Attachment A - Sample Agreement.pdf

https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx

THIS IS A SAMPLE TEMPLATE FOR PROFESSIONAL SERVICES

CHECK FOR ALTERNATIVE AND FILL-IN PROVISIONS INDICATED BY __ or [].

Date last revised: 1-4-25

A G R E E M E N T

THIS AGREEMENT is made between the CITY AND COUNTY OF DENVER, a municipal corporation of the State of Colorado (the “City”) and _____, a ______ [corporation/ partnership], authorized to do business in Colorado doing business at _______ (the “Contractor”), jointly “the parties”.

The parties agree as follows:

1. COORDINATION AND LIAISON: The Contractor shall fully coordinate all services under the Agreement with the Denver Auditor, (“Denver Auditor”) or, the Denver

Auditor’s Designee.

2. SERVICES TO BE PERFORMED:

a. As the Denver Auditor directs, the Contractor shall diligently undertake, perform, and complete all of the services and produce all the deliverables set forth on Exhibit A, the Scope of Work, to the City’s satisfaction.

b. The Contractor is ready, willing, and able to provide the services required by this Agreement.

c. The Contractor shall faithfully perform the services in accordance with the standards of care, skill, training, diligence, and judgment provided by highly competent individuals performing services of a similar nature to those described in the Agreement and in accordance with the terms of the Agreement.

d. The Contractor shall comply with all legislative and regulatory requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”); the

Health Information Technology for Economic and Clinical Health Act (“HITECH”); 42 CFR Part

2, Confidentially of Substance use Disorder Patient Records; the privacy standards adopted by the

U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, Subparts A and E;

and the security standards adopted by the U.S. Department of Health and Human Services, 45

C.F.R. Parts 160, 162, 164, and Subpart C (collectively, “HIPAA Rules”). The Contractor shall implement all necessary protective measures designed to comply with HIPAA Rules, and the

Contractor hereby agrees to be bound by the terms of the Business Associate Agreement attached hereto and incorporated herein as Appendix 1 to Exhibit A. The Contractor shall not use protected https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx health information or substance use treatment records except as legally necessary to fulfill the purpose of this Agreement and shall hold the City harmless, to the extent permitted by law, for any breach of these regulations. This Section shall survive the expiration or earlier termination of this

Agreement, and the Contractor shall ensure that the requirements of this Section are included in any relevant subcontracts or subgrants.

3. TERM: This Agreement will commence on _______, and will expire, unless sooner terminated, on ______ (the “Term”). Subject to the City’s prior written authorization, the

Contractor shall complete any work in progress as of the expiration date and the Term will extend until the work is completed or earlier terminated by the City.

4. COMPENSATION AND PAYMENT:

a. Fee: The Contractor’s sole compensation for its services rendered and costs incurred under the Agreement is ____ Thousand Dollars ($__,000.00) ) [per year and, if all

Renewal Terms are effected, total compensation for the services and expenses provided under this Agreement shall not exceed ________Dollars ($_____.00).] to be paid based on monthly invoicing as described in this Paragraph 4. Amounts billed may not exceed the Engagement Fee set forth in Exhibit A.

b. Reimbursable Expenses: No separate expenses are to be reimbursed under this agreement. [ All of the Contractor’s expenses are contained in the rates [budget] in Exhibit B.]

c. Invoicing: Contractor shall provide the City with monthly invoices in a format and with a level of detail acceptable to the City including all supporting documentation required by the

City. The City’s Prompt Payment Ordinance, §§ 20-107 to 20-118, D.R.M.C., applies to invoicing and payment under this Agreement.

d. Maximum Contract Amount:

(1) Notwithstanding any other provision of the Agreement, the City’s maximum payment obligation [if all renewal terms are effective] will not exceed

___ Thousand Dollars ($__,000.00) (the “Maximum Contract Amount”). The City is not obligated to execute an Agreement or any amendments for any further services, including any services performed by Contractor beyond that specifically described in Exhibit A. Any services performed beyond those in Exhibit A are performed at Contractor’s risk and without authorization under the Agreement.

https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx

(2) The City’s payment obligation, whether direct or contingent, extends only to funds appropriated annually by the Denver City Council, paid into the Treasury of the City, and encumbered for the purpose of the Agreement. The

City does not by this Agreement irrevocably pledge present cash reserves for payment or performance in future fiscal years. The Agreement does not and is not intended to create a multiple-fiscal year direct or indirect debt or financial obligation of the City.

5. STATUS OF CONTRACTOR: The Contractor is an independent contractor retained to perform professional or technical services for limited periods of time. Neither the

Contractor nor any of its employees are employees or officers of the City under Chapter 18 of the

Denver Revised Municipal Code, or for any purpose whatsoever. [Without limiting the foregoing, the parties specifically acknowledge that: the Contractor is not entitled to unemployment insurance benefits (unless unemployment compensation coverage is provided by the Contractor or some other entity besides the City); the Contractor is not entitled to workers’ compensation benefits from the City; and the Contractor is obligated to pay federal and state income taxes on any monies earned pursuant to this Agreement].

6. TERMINATION:

a. The City has the right to terminate the Agreement with cause upon written notice effective immediately, and without cause upon twenty (20) days prior written notice to the

Contractor. However, nothing gives the Contractor the right to perform services under the

Agreement beyond the time when its services become unsatisfactory to the Denver Auditor.

b. Notwithstanding the preceding paragraph, the City may terminate the

Agreement if the Contractor or any of its officers or employees are convicted, plead nolo contendere, enter into a formal agreement in which they admit guilt, enter a plea of guilty or otherwise admit culpability to criminal offenses of bribery, kickbacks, collusive bidding, bid-rigging, antitrust, fraud, undue influence, theft, racketeering, extortion or any offense of a similar nature in connection with Contractor’s business. Termination for the reasons stated in this paragraph is effective upon receipt of notice.

c. The Contractor may resign and terminate this Agreement upon thirty (30) days prior written notice to the City at any time in accordance with the laws, regulations, and

Professional Standards applicable to the type of services provided hereunder.

https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx

d. Upon termination of the Agreement, with or without cause, the Contractor shall have no claim against the City by reason of, or arising out of, incidental or relating to termination, except for compensation for work duly requested and satisfactorily performed as described in the Agreement.

e. If the Agreement is terminated, the City is entitled to and will take possession of all materials, equipment, tools and facilities it owns that are in the Contractor’s possession, custody, or control by whatever method the City deems expedient. The Contractor shall deliver all documents in any form that were prepared under the Agreement and all other items, materials and documents that have been paid for by the City to the City. These documents and materials are the property of the City. The Contractor shall mark all copies of work product that are incomplete at the time of termination “DRAFT-INCOMPLETE”.

7. EXAMINATION OF RECORDS: The Contractor agrees that any duly authorized representative of the City, including the Manager of Finance and the Denver Auditor upon reasonable written notice to the Contractor shall, until the expiration of three (3) years after termination of the assessment services under this Agreement, unless the firm is notified in writing by the City of the need to extend the retention period, have access to and the right to examine the records of the Contractor reasonably necessary to substantiate the Contractor's invoices to and payments from the City for services performed hereunder. Access to working papers shall be provided upon request to representatives of the United States General Accounting Office or other appropriate government audit staffs under the supervision of the Contractor and at a location designated by the Contractor. The City agrees that the Contractor's assessment work papers are the property of the Contractor, that the work papers include information that is proprietary (for example, assessment programs and the Contractor's assessment process), and that it would be inappropriate for the City to have access to certain of the Contractor's work papers because, among other things, such access may provide the City information as to how the assessment is conducted by the Contractor and could thus compromise, or be viewed as compromising, an assessment or the assessment process. However, the City and the Contractor both acknowledge and agree that the Contractor's work papers may include information, prepared by the City or by the Contractor which may be useful to the City in responding, for example, to questions raised by the cognizant assessment agency as a result of its review or assessment of the City's financial statements. The

Contractor agrees that if the City requests access to information in the Contractor's work papers as https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx to the composition of particular accounts contained in the City's financial statements or the City's accounting policies or practices (as opposed to information about the Contractor's administrative materials, assessment process or the nature and extent of assessment tests), the Contractor shall, upon reasonable notice and with representatives of the Contractor present, provide the City access to such information in the Contractor's work papers. The Contractor agrees to make working papers available either to the City or successor Contractors, upon request or approval of the City.

In addition, the Contractor shall respond to the reasonable inquiries of the Denver Auditor.

In the event the Contractor is required pursuant to valid subpoena or other legal process to produce its work papers related to the assessment services performed hereunder in any judicial or administrative proceeding, the City shall reimburse the Contractor for its professional time and expenses incurred in responding to such request, but specifically excluding any attorney’s fees or costs or any other third party fees or costs, and only to the extent that funds are available under the Maximum Contract Amount specified in Subparagraph 4(d) hereof.

Nothing in this Article or Agreement shall be deemed to waive or modify any rights of privilege available at law to the City. If Contractor is served or otherwise receives a subpoena for Contractor’s records, reports, work papers related to the assessment services performed under this Agreement, the Contractor shall deliver written notice of each and every such subpoena to the

Auditor and a copy to the City Attorney within ten (10) business days after the date of receipt or service of the subpoena.

Any records or documents in the custody of the Contractor that are available to the

City under this Paragraph 7 may be redacted by the Contractor only to the extent necessary to protect the Contractor’s proprietary and confidential information contained therein and to avoid an invasion of privacy.

8. WHEN RIGHTS AND REMEDIES NOT WAIVED: In no event will any payment or other action by the City constitute or be construed to be a waiver by the City of any breach of covenant or default that may then exist on the part of the Contractor. No payment, other action, or inaction by the City when any breach or default exists will impair or prejudice any right or remedy available to it with respect to any breach or default. No assent, expressed or implied, to any breach of any term of the Agreement constitutes a waiver of any other breach.

9. INSURANCE:

https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx

a. General Conditions: Contractor agrees to secure, at or before the time of execution of this Agreement, the following insurance covering all operations, goods or services provided pursuant to this Agreement. Contractor shall keep the required insurance coverage in force at all times during the term of the Agreement, including any extension thereof, during any warranty period and for three (3) years after termination of the Agreement. The required insurance shall be underwritten by an insurer licensed or authorized to do business in Colorado and rated by A.M. Best

Company as “A-VIII" or better. Each policy shall require notification to the City in the event any of the required policies be canceled or non-renewed before the expiration date thereof. Such written notice shall be sent to the parties identified in the Notices section of this Agreement. Such notice shall reference the City contract number listed on the signature page of this Agreement. Said notice shall be sent thirty (30) days prior to such cancellation or non-renewal unless due to non-payment of premiums for which notice shall be sent ten (10) days prior. If such written notice is unavailable from the insurer, Contractor shall provide written notice of cancellation, non-renewal and any reduction in coverage to the parties identified in the Notices section by certified mail, return receipt requested within three (3) business days of such notice by its insurer(s) and referencing the City’s contract number. Contractor shall be responsible for the payment of any deductible or self-insured retention. The insurance coverages specified in this Agreement are the minimum requirements, and these requirements do not lessen or limit the liability of the Contractor. The Contractor shall maintain, at its own expense, any additional kinds or amounts of insurance that it may deem necessary to cover its obligations and liabilities under this Agreement.

b. Proof of Insurance: Contractor may not commence services or work relating to this Agreement prior to placement of coverages required under this

Agreement. Contractor certifies that the certificate of insurance attached as Exhibit C, preferably an ACORD form, complies with all insurance requirements of this

Agreement. The City requests that the City’s contract number be referenced on the certificate of insurance. The City’s acceptance of a certificate of insurance or other proof of insurance that does not comply with all insurance requirements set forth in this

Agreement shall not act as a waiver of Contractor’s breach of this Agreement or of any https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx of the City’s rights or remedies under this Agreement. The City’s Risk Management

Office may require additional proof of insurance, including but not limited to policies and endorsements.

c. Additional Insureds: For commercial general liability, excess/umbrella liability (if required), auto liability, Contractor’s and subcontractor’s insurer shall include the City and County of Denver, its elected and appointed officials, employees and volunteers as additional insured.

d. Waiver of Subrogation: For all coverages required under this Agreement, [with the exception of Professional Liability], Contractor’s insurer shall waive subrogation rights against the City.

e. Subcontractors and Sub-consultants: Contractor shall confirm and document that all subcontractors and subconsultants (including independent contractors, suppliers or other entities providing goods or services required by this

Agreement) procure and maintain coverage as approved by the Contractor and appropriate to their respective primary business risks considering the nature and scope of services provided.

f. Workers’ Compensation/Employer’s Liability Insurance: Contractor shall maintain the coverage as required by statute for each work location and shall maintain Employer’s Liability insurance with limits of $100,000 per occurrence for each bodily injury claim, $100,000 per occurrence for each bodily injury caused by disease claim, and $500,000 aggregate for all bodily injuries caused by disease claims.

g. Commercial General Liability: Contractor shall maintain a Commercial

General Liability insurance policy with minimum limits of $1,000,000 for each bodily injury and property damage occurrence, $2,000,000 products and completed operations aggregate (if applicable), and $2,000,000 policy aggregate.

h. Automobile Liability: Contractor shall maintain Business Automobile

Liability with limits of $1,000,000 combined single limit applicable to all owned, hired and non-owned vehicles used in performing services under this Agreement.

i. Professional Liability (Errors & Omissions): Contractor shall maintain minimum limits of $1,000,000 per claim and $1,000,000 policy aggregate limit. The policy shall be kept in force, or a Tail policy placed, for three (3) years for all contracts https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx except construction contracts for which the policy or Tail shall be kept in place for eight (8) years.

j. Technology Errors & Omissions including Cyber Liability: Contractor shall maintain Technology Errors and Omissions insurance including cyber liability, network security, privacy liability and product failure coverage with minimum limits of $1,000,000 per occurrence and $1,000,000 policy aggregate. The policy shall be kept in force, or a Tail policy placed, for three (3) years.

10. DEFENSE AND INDEMNIFICATION:

a. Under the Charter of the City and County of Denver Article VI, the City

Attorney is the only officer which may provide for the legal representation of the City. It is fundamental that only the City Attorney manage the legal representation and that the Contractor has no obligation to manage the representation or legal defense of the City. Additionally, the

American Institute of Certified Public Accountants, Inc. asserts at 1.228.020 an “Independence

Rule” that their member must be free of any and all influences that might compromise objective judgment which could be tainted if required without adequate safeguards to pay for the wrongdoings of a client. The requirements of both parties are intended to be complied with in this

Section 10. Contractor agrees to indemnify and hold harmless City and its appointed and elected officials, agents and employees for, from and against all liabilities, claims, and damages to the City

(“Claims”) arising out of or resulting from any negligent or intentionally tortious acts or omissions in connection with the professional services performed under this Agreement, to the extent caused by Contractor, its employees, agents, or subcontractors. Contractor is not obligated under this section to indemnify City for the negligent acts of City or any of its officials, agents, or employees.

b. If arising out of or resulting from Contractor’s negligent or intentionally tortious acts or omissions, Contractor’s duty to pay for the defense and pay to indemnify City shall arise at the time written notice of the Claim is first provided to City regardless of whether Claimant has filed suit on the Claim. Contractor’s duty to pay to defend and pay to indemnify City shall arise even if City is the only party sued by claimant.

c. If arising out of or resulting from Contractor’s negligent or intentionally tortious acts or omissions, Contractor shall pay for the defense of any and all Claims which may be brought or threatened against City and shall pay on behalf of City any expenses incurred by https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx reason of such Claims including, but not limited to, court costs and attorney fees incurred in defending and investigating such Claims or seeking to enforce this payment in the nature of indemnity obligation. Such payments on behalf of City will be in addition to any other legal remedies available to City and will not be the City’s exclusive remedy.

d. In meeting the Contractor’s payment obligations under this Section 10, the

City will not object to the Contractor seeking to satisfy the obligation through insurance in whole or in part. Insurance coverage requirements specified in this Agreement in no way lessen or limit the liability of the Contractor under the terms of this Section 10 payment obligation. The

Contractor is responsible to obtain, at its own expense, any additional insurance that it deems necessary for the City’s protection.

e. This defense and indemnification obligation shall survive the expiration or termination of this Agreement.

11. TAXES, CHARGES AND PENALTIES: The City is not liable for the payment of taxes, late charges or penalties of any nature, except for any additional amounts that the City may be required to pay under the City’s prompt payment ordinance D.R.M.C. § 20-107, et seq.

The Contractor shall promptly pay when due, all taxes, bills, debts and obligations it incurs performing the services under the Agreement and shall not allow any lien, mortgage, judgment or execution to be filed against City property.

12. ASSIGNMENT; SUBCONTRACTING: The Contractor shall not voluntarily or involuntarily assign any of its rights or obligations, or subcontract performance obligations, under this Agreement without obtaining the Denver Auditor’s prior written consent. Any assignment or subcontracting without such consent will be ineffective and void, and will be cause for termination of this Agreement by the City. The Denver Auditor has sole and absolute discretion whether to consent to any assignment or subcontracting, or to terminate the Agreement because of unauthorized assignment or subcontracting. In the event of any subcontracting or unauthorized assignment: (i) the Contractor shall remain responsible to the City; and (ii) no contractual relationship shall be created between the City and any sub-consultant, subcontractor or assign.

13. COLORADO GOVERNMENTAL IMMUNITY ACT: In relation to the

Agreement, the City is relying upon and has not waived the monetary limitations and all other rights, immunities and protection provided by the Colorado Governmental Act, C.R.S. § 24-10-

101, et seq.

https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx

14. INUREMENT: The rights and obligations of the parties to the Agreement inure to the benefit of and shall be binding upon the parties and their respective successors and assigns, provided assignments are consented to in accordance with the terms of the Agreement.

15. NO THIRD PARTY BENEFICIARY: Enforcement of the terms of the

Agreement and all rights of action relating to enforcement are strictly reserved to the parties.

Nothing contained in the Agreement gives or allows any claim or right of action to any third person or entity. Any person or entity other than the City or the Contractor receiving services or benefits pursuant to the Agreement is an incidental beneficiary only.

16. NO AUTHORITY TO BIND CITY TO CONTRACTS: The Contractor lacks any authority to bind the City on any contractual matters. Final approval of all contractual matters that purport to obligate the City must be executed by the City in accordance with the City’s Charter and the Denver Revised Municipal Code.

17. SEVERABILITY: Except for the provisions of the Agreement requiring appropriation of funds and limiting the total amount payable by the City, if a court of competent jurisdiction finds any provision of the Agreement or any portion of it to be invalid, illegal, or unenforceable, the validity of the remaining portions or provisions will not be affected, if the intent of the parties can be fulfilled.

18. CONFLICT OF INTEREST:

a. No employee of the City shall have any personal or beneficial interest in the services or property described in the Agreement. The Contractor shall not hire, or contract for services with, any employee or officer of the City that would be in violation of the City’s Code of

Ethics, D.R.M.C. §2-51, et seq. or the Charter §§ 1.2.8, 1.2.9, and 1.2.12.

b. The Contractor shall not engage in any transaction, activity or conduct that would result in a conflict of interest under the Agreement. The Contractor represents that it has disclosed any and all current or potential conflicts of interest. A conflict of interest shall include transactions, activities or conduct that would affect the judgment, actions or work of the Contractor by placing the Contractor’s own interests, or the interests of any party with whom the Contractor has a contractual arrangement, in conflict with those of the City. The City, in its sole discretion, will determine the existence of a conflict of interest and may terminate the Agreement if it determines a conflict exists, after it has given the Contractor written notice describing the conflict.

https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx

19. NOTICES: All notices required by the terms of the Agreement must be hand delivered, sent by overnight courier service, mailed by certified mail, return receipt requested, or mailed via United States mail, postage prepaid, if to Contractor at the address first above written, and if to the City at:

Denver Auditor or Designee 201 W. Colfax Ave., Dep’t. 705 Denver, CO 80202 With a copy of any such notice to:

Denver City Attorney’s Office 1437 Bannock St., Room 353 Denver, Colorado 80202

Notices hand delivered or sent by overnight courier are effective upon delivery. Notices sent by certified mail are effective upon receipt. Notices sent by mail are effective upon deposit with the

U.S. Postal Service. The parties may designate substitute addresses where or persons to whom notices are to be mailed or delivered. However, these substitutions will not become effective until actual receipt of written notification.

20. GOVERNING LAW; VENUE: The Agreement will be construed and enforced in accordance with applicable federal law, the laws of the State of Colorado, and the Charter, Revised Municipal Code, ordinances, regulations and Executive Orders of the City and County of

Denver, which are expressly incorporated into the Agreement. Unless otherwise specified, any reference to statutes, laws, regulations, charter or code provisions, ordinances, executive orders, or related memoranda, includes amendments or supplements to same. Venue for any legal action relating to the Agreement will be in the District Court of the State of Colorado, Second Judicial

District (Denver District Court).

21. NO DISCRIMINATION IN EMPLOYMENT: I In connection with the performance of work under the Agreement, the Contractor may not refuse to hire, discharge, promote, demote, or discriminate in matters of compensation against any person otherwise qualified, solely because of race, color, religion, national origin, ethnicity, citizenship, immigration status, gender, age, sexual orientation, gender identity, gender expression, marital status, source of income, military status, protective hairstyle, or disability. The Contractor shall insert the foregoing provision in all subcontracts.

22. COMPLIANCE WITH ALL LAWS:

https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx

a. Contractor shall perform or cause to be performed all services in full compliance with all applicable laws, rules, regulations and codes of the United States, the State of Colorado; and with the Charter, ordinances, rules, regulations and Executive Orders of the City and County of

Denver.

b. [Where the source of the funds, directly or indirectly for this Agreement is the Federal

Government, the Contractor shall be responsible for determining which of the following terms are applicable to its products and/or services and agrees to the applicable provisions:

(1) Equal Employment Opportunity Compliance: Contractor agrees to comply with Executive Order 11246 of September 24, 1965, entitled

“Equal Employment Opportunity,” as amended by Executive Order

11375 of October 13, 1967, and as supplemented in Department of Labor regulations (41 CFR Part 60);

(2) Davis-Bacon Act Compliance: Contractor agrees to comply with the

Davis-Bacon Act (40 U.S.C. 3148 to 3148) as supplemented by

Department of Labor regulations (29 CFR part 5);

(3) Anti-Kickback Act Compliance: Contractor agrees to comply with the

Copeland “Anti-Kickback” Act (18 U.S.C. 874) as supplemented in

Department of Labor regulations (29 CFR Part 3);

(4) Contract Work Hours and Safety Standards: Contractor agrees to comply with Sections 102 and 107 of the Contract Work Hours and Safety

Standards Act (40 U.S.C. 327-333), as supplemented by Department of

Labor regulations (29 CFR part 5);

(5) Rights to Inventions Made Under a Contract or Agreement: Contractor agrees to comply with 37 CFR part 401, "Rights to Inventions Made by

Nonprofit Organizations and Small Business Firms Under Government

Grants, Contracts and Cooperative Agreements," and any implementing regulations issued by the awarding agency;

(6) Clean Air and Water Requirements: Contractor agrees to comply with all applicable standards, orders, or requirements issued under the Clean

Air Act (42 U.S.C. 7401 et. seq.), and the Clean Water Act (33 U.S.C.

1251 et. seq.). Contractor agrees to report each violation of these https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx requirements to the City and understands and agrees that the City will, in turn, report each violation as required to the appropriate EPA regional office;

(7) Energy Conservation Requirements: The Contractor agrees to comply with mandatory standards and policies relating to energy efficiency which are contained in the state energy conservation plan issued in compliance with the Energy Policy and Conservation Act. (42 U.S.C.

6201);

(8) No Suspension or Debarment: Contractor certifies that neither it nor its

Principals or any of its subcontractors is presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from participation in this Agreement by any Federal department or agency; and

(9) Byrd Anti-Lobbying: If the Maximum Contract Amount exceeds

$100,000, the Contractor must complete and submit to the City a required certification form provided by the City certifying that it will not and has not used Federal appropriated funds to pay any person or organization for influencing or attempting to influence an officer or employee of any agency, a member of Congress in connection with obtaining any Federal contract grant of any other award covered by 31

U.S.C. 1352. Contractor must also disclose any lobbying with non-

Federal funds that takes place in connection with obtaining any Federal award.]

23. COMPLIANCE WITH DENVER WAGE LAWS: To the extent applicable to the Contractor’s provision of Services hereunder, the Contractor shall comply with, and agrees to be bound by, all rules, regulations, requirements, conditions, and City determinations regarding the City’s Minimum Wage and Civil Wage Theft Ordinances, Sections 58-1 through 58-26

D.R.M.C., including, but not limited to, the requirement that every covered worker shall be paid all earned wages under applicable state, federal, and city law in accordance with the foregoing

D.R.M.C. Sections. By executing this Agreement, the Contractor expressly acknowledges that the

Contractor is aware of the requirements of the City’s Minimum Wage and Civil Wage Theft https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx

Ordinances and that any failure by the Contractor, or any other individual or entity acting subject to this Agreement, to strictly comply with the foregoing D.R.M.C. Sections shall result in the penalties and other remedies authorized therein.

24. LEGAL AUTHORITY: Contractor represents and warrants that it possesses the legal authority, pursuant to any proper, appropriate and official motion, resolution or action passed or taken, to enter into the Agreement. Each person signing and executing the Agreement on behalf of Contractor represents and warrants that the signer has been fully authorized by Contractor to execute the Agreement on behalf of Contractor and to validly and legally bind Contractor to all the terms, performances and provisions of the Agreement. The City shall have the right, in its sole discretion, to either temporarily suspend or permanently terminate the Agreement if there is a dispute as to the legal authority of either Contractor or the person signing the Agreement to enter into the Agreement.

25. NO CONSTRUCTION AGAINST DRAFTING PARTY: The parties and their respective counsel have had the opportunity to review the Agreement, and the Agreement will not be construed against any party merely because any provisions of the Agreement were prepared by a particular party.

26. ORDER OF PRECEDENCE: In the event of any conflicts between the language of the Agreement and the exhibits, the language of the Agreement controls.

27. INTELLECTUAL PROPERTY RIGHTS: The City and Contractor intend that all property rights to any and all materials, text, logos, documents, booklets, manuals, references, guides, brochures, advertisements, music, sketches, plans, drawings, prints, photographs, specifications, software, data, products, ideas, inventions, and any other work or recorded information created by the Contractor and paid for by the City pursuant to this Agreement, in preliminary or final forms and on any media whatsoever (collectively, “Materials”), shall belong to the City. The Contractor shall disclose all such items to the City. To the extent permitted by the U.S. Copyright Act, 17 USC § 101, et. seq., the Materials are a “work made for hire” and all ownership of copyright in the Materials shall vest in the City at the time the Materials are created.

To the extent that the Materials are not a “work made for hire,” the Contractor hereby sells, assigns and transfers all right, title and interest in and to the Materials to the City, including the right to secure copyright, patent, trademark, and other intellectual property rights throughout the world https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx and to have and to hold such copyright, patent, trademark and other intellectual property rights in perpetuity.

28. SURVIVAL OF CERTAIN PROVISIONS: The terms of the Agreement and any exhibits and attachments that by reasonable implication contemplate continued performance, rights, or compliance beyond expiration or termination of the Agreement survive the Agreement and will continue to be enforceable. Without limiting the generality of this provision, the

Contractor’s obligations to provide insurance and to indemnify the City will survive for a period equal to any and all relevant statutes of limitation, plus the time necessary to fully resolve any claims, matters, or actions begun within that period.

29. ADVERTISING AND PUBLIC DISCLOSURE: The Contractor shall not include any reference to the Agreement or to services performed pursuant to the Agreement in any of the Contractor’s advertising or public relations materials without first obtaining the written approval of the Denver Auditor. Any oral presentation or written materials related to services performed under the Agreement will be limited to services that have been accepted by the City.

The Contractor shall notify the Denver Auditor in advance of the date and time of any presentation.

Nothing in this provision precludes the transmittal of any information to City officials.

30. CONFIDENTIAL INFORMATION:

a. City Information: Contractor acknowledges and accepts that, in performance of all work under the terms of this Agreement, Contractor may have access to Proprietary Data or confidential information that may be owned or controlled by the City, and that the disclosure of such Proprietary Data or information may be damaging to the City or third parties. Contractor agrees that all Proprietary Data or confidential information provided or otherwise disclosed by the

City to Contractor shall be held in confidence and used only in the performance of its obligations under this Agreement. Contractor shall exercise the same standard of care to protect such

Proprietary Data and information as a reasonably prudent Contractor would to protect its own proprietary or confidential data. “Proprietary Data” shall mean any materials or information which may be designated or marked “Proprietary” or “Confidential”, and shall include protected and sensitive data as set forth in §§ 24-73-101and 6-1-716(1)(g)(I)(A), C.R.S., as amended that are not otherwise in the public domain (except as a result of a breach of confidentiality), or which would not be documents subject to disclosure pursuant to the Colorado Open Records Act or City ordinance, and provided or made available to Contractor by the City. Such Proprietary Data may https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx be in hardcopy, printed, digital or electronic format. The Contractor shall request written approval from the City prior to any Services using, transmitting, and maintaining City Data outside of the

United States. Written approval for the transmission of Data outside of the United States must be signed by both the City’s Chief Information Officer and by the Auditor. The City may approve or deny such request within the City’s sole discretion.

For the purposes of this Agreement the following definitions shall apply:

(1) “City Data” means all information, data, and records, regardless of form, created by or in any way originating with the City and all information that is the output of any computer processing or other electronic manipulation including all records relating to the City’s use of the Work. City Data also includes Confidential Information and

Protected Information, as defined in this Agreement.

(2) “Confidential Information” is described in subparagraph c below and additionally means all information or data, regardless of form, not subject to disclosure under the Colorado Open Records Act, § 24-72-

201, et seq., C.R.S. (“CORA”), and is marked or identified at the time of disclosure as being confidential, proprietary, or its equivalent.

(3) “D(d)ata” means information, regardless of form, that can be read, transmitted, or processed.

(4) “Protected Information” means data, regardless of form, that has been designated as sensitive, private, proprietary, protected, or confidential by law, policy, or the City. Protected Information includes, but is not limited to, employment records, protected health information, student and education records, criminal justice information, personal financial records, research data, trade secrets, classified government information, other regulated data, and personally identifiable information as defined by §§ 24-73-101(4)(b) and 6-1-716(1)(g)(I)(A), C.R.S., as amended.

Protected Information shall not include public records that by law must be made available to the public under CORA. To the extent there is any uncertainty as to whether data constitutes Protected Information, the data in question shall be treated as Protected Information until a https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx determination is made by the City or an appropriate legal authority.

b. Use of Proprietary Data or Confidential Information:

(i) Except as expressly provided by the terms of this Agreement, Contractor agrees that it shall not disseminate, transmit, license, sublicense, assign, lease, release, publish, post on the internet, transfer, sell, permit access to, distribute, allow interactive rights to, or otherwise make available the Proprietary Data or Confidential

Information or any part thereof to any other person, party or entity in any form of media for any purpose other than performing its obligations under this Agreement. Contractor further acknowledges that by providing this Proprietary Data or Confidential Information, the City is not granting to Contractor any right or license to use such data except as provided in this Agreement. Contractor further agrees not to disclose or distribute to any other party, in whole or in part, the Proprietary Data or confidential information without written authorization from the Manager.

(ii) Contractor agrees, with respect to the Proprietary Data and

Confidential Information, that: (1) Contractor shall not copy, recreate, reverse engineer or decompile such data, in whole or in part, unless authorized in writing by the Manager; (2)

Contractor shall retain no copies, recreations, compilations, or decompilations, in whole or in part, of such data; and (3) Contractor shall, upon the expiration or earlier termination of the Agreement, destroy (and, in writing, certify destruction) or return all such data or work products incorporating such data or information to the City.

(iii) At its reasonable discretion, the City may prohibit the Contractor from the use of certain software programs, databases, and computing systems with known vulnerabilities to collect, use, process, store, or generate data and information received under this Agreement. The Contractor shall fully comply with all requirements and conditions, if any, associated with the use of software programs, databases, and computing systems as reasonably directed by the City. The Contractor shall not use funds paid by the

City for the acquisition, operation, or maintenance of software in violation of any copyright laws or licensing restrictions. The Contractor shall maintain commercially reasonable network security that, at a minimum, includes network firewalls, intrusion detection/prevention, and enhancements or updates consistent with evolving industry standards The Contractor shall use industry-standard and up-to-date security tools, https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx technologies and procedures including, but not limited to, anti-virus and anti-malware protections. The Contractor shall ensure that any underlying or integrated software employed under this Agreement is updated on a regular basis and does not pose a security threat. The Contractor shall provide a software bill of materials (“SBOM”) annually or upon major changes to the solution(s) provided to the City under this Agreement. The

Contractor shall provide a complete SBOM for the supported life of the solution(s). The

Contractor shall monitor for security vulnerabilities in applicable software components and use a risk-based approach to mitigate any vulnerabilities.

c. Safeguarding City Confidential Information. “Confidential Information” includes, but is not limited to, employment records, protected health information, student and education records, criminal justice information, personal financial records, research data, trade secrets, classified government information, other regulated data, and personally identifiable information. Confidential Information also includes, without limitation, any information maintained by the City about an individual that can be used to distinguish or trace an individual’s identity, including, but not limited to, first and last name, residence or other physical address, banking information, electronic mail address, telephone number, credit card information, an official government-issued driver’s license or identification card number, social security number or tax identification number, date and place of birth, mother’s maiden name, or biometric records.

Confidential Information includes, but is not limited to, all information defined as personally identifiable information in §§ 24-73-101, C.R.S. Confidential Information shall also include

“personal information” as defined in § 24-73-103(1)(g), C.R.S. To the extent there is any uncertainty as to whether data constitutes Confidential Information, the data in question shall be treated as Confidential Information until a determination is made by the City or an appropriate legal authority. The Contractor shall only use, hold, and maintain Confidential Information in facilities located within the United States or located outside of the United States when approval has been provided by the City’s Technology Services agency upon completion of required security reviews. Disclosure of Confidential Information does not include disclosure to a third party under circumstances where the City retains primary responsibility for implementing and maintaining reasonable security procedures and practices appropriate to the nature of the Confidential

Information, and the City implements and maintains technical controls reasonably designed to safeguard Confidential Information from unauthorized access, modification, disclosure, or https://denvercity-my.sharepoint.com/personal/matt_monaghan_denvergov_org/Documents/Documents/MM/RFPs/Cybersecurity Audit_WSS_32/Attachment A - Sample Agreement.docx destruction or effectively eliminate the third party's ability to access Confidential Information, notwithstanding the third party's physical possession of Confidential Information. If the Contractor has been contracted to maintain, store, or process personal information on the City’s behalf, the

Contractor is a “Third-Party Service Provider” as defined by § 24-73-103(1)(i), C.R.S. and shall maintain security procedures and practices consistent with §§ 24-73-101, et seq., C.R.S. In addition, as set forth in § 28-251, D.R.M.C., the Contractor, including, but not limited to, the

Contractor’s employees, agents, and Subcontractors, shall not collect or disseminate individually identifiable information about the national origin, immigration, or citizenship status of any person, over and above the extent to which the City is required to collect or disseminate such information in accordance with any federal, state, or local law.

d. Data Retention, Transfer, Litigation Holds, and Destruction. Using appropriate and reliable storage media, the Contractor shall regularly backup data used in connection with this Agreement and retain such backup copies consistent with the City’s data and record retention policies. All City Data shall be encrypted in transmission, including by web interface, and in storage by an agreed upon National Institute of Standards and Technology

(“NIST”) approved strong encryption method and standard. The Contractor shall not transfer or maintain data under this Agreement outside of the United States without the City’s express written permission. Upon termination of this Agreement, the Contractor shall securely delete or securely transfer all data, including Protected Information, to the City in an industry standard format as directed by the City; however, this requirement shall not apply to the extent the Contractor is required by law to retain data, including Protected Information. Upon the City’s request, the

Contractor shall confirm, by providing a certificate, the data disposed of, the date disposed of, and the method of disposal. With respect to any data in the Contractor’s exclusive custody, the

City may request, at no additional cost to the City, that the Contractor preserve such data outside of record retention policies. The City will promptly coordinate with the Contractor regarding the preservation and disposition of any data and records relevant to any current or anticipated litigation, and the Contractor shall continue to preserve the records until further notice by the

City. Unless otherwise required by law or regulation, when paper or electronic documents are no longer needed, the Contractor shall destroy or arrange for the destruction of such documents within its custody or control that contain Protected Information by shredding,…