BPM, LLP ~ C210101 ~ Information Security Assessment Services CITY OF TIGARD,OREGON-CONTRACT SUMMARY FORM
THIS FORMMUSTACCOMPANYEVERY CONTRACT
Contract Title: Information Security Assessment Services Number: C210101
Contractor: BPM, LLP Contract Total: $34,300
Contract Overview: Cybersecurity risk assessment.Assist with developing and implementing appropriate
safeguards.
Initial Risk Level: ❑ Extreme ❑ High ® Moderate ❑ Low
Risk Reduction Steps:
Risk Comments:
Risk Signature:
Contract Manager: KeHy Johnson Ext: 2771 Department: IT
Type: ❑ Personal Svc ❑ Professional Svc ❑ Public Imp ❑ General Svc ® Coop Purchase
❑ Other: Start Date: End Date:
Quotes/Bids/Proposal: FIRM AMOUNT/SCORE
N/A
Account String: Fund-Division-Account Work Order—Activity Tyke Amount
FY
FY
FY
FY
FY
Approvals - LCRB Date:
Department Comments:
Department Signature:
Purchasing Comments:
Purchasing Signature:
City Manager Comments:
City Manager Signature:
After securing all required approvals, forward original copy to the Contracting and Purchasing Office along with a
completed Contract Checklist.
CITY OF TIGARD PARTICIPATING AGREEMENT# C210101
STATE OF OREGON AND THE OREGON COOPERATIVE PURCHASING PROGRAM (ORCPP)
through
ORCPP AGREEMENT#8263
BPM,LLP
184 East 111h Avenue,Suite 210
Eugene,OR 97401
RE: Information Security Services
SPECIFICATIONS FOR SERVICES: Contractor provides services for the City of Tigard as described in the State of Oregon Master
Services Agreement#8263 and as described in Attachment 1—City of Tigard Proposal.
EFFECTIVE DATE AND DURATION:The initial term of this Agreement shall begin on February 16,2021 and expires on June 30,2021
unless terminated sooner as provided herein.
CONSIDERATION: The City agrees to pay Contractor a sum not to exceed$34,300.00 for provision of and completion of the work in
accordance with the schedule identified in Attachment 1 herein attached. Interim payments shall be made to the Contractor with the
Contractor billing the City on a monthly basis for the total amount worked.Tax exemption certificates can be furnished to Contractor upon
request.
INSURANCE: Contractor and its subcontractors must maintain insurance acceptable to the City in full force and effect through the term
of this Agreement. Such insurance must cover risks arising directly or indirectly out of Contractor's activities or work hereunder,including
the operations of its subcontractors of any tier.
Additional Insured Provisions: All required insurance policies other than Workers'Compensation and Professional Liability,must name the
City its officers,employees,agents and representatives as additional insureds with respect to this Agreement.
Certificates of Insurance: Prior to full execution of this Agreement,contractor will furnish the City with the required Certificate of Insurance
referencing this Agreement by number,if known,coverage dates,amount,and type of insurance required by this Agreement.
BUSINESS LICENSE: Prior to execution of any performance under this Agreement,contractor must obtain a City of Tigard Business
License.
HOURS OF LABOR,PAY EQUITY: In accordance with ORS 279B.235,the following are hereby incorporated in full by this reference:
Contractor may not employ an individual for more than 10 hours in any one day,or 40 hours in any one week,except as provided by law. For
contracts for personal services,as defined in ORS 279A.055,Contractor must pay employees at least time and a half pay for all overtime the
employees work in excess of 40 hours in any one week,except for employees who are excluded under ORS 653.010 to 653.261 or under 29
U.S.C.201 to 209 from receiving overtime.
Contractor must give notice in writing to employees who work on a public contract,either at the time of hire or before commencement of
work on the contract,or by positing a notice in a location frequented by employees,of the number of hours per day and days per week that
the employees may be required to work.
Contractor may not prohibit any of Contractor's employees from discussing the employee's rate of wage, salary, benefits or other
compensation with another employee or another person and may not retaliate against an employee who discusses the employee's rate of
wage,salary,benefits or other compensation with another employee or another person.
Contractor must comply with the pay equity provisions in ORS 652.220. Compliance is a material element of this Agreement and failure to
comply will be deemed a breach that entitles City to terminate this Agreement for cause.
Attached: State of Oregon Master Services Agreement
City of Tigard Participating Agreement#C210101 Page 1 of 2
CONTRACT NUMBER: C210101
CONTRACT TITLE: Information Security Assessment Services
CITY OF TIGARD BPM,LLP
Signature Signature
Steve Rymer David Trepp, Partner in Charge BPM LLP
Printed Name Printed Name
02/22/2021 February 2, 2021
Date Date
City of Tigard Participating Agreement#C210101 Page 2 of 2
Master Services Agreement #8263
This Master Services Agreement (" MSA") is between the State of Oregon ( 'State")
acting by and through its Department of Administrative Services ("DAS") on behalf
of state agencies and members of the Oregon Cooperative Purchasing Program
("Authorized Purchasers") and BPM , LLP ("Consultant") .
Recitals
A. DAS desires to engage Consultant through this MSA to make available to
DAS and other Authorized Purchasers certain Information Security Services , as
described on Exhibit B ( "Services") .
B . On January , 2018 , DAS issued RFP #DASPS- 1410- 18 to provide authority to
award contracts to Consultant and other providers of the Services . This is not an
exclusive agreement.
C . Consultant desires to perform the Services for DAS , agencies of the State of
Oregon that are subject to DAS procurement authority according to ORS
279A. 050 and 279A. 140 and that are authorized to use this MSA through a
delegation of authority according to OAR 125-246-0170 ("Authorized Agencies") ,
and any non-Authorized Agency participant in the Oregon Cooperative
Purchasing Program operated by DAS (" ORCPP Member") , pursuant to the
terms of this MSA. DAS , Authorized Agencies and ORCPP Members are
collectively referred to as "Authorized Purchasers . "
Agreement
DAS and Consultant agree as follows :
I . Purpose of MSA. This MSA establishes terms and conditions applicable to
Consultant and DAS in connection with the Services , including but not limited to :
1 . 1 . the form of the ordering instruments to be used by Authorized Agencies
and Consultant to enter contracts for Services , including Work Order Contracts
("WOCs") or other ordering instruments (collectively, " Contracts") ;
1 .2. the terms and conditions applicable to Contracts ;
1 .3, the process through which Contracts will be created ; and
1 .4. the pricing applicable to Contracts .
This MSA is Basecamp agreement and is subject to the provisions of the Vendor
Management Program . Consultant shall comply with all requirements of the
Vendor Management Program ,
Authorized Agencies and Consultant may enter into binding and enforceable
contracts for Services only by execution of Contracts , substantially in the forms
attached hereto as Exhibits C- 1 and C-2 .
Page 1 of 60
Other Authorized Purchasers may enter into Contracts substantially in the form of
Exhibits C- 1 and C-2 , but are not required to do so and may use forms or other
ordering instruments as agreed upon by the Authorized Purchaser and Consultant.
Each Contract will specify the Services to be performed , the associated
deliverables to be delivered , and will incorporate the terms and conditions in
Exhibit A as applicable to the Contract.
2. Effective Date and Term . This MSA is effective on the later of (i) , August 1 , 2018
or (ii) the date that it has been executed by DAS and Consultant, and has been
approved as required by applicable law (" Effective Date") . Unless terminated or
extended , this MSA expires on July 31 ) 2020 ("MSA term") . DAS and Consultant
may extend this MSA by written agreement, provided , however, that the MSA term
including the initial term and any renewals will not extend longer than 10 years
from the Effective Date . MSA expiration or termination does not extinguish or
prejudice DAS' right to enforce this MSA with respect to any Consultant breach or
any default or defect in Consultant performance that has not been cured .
3. MSA Documents. This MSA includes the MSA and its exhibits which are
attached and incorporated by reference . If a conflict, inconsistency or ambiguity
exists among any portion of this MSA and any other documents, then the issue
must be interpreted in the following order of precedence , starting with the MSA
less all exhibits:
3. 1 . This MSA less all exhibits ;
3.2. Exhibit A, Contract Terms ;
3 .3 . Exhibit E, Performance Standards and Metrics
3 .4 Exhibit B , Description of Services ; Pricing ;
3 .5 . Exhibit F , Insurance
3. 6 . Exhibit D , Volume Sales Report and Vendor Collected Administrative
Fee ; and
3 .7 Exhibit C- 1 , Work Order Contract Form
4. Firm Offer Established ; Pricing Changes .
4. 1 . Firm Offer Established . This MSA constitutes a firm offer by Consultant
regardless of whether any Contract for Services is executed . This MSA is
enforceable as a firm offer pursuant to ORS 2796 . 140 for the MSA term
specified in section 2 , and all pricing in Exhibit B is valid until the MSA expires
or is terminated , unless the pricing is changed according to subsection 4 . 2 .
Notwithstanding ORS 72 . 2050 , obligations under this MSA are not revocable
by Consultant.
Page 2 of 60
4.2. Pricing Changes. Consultant shall keep pricing specified in Exhibit B
fixed for at least the first twelve ( 12) full months of this MSA. Thereafter, DAS
and Consultant may adjust pricing no more than once annually by MSA
amendment. Consultant shall submit all pricing increase requests to DAS in
writing and provide substantiating evidence that each request is based on
demonstrable market changes impacting the cost of. the Services . Pricing
changes will apply to Contracts and amendments to Contracts entered on and
after the effective date of the pricing change .
5 . Non-exclusive MSA; Consultant Selection .
5 . 1 . Non -exclusivity. This MSA is not exclusive. Each Authorized Purchaser
retains the right to contract for Services through any selection process
authorized by law, or to perform the Services itself. Neither DAS nor any other
Authorized Purchaser guarantees that any specific number of Contracts will be
entered or that any specific amount of Services will be required .
5 .2. Consultant Selection . In the event DAS awards more than one Master
Services Agreement, Authorized Purchaser must conduct a best value analysis
process to select the Consultant. Authorized Purchaser shall issue a request
for quote to all Master Services Agreement holders detailing the Service need
and evaluation criteria , including : Service availability, time for delivery or
performance, costs , and any other factors . If Authorized Purchaser elects to
award a Contract, Authorized Purchaser shall award the Contract to the
Consultant with the offer that is in the best interest of Authorized Purchaser.
Authorized Purchaser's determination is final .
5.3 . Successors and Assigns . Consultant may not assign or transfer any of
its interest in this MSA without DAS' prior written consent. Except that,
Consultant may assign or transfer the MSA without DAS ' prior written consent
in the event of merger or sale of substantially all its assets, provided Consultant
sends DAS written notice of the assignment or transfer within thirty (30)
Calendar Days of the effective date of the merger or sale . The MSA and all
Contracts are binding upon and shall inure to the benefit of DAS and
Authorized Purchaser and Consultant and their respective successors and
permitted assigns .
6 . Signed Contract Required for Services .
6 . 1 . Contract Form . DAS and Authorized Agencies must use a WOC or PO
form substantially similar to the forms attached as Exhibits C- 1 or C-2 . ORCPP
Members may use their own forms of WOC or PO as agreed upon with
Consultant.
6 .2, Contract Negotiation . Prior to signing a Contract, Authorized Purchaser
and Consultant may negotiate the specific Services to be included in the
Contract from the Description of Services set forth in Exhibit B , including but
Page 3 of 60
not limited to the cost of the Services . Authorized Purchaser and Consultant
may negotiate a fixed price or maximum amount payable for the Services
under the Contract based on the pricing specified in Exhibit B . Consultant's
pricing under any resulting Contract shall not exceed the pricing specified in
Exhibit B .
6.3 . Contract Content. To order Services , Authorized Purchasers complete
the best value selection process set forth in section 5 . 2 above and must submit
a Contract to the selected Consultant that specifies all of the following :
6.3. 1 . Language stating that the Contract is submitted under this MSA and
the MSA number;
6 .3 .2. Language incorporating all Contract terms and conditions of Exhibit
A into the Contract, which may be modified by ORCPP Members only for
consistency with applicable law;
6 .3 .3 . Clear description of the required Services and associated
deliverables ;
6.3 .4. Rates and maximum amount payable for the Services (including
travel and other expenses) ;
6 .3 .5 . Required delivery schedule for the Services ;
6 .3 .6 . Invoicing address ; and
6 .3 .7. Name of Authorized Purchaser' s authorized representative and
contact information for that individual , including telephone number and e-
mail address .
6 .4. Contract Rejection . Consultant shall reject Contracts that do not comply
with this section 6 . Consultant also shall reject Contracts that are not from
Authorized Purchasers . Consultant may verify ORCPP Members at:
http ://www. oregon , gov/DAS/SSD/SPO/index . shtml .
6 .5 . Contract Creation . Each fully executed Contract creates a separate
contract between Authorized Purchaser and Consultant that is enforceable
according to its terms and is independent of all other executed Contracts .
Each Contract consists only of the terms specified for Contracts in this MSA
and no other terms , regardless of source . DAS is an intended beneficiary
under each Contract between Authorized Purchasers and Consultant. DAS is
not obligated or liable to Consultant under any Contract unless DAS is
purchasing the Services as the Authorized Purchaser.
6 . 6 . Authorized Purchasers ' Liability under Contracts . Consultant shall
look solely to the Authorized Purchaser for any rights and remedies
Consultant may have at law or in equity arising under any Contract between
Consultant and the Authorized Purchaser. Consultant acknowledges and
agrees that DAS is not liable to Consultant under any Contract entered into
between Consultant and an Authorized Agency or an ORCPP Member unless
DAS is purchasing the Services as the Authorized Purchaser,
Page 4 of 60
7 . Payment. Authorized Purchasers will pay Consultant for Services and
associated deliverables according to the payment methodology specified in the
applicable Contract. Authorized Purchasers will pay Consultant only for Services
that Consultant has delivered or completed and Authorized Purchaser has
accepted .
8 . Services ; Pricing . Attached hereto as Exhibit B is a list of the Services and
applicable price available pursuant to this MSA.
Consultant shall perform the Services as set forth in the Statement of Work, in
accordance with the standards and methodologies set forth in the Contract,
Statement of Work, the Performance Standards and Metrics set forth in Exhibit E
attached hereto and as set forth elsewhere in this MSA or applicable Contract.
Consultant may use various software products , applications or tools ("Products") to
perform the Services , provided , however, Consultant may not sell the Products
to Authorized Purchaser pursuant to the provisions of this MSA. Consultant
agrees to perform the Services:
• Employing a methodology that conforms to the standards established by
the Project Management Institute (PMI) as described in the Project
Management Body of Knowledge (PMBOK) , current edition , supplemented
by standards set forth in ISO 12207 ; and
• In compliance with the applicable requirements set forth in DAS/OSCIO
Oregon Statewide IT and Information Security Policies , found at
http://www. oregon . gov/DAS/op/Pages/policies . aspx as those policies are
amended from time to time;
Consultant shall cooperate with Authorized Purchaser and its other contractors or
designated third parties , including its Quality Assurance contractor.
9 . Volume Sales Report and Vendor Collected Administrative Fee .
As set forth in Exhibit D , Consultant shall submit Volume Sales Reports and
Vendor Collected Administrative Fees to DAS .
10 . Representations and Warranties : Consultant represents and warrants to
DAS that:
10 . 1 . Consultant is not an 'officer, " "employee , " or "agent" of DAS , as those
terms are used in ORS 30 .265 ;
10 .2. Consultant fully understands and will perform its obligations under this
MSA;
10 . 3 . Consultant is qualified to do business in the State of Oregon and will
remain qualified throughout the MSA term ;
Page 5 of 60
10 .4. Consultant is not in arrears in the payment of any monies due and
owing the State of Oregon , or any department or agency or political
subdivision thereof, including but not limited to the payment of taxes and
employee benefits , and will not become so during the MSA;
10 .5 . Consultant shall comply with the federal , state , and local laws ,
ordinances , rules, and regulations applicable to Consultant and to-its
performance under this MSA;
10.6. Nondiscrimination in Employment. Consultant certifies , in
accordance with ORS 279A. 112 , that it has in place a policy and practice of
preventing sexual harassment, sexual assault, and discrimination against
employees who are members of a protected classi , as defined by subsection
2( 1 ) (b) of ORS 279A. 112 . As a material condition of this MSA, Consultant
must maintain , throughout the duration of this MSA, a policy and practice that
comply with ORS 279A. 112 , including giving employees written notice of the
Consultant's policy and practice .
10 .7 . Consultant shall comply with the standards established by the Project
Management Institute (PMI ) as described in the Project Management Body of
Knowledge ( PMBOK) , current edition , the Software Engineering Institute and
the Control Objectives for Information and related Technology (COBIT®)
objectives , as well as standards established by DAS for quality assurance
services ;
10 .8 . Consultant shall comply with the applicable requirements set forth in
DAS/OSCIO Oregon Statewide Information Technology and Information
Security Policies , found at,
http ://www oregon . gov/dasIOSCIO/Documents/2017%201S0 %2OStandards %
200regon . pdf and the requirements and policies set forth in the Vendor
Management Onboarding Guide , found at:
http ://www ore.gon . goylbasecamp/Documents/New Vendor Onboardinq Gui
de V. 1 . pdf, as those policies and requirements may be amended from time
to time ;
Subsection 2(1)(b) of ORS 279A. 112_ contains an expansive definition of the term "protected class":
(b) "Protected class" means a group of people that state or federal law protects from
employment discrimination including, but not limited to, a group in which membership depends on an ascribed association or
identification, or an individual's voluntary association or identification with other individuals, on the basis of one or more of these
characteristics:
(A) Race, color or ethnicity;
(H) National origin;
(C) Sex;
(D) Gender, including actual or perceived gender identity;
(E) Sexual orientation;
(F) Disability;
(G) Age;
(H) Marital status; or
m Religion.
Page 6 of 60
10 . 9 . Consultant is not in violation of, charged with nor, to the best of
Consultant's knowledge , under any investigation with respect to violation of,
any provision of any federal , state or local law, ordinance or regulation or any
other requirement or order of any governmental or regulatory body or court or
arbitrator applicable to provision of the Services , and Consultant's provision of
the Services shall not violate any such law, ordinance , regulation or order;
10 . 10 . Consultant's performance under this MSA to the best of Consultant's
knowledge creates no potential or actual conflict of interest, as defined by
ORS 244 , for either Consultant or any Consultant personnel that will perform
the Services under this MSA;
10 . 11 . Consultant represents and warrants that the personnel providing
Services under this MSA are employees of Consultant; that Consultant
withholds applicable income taxes from the pay of its employees ; that
Consultant pays workers' compensation insurance premiums arising from the
employment of its employees under this MSA; that Consultant makes all other
applicable tax and related payments arising from that employment (including
without limitation social security tax payments) ; and that Consultant provides
employee benefits to its employees , including without limitation health
insurance benefits , vacation benefits , and retirement benefits ;
10 . 12. Consultant (to the best of Consultant's knowledge) , for a period of no
fewer than six (6) Calendar years preceding the Effective Date , faithfully has
complied with :
10 . 12. 1 . All tax laws of this state and any political subdivision , including
but not limited to ORS 305 .620 and ORS chapters 316 , 317 , and 318 ;
10 . 12 .2 . Any tax provisions imposed by a political subdivision of this state
that applied to Consultant, to Consultant' s property, operations , receipts ,
or income , or to Consultant's performance of or compensation for any
work performed by Consultant;
10 . 12.3 . Any tax provisions imposed by a political subdivision of this state
that applied to Consultant, or to goods , services , or property, whether
tangible or intangible , provided by Consultant; and
10 . 12 .4. Any rules , regulations , charter provisions , or ordinances that
implemented or enforced any of the foregoing tax laws or provisions .
10 . 13 . Consultant possesses and will maintain at its own expense all
required licenses , certifications and permits necessary to deliver Services
under this MSA and all Contracts ;
10 . 14. Consultant has the power and authority to enter into and perform this
MSA and all Contracts ;
Page 7 of 60
10 . 15. This MSA, when executed and delivered , is a valid and binding
obligation of Consultant enforceable according to its terms ;
10 . 16 . Consultant has the skill and knowledge possessed by well-informed
members of its trade or profession and Consultant will apply that skill and
knowledge with care and diligence so Consultant and Consultant's employees
and any authorized subcontractors perform the Services specifications and
acceptance criteria in this MSA and the Contract; the performance of the
Services will meet or exceed the Performance Standards and Metrics and
service level guarantees set forth in Exhibit E attached hereto ; and
Consultant shall , at all times during the term of this MSA and any Contract, be
qualified , professionally competent, and duly licensed to and perform the
Services ;
10 . 17 . If Consultant uses any Products to perform the Services , the Products
will materially conform to acceptance criteria set forth in the MSA and the
Contract , including the Statement of Work and any Documentation provided
by Consultant, and are free from error or defect that materially impairs their
use , and be free from material defects in materials , workmanship , or design ;
10 . 18 . Except as otherwise provided in this MSA or a Contract and to the
extent necessary , Consultant shall provide Authorized Purchaser a license or
right to use the Products , free and clear of any and all restrictions on or
conditions of transfer, modification , licensing , sublicensing , direct or indirect
distribution , or assignment, and free and clear of any and all liens , claims ,
mortgages , security interests , liabilities , and encumbrances of any kind ;
10 . 19 . The Services and Products , if any, are free of what are commonly
defined as viruses , backdoors , worms , spyware , malware and other malicious
code that will hamper performance of the software , collect unlawful personally
identifiable information on users , or prevent the software from performing as
required under the terms and conditions of this MSA or a Contract.
Notwithstanding the foregoing , this representation and warranty does not
include a disabling device that limits , suspends or ends use of the Products or
Services expressly permitted by the terms and conditions by the license
under which it was provided ; and
10 .20 . When used as authorized by this MSA, no Work Product infringes nor
will Authorized Purchaser's use , duplication or transfer of the Work Product
infringe any copyright, patent, trade secret or other proprietary right of any
third party.
DISCLAIMER OF WARRANTIES : THE WARRANTIES SET FORTH IN THIS
SECTION 10 ARE IN LIEU OF ALL OTHER WARRANTIES , EXPRESS OR
IMPLIED , INCLUDING , BUT NOT LIMITED TO , ANY IMPLIED WARRANTIES
OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE ,
INTEGRATION , PERFORMANCE AND ACCURACY AND ANY IMPLIED
Page 8 of 60
WARRANTIES ARISING FROM STATUTE, COURSE OF DEALING , COURSE
OF PERFORMANCE OR USAGE OF TRADE .
11 . MSA Default. Consultant is in default of this MSA if:
11 . 1 . Consultant fails to honor pricing at least at or lower than the pricing
specified in Exhibit B ; or
11 .2 . Consultant violates or fails to perform any material covenant,
representation , warranty, obligation or certification under this MSA.
Before Consultant can be found in default of this MSA, DAS shall first deliver a
notice of default to Consultant. The notice must describe the specific nature of the
default, cite the specific provisions of this MSA that have been violated and specify
the time period in which the default must be cured , which in no event will be less
than thirty (30) Calendar Days . In the notice , DAS , in its sole discretion , may
include an opportunity for Consultant to cure any default in its performance of this
MSA through a Performance Improvement Plan . Consultant shall be required to
successfully complete the Performance Improvement Plan in order to be found to
have cured the specified default(s) .
12 . Remedies for Default. If Consultant is in default under section 11 or has
failed to meet the requirements of the Vendor Management Performance
Improvement Plan or otherwise failed to cure the default within the time period set
forth in the notice or Plan , DAS may, at its option , pursue any or all remedies
available to it under this MSA and at law or in equity, including without limitation ,
termination of this MSA pursuant to section 13 or pursuing a claim for damages ,
or both .
13. Termination .
13 . 1 . Mutual Termination . The parties may terminate this MSA upon the
date specified in written agreement.
13 .2. DAS ' Right to Terminate . DAS may, at its sole discretion , terminate
this MSA as follows :
13 . 2 . 1 . DAS may terminate this MSA upon thirty (30) Calendar days' prior
written notice to Consultant or any later date as specified in the written
notice ; or
13 .2 . 2 . DAS may terminate this MSA immediately if federal or state laws ,
regulations or guidelines are modified in such a way that would prohibit
any party's performance under this MSA.
13 . 3 . DAS' Right to Terminate for Cause . In addition to any other rights
and remedies DAS may have under this MSA, DAS may terminate this MSA,
Page 9 of 60
in whole or in part, immediately upon written notice to Consultant of
Consultant's default and failure to cure under sections 11 and 12 .
13 .4. Effect of MSA Termination or Expiration on Contracts . Upon
termination or expiration of this MSA, Consultant shall continue to provide the
Services and access to the Products , as necessary, and meet its obligations
under all effective Contracts issued prior to MSA termination or expiration ,
unless such Contract is otherwise terminated pursuant to its terms . The
termination or expiration of this MSA will be without prejudice to the rights of
the parties accrued up to the date of such termination or expiration .
14. Consultant's Compliance with Tax Laws .
14. 1 . Consultant must, throughout the term of this MSA and any extensions,
comply with all tax laws of this State and all applicable tax laws of any political
subdivision of this State . For the purposes of this section , "tax laws" includes
all the provisions described in subsection 10 . 12 of this MSA.
14. 1 . Any violation of this subsection 12 . 1 constitutes a material breach of
this MSA. Further, any violation of Consultant's warranty in subsection 10 . 12
of this MSA, that Consultant has complied with the tax laws of this State and
the applicable tax laws of any political subdivision of this State , also
constitutes a material breach of this MSA. Any violation shall entitle DAS to
terminate this MSA, to pursue and recover any and all damages that arise
from the breach and the termination of this MSA, and to pursue any or all of
the remedies available under this MSA, at law, or in equity, including but not
limited to :
14. 1 . Termination of this MSA, in whole or in part;
14.2. Exercise of the right of setoff, and withholding of amounts otherwise
due and owing to Consultant, in an amount equal to State's setoff right,
without penalty; and
14.3 . Initiation of an action or proceeding for damages , specific
performance , declaratory or injunctive relief. DAS shall be entitled to
recover any and all damages suffered as the result of Consultant's breach
of this MSA, including but not limited to direct, indirect, incidental and
consequential damages , costs of cure , and costs incurred in securing
replacement Services , replacement Consultant, or any of the above .
These remedies are cumulative to the extent the remedies are not
inconsistent, and DAS may pursue any remedy or remedies singly,
collectively, successively, or in any order whatsoever.
15 . Indemnity. Consultant shall defend , save, hold harmless , and
indemnify the State of Oregon and DAS , and their officers , employees and
agents from and against all third party claims , suits , actions , losses ,
Page 10 of 60
damages , liabilities , statutory penalties , costs and expenses of any nature
whatsoever, including personal injury, death , damage to real property and
damage to tangible or intangible personal property resulting from , arising
out of, or relating to the intentional , reckless or negligent acts or omissions
of Consultant or its officers , employees , subcontractors , or agents under
this MSA or any Contract including :
15 . 1 . Any claim that Consultant, a subcontractor, or Consultant's staff
or a subcontractor's staff are employees of the State or Authorized
Purchaser for any reason ; and
15 .2 Any claim against the State or Authorized Purchaser, which , if true,
would constitute a breach by Consultant of any of the duties ,
obligations , representations , warranties, or covenants set forth in this
MSA.
Without limiting the generality of the foregoing , Consultant will have no
obligation to indemnify the State of Oregon or DAS from and against any
claims , suits , actions, losses , damages , liabilities , costs and expenses
attributable solely to the acts or omissions of DAS or its officers,
employees or agents .
16 . Insurance. Consultant, at its sole cost, shall obtain and maintain the
minimum insurance coverages set forth on Exhibit F or as otherwise required by
DAS . Authorized Purchaser may request additional or other coverage under a
Contract, as Authorized Purchaser deems necessary.
17 . Governing Law. This MSA is governed by and construed according to the
laws of the State of Oregon without regard to principles of conflict of laws .
18 . Venue and Consent to Jurisdiction . Any claim , action , suit, or proceeding
(collectively, "Claim") between DAS and Consultant that arises from or relates to
this MSA must be brought and conducted solely and exclusively within the Circuit
Court of Marion County for the State of Oregon ; provided , however, if a Claim
must be brought in a federal forum , then it must be brought and conducted solely
and exclusively within the United States District Court for the District of Oregon .
CONSULTANT BY EXECUTION OF THIS MSA HEREBY CONSENTS TO THE
IN PERSONAM JURISDICTION OF THE COURTS REFERENCED IN THIS
SECTION 18 . In no event may this section be construed as (i) a waiver by the
State of Oregon of any form of defense or immunity, whether sovereign
immunity, governmental immunity, immunity based on the eleventh amendment
to the Constitution of the United States or otherwise , from any claim , or (ii)
consent by the State of Oregon to the jurisdiction of any court.
19 . MSA Contract Administrators . The MSA Contract Administrators for DAS
and for Consultant are the individuals identified in this section 19 or any other
individual identified in writing as the MSA Administrator to the other party.
Page 11 of 60
DAS MSA Contract Administrator: Consultant MSA Contract
Administrator:
Debbie Davis David Trepp , Partner IT
1225 Ferry St. SE , Salem OR 97301 Assurance
(503) 378-5345 PO Box 22303 Eugene, OR 97402
Debbie . m . davis@oregon .gov (877) 328=7475
d avi dt@i nfoatrisk. com
20 . Amendment. This MSA may be amended , modified , or supplemented only
by a written amendment signed by DAS and Consultant. Any amendment that
provides for additional Services or other services may only provide for Services
or other services directly related to the scope of Services , goods and services
described in the solicitation , and no amendment will be effective until all requisite
signatures and approvals are obtained . Either DAS or Consultant may request a
change to this MSA, including all Exhibits hereto , by submitting a written proposal
describing the desired change to the other party.
21 . Integration . This MSA and attached Exhibits constitute the entire agreement
between the parties on the subject matter hereof. There are no understandings ,
agreements or representations , oral or written , not specified herein regarding this
MSA.
Authorized Signatures :
Consultant:W
Title : Partner, IT Assurance Date : June 25 , 2018
The State of Oregon acting by and through its Department of Administrative
Service
By7
Title: c °(, (6 :S Q Date :
Approved pursuant to ORS 291 .047
Page 12 of 60
Oregon Department of Justice g�
By: � {�f �Lf(J / /. Date:
Assistan4 AlCorney General
Approved by the Office of the State CIO
as per email dated 7/27/18
Page 13 of 60
EXHIBIT A
to Master Agreement #8263
CONTRACT TERMS AND CONDITIONS
These Contract Terms and Conditions apply to all Contracts issued under this
MSA, including Work Order Contracts or other agreed upon ordering
instruments .
1 . Definitions . In addition to any other terms defined elsewhere in this Contract,
the following defined terms apply:
1 . 1 . "Authorized Purchaser Intellectual Property" means any
background information , data or intellectual property that is owned by
Authorized Purchaser. Authorized Purchaser Intellectual Property includes
any derivative works and compilations of any Authorized Purchaser
Intellectual Property.
1 . 2. " Business Day" means any day Monday through Friday, 8 : 00 a . m . to
5 : 00 p . m . , Pacific Time , excluding State of Oregon holidays and business
closure days .
1 .3 . " Calendar Day" means any day on the Western calendar.
1 .4. "Consultant Intellectual Property" means any intellectual property that
is owned by Consultant and contained in or necessary for the use of the
Deliverables , and may include any software owned by Consultant and
derivative works and compilations of any Consultant Intellectual Property.
1 .5. " Contract" means any Work Order Contract or other agreed upon
ordering instrument issued under this MSA .
1 . 6 . " Deliverables" means all items that Consultant is required to provide to
Authorized Purchaser under a Contract as part of the Services , including
Work Product.
1 .7 . "Third Party Intellectual Property" means any intellectual property
owned by parties other than Authorized Purchaser or Consultant. Third Party
Intellectual Property includes software owned by Third Parties , and derivative
works and compilations of any Third Party Intellectual Property.
1 .8 "Work Product" means everything that is specifically made , conceived ,
discovered , or reduced to practice by Consultant or Consultant's
subcontractors or agents (either alone or with others) pursuant to the
Contract, including every invention , modification , discovery , design ,
development, customization , configuration , improvement, process , software
program , work of authorship , documentation , formula , datum , technique ,
know how, secret , or intellectual property right whatsoever or any interest
therein (whether patentable or not patentable or registerable under copyright
Page 14 of 60
or similar statutes or subject to analogous protection) . Notwithstanding
anything in the immediately preceding sentence to the contrary, Work Product
is not Authorized Purchaser Intellectual Property, Consultant Intellectual
Property, or Third Party Intellectual Property.
2. Non -Exclusive Contract. Consultant acknowledges and agrees that by
executing this Contract, Authorized Purchaser is not granting to Consultant the
exclusive right to or perform the Services or to perform any other services, for
Authorized Purchaser, Authorized Purchaser may contract with other entities to
provide Authorized Purchaser with services or products that are the same or
similar to those provided to Consultant under this Contract or Authorized
Purchaser may perform any or all of the Services itself.
3. Compensation . Following Consultant's delivery or completion , and Authorized
Purchaser's acceptance of the Services , Authorized Purchaser will pay Consultant
as specified in this Contract, based on the pricing established in MSA Exhibit B .
Consultant represents that all pricing for Services under this Contract is equal to
or better than the pricing specified in the MSA.
4, Funds Available and Authorized . Consultant will not be compensated for
Services performed under this Contract by any other agency or department of the
State of Oregon other than Authorized Purchaser. Authorized Purchaser believes
it has sufficient funds currently available and authorized for expenditure to make
payments under this Contract within Authorized Purchaser's biennial appropriation
or limitation . Consultant understands and agrees that Authorized Purchaser's
payments under this Contract are contingent on Authorized Purchaser receiving
appropriations , limitations , or other expenditure authority sufficient to allow
Authorized Purchaser, in the exercise of its reasonable administrative discretion , to
continue to make payments under this Contract.
5 . Invoicing and Payment
5 . 1 . Invoices . Consultant shall submit invoices for completed and accepted
Services or Deliverables according to the payment schedule as set forth in
this Contract. Consultant shall submit invoices to Authorized Purchaser as
designated in this Contract. Consultant shall include the MSA number and
applicable Contract number on all invoices . Consultant also shall include a
description of all Services performed or Deliverables delivered , applicable
pricing , total amount invoiced and the address for payment.
5 .2 . Payment. Authorized Purchaser shall pay all undisputed amounts within
thirty (30) Calendar Days from receipt of each invoice determined to be
correct following Authorized Purchaser's review under section 5 . 3 .
Consultant may assess late payment charges only to the extent permitted by
ORS 293 .462 .
5.3 . Invoice Review / Dispute Process . Authorized Purchaser will review
each invoice and will either approve payment of the amount invoiced or notify
Page 15 of 60
Consultant of any errors or disputed charges . Authorized Purchaser may
withhold payment of any amounts that are disputed .
If an error or dispute arises concerning the amount charged in an invoice ,
Authorized Purchaser will notify Consultant of the disputed charge . Upon
notification of dispute , Consultant shall submit to Authorized Purchaser all
documentation Authorized Purchaser requires to substantiate the amount
charged .
Authorized Purchaser, in its sole discretion , will determine if the supporting
documentation provides sufficient substantiation for the disputed charges . If
Authorized Purchaser determines that the supporting documentation is
sufficient, Authorized Purchaser will notify Consultant and pay Consultant the
amount charged in the invoice . If Authorized Purchaser determines the
supporting documentation supports payment of an amount less than originally
invoiced , Authorized Purchaser will notify Consultant of the amount
Authorized Purchaser believes is due under the invoice , and if Consultant
agrees , Authorized Purchaser will pay the invoice in that lesser amount. If
Consultant does not agree , the matter will be handled in accordance with
section 20 .
6. Performance, Delivery and Acceptance .
6 . 1 . Responsibilities of Consultant. Consultant shall comply with the
requirements of the Vendor Management Program and shall perform the
Services in accordance with the standards and methodologies set forth in the
MSA including the Performance Standards and Metrics set forth in MSA
Exhibit E , and the Statement of Work , attached hereto as Exhibit No . 1 , and
as otherwise set forth in this Contract. Consultant shall cooperate with
Authorized Purchaser and its designated third parties , including providing
access and information on the Services provided and the-Products'
architecture , design , operating environment, interfaces and operating
parameters as necessary .
6 .2 . Delivery and Review of Deliverables . Unless otherwise agreed , within
ten ( 10) Business Days following Consultant's delivery of Services or
Deliverables , or both , Authorized Purchaser will review the Services and
Deliverables to determine whether the Services and Deliverables meet the
Contract requirements . If Authorized Purchaser determines that the Services
and Deliverables meet the Contract requirements , Authorized Purchaser will
notify Consultant of Authorized Purchaser's acceptance. If Consultant
receives no response from Authorized Purchaser within ten ( 10) Business
Days , then the Services or Deliverable will be deemed accepted .
If Authorized Purchaser determines that the Services or Deliverables , or both ,
do not meet the Contract requirements , Authorized Purchaser will notify
Consultant of Authorized Purchaser's rejection . Within ten ( 10) Business
Page 16 of 60
Days , or as otherwise agreed , following Consultant's receipt of Authorized
Purchaser's rejection notice, Consultant shall revise and redeliver to
Authorized Purchaser the rejected Services or Deliverables at Consultant's
sole expense to confirm that the Services or Deliverables meet the Contract
requirements as determined by Authorized Purchaser. Authorized Purchaser
will thereafter review the revised Services or Deliverables and notify
Consultant of Authorized Purchaser's acceptance or rejection in writing-within
a ten ( 10) Business Days following Authorized Purchaser's receipt of
Consultant's revised Services or Deliverables . This process is an iterative
process .
Consultant's failure to deliver Services or Deliverables that meet the
specifications and performance standards after Authorized Purchaser's
second review may constitute a default by Consultant, if Authorized
Purchaser chooses not to allow Consultant any further attempts to revise and
redeliver the Services or Deliverables , or both . Upon such default, Consultant
shall refund to Authorized Purchaser all amounts paid by Authorized
Purchaser for the Deliverables or the Services related to such Deliverables .
All such refunds are in addition to , and not in lieu of, any other remedies
Authorized Purchaser may have for Consultant's default.
6 .3 . Business Continuity Management and Disaster Recovery.
Consultant shall deliver, maintain , and upgrade as necessary , Business
Continuity Management and Disaster Recovery Plan and Procedures for the
Services and Products , acceptable to Authorized Purchaser. In the event of a
disaster, Consultant shall comply with the provisions of and deliver the
Service or access to the Products according to the Business Continuity
Management and Disaster Recovery Plan and Procedures .
6 .4. Performance Standards and Metrics . In its provision of the Services ,
Consultant shall meet the performance standards and metrics as set forth in
MSA Exhibit E .
6 .5. Responsibilities of Authorized Purchaser. If this Contract requires
Authorized Purchaser to provide any information or resources , and
Authorized Purchaser fails to provide the requisite quality or quantity of such
resources , or fails to provide such resources in a timely manner for a period
that does not exceed ten ( 10) Calendar Days , Consultant's sole remedy is an
extension of the applicable delivery dates corresponding to the delay. If
Authorized Purchaser's failure to provide such resources exceeds ten ( 10)
Calendar Days , and Consultant can show to the reasonable satisfaction of
Authorized Purchaser, that Authorized Purchaser's failure has resulted in an
unavoidable increase in the cost of the Services required for the Statement of
Work then Consultant will be entitled to recover from Authorized Purchaser
the reasonable amount of such increased costs . Consultant's right to delay
applicable delivery dates or recover for increased costs may be exercised
only if Consultant provides Authorized Purchaser with reasonable notice of
Page 17 of 60
Authorized Purchaser's failure and Consultant uses commercially reasonable
efforts to perform notwithstanding Authorized Purchaser's failure to perform .
7 . Consultant's Personnel .
7. 1 . Key Persons, Consultant's Key Persons are identified on MSA Exhibit
B or Contract, Exhibit No , 1 . The hourly rates applicable to each Key Person
are specified in MSA Exhibit B . Consultant acknowledges and agrees that a
significant reason Authorized Purchaser selected Consultant and is entering
into this Contract is because of the special qualifications of each Key Person ,
Authorized Purchaser is engaging the expertise , experience , judgment, and
personal attention of such Key Persons under this Contract. Neither
Consultant nor any Key Person shall delegate performance of the duties and
obligations of such Key Person under this Contract to any other employee ,
agent or subcontractor of Consultant unless Authorized Purchaser provides
prior written consent to such delegation . Consultant shall not reassign or
transfer a Key Person to other duties or positions so that the Key Person is no
longer available to provide Authorized Purchaser with that Key Person's
services unless Authorized Purchaser provides prior written consent to the
reassignment or transfer, or the reassignment or transfer is required based on
the termination of employment, illness , death , disability or other similar cause .
If Consultant requests Authorized Purchaser's consent to a delegation ,
reassignment, transfer or other replacement of a Key Person , Authorized
Purchaser may meet with the Key Person and review the qualifications of the
proposed substitute personnel before providing its consent or rejecting such
replacement. Any such replacement shall have substantially equivalent or
better qualifications than the Key Person being replaced . Consultant shall not
charge Authorized Purchaser, and Authorized Purchaser will not pay, for any
replacement Key Person while that Key Person acquires the necessary skills
and knowledge to continue the Services . Such period of non-charge will be
agreed upon by the parties , but not extend for more than twenty-eight (28)
Calendar Days . All replacement personnel approved by Authorized Purchaser
are deemed Key Persons for purposes of this Contract, and this Contract is
deemed amended to include those Key Persons .
7.2. Subcontracts . Consultant shall not enter into any subcontracts for any of
the Services required by this Contract without Authorized Purchaser's prior
written consent. In addition to any other provisions Authorized Purchaser may
require , Consultant shall include in any permitted subcontracts under this
Contract a requirement that the subcontractor be bound by sections 5 , 6 , 8 , 91
11 , 12 , 14 , 17 , 20 , 28 , and 30 of this Contract as if the subcontractor were the
Consultant. Authorized Purchaser's consent to any subcontractor shall not
relieve Consultant of any of its duties or obligations under this Contract.
7 .3 . Successors and Assigns . Neither Party may assign or transfer any of
its interest in this Contract without the other Party's prior written consent. This
Contract is binding upon and shall inure to the benefit of Authorized Purchaser
Page 18 of 60
and Consultant, and their respective successors and permitted assigns .
Consultant may assign or transfer the Contract without Authorized Purchaser's
prior consent in the event of merger or sale of substantially all its assets ,
provided Consultant sends Authorized Purchaser written notice of the
assignment or transfer within thirty (30) Calendar Days of the effective date of
the merger or sale .
7.4 Cooperation . Consultant understands and agrees that , as part of this
Contract, Consultant may be required to work with other contractors of
Authorized Purchaser who may be working on this or similar projects subject
to the provisions related to confidentiality and ownership of intellectual
property herein . Authorized Purchaser and Consultant acknowledge and
agree that this cooperation is essential to the mutual goal of both parties for
accurate and valuable use by Authorized Purchaser. Consultant shall create
and maintain a cooperative working relationship between and among
Authorized Purchaser and other entities and their respective representatives
involved in representing Authorized Purchaser's priorities at the federal and
statewide levels , to further the interests of Authorized Purchaser to result in
the Services being successfully completed on time and within budget.
In the event of a conflict between contractors who must cooperate ,
contractors shall notify the Authorized Purchaser's contract administrator and
abide by Authorized Purchaser's direction (s) . Authorized Purchaser will use
its best efforts to encourage its other entities and their respective
representatives to do likewise .
7. 5 Authorized Purchaser Facilities and Networks ; Access and Security.
Authorized Purchaser shall permit Consultant and Consultant personnel
access to Authorized Purchaser facilities and networks , provided Consultant
and Consultant personnel comply with all Authorized Purchaser security and
access policies , rules , procedures , and regulations for access to Authorized
Purchaser' s facilities and networks . Authorized Purchaser shall make it's
security and access policies , rules , procedures , and regulations , available to
Consultant prior to the commencement of Services for Authorized Purchaser
under this Contract.
8 . Confidentiality / Non =Disclosure.
8 . 1 . Confidential Information . Each party acknowledges that it and its
employees or agents may, in the course of performing its responsibilities
under this Contract, be exposed to or acquire information that is confidential
to the other party or the other party's clients . Any and all information of any
form obtained by one party or its employees or agents in the performance of
this Contract is confidential information of the other party ("Confidential
Information") . The parties shall treat any reports or other documents or items
(including software) which result from the use of the Confidential Information
by the recipient of such information with respect to confidentiality in the same
manner as the Confidential Information .
Page 19 of 60
Confidential Information does not include information that (i) is or becomes
(other than by disclosure by the party acquiring such information) publicly
known or is contained in a publicly available document; (ii) is furnished by the
party disclosing such information to others without restrictions similar to those
imposed by this Contract; (iii) is rightfully in the receiving party's possession
without the obligation of nondisclosure prior to the time of its disclosure under
this Contract; (iv) is obtained from a source other than the discloser without
the obligation of confidentiality, (v) is disclosed with the written consent of the
disclosing party, or; (vi) is independently developed by employees or agents
of the receiving party who can be shown to have had no access to the
Confidential Information .
8 . 2. Duties of Care. The Recipient shall use the same care and discretion to
avoid disclosure , publication or dissemination of Confidential Information as it
uses with its own similar information that it does not wish to disclose , publish
or disseminate . The Recipient may use Confidential Information only for the
purposes of this Contract. The Recipient may disclose Confidential
Information to : a) its officers , employees , subcontractors and affiliates or
other agencies who have a need to know; and b) any other party with the
Discloser's prior written consent. Before disclosure to any of the above
parties , the Recipient will have a written agreement with such party sufficient
to require that party to treat Confidential Information in accordance with this
section 8 .
8 .3 . Prevention of Unauthorized Use or Disclosure . Each party shall use
commercially reasonable efforts to assist the other in identifying and
preventing any unauthorized use or disclosure of any Confidential
Information . Without limitation of the foregoing , each party shall advise the
other immediately in the event it learns or has reason to believe that any
person who has had access to Confidential Information has violated or
intends to violate the terms of this Contract and each party will at its expense
cooperate with the other in seeking injunctive or other equitable relief in the
name of the other against any such person .
8 .4. Identity Theft. In the performance of this Contract, Consultant may
have possession or access to documents , records or items that contain
" Personal Information , " as that term is used in ORS 646A . 602( 11 ) . Personal
Information is a type of Confidential Information that is highly sensitive and
subject to additional protection . Prior to the receipt of, and during the period in
which Consultant has possession of or access to , any Personal Information ,
Consultant shall have and maintain a formal written information security
program that provides safeguards to protect Personal Information from loss,
theft, and disclosure to unauthorized persons , consistent with the Oregon
Consumer Identity Theft Protection Act, ORS 646A. 600-646A. 628 .
Consultant shall not breach or permit breach of the security of any
Personal Information that is contained in any document, record ,
Page 20 of 60
compilation of information or other item to which Consultant receives
access , possession , custody or control under this Contract. Consultant
shall not disclose , or otherwise permit access of any nature , to any
unauthorized person , of any such Personal Information . Consultant
shall not use, distribute or dispose of any Personal Information other
than expressly permitted by Authorized Purchaser, required by
applicable law, or required by an order of a tribunal having competent
jurisdiction .
Consultant shall promptly report to the Authorized Purchaser any
• breach of security, use , disclosure , theft, loss , or other unauthorized
access of any document, record , compilation of information or other
item that contains Personal Information to which the Consultant
receives access , possession , custody or control in the performance of
this Contract.
• Consultant shall require the compliance of its employees , agents , and
subcontractors with this section 8 .
8 .5 . Non -disclosure ; Disclosure Required by Law. Each party agrees
that, except as provided in this Contract or directed by the other, it will not at
any time during or after the term of this Contract disclose , directly or
indirectly, any Confidential Information to any person , and that upon
termination of this Contract each party will turn over to the other all
documents , papers and other matter in its possession which embody
Confidential Information .
If, however, a party receives any request under the Oregon Public Records
Law, the Freedom of Information Act, administrative or court order, or any
other legal request for disclosure of Confidential Information , the party
receiving the request will immediately notify the other party and provide the
other party with the opportunity to protect its information from disclosure ,
including by redaction . Each party is exclusively responsible for defending its
position concerning the confidentiality of its own information ; neither party
assumes liability for the disclosure of information required by law.
8 .6 . NDAs and Background Checks . Consultant agrees to comply with all
reasonable requests by Authorized Purchaser to ensure the confidentiality
and nondisclosure of Authorized Purchaser's Confidential Information ,
including without limitation (i) obtaining nondisclosure agreements from
Consultant's employees and agents who are performing Services and
providing copies of such agreements to Authorized Purchaser, (ii) performing
criminal background checks on each of Consultant's employees and agents
who are performing Services , and providing a copy of the results to
Authorized Purchaser, and (iii) complying with Authorized Purchaser's access
and security policies and procedures .
8 . 7. Public Records Laws . Authorized Purchaser's obligations of
confidentiality, if any , are subject to the Oregon Public Records Laws , ORS
Page 21 of 60
192 . 311 through ORS 192 .478 and the Oregon Custody and Maintenance of
Records Laws , ORS 192 . 005 through192 . 170 .
8 .8 . Injunctive Relief and Other Remedies . Each party acknowledges that
breach of this section 8 , including disclosure of any Confidential Information
may give rise to irreparable injury which may be inadequately compensable in
damages . Accordingly, each party may seek injunctive relief against the
breach or threatened breach of the foregoing undertakings , in addition to any
other legal remedies that may be available . Each party acknowledges and
agrees that the covenants contained herein are necessary for the protection
of the legitimate business interests of the other and are reasonable in scope
and content.
8. 9 . Breach Notification . In the event Consultant or its subcontractors or
agents discovers or is notified of a breach or potential breach of security
relating to Confidential Information , including a failure to comply with
Consultant' s confidentiality obligations under this Contract, Consultant shall
promptly notify Authorized Purchaser's Authorized Representative of the
breach or potential breach . If Authorized Purchaser determines that the
breach or potential breach requires notification of Authorized Purchaser
clients or employees , or other notification required by law, Authorized
Purchaser will have sole control over the notification content, timing , and
method , subject to Consultant's obligations under applicable law. Consultant
will not notify any individual or any third party other than law enforcement of
any breach or potential breach involving Authorized Purchaser Confidential
Information without first consulting with , and obtaining written permission of,
Authorized Purchaser.
8 . 10 . Publicity. Consultant agrees that it will not disclose the form , content
or existence of this Contract or any Deliverable in any advertising , press
releases or other materials distributed to prospective customers , or otherwise
attempt to obtain publicity from its association with Authorized Purchaser or
the State of Oregon , whether or not such disclosure , publicity or association
implies an endorsement by Authorized Purchaser or the State of Oregon of
Consultant's services , without the prior written consent of Authorized
Purchaser.
8 . 11 . Confidentiality Obligations . The obligations of confidentiality under
this Contract extend for two (2) years beyond either the disclosure of the
Confidential Information or the termination of this Contract, whichever is later.
9. Independent Contractor; Taxes and Withholding .
9 . 1 . Consultant shall perform all Services as an independent contractor.
Although Authorized Purchaser reserves the right to determine the delivery
schedule for the Services to be performed and evaluate the quality of the
completed performance , Authorized Purchaser cannot and will not control the
Page 22 of 60
means or manner of Consultant's performance . Consultant is responsible for
determining the appropriate means and manner of performing the Services .
9.2. If Consultant is currently performing services for the State of Oregon or
the federal government, Consultant, by signing this Contract, declares and
certifies that:
9 .2 . 1 . Consultant's delivery of Services creates no potential or actual
conflict of interest as defined by ORS 244 ;
9.2.2. No rules or regulations of Consultant's employing agency (state or
federal) would prohibit Consultant's Services under this Contract;
9 .2.3. If applicable , Consultant meets the specific independent contractor
standards of ORS 670 . 600 ; and
9.2 .4. Consultant is not an "officer, " "employee , " or "agent" of Authorized
Purchaser as those terms are used in ORS 30 . 265 .
9 .3 . Consultant is responsible for all federal or state taxes applicable to
compensation or payments to Consultant under this Contract and , unless
Consultant is subject to backup withholding , Authorized Purchaser will not
withhold from such compensation or payments any amounts to cover
Consultant's federal or state tax obligations . Consultant is not eligible for any
Social Security, unemployment insurance or workers' compensation benefits
from compensation or payments to Consultant under this Contract, except as a
self-employed individual .
10 . Representations and Warranties .
10 . 1 . Consultant's General Representations and Warranties . Consultant
represents and warrants to Authorized Purchaser that:
10 . 1 . 1 . Consultant is not an "officer, " "employee , " or "agent" of DAS or
Authorized Purchaser, as those terms are used in ORS 30 .265 ;
10 . 1 .2. Consultant fully understands and will perform its obligations under
this Contract and will not make any claims for, or have any rights to relief
based on its claim that it misunderstood the terms of this Contract, or
lacked information related to its required performance under this Contract;
10 . 1 .3 . Consultant is qualified to do business in the State of Oregon and
will remain qualified throughout the Contract term ;
10. 1 .4. Consultant is not in arrears in the payment of any monies due and
owing the State of Oregon , or any department or agency thereof, including
but not limited to the payment of taxes and employee benefits , and will not
become so during the Contract term ;
Page 23 of 60
10. 1 .5. Consultant will comply with the federal , state , and local laws ,
ordinances , rules , and regulations applicable to Consultant and its
performance under this Contract;
10 . 1 .6 . Consultant is not in violation of, charged with nor, to the best of
Consultant's knowledge , under any investigation with respect to violation
of, any provision of any federal , state or local law, ordinance or regulation
or any other requirement or order of any governmental or regulatory body
or court or arbitrator applicable to provision of the Services , and
Consultant' s provision of the Services shall not violate any such law,
ordinance , regulation or order;
10 . 1 .7 . Consultant's performance under this Contract to the best of
Consultant's knowledge creates no potential or actual conflict of interest,
as defined by ORS 244 , for either Consultant or any Consultant personnel
that will perform the Services under this Contract;
10 . 1 . 8 . Consultant represents and warrants that the personnel providing
services under this Contract are employees of Consultant; that Consultant
withholds applicable income taxes from the pay of its employees ; that
Consultant pays workers' compensation insurance premiums arising from
the employment of its employees under this Contract; that Consultant
makes all other applicable tax and related payments arising from that
employment (including without limitation social security tax payments) ;
and that Consultant provides employee benefits to its employees ,
including without limitation health insurance benefits , vacation benefits ,
and retirement benefits ;
10 . 1 .9 . Consultant (to the best of Consultant's knowledge , after due
inquiry) , for a period of no fewer than six (6) Calendar years preceding
the Effective Date of this Contract, Consultant faithfully has complied with :
• All tax laws of this state , including but not limited to ORS
305 .620 and ORS chapters 316 , 317 , and 318 ;
• Any tax provisions imposed by a political subdivision of this
state that applied to Consultant, to Consultant's property ,
operations , receipts , or income , or to Consultant' s performance
of or compensation for any work performed by Consultant;
• Any tax provisions imposed by a political subdivision of this
state that applied to Consultant, or to goods , services , or
property, whether tangible or intangible , provided by Consultant;
and
• Any rules , regulations , charter provisions , or ordinances that
implemented or enforced any of the foregoing tax laws or
provisions ;
Page 24 of 60
10. 1 . 10 . Consultant possesses and will maintain at its own expense all
required licenses , certifications and permits necessary to deliver Services
under this Contract;
10 . 1 . 11 . Consultant has the power and authority to enter into and perform
this Contract;
10. 1 . 12. This Contract, when executed and delivered , is a valid and binding
obligation of Consultant enforceable in accordance with its terms ;
10 . 1 . 13. Consultant has the skill and knowledge possessed by well-
informed members of its trade or profession and Consultant will apply that
skill and knowledge with care and diligence so Consultant and
Consultant's employees and any authorized subcontractors perform the
Services described in this Contract according to the highest standards
prevalent in the industry or business most closely involved in providing the
Services that Consultant is providing to Authorized Purchaser pursuant to
this Contract;
10. 1 . 14. The Services and each Deliverables delivered by Consultant
pursuant to the Services will materially comply with any service
descriptions , specifications , standards or requirements set forth in this
Contract; and
10. 1 . 15 Consultant shall , at all times during the term of this Contract, be
qualified , professionally competent, and duly licensed to perform the
Services .
10 .2. DISCLAIMER OF WARRANTIES : THE FOREGOING WARRANTIES
ARE IN LIEU OF ALL OTHER WARRANTIES , EXPRESS OR IMPLIED ,
INCLUDING , BUT NOT LIMITED TO , ANY IMPLIED WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE ,
INTEGRATION , PERFORMANCE ANDACCURACY AND ANY IMPLIED
WARRANTIES ARISING FROM STATUTE, COURSE OF DEALING ,
COURSE OF PERFORMANCE OR USAGE OF TRADE .
11 . Ownership and Licenses .
11 . 1 . Consultant Intellectual Property. Consultant retains ownership of all
Consultant Intellectual Property that Consultant delivers to Authorized
Purchaser pursuant to the Services performed under this Contract. Consultant
grants Authorized Purchaser a perpetual non-exclusive , irrevocable , royalty-
free , world-wide license to use, copy, display, distribute , transmit and prepare
derivative works of Consultant Intellectual Property employed in the
Deliverables or Work Product, and to authorize others to do the same on
Authorized Purchaser's behalf, in connection with use of such Deliverables .
Page 25 of 60
11 .2. Work Product. Unless otherwise agreed, upon payment for the
Services or Deliverables Authorized Purchaser owns all Work Product and the
entire right, title and interest therein , shall be exclusively vested in Authorized
Purchaser as Work Product made for hire and made in the course of the
Services rendered . If title to any Work Product may not by operation of law vest
in Authorized Purchaser, Consultant hereby irrevocably assigns the sole right,
title and interest in such Works and its proprietary rights therein to Authorized
Purchaser. Consultant agrees to execute papers which Consultant reasonably
may require to secure and maintain Authorized Purchaser's rights related to the
Work Product. Notwithstanding the foregoing , Consultant retains exclusive and
unrestricted ownership of any Consultant Intellectual Property relating to the
Services and/or supplied with any Work Product, and Consultant grants
Authorized Purchaser a worldwide , perpetual , royalty-free, and non-exclusive
right and license to use such Consultant Intellectual Property as part of the
Work Product.
11 .3. Authorized Purchaser Intellectual Property. Authorized Purchaser
owns all Authorized Purchaser Intellectual Property, including all background
information , data and all of its clients' data and information , provided to or
collected by Consultant pursuant to this Contract. Authorized Purchaser grants
Consultant anon-exclusive , royalty-free , license to use , copy, display,
distribute , transmit and prepare derivative works of Authorized Purchaser
Intellectual Property, including Authorized Purchaser data , and Work Product
only to fulfill the purposes of this Contract. Authorized Purchaser's license to
Consultant is limited by the term of the Contract and the confidentiality
obligations of this Contract.
11 .4. Third Party Intellectual Property. Unless otherwise specified in a
Contract, Authorized Purchaser will acquire and obtain a license to Third Party
Intellectual Property that is a part of a Deliverable. In the event that Work
Product is Third Party Intellectual Property, a derivative work based on Third
Party Intellectual Property, or a compilation that includes Third Party Intellectual
Property, in each case as expressly authorized by Authorized Purchaser,
Authorized Purchaser shall secure on its own behalf and in its name an
irrevocable , non-exclusive, perpetual , royalty-free license to use , reproduce,
prepare derivative works based upon , distribute copies of, perform and display
the Third Party Intellectual Property provided to Authorized Purchaser by
Consultant during the term of the Contract necessary for Consultant to deliver
the Services , and to authorize others to do the same on Authorized
Purchaser's behalf.
11 .5 . No Rights . Except as expressly set forth in this Contract, nothing in this
Contract grants or confers upon Consultant any right, title , or interest in any
intellectual property that is now owned or subsequently owned by Authorized
Purchaser. Except as expressly set forth in this Contract, nothing in this
Contract grants or confers upon Authorized Purchaser any right, title , or
interest in any Consultant Intellectual Property that is now owned or
subsequently owned by Consultant.
Page 26 of 60
11 .6. No Rights in Marks. Neither party grants the other the right to use its
trademarks , trade names , service marks or other designations in any promotion
or publication without prior written consent. Each party grants only the licenses
and rights specified in this Contract.
11 .7. Prohibition on Data Mining . Consultant shall not capture , maintain ,
scan , index, share or use Authorized Purchaser Data stored or transmitted by
the Products or Services , or otherwise use any data-mining technology, for any
non-authorized activity, and shall not permit its agents or subcontractors to do
so . For purposes of this requirement, "non-authorized activity" means the data
mining or processing of data , stored or transmitted by the service, for unrelated
commercial purposes , advertising or advertising-related purposes , or for any
other purpose other than security analysis that is not explicitly authorized in this
Contract.
11 .8. Federal Funds . If a Work Product is software and has been developed
and delivered by Consultant as a Deliverable to an Authorized Purchaser under
this Contract, and such Deliverable has been funded by Authorized Purchaser,
to any extent, with federal funds , then Authorized Purchaser will have all right,
title , and interest (including ownership of copyright and trademark) to such
Deliverable , and , ilf the software Deliverable has been funded with federal
funds , the federal agency reserves a royalty-free, nonexclusive , and
irrevocable license to reproduce, publish , or otherwise use, and to authorize
others to use for federal government purposes , such Deliverable , in each case
in accordance with 45 CFR 95 .617(b) .
12. Indemnity.
12 . 1 . CONSULTANT SHALL DEFEND , SAVE , HOLD HARMLESS AND
INDEMNIFY AUTHORIZED PURCHASER AND THE STATE OF OREGON
AND THEIR AGENCIES , SUBDIVISIONS , OFFICERS , DIRECTORS ,
AGENTS , AND EMPLOYEES FROM AND AGAINST ALL THIRD PARTY
CLAIMS , SUITS , ACTIONS , LOSSES , DAMAGES , LIABILITIES ,
STATUTORY PENALITIES , COSTS AND EXPENSES OF ANY NATURE
WHATSOEVER INCLUDING ( 1 ) ANY CLAIM THAT CONSULTANT, A
SUBCONTRACTOR , OR A CONSULTANT EMPLOYEE ORA
SUBCONTRACTOR'S EMPLOYEE ARE EMPLOYEES OF THE STATE OR
AUTHORIZED PURCHASER FOR ANY REASON , AND ( 11 ) ANY CLAIM
AGAINST THE STATE OR AUTHORIZED PURCHASER , WHICH , IF TRUE ,
WOULD CONSTITUTE A BREACH BY CONSULTANT OF ANY OF THE
REPRESENTATIONS , WARRANTIES , OR COVENANTS SET FORTH IN
THIS CONTRACT, AND (III ) ANY CLAIMS THAT THE DELIVERABLES OR
USE THEREOF OR USE OF ANY PRODUCT INFRINGE OR VIOLATE ANY
PATENT, COPYRIGHT, TRADE SECRET , TRADEMARK, TRADE DRESS ,
MASK WORK, UTILITY DESIGN , OR OTHER PROPRIETARY RIGHT
(COLLECTIVELY, " INTELLECTUAL PROPERTY RIGHTS") OF ANY THIRD
PARTY, RESULTING FROM , ARISING OUT OF , OR RELATING TO THE
Page 27 of 60
ACTS OR OMISSIONS OF CONSULTANT OR ITS OFFICERS ,
EMPLOYEES , SUBCONTRACTORS , OR AGENTS UNDER THIS
CONTRACT.
12 .2 . THE OREGON ATTORNEY GENERAL MUST GIVE WRITTEN
AUTHORIZATION TO ANY LEGAL COUNSEL PURPORTING TO ACT IN
THE NAME OF , OR REPRESENT THE INTEREST OF , THE STATE OR ITS
OFFICERS , EMPLOYEES AND AGENTS PRIOR TO SUCH ACTION OR
REPRESENTATION , FURTHER , THE STATE , ACTING BY AND
THROUGH ITS DEPARTMENT OF JUSTICE , MAY ASSUME ITS OWN
DEFENSE , INCLUDING THAT OF ITS OFFICERS , EMPLOYEES AND
AGENTS , AT ANY TIME WHEN IN THE STATE'S SOLE DISCRETION IT
DETERMINES THAT:
12. 2 . 1 . PROPOSED COUNSEL IS PROHIBITED FROM THE
PARTICULAR REPRESENTATION CONTEMPLATED ;
12 .2 .2. COUNSEL IS NOT ADEQUATELY DEFENDING OR ABLE TO
DEFEND THE INTERESTS OF THE STATE , ITS OFFICERS ,
EMPLOYEES AND AGENTS ;
12 .2. 3 . IMPORTANT GOVERNMENTAL INTERESTS ARE AT STAKE ;
OR
12.2.4. THE BEST INTERESTS OF THE STATE ARE SERVED
THEREBY.
CONSULTANT'S OBLIGATION TO PAY FOR ALL COSTS AND EXPENSES
INCLUDE THOSE INCURRED BY THE STATE IN ASSUMING ITS OWN
DEFENSE AND THAT OF ITS OFFICERS , EMPLOYEES , OR AGENTS .
12 .3 . Data and Network Services . Except to the extent that a claim or loss
results from the negligent, reckless or intentional acts or omissions of
Authorized Purchaser, Consultant shall assume liability for all claims or losses
related to data loss or breach of security caused directly or indirectly by or
resulting from the Deliverables or Services provided by Consultant.
12 .4 LIMITATION OF LIABILITY.
12 . 4 . 1 EXCEPT FOR LIABILITY ARISING OUT OF OR RELATED TO (i)
SECTION 12 . 1 , (ii) SECTION 12 . 3 , DATA AND NETWORK SERVICES ,
( iii) SECTION 8 , CONSULTANT' S DUTIES OF CONFIDENTIALITY AND
NON- DISCLOSURE , (iv) SERVICE CREDITS OR LIQUIDATED
DAMAGES ASSESSED UNDER THIS CONTRACT, OR (v) CLAIMS FOR
PERSONAL INJURY, INCLUDING DEATH , OR DAMAGE TO REAL
PROPERTY OR TANGIBLE OR INTANGIBLE PERSONAL PROPERTY
ARISING FROM THE NEGLIGENCE , RECKLESS CONDUCT OR
Page 28 of 60
INTENTIONAL ACTS OF CONSULTANT, ITS OFFICERS , EMPLOYEES
OR AGENTS , CONSULTANT'S LIABILITY FOR DAMAGES TO THE
STATE FOR ANY CAUSE WHATSOEVER IS BE LIMITED TO ONE AND
ONE-HALF TIMES THE TOTAL NOT TO EXCEED AMOUNT UNDER
THIS CONTRACT.
12 .4 . 2 EXCEPT FOR LIABILITY TO THIRD PERSONS ARISING OUT
OF OR RELATED TO ( i) SECTION 12 . 1 , (ii) SECTION 12 . 3 , (iii)
SECTION 8 , OR (iv) CLAIMS FOR PERSONAL INJURY, INCLUDING
DEATH , OR DAMAGE TO REAL PROPERTY OR TANGIBLE OR
INTANGIBLE PERSONAL PROPERTY ARISING FROM THE
NEGLIGENCE , RECKLESS CONDUCT OR INTENTIONAL ACTS OF
CONSULTANT , ITS OFFICERS , EMPLOYEES OR AGENTS NEITHER
PARTY WILL BE LIABLE TO THE OTHER FOR ANY LOST PROFITS ,
LOST SAVINGS , OR PUNITIVE , INDIRECT, EXEMPLARY,
CONSEQUENTIAL , OR INCIDENTAL DAMAGES .
13 . ASSIGNMENT OF ANTITRUST RIGHTS . CONSULTANT IRREVOCABLY
ASSIGNS TO AUTHORIZED PURCHASER ANY CLAIM FOR RELIEF OR
CAUSE OF ACTION WHICH THE CONSULTANT NOW HAS OR WHICH MAY
ACCRUE TO THE CONSULTANT IN THE FUTURE BY REASON OF ANY
VIOLATION OF 15 U . S . C . § 1 - 15 OR ORS 646 . 725 OR ORS 646 . 7307 IN
CONNECTION WITH ANY GOODS OR SERVICES PROVIDED TO THE
CONSULTANT FOR THE PURPOSE OF CARRYING OUT THE
CONSULTANT'S OBLIGATIONS UNDER THIS CONTRACT , INCLUDING , AT
AUTHORIZED PURCHASER'S OPTION , THE RIGHT TO CONTROL ANY
SUCH LITIGATION ON SUCH CLAIM OR RELIEF OR CAUSE OF ACTION .
CONSULTANT SHALL REQUIRE ANY SUBCONTRACTORS HIRED TO
PERFORM ANY OF CONSULTANT'S DUTIES UNDER THIS AGREEMENT TO
IRREVOCABLY ASSIGN TO AUTHORIZED PURCHASER , AS THIRD PARTY
BENEFICIARY, ANY RIGHT, TITLE OR INTEREST THAT HAS ACCRUED OR
WHICH MAY ACCRUE IN THE FUTURE BY REASON OF ANY VIOLATION OF
15 U . S . C . § 1 - 15 OR ORS 646 . 725 OR ORS 646 . 730 , IN CONNECTION WITH
ANY GOODS OR SERVICES PROVIDED TO THE SUBCONTRACTOR FOR
THE PURPOSE OF CARRYING OUT THE SUBCONTRACTOR'S
OBLIGATIONS TO THE CONSULTANT IN PURSUANCE OF THIS
CONTRACT, INCLUDING , AT AUTHORIZED PURCHASER' S OPTION , THE
RIGHT TO CONTROL ANY SUCH LITIGATION ON SUCH CLAIM OR RELIEF
OR CAUSE OF ACTION .
14. Suspension ; Termination .
14. 1 . Authorized Purchaser's Right to Suspend Performance. Authorized
Purchaser may, at its sole discretion , suspend Consultant's Services under this
Contract, upon written notice by Authorized Purchaser to Consultant, setting
forth the length of the proposed suspension .
Page 29 of 60
1401 . 1 Stop-Work Notice. Authorized Purchaser may, at any time , by
written notice to Consultant, require Consultant to stop all or any part of the
work required by this Contract for a period of up to ninety (90) Calendar
Days after the date of the notice, or for any further period to which the
parties may agree through a duly executed amendment. Upon receipt of
the notice , Consultant shall immediately comply with the Stop-Work Notice
terms and take all necessary steps to minimize the incurrence of costs
allocable to the work affected by the Stop Work Notice . Within a period of
ninety (90) Calendar Days after issuance of the written notice , or within any
extension of that period to which the parties have agreed , Authorized
Purchaser will either:
Cancel or modify the Stop Work Notice by a supplementary
written notice ; or
Terminate the work as permitted by either the Default or the
Convenience provisions of section 14 , Termination , including , as
applicable and as set forth in this Contract, payment.for Services
completed and accepted and Deliverables delivered and
accepted prior to the suspension and termination , reimburseable
expenses or reimburseable third party costs . .
If the Stop Work Notice is canceled , Authorized Purchaser may, after
receiving and evaluating a request from Consultant, make an adjustment in
the time required to complete this Contract and the Contract price by a duly
executed amendment, inclusive of any ramp-up time required to for
Consultant to resume Services .
14.2. Parties ' Right to Terminate for Mutual Consent. This Contract may
be terminated at any time by mutual written consent of the parties .
14.3. Authorized Purchaser's Right to Terminate for Convenience.
Authorized Purchaser may, at its sole discretion , terminate this Contract, in
whole or in part, upon thirty (30) Calendar Days written notice to Consultant.
14.4. Authorized Purchaser's Right to Terminate for Cause. Authorized
Purchaser may terminate this Contract, immediately upon notice to Consultant,
or at such later date as Authorized Purchaser may establish in such notice ,
upon the occurrence of any of the following events :
14.4. 1 . If Authorized Purchaser's funding from revenue sources is
not obtained and continued at levels sufficient to allow for
compensation for the Services or both, in Authorized Purchaser's sole
administrative discretion , this Contract may be terminated or modified
to accommodate a reduction in funds;
14.4. 2 . If federal or state regulations or guidelines are modified ,
changed , or interpreted in such a way that the Services is no longer
allowable or appropriate for purchase under this Contract;
Page 30 of 60
14.4.3 . If any license or certificate required by law or regulations to
be held by the Consultant to provide the Services required by this
Contract is for any reason denied , revoked , or not renewed ;
14.4.4. If the Authorized Purchaser discovers that Consultant is in
default for the payment of taxes or any other amount owed to a
government entity; or
14.4.5. Consultant fails to perform the Services under this Contract
within the time specified herein or any extension thereof, or so fails
to pursue the Services as to endanger Consultant's performance
under this Contract according to its terms , and such breach , default
or failure is not cured within thirty (30) Calendar Days after delivery
of Authorized Purchaser's notice, or such longer period as
Authorized Purchaser may specify in such notice.
14.5 . Consultant's Right to Terminate for Cause. Consultant may terminate
this Contract if Authorized Purchaser commits any material breach or default
of any covenant, obligation or agreement under this Contract and Authorized
Purchaser fails to cure the breach or default within thirty (30) Calendar Days
after receipt of Consultant's written notice or such longer period of cure as
Consultant may specify in such notice. Consultant shall state in the written
notice of breach or default the termination date for Authorized Purchaser's
failure to cure , which must not be less than thirty (30) Calendar Days following
Authorized Purchaser's failure to cure.
14.6 . Transition . If requested by Authorized Purchaser, Consultant shall
provide transition services to support a responsible and secure transition of
Services and Authorized Purchaser data to another service provider or to
Authorized Purchaser ("Transition Services") , subject to the terms and
conditions of the Contract as modified by the Transition Plan and provided
Authorized Purchaser is up-to-date with its undisputed payment obligations at
the commencement of the Transition Period , and continues to pay all
undisputed invoices during the Transition Period . Following receipt of the
request for Transition Services , Consultant shall not, without Authorized
Purchaser's prior written consent, which will not be unreasonably withheld ,
transfer, reassign , or otherwise redeploy any of Consultant's personnel from
providing Services under this Contract.
Consultant and Authorized Purchaser will outline a plan ("Transition Plan")
setting forth the following :
The respective Tasks and Deliverables to be completed by each party
under the Transition Plan ,
A schedule pursuant to which such Tasks and Deliverables will be
completed ,
A schedule identifying which party is responsible for paying the cost (if
any) related to each Task and Deliverable . This schedule may include
Transition Services that will not exceed the current Contract NTE . If the
Page 31 of 60
parties agree Transition Services require new or additional Services that
cause an increase in the Contract NTE , the Transition Plan will be in the
form of a Contract amendment, and
Addressing other outstanding issues .
Consultant shall complete the transition of Services from Consultant and its
subcontractors to Authorized Purchaser and to any providers that Authorized
Purchaser designates, without causing any unnecessary interruption of or
adverse impact on the Services .
Without limiting the generality of the aforementioned obligations , Consultant
shall
• Cooperate with Authorized Purchaser and any Authorized Purchaser-
designated provider by promptly taking all steps required to assist
Authorized Purchaser in completing the Transition Plan .
• Provide Authorized Purchaser and any Authorized Purchaser-
designated provider with all information regarding the Services and
Deliverables that these parties will need to complete the Transition
Period .
• Promptly and orderly conclude all Services as Authorized Purchaser
may direct. This includes the documentation of work in progress , return
of property , and other measures to provide an orderly transition to
Authorized Purchaser and any Authorized Purchaser-designated
provider.
14.7 . Consultant's Tender Upon Termination . Upon receiving a notice of
termination of this Contract, Consultant shall promptly cease all activities under
this Contract unless Authorized Purchaser expressly directs otherwise in the
notice of termination or Authorized Purchaser has requested Transition
Services . Consultant shall immediately deliver to Authorized Purchaser or
anyone Authorized Purchaser designates all documents , information , works-in-
progress , and other property that are or would be deliverables had this
Contract been completed .
15. Contract Breach . Before a party can be found in breach of this Contract, the
other party shall first deliver a notice of default to the other party. The notice must
describe the specific nature of the default, cite the specific provisions of this
Contract that have been defaulted , indicate whether the default can be cured , and
specify the time period in which the default must be cured , if cure is permitted .
15. 1 . Default by Consultant. Consultant violates or is in default of this
Contract if:
15. 1 .1 . Consultant institutes or has instituted against it insolvency,
receivership or bankruptcy proceedings , makes an assignment for the
benefit of creditors , or ceases doing business on a regular basis;
Page 32 of 60
15.1 .2, Consultant no longer holds a license or certificate that is
required for Consultant to perform Consultant's obligations under this
Contract; or
15.1 .3.Consultant fails to perform or defaults any material covenant,
warranty, obligation or certification under this Contract, provided
however that Consultant may cure the defaults within the period
specified in Authorized Purchaser's notice of default when Authorized
Purchaser determines the default is curable by Consultant.
15 .2. Default by Authorized Purchaser. Authorized Purchaser violates or is
in default of this Contract if:
15.2. 1 . Authorized Purchaser fails to pay Consultant any amount as
required under this Contract, and Authorized Purchaser does not
cure such failure to pay within thirty (30) Calendar Days after delivery
of Consultant's notice of default or such longer period as Consultant
may specify in such notice; or
15.2.1 . Authorized Purchaser defaults any material covenant,
warranty, or obligation under this Contract and such default is not
cured within thirty (30) Calendar Days after delivery of Consultant's
notice of breach or such longer period as Consultant may specify in
such notice .
16 . Remedies for Default.
16. 1 . Consultant Remedies . If a Contract is terminated pursuant
to section 14 . 2 , 14 . 31 14 .4 . 11 14 .4 . 25 14 .4 . 3 or 14 . 5 , Consultant's
sole remedy shall be a claim for accomplishing the Services
multiplied by the percentage of Services completed and accepted
by Authorized Purchaser, less previous amounts paid and any
claims which Authorized Purchaser has against Consultant. If
previous amounts paid to Consultant exceed the amount due to
Consultant under this Subsection , Consultant shall immediately pay
any excess to Authorized Purchaser upon demand .
16 .2. Authorized Purchaser Remedies . If a Contract is
terminated pursuant to section 14 .4 .4 or 14 .4 . 5 , Authorized
Purchaser shall have any remedy available to it in law or equity. If it
is determined for any reason that Consultant was not in default
under section 14 .4 .4 or 14 .4 . 5 , the rights and obligations of the
parties shall be the same as if this Contract was terminated
pursuant to section 14 . 3 .
17 . Compliance with Applicable Law.
17. 1 . Consultant shall comply with the federal , state and local laws ,
regulations , executive orders and ordinances applicable to Consultant and its
performance under this Contract and the Services provided hereunder.
Page 33 of 60
17 .2 . Consultant at all times shall comply with all Authorized Purchaser's
security and access policies and procedures , including without limitation (i)
obtaining nondisclosure agreements from Consultant's employees and agents
who are performing Services and providing copies of such agreements to
Authorized Purchaser, (ii) performing criminal background checks on each of
Consultant's employees and agents who are performing Services , and
providing a copy of the results to Authorized Purchaser,
17 .3. Authorized Purchaser' s performance under this Contract is conditioned
upon Consultant' s compliance with the obligations intended for contractors
under ORS 27913 .220 , 2796 . 225 (if applicable to this Contract) , 2798 . 230 and
27913 .235 (if applicable to this Contract) , which are incorporated into this
Contract by reference . Consultant shall , to the maximum extent economically
feasible in the performance of this Contract, use recycled paper (as defined in
ORS 279A. 010 (1 ) (gg)) , recycled PETE products (as defined in ORS
279A. 010( 1 ) (hh)) , and other recycled plastic resin products and recycled
products (as " recycled product" is defined in ORS 279A. 010 ( 1 ) (ii)) .
17.4 Nondiscrimination in Employment. Consultant certifies , in
accordance withORS 279A. 112 , that it has in place a policy and practice of
preventing sexual harassment, sexual assault, and discrimination against
employees who are members of a protected class , 2 as defined by subsection
2 ( 1 ) (b) of ORS 279A. 112 . As a material condition of this Contract, Consultant
shall maintain , throughout the duration of this Contract, a policy and practice
that comply with ORS 279A. 112 , including giving employees written notice of
the Consultant's policy and practice.
18 . Consultant's Compliance with Tax Laws .
18 . 1 . Consultant shall , throughout the term of this Contract and any
extensions , comply with all tax laws of this state and all applicable tax laws of
any political subdivision of this state . For the purposes of this section , "tax
laws" includes all the provisions described in subsection 10 . 1 . 9 of this Contract.
2 ORS 279A. 112 , subsection 2(1 )(b) contains an expansive definition of the term " protected
class" :
( b) " Protected class" means a group of people that state or federal law protects from
employment discrimination including , but not limited to , a group in which membership depends on
an ascribed association or identification , or an individual's voluntary association or identification
with other individuals, on the basis of one or more of these characteristics:
(A) Race, color or ethnicity;
( B) National origin ;
(C) Sex;
(D) Gender, including actual or perceived gender identity;
(E) Sexual orientation ;
(F) Disability;
(G) Age;
(H) Marital status; or
( 1 ) Religion .
Page 34 of 60
18 .2. Any violation of subsection 18 . 1 of this section shall constitute a material
breach of this Contract. Further, any violation of Consultant's warranty, in
subsection 10 . 1 . 6 of this Contract that Consultant has complied with the tax
laws of this state and the applicable tax laws of any political subdivision of this
state also shall constitute a material breach of this Contract. Any violation shall
entitle Authorized Purchaser to terminate this Contract, to pursue and recover
any and all damages that arise from the breach and the termination of this
Contract, and to pursue any or all of the remedies available under this
Contract, at law, or in equity, including but not limited to:
18 .2. 1 . Termination of this Contract , in whole or in part;
18 .2.2 . Exercise of the right of setoff, and withholding of amounts
otherwise due and owing to Consultant, in an amount equal to State's
setoff right, without penalty; and
18.2 .3 . Initiation of an action or proceeding for damages , specific
performance , declaratory or injunctive relief. Authorized Purchaser shall
be entitled to recover any and all damages suffered as the result of
Consultant's breach of this Contract, including but not limited to direct,
indirect, incidental and consequential damages , costs of cure , and costs
incurred in securing replacement Services , a replacement contractor, or
any of the above .
These remedies are cumulative to the extent the remedies are not
inconsistent, and Authorized Purchaser may pursue any remedy or remedies
singly, collectively, successively, or in any order whatsoever.
19. Governing Law. This Contract shall be governed by and construed
according to with the internal laws of the State of Oregon without regard to
principles of conflicts of law.
20 . Dispute Resolution ; Litigation ; Claim Venue and Consent to Jurisdiction
20 . 1 . Dispute Resolution . In the event that the Parties have any
disagreement, dispute , breach or claim of breach , non-performance , or
repudiation arising from , related to or in connection with the Contract or any of
the terms or conditions thereof, or any transaction hereunder including but not
limited to either Party's failure or alleged failure to comply with any of the
provisions of the Contract (hereinafter collectively the " Dispute") , other than one
related to the release of Confidential Information , the Parties shall first conduct
the following procedure in an attempt to resolve the Dispute:
• The Parties shall make every effort to settle any Dispute through
their respective managers , within five (5) Calendar Days of one Party
notifying the other Party of a Dispute .
Page 35 of 60
• If the Dispute is not resolved between the managers , then either
Party may initiate formal dispute resolution discussions by advising the
other party in writing . The contact point for these discussions shall be
the Parties' Authorized Representatives. The Parties shall attempt to
resolve the Dispute within five (5) Calendar Days of the notice from a
Party that they are initiating this second level of Dispute resolution
discussions . If the Parties mutually agree in writing that there has
been substantial progress toward resolution of the Dispute, this
second level may be extended for an additional five (5) Business Day
period which shall commence at the conclusion of the first five (5) day
period .
* If the Parties are unable to resolve the Dispute , the Parties may file
suit as set forth below, provided , however, that neither party will
bring a legal action arising out of or related to this Contract more
than two (2) years after the Party has actual knowledge of the
Claim .
Nothing in this section : (a) shall in any way limit a Party's rights to seek
injunctive relief of any kind , at any time , with respect to any matter; (b) in any
way limit Authorized Purchaser's or Consultant's right to suspend or terminate
the Contract or pursue other remedies available under the Contract, by law or
otherwise ; (c) remove the requirement to provide notices or filings to meet
deadlines otherwise required by law; or (d) constitute a waiver of the sovereign
immunity of the State of Oregon .
20 .2. State Agency Venue and Consent to Jurisdiction . Any claim , action ,
suit or proceeding (collectively, "Claim ") between DAS , Authorized Agency or
any other agency or department of the State of Oregon that is an ORCPP
Member, and Consultant that arises from or relates to this Contract shall be
brought and conducted solely and exclusively within the Circuit Court of
Marion County for the State of Oregon ; provided , however, that if a Claim
must be brought in a federal forum , then it shall be brought and adjudicated
solely and exclusively within the United States District Court for the District of
Oregon . CONSULTANT, BY EXECUTION OF THIS CONTRACT, HEREBY
CONSENTS TO THE IN PERSONAM JURISDICTION OF SAID COURT(S)
AND WAIVES ANY CLAIM THAT SUCH FORUM IS AN INCONVENIENT
FORUM . In no event may this section be construed as (i) a waiver by the
State of Oregon of any form of defense or immunity, whether sovereign
immunity, governmental immunity , immunity based on the eleventh
amendment to the Constitution of the United States or otherwise , from any
claim , or (ii) consent by the State of Oregon to the jurisdiction of any court .
20.3 . ORCPP Member Venue and Consent to Jurisdiction . Any
Claims between Consultant and an ORCPP Member other than an
agency of the State of Oregon that arise from or relate to this Contract
Page 36 of 60
order shall be brought and conducted solely and exclusively within the
Circuit Court of the county in which such ORCPP Authorized Purchaser
resides, or at the ORCPP Authorized Purchaser's option , within such
other county as the ORCPP Authorized Purchaser is entitled under the
laws of the relevant jurisdiction to bring or defend Claims. If any such
Claim must be brought in a federal forum , then unless otherwise
prohibited by law it shall be brought and conducted solely and exclusively
within the United States District Court for the District in which such
ORCPP Authorized Purchaser resides . CONSULTANT HEREBY
CONSENTS TO THE IN PERSONAM JURISDICTION OF SAID
COURTS AND WAIVES ANY OBJECTION TO VENUE IN SUCH
COURTS, AND WAIVES ANY CLAIM THAT SUCH FORUM IS AN
INCONVENIENT FORUM . Nothing herein shall be construed as a
waiver of ORCPP Authorized Purchaser's sovereign or governmental
immunity, if any, whether derived from the Eleventh Amendment to the
United States Constitution or otherwise, or of any defenses to Claims or
consent to jurisdiction based thereon .
21 . Records Maintenance ; Access . Consultant shall maintain all fiscal records
relating to this Contract and Consultant's performance hereunder, according to
Generally Accepted Accounting Principles . In addition , Consultant shall maintain
all other records relating to this Contract in such a manner as to clearly document
Consultant's performance of its duties under this Contract. Consultant
acknowledges and agrees that Authorized Purchaser and the federal government
(if federal funds are used ) , the-Oregon Secretary of State's Office , the Oregon
Department of Revenue , the Oregon Department of Justice and their duly
authorized representatives shall have access to such records and other books ,
documents , papers , plans and writings of Consultant relating to this Contract to
perform examinations and audits and make excerpts and transcripts . Consultant
shall retain and keep accessible all fiscal and other records relating to this
Contract, including books , documents , papers , plans , and writings , for a minimum
of six (6) years , or such longer period as may be required by applicable law,
following final payment and termination or expiration of this Contract, or until the
conclusion of any audit, controversy or litigation arising out of or related to this
Contract, whichever date is later.
22. Intended Beneficiaries . Authorized Purchaser and Consultant are the only
parties to this Contract and are the only parties entitled to enforce its terms .
Nothing in this Contract gives , is intended to give , or will be construed to give or
provide , any benefit or right, whether directly, indirectly, or otherwise , to third
persons unless such third persons are individually identified by name herein and
expressly described as intended beneficiaries of the terms of this Contract. DAS
is an intended beneficiary of the terms of this Contract.
23. Foreign Contractor. If Consultant is not domiciled in or registered to do
business in the State of Oregon , Consultant shall promptly provide to the Oregon
Department of Revenue and the Secretary of State, Corporation Division , all
information required by those agencies related to this Contract.
Page 37 of 60
24. Force Majeure. Neither Authorized Purchaser nor Consultant will be
responsible for delay or default caused by fire, riot, acts of God , terrorism , war or
any other like cause which is beyond the party's reasonable control . Consultant
shall , however, make all reasonable efforts to remove or eliminate such a cause
of delay or default and shall , upon the cessation of the cause , diligently pursue
performance of its obligations under this Contract. Authorized Purchaser may
terminate this Contract upon written notice to Consultant after it determines that
such delay or default will likely prevent successful performance of this Contract.
25. Survival . All Contract terms , which by their context are intended to survive
contract termination or expiration , shall survive , as well as sections 5 , 6 , 8 , 9 , 11 ,
12 , 13 , 16 , 19 , 28 and 30 of this Exhibit B .
26. Time is of the Essence. Consultant agrees that time is of the essence for
delivering Services under this Contract.
27. Notice. Except as otherwise expressly provided in this Contract, any
communications between the parties hereto or notices to be given hereunder
must be given in writing by email , personal delivery, facsimile , or mailing the
same , postage prepaid , to Consultant or Authorized Purchaser at the email
address , postal address or telephone number set forth in this Contract, or to such
other addresses or numbers as either party may indicate pursuant to this section
27 . Any communication or notice so addressed and mailed is effective five (5)
Business Days after mailing . Any communication or notice delivered by facsimile
is effective on the day the transmitting machine generates a receipt of the
successful transmission , if transmission was during normal business hours , or on
the next business day, if transmission was outside normal business hours of the
recipient. To be effective against Authorized Purchaser, any notice transmitted by
facsimile must be confirmed by telephone notice to Authorized Purchaser' s
Contract Administrator. Any communication or notice given by personal delivery
is effective when actually delivered . Any notice given by email is effective when
the sender receives confirmation of delivery , either by return email , or by
demonstrating through other technological means that the email has been
delivered to the intended email address .
28 . Severability. The parties agree that if any term of this Contract is declared by
a court of competent jurisdiction to be illegal or in conflict with any law, the validity
of the remaining terms is not be affected , and the rights and obligations of the
parties are construed and enforced as if this Contract did not contain the particular
term held to be invalid .
29 . Counterparts . This Contract may be executed in several counterparts , all of
which when taken together shall constitute one agreement binding on all parties ,
notwithstanding that all parties are not signatories to the same counterpart. Each
copy of this Contract so executed shall constitute an original .
30 . Amendment; Change Orders .
Page 38 of 60
30 . 1 . Amendments . This Contract may be amended , modified , or
supplemented only by a written amendment signed by Authorized Purchaser
and Consultant. Any amendment that provides for additional Servicesor other
services may only provide for Services or other services directly related to the
scope of Services in thesolicitation , and no amendment will be effective until all
requisite signatures and approvals are obtained .
30.2 . Change Orders and Change Control Process. Subject to the
conditions above , modifications to time of performance , quantity, or
deliverables in a Statement of Work attached as Exhibit No. 1 , and the related
costs may be managed through an Authorized Purchaser-authorized change
control process that reflects at least the processes described in this section .
Either Authorized Purchaser or Consultant may request a change by submitting
a written proposal describing the requested change to the other party.
Authorized Purchaser' s and Consultant's Authorized Representatives will
review the written change request and either mutually approve it for further
analysis or reject it. If the change request is mutually approved , the requesting
party will prepare a written change order, detailing all modifications to the
Services and related costs (the "Change Order") . A Change Order at a
minimum must contain :
The effective date of the Change Order;
• A detailed description of the Services to be performed under the
Change Order;
The particular specification or matter in the Statement of Work which
will be altered , and the precise scope of that alteration ;
Whether the Change Order modifies critical path Deliverables ;
• Any change in the cost of the Services to be performed pursuant to
the Change Order; and
The cumulative cost changes of all Change Orders previously
issued .
A Change Order may alter only time of performance , quantity, or deliverables in
a Statement of Work and the related costs to which it expressly relates and
must not otherwise affect the terms and conditions of this Contract. Both
parties must sign the Change Order to authorize the Services described
therein and incorporate the changes into this Contract.
30 .3. Payments , No Services may be performed pursuant to an Amendment
or Change Order and no payment may be made on account of the Amendment
or Change Order until the Amendment or Change Order is fully executed and
all required State of Oregon approvals are received . Authorized Purchaser will
pay for Services performed pursuant to an Amendment or Change Order
according to the acceptance and payment procedures set forth in this Contract.
31 . Integration ; Waiver. This Contract, including incorporated exhibits ,
constitutes the entire agreement between the parties on the subject matter hereof.
Page 39 of 60
There are no understandings, agreements , or representations , oral or written , not
specified herein regarding this Contract. No waiver, consent, modification or
change to the terms of this Contract shall bind either party unless in writing and
signed by all parties and all approvals required by law have been obtained . Such
waiver, consent, modification or change, if made , shall be effective only in the
specific instance and for the specific purpose given . The failure of Authorized
Purchaser or Consultant to enforce any provision of this Contract shall not
constitute a waiver by Authorized Purchaser or Consultant of that or any other
provision .
32. Reporting . Authorized Purchasers who are state agencies are responsible
for reporting this Contract to the Oregon Department of Revenue . The Department
of Revenue may take any and all actions permitted by law relative to the collection
of taxes due to the State of Oregon or a political subdivision , including ( i)
garnishing the Consultant's compensation under this Contract or (ii) exercising a
right of setoff against Consultant's compensation under this Contract for any
amounts that may be due and unpaid to the State of Oregon or its political
subdivisions for which the Department of Revenue collects debts .
Page 40 of 60
EXHIBIT B
to Master Agreement #8263
Description of Services ; Pricing
it
Services :
Category 1 - Identify
Develop the organizational understanding to manage cybersecurity risk to
systems, assets, data, and capabilities.
Category 2 — Protect:
Develop and implement the appropriate safeguards to ensure delivery of critical
infrastructure services .
Consultant Key Persons and Key Person Rates .
POSITION TITLE/SERVICES HOURLY RATE
DESCRIPTION
Project Manager $ 175
Social Engineering Subject Matter $110
Expert
Physical Security Subject Matter $135
Expert
Technical Security Subject Matter $ 185
Expert
Senior Technical Security Subject $225
Matter Expert
Executive Manager $225
Editing / Quality Assurance Specialist $ 110
Page 41 of 60
EXHIBIT E
to Master Agreement #8263
PERFORMANCE STANDARDS AND METRICS
Consultant shall , at all times , comply with all performance requirements and
expectations specified in the Vendor Management Program 's Contractor
Onboarding Guide , found at:
http ://www, oregon . gov/basecamp/Documents/New Vendor_Onboarding_Guide_
V. 1 . pdf
Consultant warrants that its performance will meet all requirements of the MSA,
Contract, and all federal agency requirements , if any.
Subject to the provisions and procedures set forth in the Onboarding Guide ,
below are the general and specific performance standards and metrics applicable
to Consultant's performance under this MSA:
GENERAL PERFORMANCE STANDARDS AND METRICS ;
Performance Performance Method Of
Objective Standard Performance Levels Measurement
PM#3301: The State Consultant Exceeds Expectations: Consultant
of Oregon desires to submissions are On-time and without management reviews
work with consultants made without need revision for last 4 VSR submissions with
who support the . for revision and in the quarters DAS - Procurement
State's and format established by Services. If report is
Authorized the VSR template on Satisfactory: On-time submitted on -time
Purchaser's data time. and without revision and using template
initiatives and for last quarter format and does not
operational practices. require resubmission
Unsatisfactory: Not then status is
on time, or required Satisfactory, if not
revision last quarter then status is
Unsatisfactory. If
Consultant receives
four concurrent
Satisfactory statuses
Consultant is
upgraded to Exceeds
Expectations.
PM#4101: The State Consultants maintain Exceeds Expectations: Figures are rounded
of Oregon desires its a Net Promoter Score x 55 to the nearest
Authorized of 40 or higher. integer.
Purchasers to have Satisfactory:
positive experiences 40 x <. 55 Calculated as
when working with Percentage of
Page 51 of 60
Basecamp Unsatisfactory: Promoters minus
Consultants. x 4 40 Percentage of
Detractors
Where A Promoter is
a respondent who
responded with a
score of 9 or 10
A Detractor is a
respondent who
responded with a
score between 1 and
6.
Sample Survey
Question:
" How likely would
you recommend the
products/services of
[CONSULTANT] to a
colleague or a public
organization?" on a
scale of 1-10.
PM#4102: The State Consultants maintain Exceeds Expectations:
of Oregon desires a mean score of 3 out x z> 4.4 Figures are rounded
Authorized of 5 to the nearest single
Purchasers to see the Satisfactory: decimal place.
Basecamp Catalog 3.0 ;j! x < 4.0
and its price Calculated as Mean
agreements are of Unsatisfactory: response value over a
the highest quality. x �: 3.0 rolling 4 periods
Sample Survey
Question:
"In thinking about
your most recent
purchase with
[CONSULTANT], how
was the quality of the
product or service
you received?" using
a 5 point semantic
differential scale (1 :
Bad through 5:
Good).
Page 52 of 60
PM#1303: The State All (100%) reviewed Exceeds Expectations: Figures are rounded
of Oregon desires an invoices detail prices, x = 100% to the nearest whole
agreement in which quantities, and total percentage point.
Authorized by line- item. For Satisfactory:
Purchasers are given services this includes 95% x < 100% Percent of quotes
upfront and rates, positions, and with corresponding
transparent prices, hours as applicable. Unsatisfactory: invoices that detail
both before the x < 95% costs broken down by
engagement begins item or service
and on the invoice including all
before they make deliverables.
payment.
PM#4103: The State Consultants maintain Exceeds Expectations: Figures are rounded
of Oregon desires a mean score of 3.5 x =>. 4.5 to the nearest single
consultants to price out of 5 decimal place.
their products and Satisfactory:
services competitively 3.5 c x < 4.5 Calculated as Mean
and show they response value over a
provide value. Unsatisfactory: rolling 4 periods
X < 3,5
Sample Survey
Question:
" Please rate your level
of agreement when
thinking about your
most recent purchase
with [CONSULTANT] :
Our organization
received value for the
money." (l: Strongly
Disagree, 2: Disagree,
3 : Neither Agree nor
Disagree, 4: Agree, 5:
Strongly Agree),
PM#4104: The State Consultants maintain Exceeds Expectations: Figures are rounded
of Oregon desires its a mean score of 3 out x >� 4,0 to the nearest single
consultants to of 5 decimal place.
provide high quality, Satisfactory:
skilled, and customer 3,0 <. x < 4,0 Calculated as Mean
service oriented key response value over
persons to participate Unsatisfactory: rolling 4 periods
on Authorized x < 3.0
Purchasers' contracts. Sample Survey
Question:
"In thinking about
your most recent
purchase with
[CONSULTANT] ,
Page 53 of 60
please rate the
satisfaction with the
persons employed by
[CONSULTANT] ?" (l:
Unsatisfied through
5: Satisfied)
PM#4302: The State Purchasing Partners Exceeds Expectations: Figures are rounded
of Oregon desires to generally receive a x >� 4.0 to the nearest single
work with consultants response within 2 decimal place.
who provide timely business days of a Satisfactory:
response to request as indicated 3.0 <- x 4z 4.0 Calculated as Mean
Authorized by a response of response value over a
Purchasers' requests greater than 3 out of Unsatisfactory: rolling 4 periods.
5 . Xe 3.0.
Sample Survey
Question:
"When making a
request about project
related work,
submitting a ticket, or
reporting a problem,
staff from
[CONSULTANT]
generally respond
within 2 business
days" (99: Too Early
to Measure l: Never,
5 : Always).
SPECIFIC PERFORMANCE STANDARDS AND METRICS FOR
THIS MSA:
Performance Performance Performance
Objective Standard Levels Method Of Measurement
PM#3304: The Less than or equal Exceeds Expectations: Figures are rounded to the
State of Oregon to 10% of < 5.0% nearest single decimal place.
desires an deliverables
agreement in submitted receive Satisfactory: Calculated as the total number of
which Authorized a rejection. 500% �e x 5 10.0Ljp rejected deliverables wither the
Purchasers have reporting period divided by the
confidence in the Unsatisfactory: number of deliverables that were
quality of work > 10 .0% submitted for acceptance in that
they receive from reporting period.
our consultants.
The State wants to
Page 54 of 60
reduce the need
for Authorized
Purchasers to
micro-manage or
reproduce work
that should be
completed by the
Consultant.
PM#3303 : The On average, Exceeds Expectations:
State of Oregon deliverables are <; —1.0 Figures are rounded to the
desires to work submitted when nearest single decimal place.
with consultants they are due Satisfactory:
who provide —L.0 <, x < 0.0 Survey Question: The Basecamp
quality work when program is reviewing orders placed
they estimate Unsatisfactory: >0.0 on MSA #[ ] for
work will be [TITLE] to monitor vendor delivery
completed times. Your order and deliverable
number [ORDER #: Deliverable #]
has been selected for review. In
reviewing this order deliverable,
was the deliverable received by the
due date?"
a. Please indicate the date of
order:
b. Please indicate the expected
delivery date:
C, Please indicate the date of
delivery:
PM#3601 : The Consultants Exceeds Expectations: Figures are rounded to the
State of Oregon maintain a mean x >� 4.5 nearest single decimal place,
desires to work score of 3 out of 5
with consultants Satisfactory: Customer Satisfaction Survey that
who utilize 15 s� x < 4.5 asks: "Did the Consultant use the
appropriate methods it proposed in its contract
methods of Unsatisfactory: to complete its work?" (0: Too
conducting work x 3,0 Early to Measure 1 : Strongly
that are clear and Disagree, 2 : Disagree, 3 : Neither
demonstrable. Agree nor Disagree, 4 : Agree, 5 :
Strongly Agree)
Page 55 of 60
NON-CORE MEASUREMENTS RECORDED BY VENDOR
MANAGEMENT PROGRAM :
Performance Performance Performance
Objective Standard Levels Method Of Measurement
PM#1304: The NON-CORE: No
State of Oregon Defined Standard Percentages are rounded to the
desires an nearest single decimal place.
agreement in
which the total Calculated as the sum of quoted
cost of support cost of proposal to an opportunity
services to the divided by the project estimated
total project cost budget at time of opportunity
is kept at a notice.
reasonable level.
PM#9901 : The NON-CORE: No Calculated as the count of agencies
State wants Defined Standard and authorized purchasers over the
visibility into the life of the MSA.
utilization of its
price agreements
or master
agreements,
PM#9902: The NON-CORE: No Calculated as the count of
State wants Defined Standard engagements over the life of the
visibility into the MSA.
utilization of its
price agreements
or master
agreements.
PM#9903 : The NON-CORE: No Calculated as the total dollars
State of Oregon Defined Standard expended over the life of the MSA.
wants visibility on
the utilization of
its price
agreements or
master
agreements.
PM#9904: The NON-CORE: No Flag:
State of Oregon Defined Standard Oregon Certified: Certified in
desires to contract the State of Oregon
with and promote Other Certified: [Listed
firms who hold certifications]
Certification from Not Certified
the Office of
Business Inclusion
and Diversity
(http ://www.orego
n4biz.com/How-
We-Can-
Help/COBID/)
Basecamp also
wishes to extend
opportunities to
firms who are
certified in other
Page 56 of 60
states or by a
federal entity in
certifications of
Minority, Women,
Emerging/Small,
and/or
Disadvantaged
Business
enterprises.
(Noted with an
asterisk)
Page 57 of 60
EXHIBIT F
to Master Agreement #8263
Insurance Requirements
Consultant shall obtain at Consultant's expense the insurance specified in this
Exhibit F prior to performing under this MSA or any Contract, and shall maintain it
in full force and at its own expense throughout the duration of this MSA and all
Contracts , and as required by any extended reporting period or tail coverage
requirements , and all warranty periods that apply.
Consultant shall obtain the following insurance from insurance companies or
entities that are authorized to transact the business of insurance and issue
coverage in the State of Oregon and that are acceptable to DAS . Authorized
Purchasers may request additional insurance coverages under a Contract, as
deemed necessary.
Coverage must be primary and non-contributory with any other insurance and
self-insurance . Consultant shall pay for all deductibles , self-insured retention and
self-insurance, if any.
Consultant shall obtain at Consultant's expense the insurance specified in this
Exhibit F prior to performing under this MSA or any Contract, and shall maintain it
in full force and at its own expense throughout the duration of this MSA and any
Contract, and as required by any extended reporting period or tail coverage
requirements , and all warranty periods that apply. Consultant shall obtain the
following insurance from insurance companies or entities that are authorized to
transact the business of insurance and issue coverage in the State of Oregon
and that are acceptable to DAS-and Authorized Purchaser. Authorized
Purchaser may request additional insurance coverages . Coverage must be
primary and non-contributory with any other insurance and self-insurance .
Consultant shall pay for all deductibles , self-insured retention and self-insurance ,
if any.
1 . INSURANCE REQUIRED .
1 . 1 Workers' Compensation & Employers' Liability. All employers , including
Consultant , that employ subject workers , as defined in ORS 656 . 027 , shall
comply with ORS 656 . 017 and provide workers' compensation insurance
coverage for those workers , unless they meet the requirement for an exemption
under ORS 656 . 126 (2) . Consultant shall require and ensure that each of its
subcontractors complies with these requirements . If Consultant is a subject
employer, as defined in ORS 656 . 023 , Consultant shall also obtain employers'
liability insurance coverage with limits not less than $500 , 000 . 00 each accident.
If Consultant is an employer subject to any other state's workers' compensation
law, Consultant shall provide workers' compensation insurance coverage for its
employees as required by applicable workers' compensation laws including
employers' liability insurance coverage with limits not less than $500 , 000 . 00 and
Page 58 of 60
require and ensure that each of its out-of-state subcontractors complies with
these requirements .
1 . 2 Professional Liability. Consultant shall provide Professional Liability
insurance including the following :
A combined single limit of no less than $ 1 , 000 , 000 . 00 per occurrence covering :
1 . Technology Errors and Omissions related to the professional services and
products provided under this MSA
or any Contract,
2 . Network Security/Privacy Breach of agency data ;
3 . Coverage for regulatory fines and fees imposed against Agency due to
failures in products and Services provided under this MSA or any
Contract, including defense cost.
Coverage must include errors , omissions , negligent acts , denial of service , media
liability (including software copyright) , dishonesty, fraudulent or criminal acts by a
person or persons whether identified or not, intellectual property infringement,
computer system attacks , unauthorized access and use of computer system ,
regulatory actions , and contractual liability. Coverage must extend to business
associates and independent contractors providing professional services on
behalf of or at the direction of Consultant. A primary policy or combination of a
primary policy and excess policy is acceptable in order to meet the limits
requirement.
1 . 3 Commercial General Liability . Consultant shall provide Commercial
General Liability Insurance covering bodily injury , and property damage in a form
and with coverage that are satisfactory to DAS or Authorized Purchaser. This
insurance must include personal and advertising injury liability, products and
completed operations , contractual liability coverage , in each case arising out of
Consultant's negligence , and have no limitation of coverage to designated
premises , project, or operation . Coverage must be written on an occurrence
basis in an amount of not less than $ 500 , 000 . 00 per occurrence and
$500 , 000 . 00 aggregate .
1 .4 Automobile Liability. Consultant shall provide Automobile Liability
Insurance covering Consultant's business use including for all owned , non-
owned , or hired vehicles with a combined single limit of not less than
$ 1 , 000 , 000 . 00 for bodily injury and property damage . This coverage may be
written in combination with the Commercial General Liability Insurance (with
separate limits for Commercial General Liability and Automobile Liability) . Use
of personal automobile liability insurance coverage may be acceptable if
evidence that the policy includes a business use endorsement is provided .
2. ADDITIONAL INSURED . The Commercial General Liability, and Automobile
Liability insurance required under this MSA and any Contract must include an
additional insured endorsement specifying the State of Oregon , its officers ,
Page 59 of 60
employees and agents as Additional Insureds , including additional insured status
with respect to liability arising out of ongoing operations and completed
operations but only with respect to Consultant's activities to be performed under
this MSA or any Contract. The Additional Insured endorsement with respect to
liability arising out of your ongoing operations must be on ISO Form CG 20 10 07
04 or equivalent and the Additional Insured endorsement with respect to
completed operations must be on ISO form CG 20 37 04 13 or equivalent.
3 . TAIL COVERAGE . If any of the required insurance is on a claims-made basis
and does not include an extended reporting period of at least twenty-four (24)
months , Consultant shall maintain either tail coverage or continuous claims made
liability coverage , provided the effective date of the continuous claims made
coverage is on or before the Effective Date of this MSA and any Contract , for a
minimum of twenty-four (24) months following the later of (i) Consultant' s
completion and Authorized Purchaser's acceptance of all Services required
under this MSA and any Contract, or, (ii) The expiration of all Warranty Periods
provided under this MSA and any Contract.
4. CERTIFICATE(S) AND PROOF OF INSURANCE . Consultant shall provide to
DAS and Authorized Purchaser Certificate(s) of Insurance for all required
insurance before delivering any goods or performing any Services required under
this MSA or a Contract. The Certificate(s) must list the State of Oregon , its
officers , employees and agents as a Certificate holder and as an endorsed
Additional Insured . If excess/umbrella insurance is used to meet the minimum
insurance requirement, the Certificate of Insurance must include a list of all
policies that fall under the excess/umbrella insurance . As proof of insurance
DAS or Authorized Purchaser has the right to request copies of insurance
policies and endorsements relating to the insurance requirements in this MSA or
a Contract.
5. NOTICE OF CHANGE OR CANCELLATION . Consultant or its insurer must
endeavor to provide at least thirty (30) Calendar Days' written notice to DAS or
Authorized Purchaser before cancellation of, material change to , potential
exhaustion of aggregate limits of, or non-renewal of the required insurance
coverage (s) .
6 . INSURANCE REQUIREMENT REVIEW. Consultant agrees to periodic
review of insurance requirements by DAS or Authorized Purchaser under this
Contract and to meet updated requirements as mutually agreed upon by
Consultant and DAS or Authorized Purchaser.
Page 60 of 60
Attachment 1
PROPOSALFOR
INFORMATION SECURITY ASSESSMENT SERVICES
Prepared for
City of Tigard
Prepared by:
David J. Meyer
Account Manager
davidm@infoatrisk.com
Submitted: November 19, 2020
9rA
BPM Information Security Assessment Team
184 East 11th Avenue, Suite 210, Eugene, OR, 97401
toll free 877.328.7475 1 local 541.687.5222
www.bpmcpa.com
City of Tigard Infosec Assessment Proposal RESTRICTED
TABLE OF CONTENTS
EXECUTIVESUMMARY.......................................................................................................................3
SERVICE DETAILS:COMPREHENSIVE PENETRATION TEST.....................................................................4
OVERVIEW........................................................................................................................................4
KEYBENEFITS.....................................................................................................................................4
EXTERNALTESTING PROCESS..................................................................................................................5
INTERNALTESTING PROCESS...................................................................................................................9
PROJECTTIMELINE AND DELIVERABLES....................................................................................................10
SERVICE DETAILS: INFORMATION SECURITY CONTROLS REVIEW........................................................12
OVERVIEW......................................................................................................................................12
KEYBENEFITS...................................................................................................................................12
INFORMATION SECURITY CONTROLS REVIEW PROCESS ................................................................................12
PROJECTTIMELINE.............................................................................................................................15
DELIVERABLES ..................................................................................................................................15
WORK APPROACH AND PROJECT PROCESS .......................................................................................16
PROJECT MANAGEMENT......................................................................................................................16
TESTINGMETHODS ............................................................................................................................16
PROJECTMEETINGS...........................................................................................................................17
SECURITY STATEMENT......................................................................................................................19
BPM INFORMATION SECURITY ASSESSMENT TEAM QUALIFICATIONS................................................21
REFERENCES ....................................................................................................................................21
COMPANY PROFILE AND EXPERIENCE......................................................................................................22
STAFFING ROLES AND RESPONSIBILITIES...........................................................................................24
RESUMES OF KEY STAFF.......................................................................................................................24
COSTPROPOSAL ..............................................................................................................................27
ASSERTION OF COMPLIANCE WITH ALL PROJECT REQUIREMENTS,TERMS &CONDITIONS .................28
November 19, 2020 2 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
EXECUTIVE SUMMARY
I
The Information Security Assessment team of BPM, LLP(formerly Info@Risk) is an assessment-only
information security firm that offers our clients an extensive suite of risk-based information security
assessments services. Because of our single focus, assessment-only business model, our clients can be
assured of thorough and unbiased comprehensive assessment of their information security controls.
The Information Security Assessment team has performed information security assessments since 1998
for organizations seeking effective risk mitigation and regulatory compliance.
Why BPM? In today's market, many companies profess expertise in information security but also sell
solutions to address the security deficiencies their assessments reveal. When clients engage the BPM
Information Security Assessment team, they are assured of an honest, independent assessment that will
guide the development of their information security risk management program in a cost effective, best
practices approach. All clients receive impartial recommendations for remediation, information security
plans of action and informal ad-hoc discussions on relevant risk concerns. It is because of our
assessment-only business model that our clients rely on our opinions and expertise long after we deliver
a project final report.
The Information Security Assessment team's staff and services are specifically designed and developed
to address the needs expressed by City of Tigard. Based on statements made by City of Tigard
stakeholders, it is apparent City of Tigard has made a commitment to improving their security
environment and we believe we can offera unique and impartial assessment solution.
To meet the needs specified by City of Tigard, BPM proposes the following services:
• Comprehensive Penetration Test
Please Note: The following reduced-scope/reduced cost options to the Comprehensive
Penetration Test are included for City ofTigard's consideration.
o Penetration Test without in-person Social Engineering or Physical Testing
o Technical Penetration Test (No social engineering, no phishing)
• Information Security Controls Review/Program Assessment
Detailed descriptions of the services are in the next sections. All proposed services are based on scoping
information provided by City of Tigard and all are aligned with NIST framework solutions. In reviewing
this proposal, we are confident City of Tigard stakeholders will readily recognize how BPM's NIST based
solutions—testing, review, methodology guidance and delivery of working documents for remediation
and program development—all support and transfer into a NIST based Information Security Program
standard.
November 19, 2020 3 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
SERVICE DETAILS: I
COMPREHENSIVE PENETRATION
OVERVIEW
The Comprehensive Penetration Test thoroughly assesses the real-world effectiveness of information
security controls. Executed from all typical physical, human and technological attack vectors, the testing
provides a comprehensive baseline assessment of information security control effectiveness. The
proposed Comprehensive Penetration Test entails a carefully developed testing process to enable
decision makers to make effective risk-based decisions.
The assessment evaluates the logical and physical controls securing sensitive information and
demonstrates the scope and severity of discovered vulnerabilities by manually probing them with the
most up-to-date exploits. Attempts are made to leverage vulnerabilities that at first glance may seem
unrelated and insignificant into larger exploits of greater severity. Within the defined scope, the
Information Security Assessment team's testing parallels steps that might be taken by a real-world
attacker attempting to defeat the controls.
Assessors document the success of each exploit by providing evidence, typically screen shots, in the
report findings. Test results are compiled and subjected to rigorous peer review and contextual
feedback from appropriate client personnel to ensure the accuracy of the findings. With the scope and
accuracy confirmed, the assessment results are then published in a report and presented in an Executive
Summary, both designed to clearly present the nature of the risk to sensitive information and provide
clear recommendations for remediation and informed risk-based decision making.
The assessment includes remediation verification. Verification will be performed for most high-risk
technical vulnerabilities remediated within sixty days of the project completion and submitted as a
complete group for remediation verification. Remediation verification will only be done once and the
assessors will update the project Vulnerability Remediation Matrix with the results of the remediation
verification.
KEY BENEFITS
• Provides a baseline of physical, human, and technical controls that fail to operate as expected
and ones that appear to operate as intended
• Provides remediation recommendations for making information security controls more effective
• Prioritizes remediation recommendations for efficient, importance-based remediation
• Enables accurate measurement of controls improvements
November 19, 2020 4 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
EXTERNAL TESTING PROCESS
INFORMATION GATHERING
Potential Risks Test Activities
Having credible information about a target There are three main components to information
organization and network improves the chances gathering:
of attackers successfully social engineering • Digital foot-printing to inventory the
employees and enhances their ability to identify organization's digital perimeter
exploitable vulnerabilities. Information about an o Review for any embedded
organization is typically obtained through the malicious links
Internet but can be obtained by other means, o Run scripts that change top-level
such as voicemail directories. domains and perform slight
misspelling of domain names to
reveal potential domain squatters
• Harvest information to determine
systems or applications in use that might
allow an attacker to craft more targeted
attacks. Information is harvested via
vendor press releases, tech support
discussion threads, plus the
organization's website
• Harvest employee names, titles, phone
numbers and email addresses for social
engineering attacks
VOICE SYSTEMS
Potential Risks Test Activities
Telephone voice mail can be a source of To protect the voice mail system, the following
penetration when used to exchange stolen credit items are examined:
card numbers or forward local calls to long • Voicemail account passcodes are tested
distance numbers. Stored messages in poorly for strength and examination of saved
protected mailboxes can also provide defrauders messages containing sensitive
with sensitive information. Voice mail systems information
can also be targeted by hacker organizations • The voicemail system is tested for
simply seeking to demonstrate technical fuzzing, call forwarding, and call relay
prowess. vulnerabilities that may be used in toll
fraud attacks
MODEM ACCESS SERVICES
Potential Risks Test Activities
Modems associated with public telephone To protect against these threats, the following
numbers can be identified using common war areas are assessed:
dialing applications. Sanctioned modems are • War dialing of all phone numbers
often subject to guessing or brute force attacks. o Known modems are attacked
Also, attackers still use modems as backdoor o Unknown modems are identified
access/egress points to/from a network, so that and attacked
November 19, 2020 5 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
typical network security measures, e.g. IDS/IPS,
may be bypassed.
PHONE-BASED SOCIAL ENGINEERING
Potential Risks Test Activities
Social engineering, as it relates to hacking, uses Employees are attacked via phone-based social
misrepresentation to influence an employee to engineering methods, testing the following
import malicious payloads and/or divulge their controls:
password or any other information that would be • Willingness to execute commands and
useful in the attempt to gain access to sensitive relay network information to an
information. BPM utilizes information gathered unverified caller
from public sources to develop exploits . Willingness to navigate to an external site
specifically tailored to the client's organization. and download a malware payload at the
Information such as personnel names and behest of an unverified caller
positions are used to craft attacks designed to . Willingness to disclose credentials to an
test employee awareness and training. unverified caller
BPM will harvest and document phone-based
social engineering targets using methods that
replicate the actions of an actual attacker.
Targets may be added or deleted at the client's
discretion.
EMAIL SERVICES AND MALICIOUS ATTACHMENTS
Potential Risks Test Activities
Mail servers that are not configured properly can The following email safeguards are assessed:
be victimized in many ways. One common attack . Platform-related vulnerabilities
vector is to use the organization's mail system as . Email address enumeration
a SPAM site, e.g.,a launch point for emails . SMTP relay vulnerabilities
destined for people/organizations outside the . Email address spoofing
client's organization. Also, enumerating email 0 Malicious email attachment controls
addresses that can be used by social engineers is
common. Additionally, criminal hackers
exploiting published or known vulnerabilities e.g.
email address spoofing, can greatly enhance a
phishing attack(see below).
Malicious attachments are generally considered
the most common means of delivering malware
onto an organization's network. Malicious
attachments range from nuisance attacks, to
ransomware attack drives, to performing full
scale Denial of Service (DoS) attacks against
network infrastructures and launch points for
Advanced Persistent Attacks.
November 19, 2020 6 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
PHISHING
Potential Risks Test Activities
Social engineering, as it relates to hacking, uses In the Phishing test, employees are attacked via
misrepresentation to influence an employee to email-based social engineering methods, testing
divulge their password or any other information the following controls:
that would be useful in an attempt to gain access . Willingness to follow directions in an
to sensitive information. BPM utilizes information email from an unverified sender
gathered from public sources to develop exploits . Willingness to navigate to an external site
specifically tailored to the client's organization. and/or disclose credentials
Information such as personnel names and BPM will harvest and document phishing targets
positions are used to craft attacks designed to using methods that replicate the actions of an
test employee awareness and training. actual attacker. Targets may be added or deleted
at the client's discretion to include up to 100% of
the organization's employees in the assessment.
WEB SERVICES
Potential Risks Test Activities
The Internet not only brings anonymity to To evaluate controls against web-based attacks
hackers, but also a certain degree of impunity the following areas are examined:
from legal consequences. Web services are • Vulnerabilities created by unnecessary
among the most commonly attacked systems on services running on the web servers
the Internet. • Commonly documented system security
holes
• Evaluate if the means of authentication is
consistent with levels of information
sensitivity
• Evaluate privilege escalation, i.e. can
authenticated users gain access to
unauthorized information?
• Sensitive web directory protections from
unauthorized access
• Injection, scripting, and traversal controls
FIREWALL
Potential Risks Test Activities
Unauthorized access by external and/or internal BPM assesses the susceptibility of client firewall
users. Other risks include IP spoofing, denial of to known vulnerabilities and exploits to
service attacks, programs like finger, whois, circumvent its protection features.
tracert, and nslookup, and limiting services such • Attempt to access the firewall from
as talk, Internet Relay Chat(IRC), and other outside the trusted network; determine if
similar programs (WINAMP, NET Meeting, Instant make and model can be identified and if
Messenger) to only designated ports. unauthorized connections are allowed
• Identify and attack any management
login dialogs
• Harvest and attack pre-shared keys
November 19, 2020 7 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
EXTERNAL NETWORK DEVICES
Potential Risks Test Activities
When an Internet connection is made, every • Determine if routers are configured to be
hacker in the world gains potential access to any hidden from public observation
machine using a public IP address. BPM assesses . Test to see if routers refuse all
the perimeter network devices' susceptibility to unauthorized connections
compromise. • Test for patch related vulnerabilities,
extraneous services or weak
configurations
MISCELLANEOUS SERVICES
Potential Risks Test Activities
This section includes Domain Name Services The following services are tested where
(DNS), FTP servers, and Terminal Services and applicable:
other external systems/components not fitting • DNS server allowing unauthorized servers
within the categories listed above. By exploiting to perform DNS zone transfers
vulnerabilities to these systems, a hacker could . Test FTP (File Transfer Protocol) servers
reduce system productivity and access sensitive for risks from published vulnerabilities,
hosts and/or proprietary information. including denial of service (DoS), Buffer
Overflow, and Directory Traversal
• Examine RDP and Terminal Services for
vulnerabilities related to unauthorized
system account access
November 19, 2020 8 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
INTERNAL TESTING PROCESS
ONSITE SOCIAL ENGINEERING
Potential Risks Test Activities
Onsite social engineering consists primarily of The following controls are tested where
tests of visitor controls. Combined with physical applicable:
security weaknesses, on-site social engineering • Challenging visitors on entry
vulnerabilities raise the likelihood of successful . Vetting visitor's identification
exploits against vulnerabilities discovered in . Verifying visitor's authority to visit
testing elements outlined below. . Escorting visitors
PHYSICAL SECURITY
Potential Risks Test Activities
Physical security poses challenges to the BPM assesses the following physical security
protection of information assets. Many physical controls:
weaknesses can be exploited to provide access, • Ingress controls, e.g.door locks, alarm
even of short duration, to computing resources. systems, surveillance systems
And strong physical controls can limit data 0 Externally visible monitors
leakage. Without adequate data center security, 0 Unlocked, unattended workstations
even the most complex security solutions can be . Unsecured trash receptacles, shred bins,
bypassed with physical access to the server, and dumpsters
network hardware, or in some cases, . Fire suppression controls
workstations. . Publicly accessible information assets,
e.g. lobby kiosk PCs
NETWORK DEVICES
Potential Risks Test Activities
BPM probes for weaknesses of network devices BPM assesses the following:
that could be exploited by internal attackers who . Internal network device ARP spoofing to
have penetrated the physical security perimeter, harvest and compromise data and
or internal attackers or threats that are services
unprivileged/unauthorized users. • Vulnerabilities in device software
versions
• Easily guessed credentials
WORKSTATIONS
Potential Risks Test Activities
Often the first internal systems compromised are The following are assessed:
user workstations. Once access is granted to a • WPAD-related vulnerabilities
networked workstation, a hacker can ascertain . Patch-related operating system
other possible access points. In many Windows vulnerabilities
networks, domain passwords are resident in . Known application vulnerabilities
memory. • Easily guessed passwords
• Insecure configuration settings
November 19, 2020 9 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
NETWORK SERVERS
Potential Risks Test Activities
Servers typically hold the most critical data, This section assesses the following items:
including user databases, confidential business • Patch-related operating system
information, public or private web pages, and vulnerabilities
mail services. Exploitation of application • Known application vulnerabilities
vulnerabilities could result in compromise of • Easily guessed passwords
data confidentiality, integrity (corrupted data), • Insecure configuration settings
and accessibility (files deleted). • Extraneous services running on the
servers
• Unauthenticated/unauthorized access to
data and services
MISCELLANEOUS SERVICES
Potential Risks Test Activities
Miscellaneous Security concerns devices that do Miscellaneous testing includes:
not fit into other categories. Commonly cited • Patch-related operating system
devices include storage devices, multi-function vulnerabilities
printer/scanner/fax/copiers and uninterruptible • Known application vulnerabilities
power supplies. Through security weaknesses in • Easily guessed passwords
any of these, attackers on the inside can reduce • Insecure configuration settings
system productivity, access sensitive and/or • Extraneous services
proprietary information, create the conditions • Unauthenticated/unauthorized access to
for leveraging other weaknesses possibly leading data and services
to the ability to steal, corrupt, delete, or
compromise an organization's information
systems.
EGRESS
Potential Risks Test Activities
In the event an attacker or malware payload is BPM assesses egress security from an internal
successful in gaining access to the organization's perspective, including:
network, determining the impact can be difficult. • Test limits on egress
• Test limits on data exfiltration, e.g.data
loss prevention
PROJECT TIMELINE AND DELIVERABLES
Depending upon project scope, the Comprehensive Penetration Test typically requires approximately
four to six weeks as described below:
• Testing phase: 3 weeks.
• Report/Deliverables preparation: 1 week.
• Technical presentations: 1-2 hour presentation is typically delivered during the week following
Report/Deliverables preparation.
November 19, 2020 10 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
• Executive presentation.
The deliverables for the Comprehensive Penetration Test include:
EXECUTIVE SUMMARY REPORT AND PRESENTATION DOCUMENT
The Executive Summary Report is a brief overview of the assessment and results. It is written in non-
technical language and includes areas of strength as well as recommended areas for improvement.
The Executive Presentation document contains copies of the slides shown during the results
presentation to the Executive Committee, executive management and/or other concerned parties. This
is designed to provide management with a clear, non-technical overview of the results of the full
assessment.
NARRATIVE REPORT
The Narrative Report contains detailed and summarized written findings of vulnerabilities and
descriptions of leveraged exploits, suggested risk ratings associated with each, and recommendations
for remedial action.This includes screenshots and other appropriate visual documentation, a rating of
the severity of the risk, and recommendations for remediation. The report is designed to make clear the
nature of the risk to sensitive information for each specific vulnerability to assist in prioritizing
remediation efforts and ensure effective risk mitigation.
VULNERABILITY REMEDIATION MATRIX
The Vulnerability Remediation Matrix shows all vulnerabilities found in a concise spreadsheet format.
BPM includes an electronic copy of the Vulnerability Remediation Matrix as an editable document to
record remediation. When completed, the Vulnerability Remediation Matrix can be shown to auditors to
demonstrate City of Tigard's remediation effort.
LETTER OF ATTESTATION
The auditor's cover letter of attestation provides a brief summary of project scope and results. This
document may be used to provide evidence of due care and due diligence, without revealing any result
details.
November 19, 2020 11 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
SERVICE DETAILS: I
INFORMATION SECURITY CONTROLS
OVERVIEW
The Information Security Controls Review evaluates the organization's documentation of controls
required by regulations as well as standards and additional controls informed by best practices. In
addition, the Controls Review provides detailed recommendations for Information Security Program
improvement.
BPM reviews the Information Security Program control implementation as guided by NIST SP 800-53
Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations.
In order to ensure the review includes controls appropriate for the organization, BPM incorporates
guidance from the NIST SP 800-53 Rev. 4 Low Baseline.
KEY BENEFITS
• Provides guidance for improving the Program's effectiveness in fulfilling regulations and
standards and appropriate best practices
• Provides detailed, long-term recommendations on how to improve the Program
• Guided by NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems
and Organizations
INFORMATION SECURITY CONTROLS REVIEW PROCESS
BPM will conduct the Information Security Controls Review through examination of Information Security
Program documentation and interviews with organization stakeholders.
The Information Security Controls Review will:
• Determine applicable information security controls
• Examine documentation and interview organization stakeholders
• Evaluate sufficiency of information security controls documentation
• Provide prioritized recommendations for Program improvement
DETERMINE APPLICABLE INFORMATION SECURITY CONTROLS
BPM will determine a reasonable set of applicable information security controls for the organization.
An organization's applicable information security controls are informed by:
• Controls required for compliance with regulations and standards
• Controls appropriate for the organization informed by best practices
November 19, 2020 12 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
Below is an example set of regulations, standards, and best practices that might be used to establish the
applicable controls for an organization.
APPLICABLE CONTROL SET
BPM and Organization have determined that the following regulations, standards, and best practices
comprise a reasonable set of applicable information security controls with regard to its business practices
and the sensitivity of information it protects.
• PCI Digital Security Standard 3.0
• NIST SP 800-53 r4 Low Baseline
The Information Security Controls Review will supply the organization with an authoritative Catalog of
Applicable Controls, based on guidance from NIST SP 800-53 Rev. 4.
Below is an example control from NIST SP 800-53 Rev. 4 Appendix D.
AC-7 UNSUCCESSFUL LOGON ATTEMPTS
Control: The information system:
a. Enforces a limit of[Assignment: organization-defined number] consecutive invalid logon
attempts by a user during a [Assignment: organization-defined time period]; and
b. Automatically [Selection: locks the account/node for an [Assignment: organization-defined
time period]; locks the account/node until released by an administrator; delays next logon
prompt according to [Assignment: organization-defined delay algorithm]] when the
maximum number of unsuccessful attempts is exceeded.
EXAMINE DOCUMENTATION AND INTERVIEW ORGANIZATION STAKEHOLDERS
BPM will review the organization's complete Information Security Program, including examining all
Program documentation and interviewing organization stakeholders to account for undocumented
Program practices identified during examination.
The structure and schedule of examination and interviews is detailed in the Project Timeline section
below.
EVALUATE SUFFICIENCY OF INFORMATION SECURITY CONTROLS DOCUMENTATION
BPM will evaluate the sufficiency of the organization's information security controls documentation in
fulfilling applicable compliance regulations and standards and appropriate best practices.
Evaluation of sufficiency will be both general and control-specific. Control-specific evaluation will be
organized by control families defined in NIST SP 800-53 Rev. 4.
November 19, 2020 13 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
Below is the list of control families defined in NIST SP 800-53 Rev. 4 Appendix D.
TABLE 1: SECURITY CONTROL IDENTIFIERS AND FAMILY NAMES
ID FAMILY ID FAMILY
AC Access Control MP Media Protection
AT Awareness and Training PE Physical and Environmental Protection
AU Audit and Accountability PL Planning
CA Security Assessment and Authorization PS Personnel Security
CM Configuration Management RA Risk Assessment
CP Contingency Planning SA System and Services Acquisition
IA Identification and Authentication SC System and Communications Protection
IR Incident Response SI System and Information Integrity
MA Maintenance PM Program Management
PROVIDE PRIORITIZED RECOMMENDATIONS FOR PROGRAM IMPROVEMENT
BPM will provide a prioritized set of recommendations for general improvements to the Information
Security Program.
These recommendations highlight Program concerns that are more extensive than control-specific
insufficiencies, and detail long-term steps on how to achieve the recommended improvement.
Below is an example Recommendation Summary from a Controls Review Report.
RECOMMENDATION SUMMARY
BPM recommends the following general improvements to Organization's Information Security Program.
Each recommendation includes detailed, long-term steps on how to achieve the improvement.
1. Establish Information Security Steering Committee
2. Develop Information Security Program Plan
3. Develop Information Asset Inventory
4. Develop and document baseline configuration for systems subject to change management
5. Expand Business Continuity Plan to include information security system and process
contingencies
6. Expand Disaster Recovery Plan to include quantifiable Recovery Time Objectives and
Recovery Point Objectives
These recommendations will take time and resources to address. BPM attempts to limit its
recommendations set to one which might be reasonably completed in two years.
November 19, 2020 14 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
PROJECT TIMELINE
The Information Security Controls Review is performed through examination of Information Security
Program documentation and interviews with organization stakeholders, which consist of a series of
remote meetings.
The meeting schedule is detailed in the following table.
Timeline Meeting Topic Client Time
Requirement
Prior to project Meeting —Kick-off 30 minutes
Client provides documentation Varies
Week 1 BPM reviews documentation None
Week 2 BPM reviews documentation None
Stakeholder Interviews
Week 3 Meeting —Undocumented Practices (part 1) 60 minutes
Meeting —Undocumented Practices (part 2) 60 minutes
Week 4 Meeting —Draft Report 60 minutes
If the availability of stakeholders causes delays in scheduling, an additional fee may be incurred.
DELIVERABLES
CONTROLS REVIEW REPORT: Provides the client with a detailed report of the controls review,
including an executive summary, prioritized recommendations, and narrative of controls
implementation.
CATALOG OF APPLICABLE CONTROLS: Provides the client with an authoritative catalog that includes
a reasonable set of applicable controls informed by regulations, standards, and best practices relevant
to the organization.
CONTROLS REVIEW WORKBOOK: Provides the client with the workbook used for tracking
examination and interview notes, which will serve as an exhibit of Information Security Program review.
November 19, 2020 15 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
I�WORK APPROACHR• PROCESS
The Information Security Assessment team's approach for every project is to partner with the client to
strengthen the client's security posture. With each of our services, the initial step is to identify
weaknesses, gaps, and vulnerabilities in the client's organization. We followthis with guidance to use
the assessment information to improve the organization's risk mitigation processes. Each service has a
clear outcome and set of deliverables designed to assist City of Tigard in moving their Information
Security Program forward.
All assessment activities are performed remotely from the Information Security Assessment Team's
offices unless the activity requires an onsite presence (Onsite Social Engineering, Physical Security
Assessment, Onsite Firewall Review, etc.) or as otherwise specifically noted. Throughout the project,
frequent communication with all stakeholders will be a primary aspect of our work.
The assessment services described in this proposal will follow the Information Security Assessment
team's project process.This process has been refined over nineteen years of assessment experience and
is specifically designed to ensure clear communication of test results and thorough understanding of the
risks posed by any specific finding.
PROJECT MANAGEMENT
To ensure timely and complete performance of tasks and delivery of reports and other associated
materials, BPM assigns a dedicated Project Manager. In addition to setting schedule and meeting times,
the Project Manager serves as the primary interface for all project communications. When necessary for
the completion of specific assessment duties, assessors are available for direct communication with City
of Tigard stakeholders.
TESTING METHODS
BPM has dedicated a team of specialists to perform the work proposed to City of Tigard. While each
team member has areas of specialization and particular expertise, the Information Security Assessment
team's methodology requires rigorous peer review of all findings. Modeled on academic peer review,
assessors review and challenge other team members' test results to ensure thoroughness and accuracy.
This process is developed to also ensure that information gathered from a specific testing area can be
utilized to enhance the tests performed on other assets.This will fully reveal the nature of the risks
posed by a specific vulnerability and better reflect the actions of an actual attacker who might utilize a
cascading sequence of exploits to compromise sensitive information and assets.
November 19, 2020 16 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
PROJECT MEETINGS
The meetings detailed below pertain to the Comprehensive Penetration Test service; please see the
Service Details sections for the Information Security Controls Review for a detailed list of anticipated
meetings for those services. If the Information Security Controls Review are performed in conjunction
with the Comprehensive Penetration Test, the Executive Presentation described below will also
incorporate results from those services.
PROJECT KICK-OFF MEETING
A conference call between BPM assessment personnel and appropriate City of Tigard stakeholders to:
• Explain project elements and testing methods
• Review and finalize project calendar
• Review personnel assignments (for both BPM and City of Tigard) for each task
• Coordinate appropriate communication protocols for project tasks
• Clarify any testing restrictions, exclusions or concerns, to avoid adverse impacts to City of Tigard
personnel or production systems and best ensure meeting of all project goals
DRAFT CONFERENCE CALL
After performing assessments and compiling an initial report, a conference call between BPM
Assessment personnel and appropriate City of Tigard stakeholders will be conducted to preview the
findings.
The preview conference call meeting will:
• Present draft report in a line-by-line preview of every finding to ensure City of Tigard personnel
understand all details of the issues found
• Provide the opportunity for City of Tigard personnel to present additional information that may
impact the risk posed to the organization and/or accuracy of the finding
• Receive feedback from City of Tigard stakeholders on changes/modifications for the final reports
The primary goals of the Draft Conference Call are to ensure the accuracy of each finding, and for City of
Tigard personnel to have a clear understanding of the risks posed and the appropriate steps to mitigate
such risks. Following the Draft Conference Call, and after all parties are in agreement as to the findings,
their severity, and remediation steps and priorities, BPM will prepare the Final Report forthe Executive
Presentation.
November 19, 2020 17 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
EXECUTIVE PRESENTATION
To ensure the appropriate communication of test results to organizational decision-makers, BPM will
coordinate a secure, live video conference presentation of the report results to Executive Management
and/or other appropriate personnel. This will be a high-level overview designed for these stakeholders
to understand the nature of the tests performed, the effectiveness of existing controls in managing risks,
and the responses and improvements made by City of Tigard personnel in response to the test results.
The goal will be to provide Executive Management with the information needed for them to make well-
informed, risk-based decisions. Opportunity forquestions and discussion will be included in the
presentation.
November 19, 2020 18 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
SECURITY STATEMENT
I
Information security is our business and the Information Security Assessment team considers the
management and securing of client sensitive information a matter of utmost priority. City of Tigard can
be assured their sensitive information will be protected.
Policies and procedures are in place to ensure the highest level of protection forall sensitive data. BPM
documents that address this issue include: Security Policy Manual, Incident Response Policy, Business
Continuity Plan, Privacy Policy, Information Classification Guide, Employee Manual, and Data Handling
Procedures. BPM has a third-party conduct periodic penetration testing to assess information security.
For all engagements, BPM's secure document management website is used to send and receive all client
sensitive information, from project schedule through delivery of final reports. All information is
encrypted both at rest and in transit. The physical and electronic safeguarding of data is described in the
Data Handling Procedure and includes specifics for encryption, storage, and deletion of sensitive data.
The Information Security Assessment team's terms of employment specify the security responsibilities
required of our employees and all personnel must adhere to applicable policies. Employee Security
Awareness training occurs upon hire and at least annually thereafter. In addition, BPM requires
background checks for every employee when they are hired. All project employees receive annual
Information Security training from industry leading organizations including the International
Organization for Standardization, the International Information System Security Certification
Consortium, the SANS Institute, ISACA, and others.
The Information Security Assessment team does not use sub-contractors orthird-party IT vendors.
Other vendors, such as electricians, who may have access to the team's office suite are escorted and
monitored at all times.
The Information Security Assessment team's technical security controls are designed to meet or exceed
the risk management requirements of all our customers, e.g. HIPAA, GLB, CAS, etc.The Information
Security Assessment team prohibits potentially insecure remote access protocols, such as RDP sessions,
and requires fixed, known-good source addresses (at the network layer), and multi-factor authentication
for remote access.Technical security controls include, but are not limited to,the following:
• Intrusion prevention and detection systems (IPS/IDS) in place on administrative networks
• Positive security model at the network edge to prevent unauthorized access
• Multi-layered email filtering mechanisms that include malware detection
• Encrypted communications and file exchange for customer Internet-based interactions involving
sensitive data
• Multiple redundant encrypted tunnels used for interfacing in and out of client networks
• Multi-factor controls forall workstations and client test hosts
November 19, 2020 19 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
• Full disk encryption of all workstations, applicable servers, and all test hosts
• Two-factor authentication is required to access the firewall management console, and is only
accessible from specific internal VLANs
• Automatic domain account lockout for repeated failed authentication attempts
• Comprehensive NGFW traffic logging
The Information Security Assessment team's Information Security Policy dictates that all project-related
data must be securely destroyed within six months of project completion, unless otherwise instructed
by the client. We utilize data destruction methods in accordance with protocols used by the U.S.
Department of Defense.
The most compelling attestation to the Information Security Assessment team's technical security
controls is that, in over two decades of providing highly sensitive security assessment services for
hundreds of institutions, we have not had an insurance claim, threatened or actual litigation claim, or
known security breach. We work hard every day to maintain this status and sustain our business by
being passionately focused on securing data before, during, and after engagements, and then securely
deleting all engagement data from our hosts.
November 19, 2020 20 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
INFORMATIONBPM
REFERENCES
City of Gresham
133 NW Eastman Parkway
Gresham, OR 97030
Contact: Pat Hartley, IT Director
Phone: (503) 618-2520
Email: pat.hartley@greshamoregon.gov
City of Sherwood
22560 SW Pine Street
Sherwood, OR 97140
Contact: Brad Crawford, IT Director
Phone: (503) 625-4203
Email: crawfordb@sherwoodoregon.gov
SAIF Corporation
400 High St. SE
Salem, OR 97312
Contact: Bill Donaldson, Information Security Officer
Phone: (503) 373-8725
Email: bildon@saif.com
PacificSource Health Plans
PO Box 7068
Springfield, OR 97475
Contact: David Mohr, Information Security Manager
Phone: (541) 684-5488 x5488
Email: david.mohr@pacificsource.com
Additional references are available on request.
November 19, 2020 21 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
COMPANY PROFILE AND EXPERIENCE
BPM LLP
Information Security Assessment Team
184 East 11th Avenue, Suite 210
Eugene, OR, 97401
877-328-7475 (Toll Free)
541.687.5222 (Local)
541-485-7372 (Fax)
http://www.bpmcpa.com
BPM DUNS: 18-123-9468 BPM FEIN: 81-4234542
Mission Statement: Our mission is to provide the most expert, unbiased and comprehensive
information security risk analysis services available today, while maintaining the highest levels of
integrity and ethical conduct.
QUALIFICATIONS AND CERTIFICATIONS
• CISSP: Certified Information System Security Professional
• CISA: Certified Information Systems Auditor
• CWAPT: Certified Web Application Penetration Tester
• CEH: Certified Ethical Hacker
• CPT: Certified Penetration Tester
• CSSA: Certified SCADA Security Architect
• GAWN: GIAC Assessing and Auditing Wireless Networks
BRIEF HISTORY
The Information Security Assessment team of BPM, LLP (formerly Info@Risk) was founded when the
Gramm-Leach-Bliley Act (GLBA) was still a bill in Congress and we have been performing risk analysis
services since January 1998. Originally started as a small team within a regional systems integration firm,
the potential for conflict-of-interest was soon recognized. Info@Risk was spun off into a stand-alone
corporation with no shared ownership with any other information technology firm. Since January 1998
the Information Security Assessment team has performed over 1,200 comprehensive penetration tests
and over 600 information security program reviews, configuration reviews and risk assessments. In
2017, Info@Risk joined BPM, an accounting firm that provides assurance, tax,and audit services.
LIST OF PRODUCTS AND SERVICES
• Comprehensive Information Security Penetration Test
• Application Penetration Test
• Wireless Penetration Test
• Device/System Configuration Review
• Black Box Testing /Gray Box Testing /Credentialed Testing
November 19, 2020 22 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
• Social Engineering Awareness Testing
• Information Security Risk Assessment
• Information Security Program Review
• Online Banking Review
• General IT Controls Audit
• Information Security Controls Audit
• Security Awareness Training
• Periodic Active Directory Password Audit
• Periodic Scanning
STATEMENTOF KEY DIFFERENTIATORS
BPM offers our clients an extensive suite of risk-based information security assessments services, but we
do not plan, build or manage IT systems. Because of our assessment-only business model, our clients
can be assured of a thorough and unbiased comprehensive assessment of their information security
controls. No additional security products, services, vendor or partner alliances, or other potential
conflicts of interest will ever impact the complete objectivity of the Information Security Assessment
team's assessments. In addition, with no financial stake in any information security related products or
solutions, remediation recommendations will always be the most cost-effective possible, keeping only
our client's best interests in mind.
Located in Eugene, Oregon, the Information Security Assessment team has worked with entities
throughout the United States. A large percentage of the Information Security Assessment team's clients
are repeat customers, with many of our relationships stretching back nearly to our beginning in 1998.
We attribute these enduring relationships to three facts:
• our clients value the depth and comprehensive quality of our work
• our clients recognize that to truly manage risk, an unbiased assessment and remediation plan
are a priority when choosing a vendor
• our clients seek a partnership with their impartial assessment vendor to guide them in making
informed, risk-based decisions for their organization
BPM's Information Security Assessment team provides our clients with thorough and comprehensive
information security assessments so they can be confident in making risk-based decisions best suited for
their organization. We are proud of the work we have done and are confident our references will
support this pride. In today's market, many companies profess expertise in information security but also
sell solutions to address the security deficiencies their assessments reveal. We strongly encourage you
to contact our references to find out more about the quality of our services, processes, and personnel.
November 19, 2020 23 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
STAFFING I
ROLES AND RESPONSIBILITIES
BPM will staff this project exclusively with Information Security Assessment team employees who have
performed similar assessments for a number of years. The Information Security Assessment team does
not use independent contractors or third-party vendors to perform assessments.
• Key BPM staff proposed for this project are included below in the resume section
• All Information Security Assessment team staff are US citizens
• BPM attests that all project personnel have passed thorough background checks and that no
employees working on the engagement have ever been convicted of a felony or excluded from
participation in a governmental program
• BPM attests that no client data will be disclosed
• BPM will provide all tools necessary to conduct its assessments
RESUMES OF KEY STAFF
David T.—Partner, U.S.Army Achievement Medal
IT Assurance B.A., Magna Cum Laude and Phi Beta Kappa: University of New Hampshire
M.S.,University of Oregon
A technology entrepreneur since 1989,David first led the growth of InfoGroup Northwest(now
Presidio)from four employees to the largest independent information systems integrator in the
Pacific Northwest.Leveraging his unique experience building information systems,David
launched Info@Risk in January 1998,with the single purpose of assessing clients'information
system security.Since then,he has led over 1200 information security assessment engagements
for satisfied customers across all major industries throughoutthe United States.
David has worked in Information Security with governments,financial institutions,utilities,and
healthcare since 1998.
Jeannie R.— B.S., Ithaca College
Project Manager Since 2011,Jeannie has led the team to consistently deliver on-time,in-budget,completed work.
Prior to taking on project management responsibilities,Jeannie worked for seven years as
Info@Risk's operations manager;providing her with an intimate understanding of how projects
get done. Previously,Jeannie was a Physical Therapist for 22 years,providing her with key
insights into the clinic workflow challenges facing our healthcare clients.
Jeannie has worked in Information Security since 2004.
Joshua S.— Lead University of Oregon
Technical Assessor CJIS Certification,Level 4
Certified Ethical Hacker(CEH)
Certified Penetration Tester(CPT)
Joshua also started his career as a systems administratorfor a university in 2009. Since then,
Joshua has used his education specialized track in information security as a systems specialist and
assessor. Joshua is a dual-threat assessor,with skills in both networking and application
development. Joshua's excellent work ethic and superior attention to detail make him a valued
member of the Information Security Assessmentteam.
Joshua has worked in Information Security with governments and education since 2009.
November 19, 2020 24 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
Alex B.—Lead B.A., University of Oregon
Program Assessor Certified Information Systems Auditor(CISA)
Utilizing his academic background in public speaking and critical reasoning,Alex brings the verbal
skills and critical thinking necessaryto effectively assess our clients'Information Security
programs and communicate areas for improvement.With an eager enthusiasm and strong
attention to detail,Alex has the skills to provide clients with the most accurate insights into
security processes and procedures.
Alex has worked in Information Security with governments,financial institutions,utilities,and
healthcare since 2012.
Chris S.—Senior B.S., University of Oregon
Technical Assessor CJIS Certification,Level 4
Certified Information Systems Security Professional(CISSP)
Certified Ethical Hacker(CEH)
Certified Penetration Tester(CPT)
Certified Web Application Penetration Tester(CWAPT)
Chris'six years of experience managing a non-profit's diverse network and support personnel
provide a wealth of experience in managing the confidentiality,integrity,and availability of
networked resources within a limited budget.Through his experience,Chris has developed a
profound interest and understanding of the information security necessaryto maintain an
institution's mission and integrity.With more than twelve years of professional experience in the
technology field and a broad range of networking expertise,Chris brings to the Information
Security Assessmentteam a deep commitmentto the effective management of our clients'risks.
Chris has worked in Information Security with governments,financial institutions,utilities,and
healthcare since 2009.
Ryan F.— B.S. Mathematics,University of Oregon
Technical Assessor B.S.Computer Science,University of California Santa Cruz
Certified Ethical Hacker(CEH)
Certified SCADA Security Architect(CSSA)
Ryan began his career in 2005 as an IT Help Desk employee at UC Santa Cruz,while working on an
undergraduate degree in Computer Science.Ryan continued to work as a developer and analyst
through his work on a B.S. in Mathematics at the University of Oregon in 2012.Since then,Ryan
has worked in positions of increasing complexity and authority,from System Administrator to
security management.Ryan brings his keen eye and commitment to excellence that inspires both
clients and co-workers.
Ryan has worked in Information Technology with higher education,governments,financial
institutions,utilities,commercial organizations and healthcare since 2005.
Nick A.—Technical B.S. University of Minnesota,Duluth
Assessor Certified Information Systems Security Professional(CISSP)
Certified Ethical Hacker(CEH)
Nick's ten years of experience performing IT support and administration prepared him for a
successful career as a penetration tester.With experiences ranging from troubleshooting,to
authoring policies and procedures,to implementing secure networks and VPNs,Nick's skills and
experience are both deep and broad.The successful application of that experience makes Nick a
key member of the Information Security Assessment team.
Nick has worked in Information Security with governments,financial institutions,utilities,
commercial organizations and healthcare since 2007.
November 19, 2020 25 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
Derek B.—Senior B.A. University of New Hampshire
Program Assessor M.A.University of New Hampshire
Derek has been with BPM's Information Security Assessment Team since its inception in 1998.
Over those 20+years,Derek has filled numerous roles as account manager,technical writer,and
even onsite assessor.Consequently,Derek's understanding of information security issues is both
broad and deep. Derek now focuses his attention solely on client program assessment activities,
where his wealth of knowledge is optimally applied.
Derek has worked in Information Security with governments,financial institutions,utilities,and
healthcare since 1998.
November 19, 2020 26 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
ICOST PROPOSAL
Proposed services listed below will be performed with specific reference to,and within the limits of,the
services as proposed in this document. The costfigure quoted below is all-inclusive, fixed and final
unless the project scope is changed at the request of the client. If applicable, State, County or Municipal
taxes will be added to the invoice.
Project scope and cost have been determined based upon the information below that was provided by
City of Tigard:
➢ 60 Public IPs
➢ 1800 Internal Hosts
➢ 7 Locations
The services proposed by BPM for City of Tigard are as follows:
• Comprehensive Penetration Test
$22,900
Please Note: The following are offered as reduced-scope/reduced cost options to the
Comprehensive Penetration Test:
o Penetration Test without in-person Social Engineering or Physical Testing
(no field work/travel)
$18,800
o Technical Penetration Test(No social engineering, no phishing)
$14,200
• Information Security Controls Review/Program Assessment
$11,400
Please note: All quoted prices include all travel and related expenses. Absolutely no other costs,other
than applicable taxes, will be incurred for the performance of the services described in this document.
Quoted prices are valid for 90 days.
November 19, 2020 27 BPM LLP
City of Tigard Infosec Assessment Proposal RESTRICTED
ASSERTIONOF •MPLIANCE WITH ALL PROJECT REQUIREMENTS, • •
Primary Contact Information
The account manager for this proposal is:
David J. Meyer
Account Manager
BPM
877-328-7475
davidm@infoatrisk.com
The project manager for this project is:
Jeannie Reinhardt
Project Manager
BPM
877-328-7475
ieannier@infoatrisk.com
Person authorized to contractually bind BPM LLP for any accepted proposal is:
David Trepp, M.S.
Partner, ITAssurance
BPM
877-328-7475
davidt@infoatrisk.com
All of the information contained in this proposal is true and accurate to the best of my knowledge.
�is P(w
David Trepp
Partner, ITAssurance
BPM
November 19, 2020
Notice: This document contains confidential information intended only for the use of the individual or
entity to which it is addressed. Any disclosure, copying, distribution, or action in reliance on the contents
of this document is strictly prohibited by anyone except the party to whom it is addressed.
November 19, 2020 28 BPM LLP