5-C. FY26-RFP-07 Sample Contract.pdf

Contract #: {---Contract Number---}

NPDES MS4 SCM COMPLIANCE SOFTWARE SOLUTION

Effective Date: {---Effective Date---} City Vendor#: {---Vendor Number---} Between the City of Charlotte (“City”) and {---Vendor Legal Name---}, (“{---Vendor Reference Name---}”) This cover sheet (“Cover Sheet”) and each of the attachments listed below (“Attachments”) together comprise a NPDES MS4 SCM Compliance Software Solution (the “Contract”) entered into as of the Effective Date, between {---Vendor Legal Name---} a {---Vendor State of Incorporation---} {---Vendor Entity Type---} registered to do business in North Carolina and the City of Charlotte, a North Carolina municipal corporation:

ATTACHMENTS:

Purchase and Service Terms General Conditions Price Schedule Scope of Implementation Services Project Schedule Milestone Plan Cloud Technology Requirements

Specification and Requirements Confidentiality Terms

Term: The term will start on the Effective Date and continue until the License and/or Maintenance Services have terminated.

Products and Services. {---Vendor Reference Name---} agrees to provide the products (“Products”) and perform the services (“Services”) described in the Attachments under the terms and conditions set forth in this Contract.

Compensation. The City will pay for the delivery of the Products and Services in the amounts shown in the Price Schedule. The pricing shall remain firm for the duration of this Contract, unless otherwise stated in this Contract.

Defined Terms: Capitalized terms used in this Contract have the meanings assigned in this Contract.

Email invoices to: cocap@charlottenc.gov

Each invoice shall include the purchase order number and Contract Number and shall be accompanied by a sales tax statement or shall have the sales tax amount shown clearly, along with the invoice total, on the face of the invoice.

Vendor Business Contact City Business Contact

{---Vendor Primary Contact Name---} {---City Admin First Name---} {---City Admin Last Name---}

{---Vendor Legal Name---} {---City Department---}

{---Vendor Street1---} {---Vendor Street2---} {---City Main Contact Address---} {---Vendor City---}, {---Vendor State/Province---} {---Vendor Zip Code---}

{---City Admin City---}, {---City Admin State---} {---City Admin Zip Code---}

Phone: {---Vendor Phone---} Phone: {---City Admin Office Phone---} Email: {---Vendor E-mail---} Email: {---City Admin E-mail---}

By signing below, the parties accept and agree to the terms set forth in this Contract.

{---Vendor Legal Name---} City of Charlotte

Signature:

Print Name:

Title: Date: _

Signature:

Print Name:

Title: Date:

No pre-audit certificate is required under N.C. Gen. Stat. 159-28(a) because this Contract is for an indefinite quantity with no minimum purchase requirement. Notwithstanding anything contained herein to the contrary, this Contract does not require the City to purchase a single product or service, and a decision by the City to not make any purchase hereunder will violate neither this Contract nor any implied duty of good faith and fair dealing. The City has no financial obligation under this Contract absent the City’s execution of a valid and binding purchase order or contract addendum containing a pre-audit certificate.

mailto:cocap@charlottenc.gov

PURCHASE AND SERVICE TERMS

This Attachment is incorporated into the NPDES MS4 SCM Compliance Software Solution (“Contract”) between the City of Charlotte (“City”) and {---Vendor Legal Name---} (“{---Vendor Reference Name---}”). Capitalized terms not defined in this Attachment will have the meanings stated in the Contract.

1. Definitions. The following terms shall have the meanings ascribed below for purposes of the Contract.

1.1. Acceptance: Refers to receipt and approval by the City of a Deliverable or Service in accordance with the acceptance process and criteria in the Contract.

1.2. Company Software: Refers to mean all pre-existing software owned by {---Vendor Reference Name---} or any of its “Related Entities” which {---Vendor Reference Name---} provides or is required to provide under this Contract, and all Updates and Enhancements to the foregoing. The term "Related Entity" shall mean any person or entity that is directly or indirectly in control of, controlled by, or under common control with {---Vendor Reference Name---}, including but not limited to, parent, subsidiary, and affiliate entities. The word, "control," as used in this context, shall mean ownership of a sufficient percentage (not necessarily a majority) of the outstanding voting interests in an entity so as to afford effective control of the management of the entity.

1.3. Current Release: Refers to the latest version of the Software offered for general commercial distribution at a given point in time, including all Updates.

1.4. Customizations: Refers to all newly developed software created by {---Vendor Reference Name---} and/or its subcontractors pursuant to this RFP, including but not limited to all interfaces between different components of the System and between the System and other systems. Customizations will not include Updates and Enhancements that become part of {---Vendor Reference Name---} Software.

1.5. Defect: Refers to any failure of the System or any component thereof to fully conform to the Specifications and Requirements. A non-conformity is not a Defect if it results directly from the City’s improper use or damage, unless it is reasonably likely that such non-conformity would have occurred on that or another occasion even without the City’s improper use or damage.

1.6. Deliverables: Refers to all tasks, reports, information, designs, plans, and other items that {---Vendor Reference Name---} is required to deliver to the City in connection with the Contract.

1.7. Documentation: Refers to all written, electronic, or recorded works, that describe the use, functions, features, or purpose of the System or any component thereof, and which are published or provided to the City by {---Vendor Reference Name---} or its subcontractors, including without limitation all end user manuals, training manuals, guides, program listings, data models, flow charts, logic diagrams, and other materials related to or for use with the System.

1.8. Enhancements: Refers to any products, parts of products, improvements, additions, or materials that are not included in the Products at the time of execution of an agreement or that are subsequently developed, which modify the Products to provide a function or feature not originally offered or an improvement in function.

1.9. Maintenance Services: Refers to the maintenance services described in the Scope of Maintenance Services.

1.10. Milestones: Refers to an identified deadline for the completion of specific Services and/or the Acceptance of identified

Deliverables, as specified in the Contract.

1.11. Product: Refers to all Hardware and Software, as those terms are defined herein.

1.12. Services. Refers to the services to be performed by {---Vendor Reference Name---} pursuant to the Contract.

1.13. Software: Refers to (i) all Company Software; (ii) all Customizations; (iii) all Third Party Software; and (iv) all Updates and

Enhancements of any of the foregoing. Software is considered a Product under the Contract.

1.14. Source Code: Refers to the human readable form of a computer program and all algorithms, flow charts, logic diagrams, structure descriptions or diagrams, data format or layout descriptions, pseudo-code, code listings (including comments), and other technical documentation relating to such program.

1.15. Specifications and Requirements: Refers to all definitions, descriptions, requirements, criteria, warranties and performance standards relating to the Products or System which are set forth or referenced in: (i) the Contract; (ii) the Documentation; and

(iii) any functional and/or technical specifications which are published or provided by {---Vendor Reference Name---} or its licensors or suppliers from time to time with respect to all or any part of the Products or the System.

1.16. System: Refers to [NAME OF SYSTEM] to be [designed, supplied, installed, configured, tested and commissioned] by {---Vendor Reference Name---} under the Contract, including but not limited to all Products.

1.17. System Acceptance: Refers to acceptance by the City of the complete System under the process stated in the Scope of Implementation Services attachment.

1.18. Third Party Software: Refers to all software included within the System or required for the System to function in full compliance with the Specifications and Requirements that is provided by {---Vendor Reference Name---} under the Contract and was not manufactured, developed or otherwise created by {---Vendor Reference Name---}, any Related Entity of {---Vendor Reference

Name---}, or any of {---Vendor Reference Name---}’s subcontractors. The phrase "Related Entity" shall mean any person or entity that is directly or indirectly in control of, controlled by, or under common control with {---Vendor Reference Name---}, including but not limited to any parent, subsidiary, and affiliate entities. The word, "control," as used in this context, shall mean ownership of a sufficient percentage (not necessarily a majority) of the outstanding voting interests in an entity so as to afford effective control of the management of the entity.

1.19. Updates: Refers to program logic changes made by Company or its subcontractors or vendors to correct Defects in the Products and/or related Documentation delivered hereunder.

1.20. Workaround: Refers to a reasonable change in the procedures followed or data supplied to avoid a Defect that does not impair the performance of the System or increase the cost of using the System.

2. Compensation.

2.1. PURCHASE PRICE.

The City shall pay {---Vendor Reference Name---} a fixed price of [PURCHASE PRICE] (the “Purchase Price”) as full and complete consideration for the satisfactory performance of all the requirements of this Contract. The Purchase Price is allocated to the Products and Services in accordance with the Price Schedule and shall be payable in accordance with the Milestone Plan. The amount of the Purchase Price referenced in this Section constitutes the total fees, charges and expenses payable to {---Vendor Reference Name---} under this Contract, and shall not be increased except by a written instrument duly executed by the City, which expressly states that it amends this Section of this Contract.

2.2. PAYMENT PLAN.

{---Vendor Reference Name---} shall invoice the City for the Purchase Price in accordance with the Milestone Plan. {---Vendor Reference Name---} shall not invoice the City for any Products or Services within a particular Milestone until all Products and Services required in connection with that Milestone have been fully delivered, completed and accepted by the City.

2.3. MAINTENANCE FEES FOR EXTENDED MAINTENANCE.

The Maintenance Services shall be provided to the City at no charge for a period of one (1) year after System Acceptance (the “Warranty Period”). After the Warranty Period, the City shall have five (5) one (1)-year options to purchase Extended Maintenance Services from {---Vendor Reference Name---} at a price of [ANNUAL MAINTENANCE FEE] per year (the “Maintenance Fees.”) The City shall be entitled to exercise its option to buy Extended Maintenance Service for a given one (1)-year option period by: (a) providing written notice to {---Vendor Reference Name---} at any time prior to or within sixty (60) days following the beginning of such one-year option period; or (b) payment of {---Vendor Reference Name---}’s invoice for such one-year option period. {---Vendor Reference Name---} shall invoice the City for Maintenance Fees on an annual basis, but not more than sixty (60) days before the one (1)-year extended maintenance term being billed for begins.

3. Expenses

The City will be charged at the then prevailing Federal Per Diem Rate (https://www.gsa.gov/travel/plan-book/per-diem-rates) for Charlotte, NC per day to cover all meals, lodging, travel, and other expenses (available at https://www.gsa.gov/travel-resources). No other expenses will be charged.

Each invoice for expenses shall itemize in detail and provide documentation for all expenses for which {---Vendor Reference Name---} seeks reimbursement.

4. Premium Rates. Unless explicitly listed in the Price Schedule, {---Vendor Reference Name---} will not charge the City at overtime, emergency, or other premium rates, regardless of the number of hours worked in a given day or week.

5. Product Purchase and Delivery.

5.1. COMPANY TO PROVIDE ALL SOFTWARE. As part of the Purchase Price, {---Vendor Reference Name---} shall provide all Software, labor, equipment and materials required by the City in order for the System to perform in accordance with the Specifications and Requirements, except for those items that are specifically listed in the Scope of Implementation Services as a City responsibility.

5.2. DELIVERY SCHEDULE. {---Vendor Reference Name---} shall deliver the Products by the delivery dates set forth in the Project Schedule, as may be modified by the parties’ mutual consent in the Project Plan. Delivery shall be to various City facilities unless otherwise agreed in writing by the City.

5.3. RESERVED.

5.4. DELIVERY AND INSTALLATION COSTS. All delivery and installation costs associated with the Software shall be borne by {---Vendor

Reference Name---}.

5.5. RESERVED.

5.6. TRANSFER OF WARRANTIES. Without limiting {---Vendor Reference Name---}’s obligations to provide warranty Services or the

Maintenance Services, {---Vendor Reference Name---} hereby assigns and transfers to the City all of {---Vendor Reference Name--https://www.gsa.gov/travel/plan-book/per-diem-rates https://www.gsa.gov/travel/plan-book/per-diem-rates https://www.gsa.gov/travel-resources

-}’s warranties from {---Vendor Reference Name---}’s suppliers covering Third Party Software. {---Vendor Reference Name---} will provide copies of such warranties to the City with delivery of the applicable Software. While {---Vendor Reference Name---} shall be entitled to make arrangements to have such warranty work performed by the supplier, nothing herein shall relieve {---Vendor Reference Name---} of its obligation to correct Defects in the Software or to meet the time deadlines provided in this Contract for the correction of such Defects.

5.7. RESERVED.

6. New Technology. The parties recognize that technology may change during the term of this Contract. Accordingly, the parties agree as follows:

6.1. {---Vendor Reference Name---} shall provide the City with prompt written notice of all upgrades, enhancements and modifications to the Products or Services that become available during the term of this agreement (the “New Technology”).

6.2. Unless specified in writing by the City in a specific instance, all Products provided by {---Vendor Reference Name---} will be the latest, most recent version available as of the time of installation. {---Vendor Reference Name---} will schedule installation of all Products as late in the process as is reasonably practicable to meet the Project Plan deadlines. Unless specified in writing by the City in a specific instance, {---Vendor Reference Name---} will continually update the Software after installation at no additional cost and it shall be a condition of System Acceptance that all Software be the latest, most current version available as of the date of System Acceptance.

6.3. If {---Vendor Reference Name---} causes a delay in the project of six months or more, it shall be a condition of System Acceptance (at the City’s option) that the Hardware is the latest, most recent version available as of six (6) months prior to the date of System Acceptance.

6.4. Notwithstanding anything contained in this Contract to the contrary, the City shall have the option to reject proposed New Technology and to accept less that the most current version of the Products by providing written notice to {---Vendor Reference Name---}.

6.5. {---Vendor Reference Name---} shall make the New Technology available to the City at no additional cost if required by this Contract, or if New Technology is generally commercially available to {---Vendor Reference Name---}’s customers at no additional cost. Notwithstanding the foregoing, there shall be no additional charges for providing the most recent version of the Hardware as required by this Section.

6.6. {---Vendor Reference Name---} shall provide additional details and estimated prices to the City at the request of the City, if the City wants to consider further the possible addition of the New Technology.

6.7. Notwithstanding anything contained herein to the contrary, neither the acceptance of proposed New Technology by the City nor the amendment of this Contract to incorporate New Technology shall relieve {---Vendor Reference Name---} from its obligations under this Contract to satisfy the Specifications and Requirements.

7. Acceptance of Deliverables and Milestones; System Acceptance. Acceptance of an individual Deliverable or Milestone and the entire System shall occur in accordance with the Scope of Implementation Services attachment.

8. City Resources. The City is not required to provide any information, personnel, facilities, or other resources aside from what is specifically required in the Scope of Implementation Services unless the City can do so at no cost. When this Attachment requires the City to provide a resource, {---Vendor Reference Name---} shall request it in writing in a timely manner. If {---Vendor Reference Name- --} will be delayed in performing due to any failure by the City to provide a resource required by this Contract, {---Vendor Reference Name---} shall promptly notify in writing both the City Business Contact and Official Notice Recipients identified in the General Conditions. Failure or delay by the City to provide required resources will not excuse {---Vendor Reference Name---} from any failure or delay in performance unless {---Vendor Reference Name---} has followed these steps. The duration of any excused delay will be limited to the time period after {---Vendor Reference Name---} has followed these steps.

9. Billing Records. During the term of this Contract and for three (3) years after it terminates, {---Vendor Reference Name---} will keep documentation sufficient to verify the amounts billed to the City. The City has the right to audit books, records and facilities of {--- Vendor Reference Name---} necessary to evaluate {---Vendor Reference Name---}’s compliance with the terms and conditions of this Contract or the City’s payment obligations. The City shall pay its own expenses relating to such audits, but shall not have to pay any expenses or additional costs of {---Vendor Reference Name---}. However, if non-compliance is found that would have cost the City in excess of $10,000 but for the audit, then {---Vendor Reference Name---} shall be required to reimburse the City for the cost of the audit.

10. Compensation for Termination Without Cause. If the City terminates this Contract without cause, as soon as practicable, {---Vendor Reference Name---} shall submit a statement to the City showing in detail the Services performed under this Contract through the date of termination. In the event of termination without cause pursuant to this Section, the City agrees to: (i) pay {---Vendor Reference Name---} a pro rata amount of the purchase price for Implementation Services rendered through the termination date based on percentage of completion of the applicable payment Milestones. The foregoing payment obligation is contingent upon: (i) {---Vendor Reference Name---} having fully complied with the Section of General Conditions captioned “Obligations On Termination; and (ii) {--- Vendor Reference Name---} having provided the City with written documentation reasonably adequate to verify the number of hours of Services rendered by each person through the termination date and the percentage of completion of each task, and is subject to the City’s right to inspect billing records and dispute any charges as provided under this Attachment.

11. Employment Taxes and Employee Benefits. {---Vendor Reference Name---} acknowledges and agrees that {---Vendor Reference Name- --}’s employees and subcontractors are not employees of the City. {---Vendor Reference Name---} represents, warrants, and covenants that {---Vendor Reference Name---} will pay all withholding tax, social security, Medicare, unemployment tax, worker’s compensation, and other payments and deductions that are required by law relating to provision of the Services. {---Vendor Reference Name---} shall indemnify, defend, and hold harmless the City and the City’ officials, employees and agents from and against any and all claims, losses, damages, fines, penalties, obligations, liabilities and expenses, including but not limited to reasonable attorneys' fees arising from any claim that an individual performing the Service is an employee of the City.

12. Ownership of Work Product.

12.1. {---Vendor Reference Name---} shall have exclusive ownership of intellectual property rights in all Company Software and related

Documentation, including but not limited to all copyrights, patents and trade secrets (collectively “{---Vendor Reference Name---} Intellectual Property”). {---Vendor Reference Name---} grants the City a perpetual, royalty-free, non-exclusive license to use and copy the Company Intellectual Property for all purposes of the City and the Affiliates in accordance with the terms of the License.

12.2. The City will have exclusive ownership of all reports, documents, designs, ideas, materials, concepts, plans, creative works, software, data, programming code and other work product developed for or provided to the City in connection with this Contract, and all patent rights, copyrights, trade secret rights and other intellectual property rights relating thereto (collectively the “Intellectual Property”). {---Vendor Reference Name---} hereby assigns and transfers all rights in the Intellectual Property to the City. {---Vendor Reference Name---} further agrees to execute and deliver such assignments and other documents as the City may later require to perfect, maintain and enforce the City’s rights as sole owner of the Intellectual Property, including all rights under patent and copyright law. {---Vendor Reference Name---} hereby appoints the City as attorney in fact to execute all such assignments and instruments and agrees that its appointment of the City as an attorney in fact is coupled with an interest and is irrevocable.

13. License to Use Intellectual Property. The City grants {---Vendor Reference Name---} a royalty-free, non-exclusive license to use and copy the Intellectual Property to the extent necessary to perform this Contract. {---Vendor Reference Name---} may not to use the Intellectual Property for other purposes without the City’s prior written consent, and {---Vendor Reference Name---} agrees to treat the Intellectual Property and all City data with the same level of protection that {---Vendor Reference Name---} afford {---Vendor Reference Name---}’s own trade secrets and intellectual property.

14. Contract Data.

14.1. The City shall have exclusive ownership of the following (collectively referred to as “Contract Data”): (a) all data produced or generated under this Contract for the benefit of the City or its customers; and (b) all data provided by, accessed through or processed for the City under this Contract.

14.2. {---Vendor Reference Name---} will promptly provide the Contract Data to the City in machine readable format upon the City’s request at any time while this Contract is in effect or within three years after this Contract terminates.

14.3. In accordance with the North Carolina electronic data-processing records law N.C.G.S. §132-6-1:

14.3.1. All Software and Documentation provided by {---Vendor Reference Name---} or its subcontractors will have sufficient information and capabilities to enable the City to permit the public inspection and examination and to provide electronic copies of public records stored, manipulated or retrieved by the System; and

14.3.2. All Software and Documentation provided by {---Vendor Reference Name---} or its subcontractors will have sufficient information to enable the City to create an index containing the following information with respect to each database used by the System without extraordinary commitments of staff or resources: (i) annotated list of data fields: name, description, and restricted field indicator; (ii) description of the format or record layout; (iii) frequency with which the database is updated; (iv) list of any data fields to which public access is restricted; (v) description of each form in which the database can be copied or reproduced; (vi) title of the database; (vii) owner of the data; (viii) narrative description of the database;

(ix) person creating the index; and (x) purpose of the database. {---Vendor Reference Name---} agrees that the City may copy and disclose the information listed above in response to requests for database information under the North Carolina General Statutes.

15. Company Will Not Sell or Disclose Contract Data. {---Vendor Reference Name---} will treat Contract Data as Confidential Information under this Contract. {---Vendor Reference Name---} will not reproduce, copy, duplicate, disclose, or use the Contract Data in any manner except as authorized by the City in writing or expressly permitted by this Contract.

16. Supporting Data. If {---Vendor Reference Name---} will be providing work product under this Contract that is based on an analysis of data {---Vendor Reference Name---} will provide the City with all data supporting {---Vendor Reference Name---} ’s analysis (“Supporting Data”) in a machine-readable format, together with a written description of the methods of analysis. Excluding Confidential Information of {---Vendor Reference Name---} (as defined in this Contract), the City shall be permitted to reproduce, copy, duplicate, disclose, or use the Supporting Data for any purpose, and it shall be treated as a public record under North Carolina law.

17. Regeneration of Lost Or Damaged Data. If {---Vendor Reference Name---} loses or damages any data in the City’s possession, {---Vendor Reference Name---} will, at {---Vendor Reference Name---}’s own expense, promptly replace or regenerate such data from the City's machine-readable supporting material, or obtain, at {---Vendor Reference Name---}’s own expense, a new machine-readable copy of lost or damaged data from the City’s data sources.

18. City Materials and Data Treated as Confidential. {---Vendor Reference Name---} will treat as confidential information all data and materials provided by or processed for the City in connection with this Contract. {---Vendor Reference Name---} will not reproduce, copy, duplicate, disclose, or in any way treat the data supplied by the City in any manner except that contemplated by this Contract.

19. Data Security and Privacy

19.1. General Requirements. With respect to Contract Data, {---Vendor Reference Name---} shall:

19.1.1. Establish and maintain safeguards against the destruction, loss, unauthorized alteration of, or unauthorized access to the Contract Data;

19.1.2. Comply with all laws and regulations that may apply to the Contract Data, including without limitation all laws relating to identity theft;

19.1.3. Store all Contract Data in accordance with Payment Card Industry or successor) standards then in effect (“PCI Standards”);

19.1.4. Encrypt all personally identifiable information, credit card data that is transmitted to or from {---Vendor Reference Name-

--}’s systems in connection with this Contract;

19.1.5. Ensure that Contract Data storage complies with all relevant laws, regulations and standards, including but not limited to states laws, and applicable regulatory and professional standards; and

19.1.6. Ensure that transmission of Contract Data to and from {---Vendor Reference Name---}’s system is secure.

19.2. Authentication. Okta is the City’s standard cloud-based identity provider (IdP). As {---Vendor Reference Name---} will be providing a SaaS solution, it must be able to federate authentication of City users with Okta.

19.3. Preventing Unauthorized Access. {---Vendor Reference Name---} shall identify in writing a security administrator to coordinate with the City. {---Vendor Reference Name---} shall take appropriate measures to protect against the misuse of and/or unauthorized access to the Contract Data, including the use of passwords and validated user identification for {---Vendor Reference Name---}. Should any such misuse or unauthorized access occur, {---Vendor Reference Name---} must notify the City within 24 hours of discovery.

19.4. If Unauthorized Access is suspected. {---Vendor Reference Name---} shall promptly investigate any suspicion or allegation of misuse or unauthorized access to Contract Data. If {---Vendor Reference Name---} learns or has reason to believe that Contract Data has been disclosed or accessed by an unauthorized party, {---Vendor Reference Name---} shall notify the City within 24 hours of discovery and shall take at {---Vendor Reference Name---}’s expense all remedial action required by law or as reasonably requested by the City to remedy such disclosure or unauthorized access. All remediation for third party software security vulnerabilities that are clearly identified as such by {---Vendor Reference Name---} are the responsibility of the third party to provide. This in no way limits {---Vendor Reference Name---}’s responsibility for notifying the City of the identified vulnerability.

19.5. Contract Data to Remain in the U.S. {---Vendor Reference Name---} will ensure that all Contract Data remains within the confines of the United States including any backup data, replication sites, and disaster recovery sites.

19.6. Right of Audit by City. The City shall have the right to review {---Vendor Reference Name---}’s cyber security program prior to the commencement of Cloud Services and from time to time during the term of this Contract. During the performance of the Cloud Services, on an ongoing basis from time to time and without notice, the City, at its own expense, shall be entitled to perform, or to have performed, an on-site audit of {---Vendor Reference Name---}’s cyber security program. In lieu of an on-site audit, upon request by the City, {---Vendor Reference Name---} agrees to complete, within 45 days of receipt, a Cloud Security Questionnaire provided by the City regarding {---Vendor Reference Name---}’s cyber security program.

19.7. Other Security Constraints. In order to assist {---Vendor Reference Name---} to comply with the City's requirements regarding security under the Contract, {---Vendor Reference Name---}'s security strategy will be to protect Contract Data at multiple levels, which includes data confidentiality, data integrity, and data availability.

19.7.1. Hosting Facility Security. All servers and network equipment are housed in locked cabinets at the hosting facility which provides 24x7security. To access the cabinets there must be several levels of security that must be passed where each entry point provides state of the art card readers, scanners, and other access devices.

19.7.2. Network Security. {---Vendor Reference Name---}'s network must be protected by redundant firewalls and monitored for unauthorized access. {---Vendor Reference Name---} will also implement Web Application Firewalls (WAF) to protect all City assets host by {---Vendor Reference Name---} cloud services or data centers. The WAFs will be configured to protect against any application level attacks. Firewall logs must be constantly monitored, and the logs reviewed on a regular basis. Leading-edge firewall equipment must be provided by {---Vendor Reference Name---} to protect the network. The network must be architected to be highly reliable and redundant. If a router, load balancer, or firewall should fail, there must be redundancy built in that would allow failover to take place, without causing a loss of service to City customers.

19.7.3. Firewall and WAF Management within {---Vendor Reference Name---} cloud services and data centers. {---Vendor Reference Name---} shall complete the following activities:

A. Monitoring and management of firewall appliances, WAF, and VPN connectivity to {---Vendor Reference Name---} cloud services and data centers;

B. Management of firewall and WAF upgrades;

C. In the event {---Vendor Reference Name---} identifies a suspected security breach, {---Vendor Reference Name---} will notify the City of the breach within 24 hours of discovery; and D. Restrict database users to a controlled list; individual activities to be restricted, logged and monitored.

19.7.4. Server Security. The City's installation will be implemented on dedicated virtual or physical servers, or logically separate databases, meaning these server environments will be used for and accessible only by the City of Charlotte and {---Vendor Reference Name---} staff;

19.7.5. Endpoint Protection. {---Vendor Reference Name---} shall complete the following activities:

a) Install Endpoint Detection and Response (EDR) on {---Vendor Reference Name---} managed servers;

b) Maintain all EDR with the latest patches, engines and heuristics; and

c) Scan, quarantine, and clean all in-bound and out-bound files (including email attachments) for viruses.

19.7.6. Cloud Services Security. {---Vendor Reference Name---} provided access for customers to Cloud Services and applications must use SSO authentication via the City’s Okta service. The design of the application must be robust so as to prevent one of {---Vendor Reference Name---}’s customers from accessing another customer's data. There must be several layers of protected services standing between the web page where the customer logs in and the actual data.

19.7.7. Security Patches. Where it does not impact application supportability, security patches to Platform Software will be applied within 30 days of being released. Critical vulnerabilities that are being exploited in the wild must be patched or remediated immediately.

19.7.8. Passwords. At a minimum, all user accounts must meet the following password requirements:

• Password must be at least thirteen (13) characters and include at least three of the following types of characters:

upper case, lower case, number, and special character.

• New passwords must not have been used in the past 10 passwords.

Passwords must be changed every 90 days and have a minimum age of two (2) days.

19.7.9. Encryption. Sensitive or confidential data must be encrypted at rest or in transit. Secure protocols providing encryption of usernames, passwords, and data (e.g., SSH, HTTPS) must be used. Any transmission of sensitive City information should be performed utilizing an industry standard level of encryption; the preferred encryption algorithm is AES 256 bit. HTTPS will use TLS 1.3 as a minimum. The use of proprietary encryption algorithms is prohibited.

20. Removal and Replacement of Personnel. “Key Personnel” are the individuals listed as such on the Scope of Implementation Services, and any other individuals whom the City reasonably deems integral to successful performance of the Services. Absent the City’s written approval, {---Vendor Reference Name---} will not: (i) remove Key Personnel from performance of this Contract or permit {---Vendor Reference Name---}’s subcontractors to remove Key Personnel from performance of this Contract; or (ii) materially reduce or allow {--- Vendor Reference Name---}’s subcontractors to materially reduce the involvement of Key Personnel in performing this Contract. The City will have the right to interview and approve Key Personnel, and also to require the removal and replacement of Key Personnel if the City has reasonable grounds to believe that the individual is not suitable for the assignment, including without limitation insufficient experience, inadequate qualifications, lack of necessary skills, improper conduct, background check results, or other grounds. Upon receipt of a request for rejection, removal, or replacement of an individual, {---Vendor Reference Name---} will promptly comply with the request and provide the City with the requisite background materials for a proposed alternate or successor. If {---Vendor Reference Name---} does not believe the City has reasonable grounds for making the request, {---Vendor Reference Name---} will notify the City in writing and the City will have the right to exercise its termination rights under the Contract, or to suspend the Contract and any payments due until such matter is resolved.

21. Background Checks.

21.1. BACKGROUND CHECKS REQUIRED PRIOR TO WORK. Prior to starting work under this Contract, {---Vendor Reference Name---} will conduct a background check on each {---Vendor Reference Name---} employee assigned to work under this Contract, and will require its subcontractors (if any) to perform a background check on each of their employees assigned to work under this Contract (collectively, the “Background Checks”). Each Background Check must include: (a) the person’s criminal conviction record from the states and counties where the person lives or has lived in the past seven (7) years; and (b) a reference check.

21.2. NEW CHECKS REQUIRED EACH YEAR AND PRIOR TO NEW PROJECTS. After starting work under this Contract, {---Vendor Reference Name---} will, on an annual basis, perform a Background Check for each {---Vendor Reference Name---} employee assigned to work under this Contract during that year, and will require its subcontractors (if any) to do the same for each of their employees.

If {---Vendor Reference Name---} undertakes a new project under this Contract, then prior to commencing performance of the project {---Vendor Reference Name---} will perform a Background Check for each {---Vendor Reference Name---} employee assigned to work on the project, and will require its subcontractors (if any) to do the same for each of their employees.

21.3. ADDITIONAL INVESTIGATION OF CERTAIN EMPLOYEES. If a person’s duties under this Contract fall within the categories described below, the Background Checks that {---Vendor Reference Name---} will be required to perform (and to have its subcontractors perform) shall also include the following additional investigation:

21.3.1. If the job duties require driving: A motor vehicle records check.

21.3.2. If the job duties include responsibility for initiating or affecting financial transactions: A credit history check.

21.3.3. If job duties include entering a private household or interaction with children: A sexual offender registry check.

21.4. COMPLIANCE WITH APPLICABLE LAW. {---Vendor Reference Name---} must follow all state and Federal laws when conducting Background Checks, including but not limited to the Fair Credit Reporting Act requirements, and shall require its subcontractors to do the same.

21.5. DUTY TO REPORT INFORMATION TO CITY. {---Vendor Reference Name---} shall notify the City of any information discovered in the Background Checks that may be of potential concern for any reason.

21.6. CHECKS CONDUCTED BY CITY. The City may conduct its own background checks on principals of {---Vendor Reference Name---} as the City deems appropriate. By operation of the public records law, background checks conducted by the City are subject to public review upon request.

GENERAL CONDITIONS

This Attachment is incorporated into the NPDES MS4 SCM Compliance Software Solution (“Contract”) between the City of Charlotte (“City”) and {---Vendor Legal Name---} (“{---Vendor Reference Name---}”). Capitalized terms not defined in this Attachment will have the meanings stated in the Contract.

1. PRIORITY OF ATTACHMENTS. In the event of a conflict among the Attachments, Attachments shall have priority in the order in which they are listed on the Cover Sheet.

2. INVOICES. Each invoice sent by {---Vendor Reference Name---} shall detail all Services performed and delivered which are necessary to entitle {---Vendor Reference Name---} to the requested payment under the terms of this Contract. All invoices must include an invoice number and the City purchase order number for purchases made under this Contract. Purchase order numbers will be provided by the City. Invoices must be submitted with lines matching those on the City-provided purchase order.

3. PAYMENT TERMS. The City will pay undisputed, properly submitted invoices within thirty (30) days after receipt. As a condition of payment, {---Vendor Reference Name---} must invoice the City for Services within 60 days after the Services are performed. {---Vendor Reference Name---} WAIVES THE RIGHT TO CHARGE THE CITY FOR ANY SERVICES THAT HAVE NOT BEEN INVOICED WITHIN 60 DAYS

AFTER SUCH SERVICES WERE RENDERED.

4. TERMINATION.

4.1. TERMINATION FOR CONVENIENCE. The City may terminate this Contract at any time without cause by giving thirty (30) days written notice to {---Vendor Reference Name---}.

4.2. TERMINATION FOR CAUSE. Without limiting any other termination rights set forth in this Contract, either party may terminate this

Contract for default if the other party fails to cure a material breach within thirty (30) days after receipt of written notice that identifies the breach and the intent to terminate if not cured. The City may terminate this Contract for default without a cure period if {---Vendor Reference Name---}:

4.2.1. Fails to obtain, maintain, or provide proof of the insurance policies and endorsements as required by this Contract; or

4.2.2. Becomes more than ten (10) days late performing the Services; or

4.2.3. Fails to act in a way that creates a risk to safety or causes or is likely to cause the City to incur property damage, fines, or penalties.

4.3. TERMINATION FOR FAILURE TO AGREE ON PROJECT PLAN. If the parties have not finalized and agreed upon the Project Plan by the date set forth in the Project Schedule, the City shall be entitled to terminate this Contract and receive a refund of all amounts paid to {---Vendor Reference Name---}.

4.4. TERMINATION CONVERSION. If the contract is terminated by the CIty for cause but it is later conclusively determined that the Company has not in fact defaulted, the termination shall be deemed to have been affected for the convenience of the City and the Company shall be paid through the date of the termination.

4.5. AUTHORITY TO TERMINATE. Authority to terminate this Contract on behalf of the City rests with the City Manager and Deputy City Manager, or any designee of the forgoing having the same level of delegated signature authority as would have been required to execute the Contract.

4.6. OBLIGATIONS ON TERMINATION.

4.6.1. Upon expiration or termination of this Contract, {---Vendor Reference Name---} will promptly provide to the City, at no cost,

(i) all data, materials, software, and equipment provided to {---Vendor Reference Name---} by or on behalf of the City; (ii) all deliverables that are completed or in process as of the date of termination; and (iii) a statement of all Services performed through termination, together with such detail and documentation as is otherwise required under this Contract for payment.

4.6.2. Upon expiration or termination of this Contract, {---Vendor Reference Name---} shall, at no cost to the City, cooperate with the City in connection with the transfer of the Services, functions and operations provided by {---Vendor Reference Name-- -} hereunder to another provider selected by the City or to the City, as determined by the City. Such transition services include but are not limited to:

a) Notifying all affected service providers and subcontractors of the Company of transition activities;

b) providing reasonable training to City staff or the successor service provider in the performance of the Cloud Services;

c) using commercially reasonable efforts to assist the City in acquiring any necessary rights to legally and physically access and use any third party technologies and documentation then being used by {---Vendor Reference Name---} in connection with the Services;

d) using commercially reasonable efforts to make available to the City, pursuant to mutually agreeable terms and conditions, any third party services then being used by {---Vendor Reference Name---} in connection with the Cloud Services.

4.6.3. The expiration or termination of this Contract shall not relieve either party of its obligations regarding “Confidential Information”, as defined in the Section titled Confidentiality Terms.

4.7. CROSS TERMINATION. A default by the City under the Scope of Maintenance Services Attachment shall constitute grounds for terminating the Maintenance Services if not cured as provided above, but shall not constitute a basis for {---Vendor Reference Name---} to terminate the License or any other obligations {---Vendor Reference Name---} may have under this Contract. A default by the City under the Scope of Implementation Services Attachment shall constitute grounds for terminating the Implementation Services if not cured as provided above, but shall not constitute a basis for the Company to terminate the License, the Maintenance Services or any other obligations {---Vendor Reference Name---} may have under this Contract. Otherwise, a default by either party under any Attachment of this Contract, or the main body of this Contract, shall be regarded as a default under the entire Contract.

4.8. NO SUSPENSION. In the event that the City disputes in good faith an allegation of default by {---Vendor Reference Name---}, notwithstanding anything to the contrary in this Contract, {---Vendor Reference Name---} shall not terminate this Contract or suspend or limit the delivery of Products or Services or any warranties or repossess, disable or render unusable any Software supplied by {---Vendor Reference Name---}, unless (i) the parties agree in writing, or (ii) an order of a court of competent jurisdiction determines otherwise.

5. REPRESENTATIONS AND WARRANTIES. {---Vendor Reference Name---} represents, warrants, and covenants that:

5.1. For a period of twelve (12) months after System Acceptance (the “Warranty Period”), the System will fully comply with the Specifications and Requirements, and all federal, state and local laws, regulations, codes and guidelines that apply to it (including any changes to such laws, etc.).

5.2. All Products and Services delivered after System Acceptance shall fully conform to the Specifications and Requirements for a period of one year after acceptance of such Product or Service by the City.

5.3. For as long as the City exercises its options to purchase Extended Maintenance Services, the System will fully comply with the Specifications and Requirements, and all federal, state and local laws, regulations, codes and guidelines that apply to it (including changes to such laws, etc.).

5.4. All Software provided by {---Vendor Reference Name---} or its subcontractors is and will be free of viruses, worms and Trojan horses, and any code designed to disable the Software because of the passage of time, alleged failure to make payments due, or otherwise (except for documented security measures such as password expiration functions);

5.5. Prior to System Acceptance, {---Vendor Reference Name---} will correct all Defects in the System and the components thereof within the time frames set forth in the Scope of Implementation Services and the Project Plan. During the Warranty Period and at all times during which the City has purchased Extended Maintenance Services, the Company will correct all Defects and provide Maintenance Services pursuant to the Scope of Maintenance Services Attachment.

5.6. All Documentation for the Products and the System is and will be in all material respects complete and accurate, and will enable data processing professionals and other City employees with ordinary skills and experience to utilize the Products and the System for the expressed purpose for which they are being acquired by the City;

5.7. All work performed by {---Vendor Reference Name---} and/or its subcontractors pursuant to this Contract shall meet the highest industry standards and shall be performed in a professional and workmanlike manner by staff with the necessary skills, experience and knowledge;

5.8. Neither the Services, nor the Products nor any Deliverables provided by {---Vendor Reference Name---} under this Contract will violate, infringe or misappropriate any patent, copyright, trademark or trade secret rights of any third party, or any other third party rights (including without limitation non-compete agreements); and

5.9. {---Vendor Reference Name---} shall not place or allow to be placed on the Software any third party lien or encumbrance of any kind at any time which could conceivably interfere with the City’s use of the Software or {---Vendor Reference Name---}’s maintenance of the Software.

5.10. Neither the execution nor the performance of this Contract will violate any third party contractual rights;

5.11. {---Vendor Reference Name---} is a duly organized and validly existing entity of the type set forth in the first paragraph of this

Contract, is in good standing under the laws of the state specified in the first paragraph of this Contract, and is registered to do business in North Carolina; and

5.12. {---Vendor Reference Name---} has the requisite power and authority to execute and perform this Contract. {---Vendor Reference Name---} and each person signing this Contract for {---Vendor Reference Name---} represents and warrants that the execution, delivery, and performance of this Contract have been duly authorized by {---Vendor Reference Name---}.

Additional warranties may be set forth in the Attachments.

6. REMEDIES.

6.1. Right to Withhold Payment. The City is entitled to setoff and deduct from any amounts…