherwise provide backup data to the City. Backups will be maintained offline, encrypted, and regularly tested for availability and integrity for disaster recovery scenarios, including ransomware.

5.8 Applicable Laws and Regulations. Contractor will comply, and assist City to comply with, all applicable State and Federal laws and regulations including, but not limited to:

• Federal Information Security Modernization Act of 2014 (FISMA):

https://csrc.nist.gov/topics/laws-and-regulations/laws/fisma

• OMB Circular A-130:

https://www.federalregister.gov/documents/2016/07/28/2016-17872/revision-of-omb-circular-n…