Attachment_E_-_Exhibits_1_-_3.pdf

EXHIBIT 1

Information Security Requirements & Information Requests for RFPs 5/2/2019

If a hybrid or a cloud solution is proposed the vendor agrees to:

• Adhere to the TERMS & CONDITIONS PRINCIPLES FOR A CLOUD-HOSTED SOLUTION

• Complete the Security Questionnaire for Hosted Vendor Solutions

• Consent to Internet Security Reputation Monitoring services. If a vendor’s reputation score drops below a medium level, the agreement may be subject to change.

The vendor shall supply the following information for their solution and any third-party associated technology integrated into the solution:

1. Personnel Security

1.1. Before being granted access to OUC data, personnel shall complete an OUC background check.

1.2. Personnel developing, administering, and managing the solution technologies shall have information security-appropriate training. Provide details, including completion dates of this training for all applicable personnel.

2. Asset management

2.1. List the make, model, version of the technology solution components.

2.2. Define the integrations required and the association to the components listed above.

3. Secure solution development and production environment management

3.1. List any in-place security frameworks in the development and production environments, such as NIST, CSC CIS, or ISO.

3.2. List in-place security-related attestations in the development and production environments.

3.3. List all security testing and security controls used for development and on-going security support of your solution.

3.4. List any standard security products supported by your solution, such as anti-malware and application whitelisting.

3.5. Describe your vulnerability management process.

3.6. Describe your security vulnerability notification policy and process.

4. Access control

4.1. Describe the access management capabilities of the proposed solution.

4.2. List the roles that the solution supports.

4.3. List in-place privileged access roles.

4.4. Describe the access required to support the solution.

4.5. Describe how the access control functions support the principles of least privilege and separation of duties.

4.6. Describe how dormant accounts are identified.

4.7. Describe the multi-factor authentication function, if applicable.

4.8. Indicate if an automated data classification function is part of the solution.

4.9. List any integrated directories services such as LDAPs or cloud services such as Okta.

5. Audit logs

5.1. Provide the types of logs included in the solution.

5.2. Indicated if an events interpretation key is available to support identification and analysis of anomalous activity.

5.3. Indicate if these logs are readily consumable by SIEMs such as Splunk.

6. Data Protections and Recovery capabilities

6.1. Describe the protections that provide data confidentiality, integrity, and availability assurance.

6.2. Indicate if detection and alerting on potential data exfiltration is included in the solution.

6.3. Describe the encryption and ciphers included for data at rest and in motion.

6.4. Describe the data recovery ability and the typical recovery timeframe.

6.5. Supply a sample data set that might be required for your solution.

7. Change management

7.1. Describe your internal change management process.

7.2. Describe the communications and timeframe for communications OUC can expect to receive on change management.

7.3. Describe the recourse available to OUC if a planned change is not acceptable.

7.4. Describe the notification OUC can expect to receive if a change causes an issue.

8. Cyber security events

8.1. Provide your breach notification policy and process.

8.2. Indicate if your organization has an incident response plan. If so, provide the plan.

Revised - February 5, 2016

TERMS & CONDITIONS PRINCIPLES

FOR A CLOUD-HOSTED SOLUTION

The following are selected principles upon which the winning bidder ("Proposer") proposes to base a cloud-hosted software solution for the Orlando Utilities Commission (OUC).

These principles reflect key topics that will need to be addressed in the resulting supply or services contract (Cloud Agreement). They are not intended to reflect final contractual language or to address every provision which the parties may incorporate into a final agreement. The specific final contractual language shall be as agreed to by the parties prior to the execution of the Cloud Agreement.

1. ACCESS TO PUBLIC RECORDS

The vast majority of OUC records and data will be considered “Public Records” under Florida Law. “Public Records” are defined in Section 119.001(12), Florida Statutes as “. . . all documents, papers, letters, maps, books, tapes, photographs, films, sound recordings, data processing software, or other material, regardless of the physical form, characteristics, or means of transmission, made or received pursuant to law or ordinance or in connection with the transaction of official business by any agency.” Any OUC data that will be hosted on a cloud-based solution provided will be subject to following requirements:

1) Protection of Data Proposer will be limited in its ability to delete OUC Public Records. If certain Public Records are found to violate Proposer’s policies, Proposed may segregate such material and make available for OUC to copy prior to any deletion.

2) Limitation of Rights and Remedies of Proposer The contract remedies of the Proposer for default of other violations of policy by OUC under the terms of the cloud-based solution proposed will be limited to the extent that OUC Public Records are stored on the Proposer’s cloud solution. The following will be considered acceptable remedies for Proposer under any such program contract:

a. Termination Subject to Access and Copying Rights. If at any time OUC is in default of otherwise not performing under the terms of the contract for the Proposer’s cloud-based solution, Proposer’s Termination remedies will be conditioned on the following:

i. OUC shall have the right to access Public Information for a defined period of time after a termination event, even where the fault is with OUC; and,

ii. OUC shall have the right to copy any such Public Records on the cloud-hosted solution for a defined period of time after termination and prior to deletion by the Proposer.

EXHIBIT 2

3) Force Majeure

Should the contract include a force majeure provision, such provision will not relieve Proposer of the duty to provide access to Public Records.

4) Governing Law

The contract for the cloud solution will acknowledge that the public records requirements and terms will be governed by Florida Law.

2. IT SECURITY REQUIREMENTS

Any cloud-based solution contract with the Proposer will be subject to specific security protocols and protections that comply with OUC’s standards for Public Records. The following security requirements and those in the entire RFP shall apply to Proposer’s cloud-based solutions.

The solution must comply with OUC’s IT standards, including the password standard and hardware/software standards.

The shortlisted vendors agree to respond fully to a detailed questionnaire on the vendor’s security controls.

prior to deletion by the Proposer.

b. Suspension Subject to Access and Copying Rights. If at any time OUC is in default of otherwise not performing under the terms of the contract for the Proposer’s cloud-based solution, Proposer’s suspension of service rights will be conditioned upon the following:

i. OUC shall have the right to access Public Records, even if OUC can’t add to the Public Records or use any of the other services offered; and,

ii. Rights of OUC to access and download the Public Records if suspension leads to termination; and,

iii. If suspension or termination result in blocking OUC access to the Public Records, then Proposer will be required to acknowledge the Proposer is assuming the role as records custodian under the Florida Statutory requirements for the preservation of Public Records; as such, there will need to be a provision for a notice process whereby OUC will provide notices and inform Proposer as the records custodian of what Public Records must be provided if requested by a member of the public; and,

iv. Proposer may not charge for access to Public Records if provided in response to a public records request under Chapter 119, Florida Statutes.

1) Data Management

a. Separation from Other Clients’ Data Data classified as privileged or private will be hosted within a separate instance on any server and not mixed with other companies’ data.

b. Encryption Data classified as privileged or private will be encrypted or otherwise significantly protected in transit, in process, and at rest.

c. Storage and Transmission Limited to North America OUC data must be stored and transmitted only within North America.

d. Backup OUC data will be backed up on a regular basis and retained according to OUC’s stated requirements. OUC data will be backed up:

Hourly Every hours Daily Weekly Monthly

e. Disposal The vendor(s) must provide a secure method for data and equipment disposal.

f. Third-Party Attestation The vendor(s) must ensure that personnel and the data center meet a minimum certification level (such as PCI, SSAE 16, ISO 27001) that demonstrates physical and logical security.

Reference the OUC Data Classification Standard for data classes, states, and high-level security requirements, Attachment G on the RFP.

2) Vendor’s Personnel Practices

Vendors or contractors accessing OUC’s network or sensitive data may be required to follow the OUC background check process.

Vendors or contractors directly (locally) accessing the OUC network will be required to use OUC systems to perform required work under its OUC agreement.

3) Compatibility

The proposed solution must be compatible with existing OUC technologies without requiring modifications to those technologies (e.g. Internet Explorer browser version 10 among other requirements). OUC will provide a list of such technologies if requested.

4) Access Control Management

a. Network and Server Layer - The solution must have the ability to limit services and ports into and out of the hosted environment(s) and OUC’s environment.

b. Application Layer - The technologies functionality will support at a minimum a three-tier access management process (i.e., super user, power user, and user).

5) Security Assurance

a. Penetration Testing - the vendor(s) must allow OUC (or an OUC-contracted service) to conduct network penetration testing on a scheduled basis.

b. Security & Health Monitoring - the vendor(s) must allow OUC (or an OUC-contracted service) to monitor the health and security status of OUC’s hosted environment on an ongoing basis.

c. Notification of Security Event – the vendor(s) will notify OUC of a potential or confirmed breach within 4 hours of the discovery.

6) Florida Information Protection Act

The Florida Information Protection Act (FIPA) Florida Statute §501.171 affects all covered entities that acquire, maintain, store or use customers’ personal information.

FIPA also makes it the responsibility of those entities to notify customers when a breach occurs, even if the breach occurs through a third-party.

FIPA expands the definition of “personal information” to include use of a person’s first name or initial and last name in combination with a SSN, driver’s license number, credit card number, account number, security code, password, or email address. Additionally, FIPA has defined “breach of security” to mean unauthorized access to personal information in the system and does not require personal information to be actually acquired before reporting mandates are triggered.

This law covers employees, customers, contractors, applicants or any other individual from whom we have acquired maintained, stored or used personal information.

Rev #8 Dated 07/28/16

ORLANDO UTILITIES COMMISSION

SOFTWARE TERMS AND CONDITIONS

GC 1.0 SOFTWARE AND LICENSE

1.1 Software. As used herein, “Software” means the computer programs identified in the applicable Schedule A attached hereto (“Schedule A”), in source code, object code or binary form or in any other form, including any related or included computer programs, whether owned by Licensor or licensed to Licensor by a third party which has authorized Licensor to sublicense such computer programs, and including any documentation or related materials concerning the application, use, training of users, theory of operation, maintenance or any other aspect of the Software.

1.2 License. In consideration of the license fee specified in the applicable Schedule A (“License Fee”), Licensor grants to OUC a perpetual nonexclusive right to use the Software described in the applicable Schedule A.

GC 2.0 SOFTWARE USE

2.1 Scope of Use. The Software may be used throughout OUC’s enterprise as described on Schedule A. OUC may use the Software to process their own data and data received from or transmitted to their suppliers, dealers and customers in connection with the businesses of OUC, as long as they do not provide data processing services to any unrelated third party similar to the services of a data processing business.

2.2 Other Systems. If Licensor has or at any time in the future enables the Software, or any portion thereof, to run on other types of CPUs or operating systems than that presently used by OUC, Licensor hereby grants to OUC a license to use and the right to obtain a copy of the Software on such CPU(s) or operating system(s) at no additional cost or license fee.

2.3 Additional Copies of Software. OUC shall have the right to make backup copies and to obtain replacement copies of the Software at no charge (except for the cost of the media and any shipping), if its copy of the Software is damaged or destroyed for any reason.

2.4 Backup and Disaster Uses. OUC may use a backup copy of the Software for general testing purposes. In emergency situations and for disaster testing, OUC may use the Software in off-site or backup computer facilities (which may be owned or operated by others) for the duration of the emergency or disaster.

2.5 Noninterference. OUC shall be entitled to use the Software without interference or disturbance, subject only to its obligation to comply with the terms of this License. Licensor represents that this License is not subject or subordinate to

EXHIBIT 3

any right of Licensor's creditors or of any other person claiming by or through Licensor.

GC 3.0 DELIVERY AND ACCEPTANCE

3.1 Delivery and Installation. The Software shall be delivered to the installation site and by the date specified on the applicable Schedule A. Unless otherwise stated in Schedule A, Licensor shall perform all installation services as required by

OUC.

3.2 Acceptance. Following successful installation and sufficient testing of the

Software by Licensor and OUC to demonstrate that the Software is performing properly, OUC shall provide Licensor with written notice of acceptance of the Software (“Acceptance”).

GC 4.0 PAYMENT OF FEES

4.1 Payment. Upon Acceptance, OUC will be invoiced for any portion of the License

Fee specified in the applicable Schedule A. Payment of all invoices will be made on a net 30 day basis.

4.2 Receipt of License. Notwithstanding the foregoing, OUC will not pay any invoice from Licensor until OUC has received a fully executed original of this License.

GC 5.0 PROPRIETARY INFORMATION

5.1 Confidentiality. In connection with this License, Licensor may from time to time have access to confidential and proprietary information ("Proprietary Information") of OUC, or of third parties who have licensed the information to OUC under an obligation of confidentiality. Licensor acknowledges that the disclosure to third parties or use by Licensor or third parties of such information will damage OUC. Except for any use by Licensor necessary for the performance of Licensor’s obligations hereunder, Licensor agrees to keep all such Proprietary Information in strict confidence, and further agrees not to disclose, use, publish, transfer, copy or otherwise make available any portion of the Proprietary Information to any person without OUC's prior written approval.

5.2 Procedures. Licensor agrees to keep any and all Proprietary Information in its possession in a secure place and to take appropriate action satisfactory to OUC to assure continuous confidentiality. If required by OUC, all of Licensor's employees, officers, or agents having access to OUC's Proprietary Information (now or at any time in the future) will sign specific confidentiality Licenses incorporating the provisions herein relating to protection of OUC's Proprietary Information.

5.3 No Publicity. Licensor will not use any of OUC's Proprietary Information and will not use OUC's name or refer to any of OUC's computer systems or programs in any sales brochures, product demonstrations or verbal sales presentations without OUC's prior written consent.

5.4 Software. OUC acknowledges that the Software constitutes confidential and proprietary information of Licensor, and OUC agrees to maintain the Software in strict confidence and agrees not to disclose, use, publish, transfer, copy or otherwise make available any portion of the Software to any third party, except as permitted herein or required by legal authority.

5.5 Exceptions. The obligations of confidentiality set forth in this Article shall not apply to information which (i) is already known to the recipient thereof at the time of disclosure, (ii) is obtained by the recipient from a third party without restriction,

(iii) is in the public domain or (iv) is independently developed by the recipient without any use of the Proprietary Information.

GC 6.0 TRAINING AND MAINTENANCE

6.1 Training. Licensor shall provide the training services described on Schedule A for the training fees described on Schedule A.

6.2 Maintenance Fee. The cost of Software maintenance services (“Maintenance

Services”) for the first year after Acceptance of the Software is included in the License Fee and warranty coverage. Payment of the annual maintenance fee specified in Schedule A (“Maintenance Fee”) on each anniversary of the Acceptance of the Software shall entitle OUC to Maintenance Services for the next year. Maintenance Fees will be invoiced by Licensor 45 days before the due date. Maintenance Fees shall not increase during the first three (3) years of this License, nor shall subsequent fees (fees applicable after the first three (3) years) increase more than the current fee adjusted for that year’s increase in the PPI (Producer Price Index as published by the U.S. Dept. of Labor Bureau of Labor Statistics). Licensor will provide OUC at least ninety (90) days written notice of any proposed increase in the Maintenance Fees. Should Licensor's notice be received less than ninety days prior to the due date, the fee increase shall not be effective for the Maintenance Services for the next annual period.

6.3 Maintenance Services. Maintenance Services include telephone assistance, error identification and correction, program maintenance and all Software modifications, updates, enhancements and new releases, including any corresponding technical documentation, all of which shall made available at no additional charge beyond the Maintenance Fee.

6.4 Maintenance Availability. Licensor guarantees that Maintenance Services will be available for a minimum of five (5) years after the Acceptance of the Software.

OUC is not obligated to renew Maintenance Services for any period. Should OUC elect not to renew Maintenance Services, OUC will return Licensor's invoice with written confirmation of the decision not to renew. OUC may terminate Maintenance Services with thirty (30) days written notice to Licensor, and Licensor agrees to prorate and refund to OUC one-twelfth of the Maintenance

Fees paid for each full month remaining during the one-year maintenance period.

If OUC ever discontinues Maintenance Services, OUC may reinstate these Maintenance Services from Licensor at any time.

6.5 Access for Maintenance. OUC agrees to provide Licensor with reasonable access to the Software for maintenance purposes. Licensor must notify OUC at least one (1) week in advance of any required access, except in response to a request for service from OUC.

GC 7.0 WARRANTY

7.1 Warranty. Licensor warrants that the Software, at the time of acceptance and for one (1) year thereafter, will perform in accordance with the Software's published specifications and as represented to OUC and that the Software will be compatible with the operating system, application programs, computing equipment, and networks interfacing with the computer systems running the Software. Licensor’s warranty support shall include all of the Maintenance Services specified in Article VI of this License.

GC 8.0 PATENT AND COPYRIGHT INDEMNIFICATION

8.1 Patent and Copyright Indemnification. Licensor represents that the Software does not violate or infringe on any patent, trademark, trade secret, copyright, or other intellectual property right of any third person. Licensor hereby agrees to indemnify, defend, and hold OUC harmless from any claim, suit or action, and any loss, damage, judgment, cost or expense, including reasonable attorney's fees, which may be incurred in connection with any claim that the Software infringes any patent, trademark, trade secret, copyright or other intellectual property right. OUC shall give prompt written notice of any such claim to Licensor, so that Licensor may settle or defend such action at Licensor's sole expense, but Licensor shall not be excused by a failure of OUC to give notice unless and then only to the extent Licensor is prejudiced by such lack of notice.

In the event an injunction is issued, or is reasonably likely to be issued, prohibiting OUC’s use of the Software, or the Software is held to infringe the rights of any third party, Licensor shall have the option, at Licensor's sole expense, either to procure for OUC the right to continue using the Software or to replace or modify the Software so that it becomes non-infringing. In the event neither of these options is possible, Licensor shall refund all License Fees and Maintenance Fees paid by OUC.

GC 9.0 SOURCE CODE

9.1 Source Code. OUC may obtain a copy of the complete source code to the current version of the Software (“Source Code”) at any time, upon payment of the fee specified on Schedule A. If OUC has obtained a copy of the Source Code, the Maintenance Services shall include a revised and updated copy of the Source Code for each new revision and version of the Software.

9.2 Escrow of Source Code. If OUC has not already received a copy of the Source

Code pursuant to the foregoing section, Licensor agrees to place the Source Code in an escrow account acceptable to OUC and to continually update this copy of the Source Code, so that it accurately represents the version and revision of the Software being used by OUC. In the event Licensor (i) becomes insolvent, (ii) is the subject of bankruptcy or receivership proceedings, (iii) ceases business, (iv) is unwilling or unable to maintain the Software in accordance with this License, or (v) agrees to be acquired by or merged with another company without OUC’s prior written consent, OUC shall be given a copy of the Source Code from the escrow account, without any cost or other obligation to OUC. In addition, Licensor agrees to provide OUC with the most current version of the Source Code immediately upon request, at no additional cost, should it become apparent that any of the above business conditions are likely to or have occurred.

GC 10.0 TERMINATION

10.1 Termination. If either Party breaches a material provision of this License, the other Party may give written notice of breach. If the breaching Party fails to cure the breach within thirty (30) days, this License may be terminated by the non-breaching Party giving written notice of termination.

10.2 Return of Software. Upon termination of this License, OUC shall cease to use and secure the Software and all copies thereof for such period of time as required by law for retention prior to destruction of the Software

10.3 Survival of Confidentiality. The confidentiality obligations contained in Article V and GC-14.0 shall survive termination of the License for any reason.

10.4 Refund of Fees. In the event a breach by Licensor leads to the termination, OUC shall be entitled to a full refund of all License Fees and Maintenance Fees paid by OUC. In the event a breach by OUC leads to the termination, no refunds will be due.

GC 11.0 FACILITY ACCESS / INSURANCE

11.1 Facility Access Conditions. Licensor shall be granted access to the Facility under the License, to the extent access is required for the performance of the Services, but any such access will be subject to the following conditions:

Licensor will be required to confine its activities to only those portions of the Facility necessary for performance of the Services.

Licensor shall be required to take all safety measures reasonably necessary to protect OUC, its permitees and licensees and the property of each, from injury or damage caused by or resulting from the performance of Services. Licensor shall follow any and all safety and security procedures established by OUC for the

Facility or Facilities where Services are being performed. To the extent applicable, Licensor shall be provided a copy of applicable safety and security rules and Licensor shall read and follow such rules. In the event of a security emergency, OUC may deny Licensor access to a Facility or request that Licensor leave the Facility.

Licensor shall be required to maintain an agreed level of insurance coverages of the types set forth in this Article at all times during the term of the performance of the Services.

Licensor’s performance of Services shall not be permitted to interfere with the use, occupancy or enjoyment of the Facility by OUC.

No work or activity performed as part of the Services shall be permitted to cause OUC to be in violation of any requirement of law nor shall Licensor or any agent, employee or representative be permitted to violate any federal, state or local laws while performing Services.

Licensor shall be required to perform all Services in a manner that will not damage the Facility and Licensor shall be responsible for the cost of repairing any such damage.

The Supplier’s and subcontractor’s personnel who perform the work in connection with this Contract shall conform to the Orlando Utilities Commission (OUC) Alcohol and Controlled Substance Abuse Policy. This policy may be found on the Orlando Utilities Commission’s website, www.ouc.com under “Supplier Information”.

11.2 Required Insurance. The Licensor shall acquire and maintain at all times during the performance of Services at the Facility under the License, at the Licensor's expense and as part of the price, a minimum of the following insurance unless specifically agreed otherwise by OUC in its sole and exclusive discretion.

11.3 Workers Compensation and Employers Liability. This insurance shall protect the

Licensor against all claims under applicable state workers’ compensation laws.

Licensor shall also be protected against claims for injury, disease, or death to employees which, for any reason, may not fall within the provisions of a state workers compensation law. The policy shall include an “all states” or “other states” endorsement.

The liability limits shall not be less than:

Workers’ Compensation Statutory Employers Liability $1,000,000 each occurrence

11.4 Commercial General Liability. Commercial general liability insurance with limits of liability of $2,000,000 limit each occurrence (Bodily Injury & Property Damage).

Commercial general liability Insurance shall include coverage for all the Licensor's contractual liability. OUC may allow in its sole discretion, a http://www.ouc.com/ combination of General Liability coverage and Umbrella coverage to satisfy required liability limits.

11.5 Automobile Liability. Automobile liability insurance with limits of liability of

$1,000,000 limit each occurrence (Bodily Injury & Property Damage).

11.6 Certificates. Licensor shall be required upon written request from OUC, to furnish OUC with certificates of insurance as evidence that the policies required under the License are in full force and effect.

11.7 Additional Insured. All insurance coverages furnished under this Contract except

Workers' Compensation, Employers' Liability and Professional liability shall include OUC, and their partners, commissioners, directors, officers, agents, and employees as additional insureds with respect to the activities of the Supplier and his subcontractors.

Notwithstanding any other provision of these policies, the insurance afforded shall apply separately to each insured, named insured, or additional insured with respect to any claim, suit, or judgment made or brought by or for any other insured, named insured, or additional insured as though a separate policy had been issued to each.

OUC shall not by reason of their inclusion under these policies incur liability to the insurance carrier for payment of premium for these policies.

11. 8 Waiver of Subrogation. The Contractor and his subcontractors shall require their insurance carriers, with respect to all insurance policies, to waive all rights of subrogation against the Owner and the Engineer, their partners, directors, officers, agents, and employees and against other contractors and subcontractors.

12.0 MISCELLANEOUS

12.1 Disaster Recovery Assistance. In the event of a disaster totally or partially disabling OUC’s computing or telecommunications capability, whether due to natural or man made causes, Licensor agrees to use its best efforts to aid in the prompt restoration of OUC’s use of the Software, including but not limited to (i) furnishing emergency replacements of the Software or documentation immediately upon request via overnight delivery, (ii) the provision of Maintenance Services on an emergency basis, and (iii) providing technical assistance to OUC to restore usage of the Software or to recover data. OUC shall be treated at least as favorably as Licensor’s most favored customer in the event that the disaster also affects other customers of Licensor. OUC shall reimburse Licensor for the costs actually incurred by Licensor in providing the emergency response, including time, materials, and shipping and transportation expenses.

12.2 Copies of Documentation. OUC may make copies for its internal use all of Licensor’s manuals and other documentation concerning the application, use, training of users, theory of operation, maintenance or any other aspect of the Software, provided that all of Licensor’s logos, trademarks and copyright notices are reproduced in whole in original form.

12.3 Force Majeure.

Supplier Force Majeure Delay. Supplier will not be liable for failure to perform any obligation or delay in performance of Work resulting from any cause beyond the reasonable control of Supplier, or from any act of God; act of civil or military authority; act of war whether declared or undeclared; act (including delay, failure to act, or priority) of any governmental authority (federal, state or local); civil disturbance; insurrection or riot; sabotage; fire; inclement weather conditions;

earthquake; or flood. Notwithstanding the above, Supplier shall not be excused from performance of any service under this Article GC. 30 for any cause resulting from the negligence of Supplier or failure to properly assess the availability of laborers, skilled trades or other workers or the timing of its service.

Extension of Services Schedule.

In the event of a delay or interruption in performance of service excusable under this Article, the time of performance of such service by Supplier will be extended by a period of time the Parties agree is reasonably necessary to overcome the effects of the delay. An extension of time shall be the sole and exclusive remedy for any damages due to delay, including but not limited to loss of profits, loss of use, equipment rental or overhead expenses.

OUC Termination for Excessive Delay.

If due to the conditions specified above Section, the Supplier’s service is delayed for a period of more than ninety (90) Days, OUC may terminate the Contract and shall have no further liability to Supplier except for payment for services completed in accordance with the Contract up to the termination date.

12.4 Arbitration of Disputes. In the event the Parties agree to participate in binding arbitration the arbitration shall be conducted under the commercial arbitration rules of the American Arbitration Association then in effect (“Rules”). The arbitration shall be held and the award made in Orlando, Florida. The arbitrator shall be chosen by License of the Parties from a panel of persons with a knowledge of electronic data processing industry practices, contracts and data processing systems. In the event the Parties cannot agree on an arbitrator, the arbitrator shall be selected from the aforementioned panel pursuant to the Rules.

The decision of the arbitrator shall be binding on both Parties, and judgment upon the award rendered by the arbitrator may be entered in any court of appropriate jurisdiction.

12.5 Most Favorable Terms. All of the prices, terms, conditions, warranties, licenses and benefits granted by Licensor herein are comparable to (or more advantageous to OUC than) the terms being offered by Licensor to any other present customer.

12.6 Taxes The License Fee and Maintenance Fee do not include local, state, or federal sales, use, excise, personal property or other similar taxes or duties, and any such taxes shall be paid by OUC, except for taxes based on the net or gross income of Licensor.

12.7 Notices. Any notice or other communication required or permitted hereunder shall be given in writing to the other party at such party's address. Either Party may change its address by giving notice to the other in writing. All notices shall be effective five days after mailing postage prepaid by certified mail (return receipt requested), or upon receipt if delivered personally.

12.8 Assignment. This License may not be assigned by either Party without the prior written consent of the other Party, and any attempted assignment shall be void;

provided, however, OUC may assign this License, upon written notice to Licensor, to any of its Affiliates without the consent of Licensor. This License shall be binding upon the Parties' respective successors and permitted assigns. In the event Licensor is merged, consolidated with, or acquired by another company, the successor company shall continue to be bound by all of the terms and conditions, or OUC shall be paid a full refund of all License Fees and Maintenance Fees paid.

12.9 Order of Precedence. In the event of an actual inconsistency between the terms and conditions of this License and any Schedule, the terms and conditions of the Schedule shall take precedence over any inconsistent terms and conditions of this License, but only with respect to that Schedule.

12.10 Modification and Waiver. No modification, amendment, supplement to or waiver of this License or any of its provisions shall be binding upon the Parties hereto unless made in writing and duly signed by both Parties. A failure or delay by either Party to this License to enforce any of the provisions of this License, to exercise any option which is herein provided or to require performance of any of the provisions hereof, shall not be construed to be a waiver of such provision, or prevent future enforcement of such provision in the same or in a different situation.

12.11 Severability. In the event that one or more of the provisions contained herein shall for any reason be held to be illegal or unenforceable in any respect under the laws of any applicable jurisdiction, such illegality or unenforceability shall not affect any other provision of this License. This License shall be construed in that jurisdiction as if such illegal or unenforceable provision or provisions had been modified by the License of the Parties to the extent necessary to allow such provision to be enforceable while still protecting the legitimate interests of each Party as expressed in this License.

12.12 Governing Law.

The validity, construction, and performance of the License, shall be governed exclusively by the laws of the State of Florida. Venue shall be any court of competent jurisdiction located in Orange County, Florida. The Parties agree that in no event shall the Uniform Law on the Formation of Contracts for the Sale of Goods, based upon the United Nations Convention on Contracts for the International Sale of Goods (CISG) be applicable to this License.

12.13 Injunctive Relief. The Parties agree that damages may be inadequate to compensate a Party for a breach of certain of the provisions of this License, particularly including (but without limitation) the confidentiality provisions with respect to Proprietary Information. The damaged Party therefore shall be entitled to seek injunctive and other relief, including specific performance of the terms of this License, without the necessity of posting bond, in addition to any other remedy it may have under this License or at law.

12.14 Attorneys' Fees. In the event of any litigation or arbitration concerning this

License, the prevailing Party shall be entitled to recover its cost and expenses, including reasonable attorneys’ fees if awarded as part of a final judgment or decree.

12.15 No Agency Relationship. Nothing contained in this License shall create any agency, fiduciary, joint venture, employment or partnership relationship between OUC and Licensor.

12.16 Headings. The headings in this License are for purposes of reference only and shall not in any way limit or otherwise affect the meaning or interpretation of any of the terms hereof.

12.17 Counterparts. This License may be executed in one or more counterparts, each of which may be deemed to be an original instrument, but all of which together shall constitute but one instrument.

GC 13.0 DISPUTE PROCESS

13.1 Dispute Process: The procedures specified herein shall be the sole and exclusive procedures for the resolution of general and billing disputes between the Parties arising out of or relating to this License. The Parties will participate in good faith in the procedures specified herein.

A. General:

1. The procedures specified herein shall be the sole and exclusive procedures for the resolution of disputes between the Parties arising out of or relating to this License. The Parties will participate in good faith in the procedures specified in this Section.

2. All applicable statutes of limitation and defenses based upon the passage of time shall be tolled while the procedures specified in this Section are pending. The Parties will take such action, if any, required to effectuate such tolling.

3. In the event of any dispute under this License which cannot be readily resolved, it shall be referred to the appropriate executives of the respective Parties to this License (hereinafter “Party” or “Parties”) for negotiation and resolution as described below.

4. If the dispute has not been resolved by negotiation or mediation as provided herein within sixty (60) days of the initiation of such mediation procedure, either Party may initiate litigation upon ten (10) days' written notice to the other Party; provided, however, that if one Party has requested the other to participate in a nonbinding procedure, as provided for under this Section, and the other has failed to participate, the requesting Party may initiate litigation before expiration of the above period.

B. Disputes:

1. Disputes, as defined herein and under the License, include Licenses, claims, counterclaims, matters in question, and differences of opinion between OUC and Licensor, regarding the Work and modifications or changes to the Work. Disputes may involve interpretation of the License, acceptability of the Work, costs and/or time for performance.

2. Disputes may also involve other subjects mutually agreed by OUC and Licensor.

3. Payment Disputes:

a) If a dispute arises between the Parties, the dispute shall be submitted to an appropriate panel assembled by the Manager of Purchasing no later than forty-five (45) days after receipt of the disputed payment. OUC shall render a final decision on the disputed payment within sixty (60) days after receipt of the invoice.

b) If the dispute is decided in favor of OUC, interest shall begin to accrue fifteen (15) days after the decision is announced.

c) If the dispute is decided in favor of Licensor, interest shall accrue as of the original date the payment became due.

d) The panel’s final decision can be taken as a contract dispute through the process outlined below.

C. Step Negotiations:

1. Either Party may give the other Party written notice of any dispute not resolved in the normal course of business. Executives of both Parties at levels one step above the project personnel who have not previously been involved in the dispute shall meet at a mutually acceptable time and place within ten (10) days after delivery of such notice and thereafter as often as they reasonably deem necessary, to exchange relevant information and to attempt to resolve the dispute.

If the matter has not been resolved by these persons within thirty (30) days of the disputing Party's notice, or if the Parties fail to meet within ten (10) days, the dispute shall be referred to senior executives of both Parties who have authority to settle the dispute and who shall likewise meet to attempt to resolve the dispute. If the matter has not been resolved within thirty (30) days from the referral of the dispute to senior executives, or if no meeting of senior executives has taken place within fifteen (15) days after such referral, either Party may initiate mediation as provided hereinafter.

2. All negotiations pursuant to this Section shall be confidential and shall be treated as compromise and settlement negotiations for purposes of the Federal Rules of Evidence and state rules of evidence.

D. Mediation:

1. If the dispute has not been resolved by negotiation as provided herein, the Parties shall endeavor to settle the dispute by mediation.

Either Party may initiate a mediation proceeding by a request in writing to the other Party, Thereupon, both Parties will be obligated to engage in mediation. The proceeding will be conducted in accordance with the then current Center for Public Resources ("CPR") Model Procedure for Mediation of Business Dispute or other mutually agreed upon procedures, with the following exceptions:

a. If the Parties have not agreed within thirty (30) days of the request for mediation on the selection of a mediator willing to serve, the CPR, upon the request of either Party, shall appoint a member of the CPR Panel of Neutrals as the mediator; and

b. Efforts to reach a settlement will continue until the conclusion of the proceeding, which is deemed to occur when: a) a written settlement is reached, or b) the mediator concludes and informs the Parties in writing that further efforts would not be useful, or

c) the Parties agree in writing that an impasse has been reached. Neither Party may withdraw before the conclusion of the proceeding.

2. The Parties regard the aforesaid obligation to mediate as an essential provision of this License and one that is legally binding on them. In case of a violation of such obligation by either Party, the other may bring an action to seek enforcement of such obligation in any court of law having jurisdiction thereof.

E. Litigation:

1. If the dispute has not been resolved by negotiation or mediation as provided herein within sixty (60) days of the initiation of such mediation procedure, either Party may initiate litigation upon ten (10) days written notice to the other Party; provided, however, that if one Party has requested the other to participate in a nonbinding procedure, as provided for under this Section, and the other has failed to participate, the requesting Party may initiate litigation before expiration of the above period.

2. All applicable statutes of limitation and defenses based upon the passage of time shall be tolled while the procedures specified in this Section are pending. The Parties will take such action, if any, required to effectuate such tolling.

3. Claims, counterclaim, disputes, and other matters in question between OUC and Contractor that are not resolved will be decided in the Ninth Judicial Circuit, in and for Orange County, Florida, which shall have exclusive jurisdiction and venue over all matters in question between OUC and Contractor.

GC 14.0 PUBLIC RECORDS NOTICE

IF THE SUPPLIER HAS QUESTIONS REGARDING THE APPLICATION

OF CHAPTER 119, FLORIDA STATUTES, TO THE SUPPLIER’S DUTY

TO PROVIDE PUBLIC RECORDS RELATING TO THIS CONTRACT,

CONTACT THE CUSTODIAN OF PUBLIC RECORDS AT THE

TELEPHONE NUMBER, EMAIL ADDRESS AND MAILING ADDRESS

PROVIDED BELOW.

Supplier acknowledges that OUC is subject to Chapter 119, Florida Statutes (“Public Records Law”) and that any record (regardless of form or format) created to memorialize OUC business or used to make OUC business decisions is considered a public record, unless exempted or deemed confidential by law or the Florida Constitution (“OUC Business Records”). Any OUC Business Records provided to or generated by Supplier coincident with performing Services under this Contract ([Agreement) must be kept and maintained in accordance with the Public Records Law.

Any such OUC Business Records held by Supplier must also be made available to the public for inspection or copying, within a reasonable time if requested under the Public Records Law. Further, upon request of OUC’s records custodian, Supplier shall provide OUC a copy of the requested OUC Business Records or allow such records to be inspected or copied, within a reasonable time, at a cost that does not exceed the rate provided in the Public Records Law.

Supplier shall ensure that OUC Business Records that are exempt or confidential and exempt from public records disclosure requirements are not disclosed except as authorized by law for the duration of the contract term and following completion of the contract if the Supplier does not transfer the records to OUC. Upon completion of the [Contract][Agreement], Supplier may transfer, at no cost to OUC, all OUC Business Records in possession of Supplier or keep and maintain OUC Business Records required by OUC to perform the services or work.

If Supplier receives a public records request for any OUC Business Records, Supplier shall notify OUC’s Records Custodian in writing by email or US Mail at the following email address and provide OUC a copy of the request:

Custodian of Records c/o Orlando Utilities Commission 100 West Anderson Street Orlando, Florida 32801 Email: recordscustodian@ouc.com Telephone: (407) 434-2727

Supplier shall provide any OUC Business Records responsive to the public records request to OUC along with the above notice. Supplier shall respond to the requestor within one working day from the date of receiving the public records request that all requests for such information should be provided to the OUC Records Custodian at the above address and email. Supplier shall keep all OUC Business Records stored in separate files (both hard copy and electronic) to minimizes the chances of exposing Supplier files to a public records dispute.

Supplier shall routinely demonstrate that any electronic OUC public records can be transferred to OUC in a format that is compatible with OUC and industry standards (e.g.

ASCII Text, Adobe PDF, XML, EDIF, CSV, etc.). Encryption of files and data must be accompanied with the appropriate mechanisms to transfer the data successfully (e.g.

passwords, cipher, PGP, and SSL keys). Upon request from a member of the public, from OUC, or at the termination of services, Supplier shall provide any or all records in the OUC supported format.

If the Supplier transfers all OUC Business Records to OUC upon completion of the Contract, Supplier shall destroy any duplicate OUC Business Records that are exempt or confidential and exempt from public records disclosure requirements. If the Supplier keeps and maintains OUC Business Records upon completion of the Contract, the Supplier shall meet all applicable requirements for maintaining public records. If Supplier keeps and maintains OUC Business Records, upon completion of the Contract (Agreement), Supplier must meet all applicable requirements for retaining public records.

GC 15.0 E-VERIFY REQUIREMENTS

Pursuant to Section 448.095, Florida Statutes, Supplier acknowledges that if awarded a Contract pursuant to this bid, Supplier and its subcontractors are required to utilize the U.S. Department of Homeland Security’s (DHS) E-verify system to verify the employment eligibility status of all new employees hired by the Supplier during the Contract term. Supplier shall include in related subcontracts a requirement that sub-contractors performing work or providing services pursuant to the Contract utilize the E- Verify system to verify employment of all new employees hired by the sub-contractor during the Contract term.

By executing this Contract, the Supplier certifies that it is registered with, and uses, the E-Verify system for all newly hired employees. In addition, if Supplier enters into a contract with a subcontractor, the Supplier must obtain an affidavit from its subcontractor(s) in accordance with paragraph (2)(b) of section 448.095, F.S., and shall maintain a copy of such affidavit for the duration of the Contract.

mailto:recordscustodian@ouc.com

This section serves as notice to the Supplier regarding the requirements of section 448.095, F.S., specifically sub-paragraph (2)(c)(1), and OUC’s obligation to terminate the Contract if it has a good faith belief that the Supplier has knowingly violated section 448.09(1), F.S. If terminated for such reason, the Supplier will not be eligible for award of a public contract for at least one year after the date of such termination.