PCI_Consultant_RFP.pdf

Request for Proposals

City of Minneapolis Finance and Property Services

PCI Compliance Consulting Event #0000004221

Proposals Due by: 12:00 PM, July 24, 2026

REQUEST FOR PROPOSALS

FOR

PCI Compliance Consulting

I. INVITATION: It is the intention of the City to solicit proposals for PCI Compliance Consulting services.

The City of Minneapolis (hereinafter referred to as the City) makes this Request for Proposals (hereinafter referred to as the RFP) in order to select a qualified Consulting Firm (hereinafter referred to as the Consultant) for providing PCI Compliance Consulting services (hereinafter called the Project). The Project is generally described in the “Scope of Services” (Attachment B), contained within this RFP, including descriptions of roles, responsibilities and relationship of the Consultant, City, and other parties involved in the Project.

II. SCOPE OF SERVICES:

The scope of work as summarized below and detailed in Attachment A, will include, but may not be limited to:

1. The Consultant will provide an annual PCI Statement of Work that details the scope and cost of the compliance assessment.

2. The consultant will provide a gap analysis report by merchant location that details gaps in compliance.

3. The consultant will provide an action plan to remediate all compliance gaps and will assist the City when appropriate in developing a remediation roadmap to complete compliance.

4. The Consultant will provide individual Attestations of Compliance for each of the four merchant entities.

5. The Consultant will provide assistance and guidance in meeting the testing and scanning required for PCI compliance.

6. The Consultant will provide assistance and guidance with the development and updating of PCI Related documentation, and proactively keep the City informed of changing PCI Standards and card issuer recommendations.

7. The Consultant will provide a communications plan.

SEE ATTACHMENT A – DETAILED SCOPE OF SERVICES

III. PROPOSAL DUE DATE: All proposals must be submitted electronically through the eSupplier

Portal. If you are already a City Supplier you should have received an email containing your eSupplier User ID and Password. If you do not remember your password, click on the "Forgot Password" tile to enter your User ID and a new password will be emailed to you. If you are not already a city supplier, click on the eSupplier link below and then click on the "Bidder Registration" tile to register. If you need further assistance with eSupplier, please send an email to eprocurement@minneapolismn.gov

1. To access the eSupplier Portal, visit http://minneapolismn.gov/finance/procurement/eSupplier and click or tap on the “Use The Portal” link:

2. If you are not already a city supplier, you will need to first register as a bidder. You can do this by following the “Use the Portal” link described above and then clicking on the “Bidder Registration” tile to register:

3. Click Register Now

4. If you are already a City Supplier, you should have received an email containing your eSupplier User ID and Password.

If you do not remember your password, click on the “Forgot Password” tile to enter your User ID and a new password will be emailed to you.

5. If you need help with registering to use the eSupplier portal, you can find written and video instructions at http://minneapolismn.gov/finance/procurement/eSupplier by clicking or tapping on the “Portal Instructions Written or Video Link”:

If you need further assistance with eSupplier;

• EMAIL (subject line: eSupplier help) - eProcurement@minneapolismn.gov

• PHONE: 612-673-2311

NOTE: Late Proposals will not be accepted.

IV. PROPOSAL FORMAT: The Consultant shall provide the appropriate information in sufficient detail to demonstrate that the evaluation criteria has been satisfied as specified in the Section titled “EVALUATION OF PROPOSALS”.

To allow for easier comparison of proposals during evaluation, proposals should contain the following sections and appendices and be arranged in consecutive order.

mailto:eprocurement@minneapolismn.gov https://gcc01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fminneapolismn.gov%2Ffinance%2Fprocurement%2FeSupplier&data=02%7C01%7Cmaija.peura%40minneapolismn.gov%7Cc71560a097e2411a20b208d7baeda1fa%7C0bfb3f5ae8ea4d54b0212b2f910c715f%7C0%7C0%7C637183402102383329&sdata=yBQ%2BfsnIyIC0rYfNRLF1JEWzCplCjdtfAUV2dMAI5n0%3D&reserved=0 http://minneapolismn.gov/finance/procurement/eSupplier

1. Executive Summary - The Executive Summary should include a clear statement of the Consultant’s understanding of the RFP. Include a background of the firm, an identification of the proposed project team, and a summary of the proposed services.

2. Scope of Services - Describe how services will be provided. Include a listing and description of tasks, deliverables and action plan. Proposals may include examples of a SAQ, AOC, and communication plan.

3. Experience and Capacity - Describe the background and related experience demonstrating ability to provide required services. Indicate if company expansion is required to provide service.

4. References – Provide at least 3 references from projects similar in size and scope to the

City of Minneapolis. Large public sector entities would be preferred but not required.

Provide the designated person’s name, title, organization, address, telephone number and the project(s) that were completed under that client’s direction.

5. Personnel Listing – List individuals involved with the project and specific applicable experience. Sub-consultants should also be listed, including the identification of any that are certified in the City of Minneapolis Small & Underutilized Business Program.

6. Cost/Fees - Indicate proposed cost of service including a description of how costs were determined. Specify what and how the charges for services will be applied (e.g. a base fee per engagement, hourly rates, or other direct costs to be applied). Identify payment billing schedule and an expected cost breakdown for each year of service.

7. Company Financial Information – State whether your company is local, regional, national or international. Include city and state of company’s headquarters. Provide a brief history of the company and ownership structure and information on pending buy-outs/mergers/acquisitions. Provide evidence of financial capacity, bonding capacity and insurance policies (see Exhibit A for Standard Agreement Insurance Form). Provide the firm’s latest annual report or 10K and other relevant financial information. Have there been any bankruptcy filings by the company, its principals and officers during the previous seven years?

V. EVALUATION OF PROPOSALS – SELECTION OF CONSULTANT: Proposals will be reviewed by an Evaluation Panel made up of representatives of the City of Minneapolis Banking, Investments & Debt division, Information Technology, and other City staff, as needed. The Evaluation Panel will select a "short list" of qualified Consultants who may be formally interviewed as part of the final selection, if deemed necessary by the City. Evaluations will be based on the required criteria listed in the Section titled “PROPOSAL FORMAT”, and the following:

A. Quality of Executive Summary.

B. How well the Scope of Services offered meets department objectives.

C. Experience and capacity of Consultant.

D. Review of references to confirm satisfactory customer service, performance, knowledge of industry, and timeliness. References which are similar to the size or complexity of the City will be noted.

E. Qualifications and experience of staff.

F. Cost of services proposead.

G. Financial responsibility and capacity of company.

VI. SCHEDULE: The following is a listing of key Proposal and Project milestones and duration:

RFP Release July 1, 2026 Questions on RFP Due by 12:00 PM on July 10, 2026 Responses to Questions posted by 4:00 PM on July 17, 2026 Proposals due by 12:00 PM on July 24, 2026 Estimated Consultant selection August 7, 2026 Estimated services start date September 1, 2026 Estimated services end date August 31, 2029 Duration of contract (not to exceed 5 years) 3 + 1 + 1

VII. CONTRACT: The contracting parties will be the City of Minneapolis and the Consultant selected to provide the services as described herein. The selected proposal, along with the RFP and any counter proposal will be incorporated into a formal agreement after negotiations. It is the intent of the City to award a single contract for a term of 3 years with the option to extend the contract, on an annual basis, at the sole option of the City, for 2 additional years.

VIII. DEPARTMENT CONTACT/REQUESTS FOR CLARIFICATION: The Consultant’s primary interface with the City will be with the Contract Manager who will act as the City’s designated representative for the Project. Prospective responders shall direct inquiries/questions in writing only to:

Contract Manager: Dave Wheeler, Senior Manager - Banking, Investment & Debt

Email: david.wheeler@minneapolismn.gov

Responses to the questions will be posted as an addendum to the current event in the eSupplier Portal – Contracting Opportunities.

The Contract Manager is the only individual who can be contacted regarding the Project before proposals are submitted. The Contract Manager cannot vary the terms of the RFP.

IX. REJECTION OF PROPOSALS: The City does not promise to accept the lowest cost proposal and specifically reserves the right to reject any or all proposals, to waive any formal proposal requirements, to investigate the qualifications and experience of any Contractor, to reject any provisions in any proposal, to obtain new proposals, to negotiate the requested services and contract terms with any Contractor, or to proceed to do the work otherwise. Incomplete proposals and proposals not sufficiently detailed or not in acceptable form may be rejected by the City.

mailto:david.wheeler@minneapolismn.gov

X. ADDENDUM TO THE RFP: If any addendum is issued for the RFP, it will be posted as an attachment to the RFP package in the eSupplier portal. The City reserves the right to cancel or amend the RFP at any time

XI. DATA PRACTICES:

Data you provide in response to this RFP will be subject to the Minnesota Government Data Practices Act and may be available to the public. Minn. Stat. 13.591 classifies Business Data and subdivision 3 specifically addresses data submitted in response to an RFP. If you are submitting specific data which you believe meets the definition of trade secret data as defined in Minn. Stat. 13.37, please indicate this on the documents containing the data. The City may ask you to establish that the data meets all of the conditions set forth in Minn.

Stat. 13.37, subdivision 1(b).

Attachment A – Detailed Scope of Services

A. REQUIRED SERVICES

PCI scope as described by the PCI Security Standards Council is as follows:

PCI requirements apply to all system components. In the context of PCI DSS, “system components” are defined as any network component, server or application that is included in, or connected to, the cardholder data environment. System components also include any virtualization components such as telephony, virtual machines, virtual switches/routers, virtual appliances, virtual applications/desktops, and hypervisors. The cardholder data environment is comprised of people, processes and technology that handle cardholder data or sensitive authentication data.

• Network components may include but are not limited to firewalls, switches, routers, wireless access points, network appliances, and other security appliances.

• Server types may include but are not limited to the following: web, application, database, authentication, mail, proxy, network time protocol (NTP), and domain name server (DNS).

• Applications may include but are not limited to all purchased and custom applications, including internal and external (for example, Internet) applications.

The scope of work as summarized below and detailed hereafter, will include, but may not be limited to:

8. The Consultant will provide an annual PCI Statement of Work that details the scope and cost of the compliance assessment.

9. The consultant will provide a gap analysis report by merchant location that details gaps in compliance.

10. The consultant will provide an action plan to remediate all compliance gaps and will assist the City when appropriate in developing a remediation roadmap to complete compliance.

11. The Consultant will provide individual Attestations of Compliance for each of the four merchant entities.

12. The Consultant will provide assistance and guidance in meeting the testing and scanning required for PCI compliance.

13. The Consultant will provide assistance and guidance with the development and updating of PCI Related documentation, and proactively keep the City informed of changing PCI Standards and card issuer recommendations.

14. The Consultant will provide a communications plan.

1. Statement of Work

The first step of a PCI DSS assessment is to accurately determine the scope of the review. At least annually and prior to the annual assessment, the assessed entity should confirm the accuracy of their PCI DSS scope by identifying all locations and flows of cardholder data and ensuring they are included in the PCI DSS scope. To confirm the accuracy and appropriateness of PCI DSS scope, perform the following:

• The assessed entity identifies and documents the existence of all cardholder data in their environment, to verify that no cardholder data exists outside of the currently defined cardholder data environment (CDE).

• Once all locations of cardholder data are identified and documented, the entity uses the results to verify that PCI DSS scope is appropriate (for example, the results may be a diagram or an inventory of cardholder data locations).

• The entity considers any cardholder data found to be in scope of the PCI DSS assessment and part of the CDE unless such data is deleted or migrated/consolidated into the currently defined CDE.

• The entity retains documentation that shows how PCI DSS scope was confirmed and the results, for assessor review and/or for reference during the next annual PCI SCC scope confirmation activity.

The Consultant will provide an annual PCI Statement of Work that details the scope and cost of the compliance assessment.

2. Gap Analysis Report This portion of the process is dedicated to mapping the requirements defined in the PCI DSS to the processes and technologies currently employed by the City of Minneapolis. Each system component included in the PCI scope must be assessed for compliance against the PCI DSS and gaps will be identified and documented.

In order to properly evaluate the Gaps in compliance, visits to all merchant locations are recommended. These site visits will include interviews with employees, managers, and technical staff as well as the gathering of appropriate diagrams and documentation of processes. The site visits should be used to evaluate activities listed below and any other appropriate activities related to PCI DSS compliance.

• How and why credit cards are accepted

• Analysis of Technology and Systems used to take payments

• Service providers used in the process or in support of the systems (outsourced web hosting, payment gateways, Value Added Resellers (VAR), etc.)

• Methods used to capture/obtain the cardholder data (fax, mail, phone, in-person, etc.)

• Any storage of cardholder data, electronic or paper

• People/roles/titles involved in the payment process

• People/roles/titles involved in the support of the systems/network

• Departmental procedures for handling cardholder data, documented or undocumented

• Reporting methods

• Refund processes

• Collection processes

• Tour of areas used to process cards or store cardholder data

• Physical review of systems/payment terminals used for processing cards

• In the event of e-commerce, a walkthrough of a transaction (up to the point of where the card number would be entered) Adoption of PCI-DSS

• General PCI guidance and proactive updates to new or upcoming PCI standards

• Participation in information security steering committees

• Security training and awareness guidance

• Vendor oversight

• Documentation work – policies, procedures, standards and guidelines

• Documentation updates – network diagrams and asset lists

• Both scheduled and ad-hoc security meetings

• Incident response

• General information security advisory services

The consultant will provide a gap analysis report by merchant location that details gaps in compliance.

3. Action Plan Compile documentation and recommendations to address any gaps in compliance discovered during the Gap Analysis and write detail action plan recommendations. The recommendations may include choosing different technologies and/or developing new processes and documentation. The Action Plan will be an ongoing process executed in combination with the Gap Analysis. The end result will be multiple action plans targeting different areas of technology and business operations delivered over the course of the engagement. Completion of the Action Plan will occur when all components of the PCI-DSS are either in compliance or are included in an action plan.

The consultant will provide an action plan to remediate all compliance gaps and will assist the City when appropriate in developing a remediation roadmap to complete compliance.

4. Attestations of Compliance (AOC) and Self-Assessment Questionnaire (SAQ D) The final AOC and SAQ D documents will be provided for the appropriate representative from City of Minneapolis to sign-off and submit. The City of Minneapolis is scheduled to certify compliance with its merchant card services provider (currently US Bank) annually.

The Consultant will provide individual Attestations of Compliance for each of the four merchant entities.

5. Scanning and Testing

Internal and External Penetration Testing and Quarterly Vulnerability Scans are required as part of our PCI Compliance Program. These scans are currently performed by City IT staff.

• Quarterly PCI Compliant External Vulnerability Scanning (dynamic list, up to 50 addresses) o Convention Center

• Run monthly vulnerability scan of CDE o Monthly internal vulnerability scanning of the CDE network segment o Communication and guidance on all vulnerability remediation with City staff, contractors, service providers, and vendors

• Review network for unauthorized wireless access points quarterly o Technical audit of network access quarterly (testing for any new devices or active ports on the network) o Manual audit of all physical locations for the presence of wireless equipment quarterly (with the assistance of City personnel)

Implement a methodology for penetration testing that includes at least the following:

• Is based on industry-accepted penetration testing approaches (for example, National Institute of Standards and Technology (NIST SP800-115).

• Includes coverage for the entire CDE perimeter and critical systems.

• Includes testing from both inside and outside of the network.

• Includes testing to validate any segmentation and scope reduction controls.

• Defines application-layer penetration tests to include, at a minimum, the vulnerabilities listed in

• Requirement 6.5.

• Defines network-layer penetration tests to include components that support network functions as well as operating systems.

• Includes review and consideration of threats and vulnerabilities experienced in the last

12 months.

• Specifies retention of penetration testing results and remediation activities results

The following attack vectors should be included in the application layer tests:

• Injection flaws (SQL injection, OS command injection, LDAP injection, XPath injection)

• Buffer overflow vulnerabilities

• Insecure use of cryptographic storage

• Unencrypted or improperly encrypted sensitive communications

• Information leakage via error messages

• Cross-site scripting (XSS)

• Insecure direct object references

• Failure to restrict URL access

• Directory traversal vulnerabilities

• Cross-site request forgery (XSRF, CSRF)

• Other vulnerabilities identified as high risk during your risk assessment

The Consultant will provide assistance and guidance in meeting the testing and scanning required for PCI compliance.

6. Plans and Recommendations Various PCI related documentation must be reviewed annually and appropriate updates or changes made to ensure PCI compliance.

• Review the effectiveness of risk management processes

• Review the effectiveness of Incident Response Plan

• Review Disaster Recovery and Business Continuity Plan

• Review Vendor Security Awareness Training Program

• Review the City’s PCI Policy and Procedures

• Oversee the vender management process, including o Annual review of vendors and service providers o Direct communication about PCI DSS requirements to the vendors

The Consultant will provide assistance and guidance with the development and updating of PCI Related documentation, and proactively keep the City informed of changing PCI Standards and card issuer recommendations.

7. Communications Plan The City of Minneapolis meets regularly with its PCI Consultants as detailed below.

• The consultant schedules regular conference calls with the City\Park Board teams.

• Additional conference calls or onsite visits with individual merchant locations are scheduled as needed.

The Consultant will provide a Communications Plan.

B. CITY OVERVIEW

US Bank is the acquiring bank for the City of Minneapolis and Elavon is their processor. US Bank\Elavon require the City of Minneapolis to report attestations of compliance annually to the Payment Card Industry Data Security Standards (PCI DSS).

The City of Minneapolis has approximately 90 MCVS (MasterCard Visa) merchant accounts and 75 AMEX (American Express) Merchant Accounts at multiple locations and accepts online payments for a number of its enterprise operations. Visa, MasterCard, Discover and American Express are the only credit cards accepted at the City. The City owns all its merchant processing equipment.

Payment Volumes Merchant account revenue transaction volumes (appx) by entity for 2025:

Location Revenue Volume City $110 million 400,000 Park Board $4 million 900,000

Payment Types The City currently accepts Visa (VS), MasterCard (MC), Discover (DI), and American Express (AMEX). The City plans to enable digital wallet capabilities as a payment type in the near future.

Generally, MC\VS\DI account for 80% of the transaction count and AMEX accounts for 20% of the transaction count.

Generally, MC\VS\DI account for 85% of the revenue volume and AMEX accounts for 15% of the revenue volume.

Payment Channels The City currently accepts all payment types via the Web The City currently accepts all payment types via an IVR platform The City currently accepts all payment types via Point of Sale (POS) The City currently accepts payments both via a free-standing terminal and a virtual terminal.

Payment Processors Currently, the City’s preferred gateway processor is CyberSource for most City online transactions and Paymentus for utility billing.

LOCATION PROVIDER

Utility Billing Paymentus Park Board CyberSource Block Events CyberSource Truth in Housing CyberSource Animal Control CyberSource Mpls Development Review CyberSource Impound Lot CyberSource Convention Center CyberSource

C. MERCHANT LOCATIONS

LOCATION DESCRIPTION (2026 DATA)

ADDRESS

1. Utility Billing – Accepts credit card payments online, IVR and POS (Point of Sale) for utility bills, water and sewer permit, (water, sewer, refuse) bill from City and City invoices. (260K transactions, $70 million revenue)

City of Minneapolis – Utility Billing 505 4th Avenue South Minneapolis, MN 55415

2. Park Board – Accepts credit card payments online and POS for rec programming, golf fees, entry to ice or aquatics, ice time rental, contract parking, memorial and tributes, equipment, concessions, dog tags, payments for citations and daycare. (760K transactions, $4 million revenue)

Minneapolis Park & Recreation Board Headquarters 2117 West River Road Minneapolis, MN 55411

3. Block Events – Accepts credit card payments online for event permits via fully outsourced e-commerce system. (250 transactions, $12K revenue)

City of Minneapolis – Block Events 33 North 9th Street Minneapolis, MN 55403

4. Truth in Housing (TISH)/ Construction Code Services (CCS) – TISH and CCS accept online credit card payments from registered contractors.

(4K transactions, $113K revenue)

City of Minneapolis – TISH/CCS

Minneapolis, MN 55415

5. Impound Lot – Accepts credit card payments online and POS for v ehicles that have been impounded. (24K transactions, $6.5 million revenue)

City of Minneapolis – Impound Lot 50 Van White Memorial Blvd.

Minneapolis, MN 55405

6. Mpls Development Review (MDR) – MDR accepts credit card payments and POS for commercial and residential construction related issues and business licenses (food, liquor, contractors). (45K transactions, $20 million revenue)

City of Minneapolis – MDR

7. Convention Center – Accepts credit card payments online and POS for convention center and exhibitor services and with a Skidata payment application for parking. (50K transactions, $6.2 million revenue)

City of Minneapolis – Convention Center 1301 2nd Avenue South Minneapolis, MN 55403

8. Animal Control – Accepts credit card payments online and POS for pet license tags, permits, adoption, impound fees and some retail sales withing the City of Minneapolis. (12K transactions, $2.1 million revenue)

9. 311/Public Service Center/A.R. – Accepts in-person credit card payments for permits, licenses and utility bills. (2K transactions, $1.6 million revenue)

Locations may be added or removed as needed.

City of Minneapolis – Animal Control 212 17th Avenue North Minneapolis, MN 55411

City of Minneapolis – 311/PSC

Attachment B Sample Standard Contract-Do not complete

City of Minneapolis Standard Contract

(For Professional Services Contracts up to $175,000)

City Contract Number:

Informal Event Number:

City Department responsible for the Contract:

1. CONTRACT

THIS CONTRACT (“Contract”) is made between the City of Minneapolis, a Minnesota municipal corporation (“City”), and [vendor name] a [entity type] (“Contactor”), for [short contract description] services to be provided under the terms of this Contract.

2. SCOPE OF SERVICES

The Contractor agrees to perform the following services for the City:

[scope of services]

[USE IF APPLICABLE:] Services to be provided per the Request for Proposal attached as Exhibit B, as modified by the proposal from the Contractor attached as Exhibit C. If applicable, a project schedule is attached as Exhibit D.

3. COMPENSATION

A. The Contractor will be compensated as follows:

[compensation]

B. Total compensation under this Contract will not exceed $[dollar amount]

C. Invoices: A detailed statement of services rendered (“Invoice”) must be submitted to the Contract Manager on or before the 20th day of each month following the month in which services are rendered. At minimum, each Invoice must include (1) a narrative of the services rendered, the name of the person(s) rendering such service, the hourly rate, and the number of hours or partial hours worked in connection with such service; (2) documentation of all reimbursable expenses and disbursements made on behalf of the City; and (3) the total amount chargeable for the month. The City is under no obligation to honor or pay any Invoices submitted more than 120 days after the Termination Date of the Contract.

D. Expense Reimbursement:

The Contractor must submit any reimbursable expenses and documentation of those expenses with its itemized Invoices. Eligible reimbursable expenses are limited to the following:

[reimbursable expenses]

The City will pay only for reimbursable expenses that are reasonably and necessarily incurred and as provided above. The City reserves the right to dispute any invoice submitted without adequate documentation supporting any requested reimbursements. The City also reserves the right to seek reimbursement if it is discovered that the City made any improper payments to the Contractor during this Contract. The total amount for compensation, including reimbursable expenses, may not exceed the maximum compensation specified above.

The Contractor must get prior approval for all travel-related expenses from the City Department Contract Manager. The Contractor will only be reimbursed for the types of travel expenses that are allowed for travelling by City employees and for an amount that does not exceed the maximum reimbursements available to City employees. All travel must be conducted in accordance with the City’s Travel Reimbursement Conditions for Contractors.

Also, if applicable and at the City’s option, the City will reimburse the Contractor for mileage using the IRS “deductible” rates rather than paying the Contractor’s costs for a rental vehicle.

The City will not reimburse Contractor for any rental vehicle insurance or refueling charges.

Note: The sum total for Compensation and eligible reimbursable expenses under this Standard Contract Form shall not exceed One Hundred Seventy-Five Thousand ($175,000) dollars.

4. EFFECTIVE DATE AND TERMINATION DATE

This Contract is in full force and effect from [start date] (“Effective Date”) through [end date] (“Termination Date”) unless otherwise extended by the City or terminated earlier under the https://www2.minneapolismn.gov/media/content-assets/www2-documents/government/ContractorTravelReimbursementConditions(City-paidTravelbyNon-Employees).pdf

Termination, Default and Remedies section. The duration of this Contract including amendments will not exceed five years.

5. ASSIGNMENT OR TRANSFER OF INTEREST

The Contractor will not assign any interest in the Contract, and will not transfer any interest in the same either by assignment or novation, without the prior written approval of the City, which will not be withheld or delayed unreasonably.

6. SUBCONTRACTING OR SUBCONSULTING

The Contractor must not engage in any subcontracting or sub-consulting of any part of the Scope of Services to be provided under this Contract without the City’s prior written approval.

The Contractor must inform the City of the person(s) or entity(ies) selected as a sub-contractor or sub-consultant at the time it requests the City’s written approval. If sub-contacting or sub-consulting is permitted by the City, the Contractor is encouraged to hire, retain, or engage an “Approved Small Business Enterprise” as that term is defined in Chapter 18A of the Minneapolis Code of Ordinances, and will provide a report on efforts to retain Approved Small Business Enterprises for any subcontracting or sub-consulting services at the City’s request.

7. CONTRACT ADMINISTRATION

All provisions of this Contract will be coordinated and administered by the Contract Manager identified in the Notices section. The City will monitor the performance of the Contractor against goals and performance standards as provided in the Scope of Services. The City’s Contract Manager identified in Section 19 below will provide written notice if the City determines that the Contractor’s performance is substandard. Where no performance standards or goals have been identified in the scope of Service, then performance will be determined using standards applicable to the Contractor’s profession or industry.

8. PRIOR UNCURED DEFAULTS

Pursuant to Section 18.110 of the City’s Code of Ordinances, the City may not contract with persons or entities that have defaulted under a previous contract or agreement with the City and have failed to cure the default.

9. INDEPENDENT CONTRACTOR

Nothing contained in this Contract is intended to, or should be construed in any manner, as creating or establishing the relationship of employer/employee between the parties. The Contractor will remain an independent Contractor at all times with respect to the work or services to be performed under this Contract. Any and all employees of Contractor or other persons engaged in the performance of any work or services required by Contractor under this Contract will be considered employees or subcontractors of the Contractor only and not of the City; and any and all claims that might arise, including Worker’s Compensation claims under the Worker’s Compensation Act of the State of Minnesota or any other state, on behalf of said employees or other persons while so engaged in any of the work or services to be rendered or provided herein, will be the sole obligation and responsibility of the Contractor.

10. ACCOUNTING STANDARDS

The Contractor agrees to maintain the necessary source documentation and enforce sufficient internal controls as dictated by generally accepted accounting practices (GAAP) applicable to the Contractor to properly account for expenses incurred under this Contract.

11. CONTRACTOR’S INSURANCE

The Contractor will maintain the types of insurance and limits of coverage identified in Exhibit A, which is attached and made part of this Contract.

12. RETENTION OF RECORDS

Pursuant to Minnesota Statutes, Section 138.17 and Section 15.17, the Contractor will retain all records pertinent to expenditures incurred under this Contract in a legible form for a period of six years commencing after the later of contract close-out or resolution of all audit findings. Records for non-expendable property acquired with funds under this Contract will be retained for six years after final disposition of such property.

13. DATA PRACTICES

The Contractor agrees to comply with the Minnesota Government Data Practices Act, Minnesota Statutes, Chapter 13, (“the Act”), and all other applicable state and federal laws relating to data privacy or confidentiality. The requirements of Minnesota Statutes, Section 13.05, subdivision 11 apply to this contract. The Contractor will comply with the Act and be subject to penalties for non-compliance as though it were a “governmental entity.” If sub-contracting or sub-consulting is permitted under this Contract, each sub-contracting or sub-consulting agreement must include the sub-contractor or sub-consultant’s agreement to comply with the Act. The Contractor must immediately report to the City any requests from third parties for information relating to this Contract. The City agrees to promptly respond to inquiries from the Contractor concerning data requests. The Contractor agrees to hold the City, its officers, and employees harmless from any claims, liability, loss, damage, expense, or judgment, including reasonable attorneys’ fees, resulting from the Contractor’s disclosure or use of data protected under state and federal laws. The Contractor’s duty to comply with Minn. Stat. Chap. 13 and all other applicable federal and state laws relating to the protection of data will continue past the expiration of this contract.

14. COMPLIANCE WITH THE LAW

The Contractor agrees to abide by the requirements and regulations of The Americans with Disabilities Act of 1990 (42 U.S.C. Sections 12101-12213) (ADA), the Minnesota Human Rights Act (Minn. Stat. Ch. 363A), the Minneapolis Civil Rights Ordinance (Ch. 139), and Title VII of the Civil Rights Act of 1964 (42 U.S.C. Section 2000e). These laws deal with discrimination based on race, gender, disability, religion and with sexual harassment. In the event the Contractor has questions concerning these requirements, Contractor should request necessary clarifications from the City. Violation of any of the above laws can lead to termination of this Contract.

15. INSPECTION OF RECORDS

As provided in Minnesota Statutes, Section 16C.05, subdivision 5, the Contractor agrees that the City, the State Auditor or any of their duly authorized representatives, at any time during normal business hours and as often as they may reasonably deem necessary, will have access to and the right to examine, audit, excerpt and transcribe any books, documents, papers, records and accounting practices and procedures that are relevant and involve transactions relating to this Contract for a period of six years after the final payment is made by the City to the Contractor. The inspection will be at the City’s expense unless the City discovers improper payments totaling five percent or more of the contract value, in which case the Contractor will reimburse the City for any improper payments as well as the City’s reasonable inspection costs.

16. LIABILITY AND INDEMNITY

The Contractor agrees to defend, indemnify and hold harmless the City against any and all claims, liability, loss, damage or expense arising under the provisions of this Contract to the extent caused by the negligent acts or omissions of the Contractor or its employees, agents, subcontractors and sub-consultants.

17. TERMINATION, DEFAULT AND REMEDIES

The City reserves the right to cancel the Contract without penalty, if circumstances arise which prevent the City from commencing or continuing the project or any phase of the project and at any time if it is determined that the City was fraudulently induced to enter into the contract. In such a situation, the City will issue a written notice to “stop work” and demand the Contractor mitigate any contract-related expenses.

Either party to this Contract may terminate this Contract upon thirty (30) days written notice, except in instances where the Contractor fails to fulfill its obligations under this Contract in a proper and timely manner, or otherwise violates the terms of this Contract, in which case the City has the right to terminate this Contract if the Contractor has not cured the default within seven (7) days after receipt of written notice of the default from the City.

Notwithstanding the Liability and Indemnity Section or this Termination, Default and Remedies Section, the Contractor will not be relieved of liability to the City for damages sustained by the City as a result of any breach of this Contract by the Contractor. The City may, in such event, withhold payments due to the Contractor for the purpose of set-off until such time as the exact amount of damages due to the City is determined. The rights or remedies provided here will not limit the City, in case of any default, error or omission, by the Contractor, from asserting any other right or remedy allowed by law, equity, or by statute. Nothing in this Contract will be construed as a waiver of any right, remedy, liability limit or immunity of the City or the Contractor under law.

18. DISPUTE RESOLUTION

If a dispute arises out of or relates to this Contract, or the alleged breach thereof, the aggrieved party will first notify the other party in writing of the specific facts resulting in the dispute, as well as the aggrieved party’s desired remedy (“Notice of Dispute”). Representatives of the parties must promptly meet and attempt in good faith to negotiate a resolution of the dispute.

If the dispute is not resolved within sixty days of the receipt of the Notice of Dispute, the parties may jointly select a mediator to facilitate further discussion and conduct non-binding mediation. The parties will equally share the fees and expenses of this mediator. Engaging in this or another mutually agreed on dispute resolution procedure is a condition precedent to litigation except that the City may bring litigation without engaging in dispute resolution if in the City’s sole discretion, litigation is needed to address an emergency.

19. NOTICES

All notices authorized or required under this Contract must be in writing. Notice will be deemed to have been given when delivered personally, emailed, or when deposited in the United States mail, registered, or certified postage prepaid, addressed as follows, or addressed to any such party at such other address as such party will hereafter furnish by notice to the other party:

CONTRACTOR:

[Vendor name] [Contact name] [Address] [Email, phone]

CITY OF MINNEAPOLIS:

[name], Department Head [name], Contract Manager address Contact Phone:

Contact Email:

20. INTELLECTUAL PROPERTY

All Work produced by the Contractor under this Contract is classified as “work for hire” and upon payment by the City to the Contractor will be the exclusive property of the City and will be surrendered to the City immediately upon completion, expiration, or cancellation of this Contract. “Work” covered includes all reports, notes, studies, photographs, designs, drawings, specifications, materials, tapes or other media and any databases established to store or retain the Work. The Contractor may retain a copy of the work for its files in order to engage in future consultation with the City and to satisfy professional records retention standards. The Contractor represents and warrants that the Work does not and will not infringe upon any intellectual property rights of other persons or entities. If any Work does not qualify as a work for hire, Contractor grants the City a perpetual, nonexclusive, royalty free license to the work.

Each party acknowledges and agrees that each party is the owner of all right, title, and interest in and to its services, products, software, source and object code, specifications, designs, techniques, concepts, improvements, discoveries, and inventions including all intellectual property rights thereto, including without limitations any modifications, improvements, or derivative works thereof, created prior to, or independently, during the terms of this Contract. This Contract does not affect the ownership of each party’s pre-existing, intellectual property. Each party further acknowledges that it acquires no rights under this Contract to the other party’s pre-existing intellectual property, other than any limited right explicitly granted in this Contract.

21. CONFLICT OF INTEREST/CODE OF ETHICS

Pursuant to Section 15.250 of the City’s Code of Ordinances, both the City and the Contractor are required to comply with the City’s Code of Ethics. Chapter 15 of the Code of Ordinances requires City officials and the Contractor to avoid any situation that may give rise to a “conflict of interest.” A “conflict of interest” will arise if Contractor represents any other party or other client whose interests are adverse to the interests of the City.

As it applies to the Contractor, the City’s Code of Ethics will also apply to the Contractor in its role as an “interested person” since Contractor has a direct financial interest in this Agreement. The City’s Code of Ethics prevents “interested persons” from giving certain gifts to employees and elected officials.

Contractor certifies that it does not have any conflict of interest as defined in the City’s Code of Ethics. Contractor further certifies that, to the best of its knowledge, no City employee or elected official has any pecuniary interest in the business of Contractor or with this Contract and no person associated with Contractor has any interest that would conflict in any manner or degree with the performance of this Contract.

22. MISCELLANEOUS PROVISIONS

1. Successors and Assigns – This Contract will be binding upon and inure to the benefit of the successors and assigns of the City and of the Contractor.

2. Severability – If any provision of this Contract is held invalid or unenforceable, such invalidity or unenforceability will not affect any other provision, and this Contract will be construed and enforced as if such invalid or unenforceable provision had not been included.

3. No Partnership or Joint Venture – Neither the City nor the Contractor is an agent, partner, or joint venturer of the other for any purpose or has any authority to bind the other.

4. No Third-Party Beneficiaries – This Contract does not create any third-party beneficiary rights in any individual or entity that is not a party to this Contract.

5. Applicable Law – This Contract will be governed by and construed according to the laws of the State of Minnesota without regard to its conflict of law provisions.

Venue for all legal proceedings arising out of this Agreement, or breach thereof, must be in the state or federal court with competent jurisdiction in Hennepin County, Minnesota.

6. Waiver – Failure to enforce any provision of this Contract does not affect the rights of the parties to enforce such provision in another circumstance. Neither does it affect the rights of the parties to enforce any other provision of this Contract at any time.

7. Conflict and Priority – This Contract takes precedence over any attachments, Exhibits, or terms and conditions that may be attached to this Contract. If a conflict is found between the provisions in this Contract and any attachments, the terms of the Contract will prevail. If the Contract was awarded by RFP, the provisions in the following rank order will take precedence: 1) Contract; 2) Proposal; and last 3) Request for Proposals.

8. Amendments – Any amendments to this Contract will be in writing and signed by both the City and the Contractor. Including any amendments, total compensation (including reimbursable expenses) may not to exceed $175,000 per the Compensation Section and the term may not exceed five years.

9. Counterparts/Electronic Signatures – This Contract may be executed in counterparts, each of which has the effect of an original. An electronic signature will be deemed an original signature.

10. Entirety of Contract – This Contract and the included Attachments/Exhibits constitute the entire and exclusive Contract of the parties.

The parties being in agreement have caused this Contract to be signed as follows:

FOR THE CONTRACTOR:

Signature:

Title:

By signing this Contract, I represent that I have the authority to enter into and bind the Contractor to this Contract.

FOR THE CITY (Authorized Signatory for the Responsible Department):

Signature:

Title:

By signing this Contract, I represent that I have the authority to enter into and bind the City to this Contract.

Procurement Review (Initial):

Exhibit A

Standard Agreement Insurance Form

Please find below insurance requirements for the Contractor and any permitted subcontractor or sub-consultant. Without written evidence of insurance coverage from each subcontractor or sub-consultant, the Contractor will either provide insurance coverage for the subcontractor(s) or sub-consultant(s) or assume full liability for their acts and omissions. Please fill in a-e.

Contractor must check one box under each insurance area and sign at the bottom. Please note:

No changes or additions can be made to this form other than indicating self-insurance status (if applicable, also attach a letter that outlines self-insurance coverage).

a) 1. Workers’ Compensation Insurance that meets the statutory obligations with Employer’s

Liability limits of at least $100,000 each accident, $500,000 disease policy limit, and $100,000 disease each employee.

Attached is a certificate evidencing above insurance coverage in force as of the Contract start date.

MN Statute Chapter 176 does not apply because Contractor has no employees and will not have any during the life of the Contract.

Contractor is exempt under MN Statutes Chapter 176.041, and attached is a memorandum explaining and evidencing the exemption.

2. Workers Compensation Insurance for non-employees providing services under this Contract (i.e., subcontractors). Contractors assume full Workers’ Compensation liability for uninsured sub-contractors.

Attached is a certificate evidencing Workers Compensation insurance coverage in force as of the Contract start date (either umbrella coverage by Contractor or separate coverage by non-employees).

Non-employees such as subcontractors will not provide any services under this Contract.

All non-employees such as subcontractors performing work associated with the Contract are exempt under MN Statutes Chapter 176.041, and attached is a memorandum explaining and evidencing the exemption.

b) Commercial General Liability Insurance. The policy must be on an “occurrence” basis, must include contractual liability coverage and provide coverage limits at least equal to $2,000,000 per claim and $2,000,000 aggregate. The City must be named an “additional insured” on Contractor’s policy and must be indicated on the ACORD declaration form.

Attached is a certificate evidencing above insurance coverage in force as of the Contract start date.

c) Commercial Automobile Liability insurance covering all owned, non-owned and hired automobiles at coverage limits at least equal to $1,000,000 per claim and $1,000,000 aggregate for all claims arising from the same occurrence.

Attached is certificate evidencing above insurance coverage in force as of the Contract start date.

Contractor’s personal auto liability insurance coverage addresses the risk. Attached is a letter from insurance agent stating that personal automobile insurance policy covers business usage of all automobile(s) that will be used during the life of this Contract.

Contractor will not drive or hire any automobiles while performing services under this Contract.

d) Professional Liability Insurance providing coverage for the claims that arise from the errors of Contractor, its subcontractors or sub-consultants, omissions of Contractor, its subcontractors or sub-consultants, failure to render a professional service by Contractor, its subcontractors or sub-consultants, or the negligent rendering of the professional service by Contractor, its subcontractors or sub-consultants, at coverage limits at least equal to $2,000,000 per claim and $2,000,000 for all claims that arise during the coverage period. The insurance policy must provide the protection stated for two years after completion of work.

Attached is a certificate evidencing above insurance coverage in force as of the Contract start date.

The Contractor is not providing services under this Contract which would enable the Contractor to obtain professional liability insurance. To the extent that Contractor otherwise fails to obtain professional liability insurance, the Contractor agrees to assume full responsibility for any and all damages that occur as a result of Contractor’s, its subcontractors’ or sub-consultants’ negligent acts, errors or omissions.

e) Cyber Liability Insurance providing coverage for the claims that arise from the disclosure of private…