7-7. Terms and Conditions for Cloud Services.pdf

CITY OF ARLINGTON - OFFICE OF PROCUREMENT

TERMS AND CONDITIONS FOR

CLOUD SERVICES

Project #: Page 1 of 1 Project Title:

1. Definitions

1.1. “City” means the City of Arlington, including all its offices, positions, administrations, departments, divisions, bureaus, boards, commissions, corporations, or agencies and their respective personnel.

1.2. “Contractor” means the same as Consultant or Provider.

1.3. “City Data” means (1) Data characterizing the City or its behavior; (2) Data created, generated, stored or maintained by, at the direction of, or for the benefit of the City; and (3) any copies or derivatives of such Data.

1.4. “City Technology Assets” means all City facilities, City systems, City telecommunications, electronic data created, processed, accessed, transferred, stored, or disposed of by City systems, and such systems' peripheral equipment, networks, or magnetic data, and any electronic data created, processed, accessed, transferred, stored, or disposed of by such systems.

1.5. “Cloud Service/s” or “Service” means the software-, platform-, infrastructure- or other “as a service” solution for which access is provided by Contractor to the City under this Contract, including any client software provided to the City by Provider for use with the Cloud Service. Any software to be installed on the City’s hardware for the purpose of facilitating the City’s use of the Cloud Services shall be deemed to be a part of the Cloud Services.

1.6. “Data” means any information representation(s) of information, knowledge, facts, ideas, concepts or similar including any texts, instructions, documents, databases, diagrams, graphics, drawings, images, sounds, or biometrics that are accessed, communicated, created, generated, stored (in temporary or permanent form), filed, produced or reproduced, processed, referenced, or transmitted, in any form or media.

1.7. “Process” means to perform any act, omission or operation on or with respect to data, such as collecting, recording, organizing, storing, adapting, altering, retrieving, accessing, deleting, blocking, erasing, destroying, 2 | P a g e combining, reviewing, using, transmitting, disseminating or otherwise making data available.

1.8. “System” means a discrete set of information resources organized for the creation, collection, processing, maintenance, use, sharing, dissemination, or disposition of information. It encompasses, individually or collectively, all Network addressable items in an information technology environment and non-networked items with central processing units. Systems should be construed broadly to include, without limitation, servers, laptops, mainframes, portable computing devices, cloud infrastructure, Internet of Things devices, network appliances, industrial control system devices and supervisory control and data acquisition devices.

2. Security Responsibilities. Contractor is responsible for all security. Any shared security responsibilities must be identified with the Proposal and resulting Contract.

3. Background Checks and Security Awareness. Upon the request of the City, the Contractor shall obtain criminal background checks for Contractor Staff that the Contractor intends to utilize in the provision of services under the Contract and must provide the results of the criminal background checks to the City. If any Contractor Staff are not acceptable to the City in its sole opinion based upon the results of a criminal background check, the City, in its sole discretion, shall have the right to request that such Contractor Staff not provide services under the Contract. The Contractor must comply with such requests and provide replacement Contractor Staff in such cases. The Contractor shall promote and maintain awareness of the importance of securing the City’s information among the Contractor’s employees and agents.

4. Change Control and Advance Notice. The Contractor shall give a minimum forty-eight (48) hour advance written notice (or as otherwise identified in the Contract) to the City of any Updates that may impact availability of Service or performance. Contractor must provide Updates to the City at no additional cost when Contractor makes such Updates generally available to its users. No Update or other change to the Service may decrease or otherwise negatively impact the Service’s functionality or adversely affect the City’s use of or access to the Service.

5. Responsibilities and Uptime Guarantees. The Contractor shall be responsible for the acquisition and operation of all hardware, software and network support

3 | P a g e related to the Service being provided. The technical and professional activities required for establishing, managing and maintaining the environments are the responsibilities of the Contractor. The Service shall be available twenty-four

(24) hours per day, seven (7) days per week and three hundred sixty-five (365) days per year (excepting reasonable downtime for maintenance).

6. GovRAMP and TX-RAMP Certification. For purposes of this Contract, any Contractor offering Cloud Services, must certify each cloud product or service holding: GovRAMP Core Certification or higher; or TX-RAMP Level 2 Certification.

6.1. For new Cloud Services, the required certification must be in place on or before the Contract Effective Date.

6.2. For renewals of existing Cloud Services, the Contractor must obtain the required certification within 180 calendar days after the Effective Date.

6.3. The Contractor must maintain the required certification status for all products in this Contract for the entire duration of the Contract term.

6.4. If the Contractor believes their Cloud Service(s) are not processing Confidential data or is not considered mission-critical to the City’s operations, the Contractor may request, in writing, an exemption from this certification requirement for the products or services covered by this Contract; such exemption requests must be submitted within thirty (30) days of execution of this Contract, to the City Office of Cybersecurity at security@arlingtontx.gov. The City may, at its sole discretion, deny or grant an exception.

6.5. Cloud Services utilizing a GovRAMP security status to satisfy RAMP certification must grant the City continuous monitoring access through GovRAMP.

7. Reporting an Information Security or Privacy Incident. The Contractor shall report any information security or privacy incident affecting its Cloud Services to the City’s Office of Cybersecurity via email at security@arlingtontx.gov within 72 hours of identifying the incident. Such notification shall include all relevant details available at the time to facilitate the City’s assessment and response, and the Contractor shall continue to provide updates as additional information becomes available.

mailto:security@arlingtontx.gov

4 | P a g e

7.1. For purposes of this Contract, an “Information Security or Privacy Incident” is defined as any unauthorized access, disclosure, alteration, loss, or destruction of data, or any breach of the confidentiality, integrity, or availability of information affecting the City’s information. "Information" means any City data, records, files, documents, or other materials, whether in electronic, digital, paper, or any other form, that contain or relate to:

7.1.1. Personal Data, Personally Identifiable Information (PII), or Protected Health Information (PHI);

7.1.2. Confidential Information or Proprietary Information;

7.1.3. Customer, Employee, or Third-Party Information provided to or obtained by a party in connection with the performance of this Contract;

7.1.4. Any data subject to applicable privacy, data protection, or information security laws, including but not limited to data that identifies or could reasonably be used to identify an individual.

8. Data Location. The Contractor shall provide its Service to the City and its end users solely from data centers within the United States; and storage of City Data at rest shall be located solely in data centers within the United States. The Contractor shall not allow its personnel or subcontractors to store City Data on portable devices, except for devices that are used and kept only at its U.S. data centers. Each data center used by the Contractor to support the Contract must be within a physical security perimeter to prevent unauthorized access, and physical entry controls must be in place so that only authorized personnel have access to City Data.

9. Written Applications. If Contractor will be storing, processing, or transmitting City data through an IaaS or PaaS provider, Contractor must provide a letter from the IaaS/PaaS stating Contractor is a customer in good standing and which environment City data will be stored, processed, and transmitted. The City should be notified, in writing, of a data location change within ten (10) calendar days or other timeframe as may be mutually agreed upon by the parties.

10. Data Privacy. The Contractor must comply with all applicable laws, rules and regulations related to data privacy and security, specific to the type(s) of Data and as otherwise specified in the Contract, which may include, but is not limited to FBI’s Criminal Justice Information Services (CJIS) Compliance, Health

5 | P a g e

Portability and Accountability Act (HIPAA),and Payment Card Industry (PCI) security standards.

11. Access to Security Logs and Reports. The Contractor shall provide reports to the City; or alternatively, provide the City with access to report data and reporting tools. Unless specified otherwise in the Contract, reports shall include latency statistics, system performance statistics, user access logs, user access IP address, user access history, security logs and event logs for all City Data.

12. Transition, Transfer Assistance Termination or Suspension.

12.1. The City shall have the ability to import or export all or portions of City Data and City-written applications at its discretion without interference from the Contractor at any time during the term of the Contract. This includes the ability for the City to import or export City Data and City-written applications and from other entities.

12.2. The Contractor shall reasonably cooperate without limitation with any City authorized entity for the transfer of City Data to the City upon termination or expiration of the Contract. The Contractor must transfer City Data or allow the City to extract City Data and City-written applications, at no additional cost to and in a format designated by the City, and the City Data must be unencrypted.

12.3. The return of City Data and City-written applications shall occur no later than sixty (60) calendar days after termination or expiration of the Contact; or within another timeframe as agreed to in writing by the parties.

Contractor shall facilitate the City’s extraction of City Data and City-written applications by providing the City with all necessary access and tools for extraction, at no additional cost to the City.

12.4. During any period of suspension of Service, the Contractor shall continue to fulfill its obligations to maintain City Data and City-written applications.

12.5. In the event of termination or expiration of the Contract, the Contractor shall not take any action to intentionally erase City Data or City-written applications for a period of sixty (60) calendar days after the effective date of termination or expiration. After such period, the Contractor shall have no obligation to maintain or provide any City Data or to maintain any City-written applications and shall thereafter, unless legally prohibited, 6 | P a g e delete all City Data and City-written applications (in all forms) within its systems or otherwise in its possession or under its control, unless otherwise instructed by the City. City Data and City-written applications shall be permanently deleted and shall not be recoverable in accordance with National Institute of Standards and Technology (NIST) approved methods.

Certificates of destruction shall be provided to the City no later than ninety

(90) calendar days after termination or expiration of the Contract.

12.6. The Contractor must maintain the confidentiality, integrity, availability, and security of City Data and City-written applications during any transition or transfer and thereafter for as long as the Contractor possesses City Data and City-written applications.

13. Injunctive Relief. Contractor agrees that: (i) no adequate remedy exists at law if it fails to perform or breaches any of the provisions of the Contract regarding confidentiality, availability, integrity, and security of City Data; (ii) it would be difficult to determine the damages resulting from its breach, and such breach would cause irreparable harm to the City; and (iii) a grant of injunctive relief provides the best remedy for any such breach, without any requirement that the City prove actual damage or post a bond or other security. Contractor waives any opposition to such injunctive relief or any right to such proof, bond, or other security. (This section does not limit either party’s rights to injunctive relief from breaches not listed.)

14. No Supplementary Agreements or Terms; No Unilateral Changes;

Applicability. All click-through, click-wrap, or shrink-wrap agreements or other end user terms and conditions that are embedded in or provided with any of Contractor’s Cloud Services or presented to users in the course of the City’s use of the Cloud Services are not applicable to the City, even if use of Contractor’s Cloud Services require an affirmative acceptance of those terms.

The terms and conditions of this Contract are in static form, and no online terms and conditions that are incorporated by reference in this Contract or set forth in hyperlinked websites are binding on the City, including any other privacy policies of the Contractor and third-party providers.

14.1. To be valid, any amendment to this Contract must be in writing and signed by the Parties.

15. License Grant. Subject to the terms and conditions of this Contract, the Contractor grants the City a worldwide, limited, non-exclusive right and license

7 | P a g e during the term of this Contract to: (a) use the Cloud Services; (b) implement, configure and access the Cloud Services, including all actions and licenses necessary to fully effectuate the purposes of this Contract and the City’s internal business and IT purposes; and (c) access and use Contractor’s documentation

16. Fees.

16.1. The City is not responsible for an early termination fee.

16.2. Rates and fees may only be increased pursuant to a written amendment to this Contract that has been signed by both parties. Overage and excess usage fees are not permitted in the absence of the City’s prior written agreement.

16.3. The City shall not be liable for any unauthorized use, including fees and charges that may become due to Provider as a result of that use.

16.4. The City’s payment of an invoice without objection or failure to raise an objection to an invoice shall not constitute a waiver of any objections to that invoice.

17. Compliance of Contractor’s Employees and Subcontractors. Contractor must ensure that its employees and subcontractors comply with and are subject to a policy or written agreement to comply with, all provisions of the Contract regarding confidentiality, availability, integrity, and security of City Data that are applicable to the work they perform under the Contract.

Vendor Name:

Vendor has read and agrees to this Standard Terms and Conditions form in its entirety.

Vendor Signature Date