Attachment A_Sample Contract~1.docx

RFQ BVA S-44000-00016305 – Penetration Testing

ATTACHMENT A

Sample Contract

Work Order Contract Form

MSA# XXXX Work Order Contract #_____________

This Work Order Contract #_______ (“Work Order Contract” or “WOC”) is entered between the State of Oregon, acting through its Department of Consumer and Business Services (“Authorized Purchaser” or “DCBS”), and ______ (“Consultant”).

I. Recitals

1. Authorized Purchaser desires to engage Consultant to perform Services to enable Authorized Purchaser to achieve specific business and governing entity mission objectives.

2. Consultant desires to perform Services for Authorized Purchaser.

II. Agreement

In consideration of the foregoing recitals and the mutual terms and conditions set forth below, Authorized Purchaser and Consultant agree as follows:

1. This WOC is entered pursuant to, and is subject to, the MSA.

2. WOC Documents and Order of Precedence. MSA Exhibit A, Contract Terms and Conditions and Exhibit No. 1, Statement of Work, are incorporated and apply to this WOC by reference. If a conflict, inconsistency or ambiguity arises in WOC interpretation, this WOC must be interpreted in the following order of precedence:

2.1. WOC less MSA Exhibit A;

2.2. MSA Exhibit A;

2.3. Exhibit No. 1, Statement of Work.

3. Effective Date and Term. This WOC is effective on the later of (i) ______, or (ii) the date that it has been executed by Authorized Purchaser and Consultant, and has been approved as required by applicable law (“Effective Date”). Unless terminated or extended, this WOC will expire on _________________________. WOC expiration does not extinguish or prejudice Authorized Purchaser’s right to enforce this WOC with respect to any breach of a Consultant warranty or any default or defect in Consultant performance that has not been cured.

4. Services; Performance Standards and Metrics. Consultant shall perform the Services and deliver to Authorized Purchaser the deliverables (“Deliverables”) set forth in Exhibit No. 1, the Statement of Work (the “Statement of Work”). The Statement of Work includes the delivery and payment schedule for the Services, and Deliverables. Consultant shall perform the Services according to the terms and conditions of this Work Order Contract. In its provision of the Services, Consultant shall meet the performance standards and metrics as set forth in MSA Exhibit E and in Exhibit No. 1, Statement of Work. Consultant shall provide, maintain, and upgrade any hardware and related equipment, and software provided by Consultant and required for delivery and operation of the Services used in the provision of the Services.

5. Compensation, Invoices and Payment Methodology.

5.1 The maximum not-to-exceed compensation payable to Consultant under this WOC, which includes allowable expenses is _________________________ ($__________). Authorized Purchaser will not pay Consultant any amount in excess of the not-to-exceed compensation of this WOC and will not pay for Services performed before the Effective Date or after expiration or termination of this WOC. If the maximum compensation is increased by amendment of this WOC, the amendment must be fully effective before Consultant performs the Services subject to the amendment.

5.2. Consultant shall send all invoices to:

5.3. Authorized Purchaser shall pay Consultant for Services and Deliverables as set forth in Exhibit No. 1.

5.4. Authorized Purchaser will not pay or reimburse any expenses incurred by Consultant during the completion of the Services except as authorized in the Statement of Work or elsewhere in this Contract. Any such authorized travel expenses must comply with the Oregon Travel Policy available on the Internet at: http://www.oregon.gov/das/cfo/sars/policies/oam/40.10.00.pdf

6. WOC Authorized Representatives and Key Persons. The following individuals are Authorized Representatives or Key Persons under this WOC:

7. Consultant Data. As a condition precedent to the effectiveness of this Work Order Contract, Consultant shall provide all information requested below. Authorized Purchaser will report this information to the Internal Revenue Service (“IRS”) under the name and taxpayer identification number provided. (See IRS 1099 for additional instructions regarding taxpayer identification numbers.) Information not matching IRS records could subject Consultant to thirty-one percent (31%) backup withholding.

Name (tax filing):

Address:

Citizenship: Non-resident alien Yes No

Business Designation (check one):

Corporation Partnership Limited Liability Company

Limited Liability Partnership Sole Proprietorship Limited Partnership

Federal Tax ID#: or Social Security No.:

(These numbers are requested pursuant to ORS 305.385 and OAR 150-305.100.)

8. Tax Certification. The individual signing on behalf of Consultant hereby certifies and swears under penalty of perjury to the best of the individual’s knowledge that: that for a period of at least six (6) years prior to the WOC Effective Date, Consultant has complied with the tax laws of this state and the applicable tax laws of any political subdivision of this state. Any violation shall entitle Authorized Purchaser to terminate this WOC, to pursue and recover any and all damages that arise from the breach and the termination of this WOC, and to pursue any or all of the remedies available under this WOC, at law, or in equity, including but not limited to:

· Termination of this WOC, in whole or in part;

· Exercise of the right of setoff, and withholding of amounts otherwise due and owing to Consultant, in an amount equal to State’s setoff right, without penalty; and

· Initiation of an action or proceeding for damages, specific performance, declaratory or injunctive relief. Authorized Purchaser shall be entitled to recover any and all damages suffered as the result of Consultant's breach of this WOC, including but not limited to direct, indirect, incidental and consequential damages, costs of cure, and costs incurred in securing replacement Services or replacement consultant or any of the above.

These remedies are cumulative to the extent the remedies are not inconsistent, and Authorized Purchaser may pursue any remedy or remedies singly, collectively, successively, or in any order whatsoever.

Authorized Signatures:

Consultant

By: ______________________________________________ [signature]

____________________________________________ Date: ___________ [print name]

Title: __________________________________________

Authorized Purchaser

By: ______________________________________________ [signature]

___________________________________________ Date: ___________ [print name]

Title: _________________________________________

Approved for legal sufficiency pursuant to ORS 291.047 and OAR 137-045-0030

Oregon Department of Justice

Exhibit No. 1 to Work Order Contract Sample Statement of Work

Part I. General Information and Overview

The Oregon Department of Consumer and Business Services (“DCBS” or “Client”) is Oregon’s largest consumer protection and business regulatory agency. DCBS is a resource to consumers and businesses in areas involving building safety, finance, and workplace health and safety.

The goal is to identify exploitable vulnerabilities, validate existing security controls, and provide actionable remediation guidance to reduce organizational risk.

Definitions:

“CVSS” means Common Vulnerability Scoring System “CIS” means Center for Internet Security “NIST” means National Institute of Standards and Technology

Acceptance Process for Deliverables:

1. Agency shall inspect and either accept or reject each deliverable within ten (10) calendar days from the date Contractor delivers the deliverable to Agency. If Agency does not provide written notice of acceptance or rejection of the deliverable to Contractor within ten (10) calendar days following the date of delivery, Agency is deemed to have accepted the deliverable. If Agency rejects the deliverable, then Agency’s written notice of rejection shall, at a minimum, itemize the apparent defects and include:

a. a description of nonconformance between the deliverables and the Contract requirements and specifications for that deliverable,

b. a description of any other nonconformance of the deliverable, and

c. a statement indicating whether Contractor may cure the nonconformance and if so, the method in which and time period within which Contractor shall cure.

Contractor’s failure to deliver the deliverables in accordance with the requirements of this Contract is a material breach of this Contract.

Assumptions

· All work must be completed by June 30, 2026.

· Contract will provide all material used to perform penetration testing.

Part II. Tasks and Deliverables

A. Tasks and Deliverables

Consultant shall evaluate Agency’s vulnerabilities by performing penetration testing using the following exploits:

· Social Engineering,

· Service Desk Exploit

· Phishing

· Web Services

· Physical Pentest

· Network Access

· Wi-Fi

· On-Lan Wi-Fi

· Hot Network Jack

· Device Security

· Employee Laptop

Task No. 1:

Rules of Engagement Document

Task No. 1 Deliverables:

Deliverable 1.1: Rules of engaging document outlining how the vendor will intend to perform the pentation testing.

Deliverable Schedule:

Task No. 2:

Executive Summary

Task No. 2 Deliverables:

Deliverable 2.1: Executive summary suitable to leadership following penetration testing

Task No. 3:

Detailed Technical Report

Task No. 3 Deliverables:

Deliverable 3.1: Detailed Technical Report that includes:

· Description of the findings of the penetration testing

· Risk Rating (CVSS or equivalent standard)

· Affected Systems

· Clear remediation recommendations

Task No. 4:

Mapping of findings to security frameworks

Task No. 4 Deliverables:

Deliverable 4.1: Mapping of findings to security frameworks (CIS Controls, NIST)

TBD

Task No. 5:

Post-engagement debrief session

Task No. 5 Deliverables:

Deliverable 5.1: Post-engagement debrief session hosted by Consultant

TBD

B. RESPONSIBILIES OF AUTHORIZED PURCHASER

(1) Authorized Purchaser's obligations set forth in this WOC shall be performed by Authorized Purchaser in a timely and proper fashion in accordance with the Installation Schedule, or as otherwise agreed upon between the Parties, to allow Consultant to timely perform its obligations under this WOC.

(2) In addition, Authorized Purchaser shall also have the following additional obligations:

Duties TBD

Part IV. Payment Provisions.

Contractor shall prepare invoice(s) as follows:

2. Contractor shall submit invoices, no more than once monthly, electronically via email to the following address:

a. Authorized Agency Name: DCBS

3. Each invoice must state:

a. Contract number: PO-44000-000XXXXX

b. A detailed description of Services performed.

c. Date(s) Services were performed.

d. Rate(s) for Services performed.

e. The total amount due and the payment address.

f. Contractor shall submit an invoice requesting payment for all deliverables completed in the month prior to the invoice issue date. Contractor’s claims to Authorized Agency for overdue payments on invoices are subject to ORS 293.462.

If Contractor fails to present invoices in proper form within sixty (60) calendar days after the end of the month in which Services were rendered, Contractor waives any rights to present such invoice thereafter and to receive payment therefor.

Any overdue payments to Contractor by Authorized Agency for an approved invoice are subject to ORS 293.462.

Payment will be made to Contractor no later than 45 calendar days from receipt of invoice completed in conformance with all contractual requirements. Authorized Agency will endeavor to notify Contractor within 10 business days of receipt of invoice regarding any necessary revisions or corrections to the invoice. If revisions are necessary, payment will be made no later than 45 calendar days from receipt of the revised invoice. Any interest for overdue payment will be in conformance with Oregon law.

Part V. Travel and Other Expenses.

Unless otherwise agreed, Authorized Purchaser will not reimburse Consultant travel or other expenses, unless Authorized Purchaser has preapproved expenses and only pursuant to the Oregon Accounting Manual: http://www.oregon.gov/das/Financial/Acctng/Documents/40.10.00.pdf