Loading...
HomeMy WebLinkAboutSanta Clara County - CJIC System Network Services (2018)DocuSign Envelope ID: CF31E5F6-605A-44E8-92D1-655C3766C9B8 Your Technology Partner County of Santa Clara Office of the County Executive Information Services Department 1555 Berger Drive, Bldg. 2 San Jose, California 95112-2704 (408) 299-3611 Fax 286-6289 NETWORK SERVICES BILLING FOR ACCESS TO CJIC SYSTEM This is an Agreement between the County of Santa Clara (hereinafter, "County") and City of Gilroy Police Department (hereinafter, "Gilroy Police Department" or "Gilroy") for the network services to access the CJIC system. 1. Term of Aareement: Upon full execution, the term of this Agreement remains in full force and effect, commencing July 1, 2018 through June 30, 2020, unless and until either County or Gilroy Police Department exercises its right to terminate as provided in Section 4 below. 2. Pavment and Billina,: As of July 1, 2018, the Gilroy Police Department shall be invoiced annually a one-time lump sum of $2,569.91 each year for network support services to be rendered by the County through FY2020. In addition, Gilroy shall pay a monthly connect charge of $25.81 per TN3270 connection used to access the CJIC during FY2019 and $27.10 through FY2020. Payment of invoice amounts shall be due and payable within (30) days of receipt. 3. Indemnification and Insurance Reauirements: In lieu of and not withstanding the pro rata risk allocation which might otherwise be imposed between the Parties pursuant to Government Code Section 895.6, the Parties agree that all losses or liabilities incurred by a party shall not be shared pro rata but instead the County and Gilroy Police Department agree that pursuant to Government Code Section 895.4, each of the parties hereto shall fully indemnify and hold each of the other parties, their officers, board members, employees and agents, harmless from any claim, expense or cost, damage or liability imposed for injury (as defined by Government Code Section 810.8) occurring by reason of the negligent acts or omissions or willful misconduct of the indemnifying party, its officers, board members, employees or agents, under or in connection with or arising out of any work, authority or jurisdiction delegated to such party under this Agreement. No party, nor any officer, board member, employee, or agent thereof shall be responsible for any damage or liability occurring by reason of the negligent acts or omissions or willful misconduct of other parties hereto, their officers, board members, employees or agents, under of in connection with or arising out of any work, authority or jurisdiction delegated to such other parties under this Agreement. Upon County's request, Gilroy Police Department must provide information and documentation regarding its commercial or self-insurance program. 4. Governina Law: Unless where preempted by Federal laws such as in Copyright Laws, this Agreement shall be enforced and interpreted under the laws of the State of California and the County of Santa Clara, without any regards to the conflict of law principles. Limitation of Liabilitv: Gilroy Police Department acknowledges and agrees that the consideration which County is charging hereunder does not include any consideration for assumption by County of the risk of Gilroy's damages, including special, indirect, consequential or incidental damages, which may arise in connection with Gilroy's use of the CJIC. Accordingly, Gilroy agrees that County shall not be liable to Gilroy or its users for any damages, including loss -of -profit, indirect, incidental, special, consequential, liquidated, exemplary, or punitive damages arising out of the licensing, sublicensing or use of the CJIC. In no event shall the County's liability exceed the fee paid by Gilroy to County for use of the CJIC. Page I of 10 Board of Supervisors: Mike Wasserman, Dave Cortese, Ken Yeager, Joe Simitian, Cindy Chavez. County Executive: Jeffrey V. Smith Network Services Billing for Access to CJIC System (Gilroy PD) DocuSign Envelope ID: CF31E5F6-605A-44E8-92D1-655C3766C9B8 6. Limited Warranty: County represents and warrants to Gilroy that the CJIC will perform in a reasonable manner during the term of this Agreement. Should County be in breach of its representation and warranty under this Section, County's entire liability and Gilroy's exclusive remedy shall be termination of the Agreement. 7. Disclaimer of Warranties: THE LIMITED WARRANTY SET FORTH IN THE LIMITED WARRANTY SECTION IS IN LIEU OF ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR USE. The warranty stated in the Limited Warranty section is the sole and the exclusive warranty offered by County. County makes no other warranties of any kind respecting the CJIC, either express or implied, including but not limited to any warranty of design, quality, accuracy, data integrity, lack of viruses, bugs, worms, back doors, and Trojan horse computer programs, completeness, performance, of merchantability, or of fitness for a particular purpose, even if County has been informed of such purpose. No agent or employee of County is authorized to alter or exceed the warranty obligations of County as set forth herein. 8. Ownership: Gilroy acknowledges and agrees that the CJIC and any derivatives are the sole property of County. Gilroy has no right, title, or interest to the CJIC or any derivatives thereof. 9. Severability: If any provision of this Agreement shall be held by a court of competent jurisdiction to be illegal, invalid or unenforceable, the remaining provisions shall remain in full force and effect. 10. Venue: The parties to this Agreement hereby agree to submit to the exclusive jurisdiction of and venue in the courts of competent jurisdiction, federal or state, in the County of Santa Clara in any disputes related to or arising out of this Agreement. 11. Termination of Agreement: Either party may cancel or terminate this Agreement for any reason whatsoever upon sixty (60) days notice. Notice of termination shall be in writing and sent by registered mail to the Chief Information Officer (CIO) and the appropriate person designed by Gilroy Police Department, as follows: Ann Dunkin, CIO Information Services Department 1555 Berger Drive, Bldg. 2, Floor 2 San Jose, CA 95112 Gabriel Gonzalez, City Administrator Gilroy Police Department 7370 Rosanna St. Gilroy, CA 95020 (408) 846-0272 12. Right of Third Parties: This Agreement shall not confer any rights on any third party. No party shall, on the basis of this Agreement, in any way contract on behalf of or in the name of the other party. 13. Assignment: This Agreement may not be assigned by either party without the consent of the other party. 14. Amendment: The terms and conditions of this Agreement may be amended only by written agreement signed by the parties hereto. 15. Waiver: No delay or failure to require performance of any provision of this Agreement shall constitute a waiver of that provision as to that or any other instance. Any waiver granted by a party must be in writing, and shall apply to the specific instance expressly stated. 16. Security: The parties shall comply with the security requirements, change control and other related practices under this Agreement as set forth in Attachment A, attached and incorporated by this reference. Page 2 of 10 Board of Supervisors: Mike Wasserman, Dave Cortese, Ken Yeager, Joe Simitian, Cindy Chavez. County Executive: Jeffrey V. Smith Network Services Billing ror Access to CJIC System (Gilroy PD) DocuSign Envelope ID: CF31E5F6-605A-44E8-92D1-655C3766C9138 17. Entire Agreement: This document represents the entire Agreement between the parties with respect to the subject matter hereof. All prior negotiations and written and/or oral agreements between the parties with respect to the subject matter of this Agreement are merged into this Agreement. 18. Survival: The following sections of this Agreement shall survive termination of this Agreement for any reason: 2 through 17. 19. Contract Execution: Unless otherwise prohibited by law or County policy, the parties agree that an electronic copy of a signed contract, or an electronically signed contract, has the same force and legal effect as a contract executed with an original ink signature. The term "electronic copy of a signed contract" refers to a transmission by facsimile, electronic mail, or other electronic means of a copy of an original signed contract in a portable document format. The term "electronically signed contract" means a contract that is executed by applying an electronic signature using technology approved by the County. County of Santa Clara Focu5igned by: SUI' (,Y6W (I Date 6/15/2018 LeslieJCrowell, Deputy County Executive On behalf of Jeffrey V. Smith, County Executive Approved By: F101-S11"Id by: ara rbw�16 Date 6/12/2018 9afe76ri7l0, Deputy County Counsel On behalf of Robert Nakamae, Deputy County Counsel Approved By: FADI,uS!glld by: AA t�Date AkA 6/12/2018 _ Annikuhr , Chief Information Officer �Do c Signed by: 'T-eresas ien, Fiscal Officer Date 6/12/2018 Gilroy Police Department Date _........ Gabriel Gonzalez, City Administrator os Approved as to Form: Gilroy City Attq_rMW',%-.0ffice Page 3 of 10 Board of Supervisors: Mike Wasserman, Dave Cortese, Ken Yeager, Joe Simitian, Cindy Chavez. County Executive: Jeffrey V. Smith Network Services Billing for Access to CJIC System (Gilroy PD) City Attorney DocuSign Envelope ID: CF31 E5F6-605A-44E8-92D1 -655C3766C9B8 EXHIBIT A — VENDOR REMOTE ACCESS AGREEMENTS Agreement by and Between GILROY POLICE DEPARTMENT and COUNTY OF SANTA CLARA This is the Agreement between the COUNTY OF SANTA CLARA (County) and Gilroy Police Department (Contractor) relating to Network Services Billing. Dated: February 12th, 2018 1. Scope of Access a. "Remote Access" is the act of accessing County of Santa Clara ("County") systems from a non -County network infrastructure. "Systems" include personal computers, workstations, servers, mainframes, phone systems, and/or any device with network capabilities (e.g., a workstation with an attached modem, routers, switches, laptop computers, handheld devices). b. County hereby grants Remote Access privileges for Contractor to access the following County systems, at the locations listed, collectively referred to as "IS," in accordance with the terms of the Agreement: Countv Systems: Criminal Justice Information Control (CJIC) c. All other forms of access to the named Systems, or to any County System that is not specifically named, is prohibited. d. Remote Access is granted for the purpose of Contractor providing services and performing its obligations as set forth in the Agreement including, but not limited to, supporting Contractor -installed programs. Any access to IS and/or County data or information that is not specifically authorized under the terms of this Agreement is prohibited and may result in contract termination and any penalty allowed by law. e. County will review the scope of Contractor's Remote Access rights periodically. In no instance will Contractor's Remote Access rights be reduced, limited or modified in a way that prevents or delays Contractor from performing its obligations as set forth in the Agreement. Any modifications to Remote Access rights must be mutually agreed to in writing by County and Contractor. 2. Security Requirements a. Contractor will not install any Remote Access capabilities on any County owned or managed system or network unless such installation and configuration is approved in writing by County's and Contractor's respective designees. b. Contractor may only install and configure Remote Access capabilities on County systems or networks in accordance with industry standard protocols and procedures, which must be reviewed and approved by County's designee. c. Contractor will only Remotely Access County systems, including access initiated from a County system, if the following conditions are met: Page 4 of 10 Board of Supervisors: Mike Wasserman, Dave Cortese, Ken Yeager, Joe Simitian, Cindy Chavez. County Executive: Jeffrey V. Smith Network Services Billing for Access to CJIC System (Gilroy PD) DocuSign Envelope ID: CF31 E5F6-605A-44E8-92D1 -655C3766C9B8 1. Contractor will submit documentation verifying its own network security mechanisms to County for County's review and approval. The County requires advanced written approval of Contractor's security mechanisms prior to Contractor being granted Remote Access. 2. Contractor Remote Access must include the following minimum control mechanisms: a. Two -Factor Authentication: An authentication method that requires two of the following three factors to confirm the identity of the user attempting Remote Access. Those factors include: 1) something you possess (e.g., security token and/or smart card); 2) something you know (e.g., a personal identification number (PIN)); or 3) something you are (e.g., fingerprints, retina scan). The only exceptions are County approved County site to Contractor site Virtual Private Network (VPN) infrastructure. b. Centrally controlled authorizations (permissions) that are user specific e.g., access lists that limit access to specific systems or networks). c. Audit tools that create detailed records/logs of access attempts. d. All Contractor systems used to Remotely Access County systems must have industry -standard anti -virus and other security measures that might be required by the County (e.g., software firewall) installed, configured, and activated. e. Access must be established through a centralized collection of hardware and software centrally managed and controlled by County's and Contractor's respective designees. 3. Monitoring/Audit County will monitor access to, and activities on, County owned or managed systems and networks, including all Remote Access attempts. Data on all activities will be logged on a County managed system and will include the date, time, and user identification. 4. Copying, Deleting or Modifying Data Contractor is prohibited from copying, modifying, or deleting any data contained in or on any County IS unless otherwise stated in the Agreement or unless Contractor receives prior written approval from County. This does not include data installed by the Contractor to fulfill its obligations as set forth in the Agreement. 5. Connections to Non -County Networks and/or Systems Contractor agrees to make every effort to protect County's data contained on County owned and/or managed systems and networks within Contractor's control from unauthorized access. Prior written approval is required before Contractor may access Page 5 of 10 Board of Supervisors: Mike Wassennan, Dave Cortese, Ken Yeager, Joe Simitian, Cindy Chavez. County Executive: Jeffrey V. Smith Network Services Billing for Access to CJIC System (Gilroy PD) DocuSign Envelope ID: CF3lE5F6-605A-44E8-92D1-655C3766C9B8 County networks or systems from non -County owned and/or managed networks or systems. Such access will be made in accordance with industry standard protocols and procedures as mutually agreed upon and will be approved in writing by County in a timely manner. Remote Access must include the control mechanisms noted in Paragraph 2.c.2 above. 6. Person Authorized to Act on Behalf of Parties The following persons are the designees for purposes of this Agreement: Contractor: Title/ Designee - Gabriel Gonzalez, Citv Administrator County: Title/ Designee — Ann Dunkin, Chief Information Officer Either party may change the aforementioned names and or designees by providing the other party with no less than three (3) business day's prior written notice. 7. Remote Access Provisions Contractor agrees to the following: a. Only staff providing services or fulfilling Contractor obligations under the Agreement will be given Remote Access rights. b. Any access to IS and/or County information that is not specifically authorized under the terms of this Agreement is prohibited and may result in contract termination and any other penalty allowed by law. c. An encryption method reviewed and approved by the County will be used. County is solely responsible and liable for any delay or failure of County, as applicable, to approve the encryption method to be used by Contractor where such delay or failure causes Contractor to fail to meet or perform, or be delayed in meeting or performing, any of its obligations under the Agreement. d. Contractor will be required to log all access activity to the County. These logs will be kept for a minimum of 90 days and be made available to County no more frequently than once every 90 days. 8. Remote Access Methods a. All forms of Remote Access will be made in accordance with mutually agreed upon industry standard protocols and procedures, which must be approved in writing by the County. b. A Remote Access Back -Up Method may be used in the event that the primary method of Remote Access is inoperable. c. Contractor agrees to abide by the following provisions related to the Primary and (if applicable) Backup Remote Access Methods selected below. (Please mark appropriate Page 6 or 10 Board of Supervisors: Mike Wasserman, Dave Cortese, Ken Yeager, Joe Similian, Cindy Chavez. County Executive: Jeffrey V. Smith Network Services Billing for Access to CJ[C System (Gilroy PD) DocuSign Envelope ID: CF31 E5F6-605A-44E8-92D1 -655C3766C9B8 box for each applicable Remote Access Method; if a method is inapplicable, please check the box marked N/A). 1. VPN Site -to -Site X Primary _Backup _N/A The VPN Site -to -Site method involves a VPN concentrator at both the vendor site and at the County, with a secure "tunnel" opened between the two concentrators. If using the VPN Site -to -Site Method, Contractor support staff will have access to the designated software, devices and systems within the County, as specified above in Paragraph 1.b, from selected network -attached devices at the vendor site. 2. VPN Client Access _Primary _ Backup X N/A In the VPN Client Access method, a VPN Client (software) is installed on one or more specific devices at the Contractor site, with Remote Access to the County (via a County VPN concentrator) granted from those specific devices only. An Authentication Token (a physical device or software token that an authorized remote access user is given for user authentication purposes, such as a CryptoCard, RSA token, SecureAuth IdP) will be issued to the Contractor in order to authenticate Contractor staff when accessing County IS via this method. The Contractor agrees to the following when issued an Authentication Token: a. Because the Authentication Token allows access to privileged or confidential information residing on the County's IS, the Contractor agrees to treat the Authentication Token as it would a signature authorizing a financial commitment on the part of the Contractor. b. The Authentication Token is a County -owned device, and will be labeled as such. The label must remain attached at all times. c. The Authentication Token must be kept in a secured environment under the direct control of the Contractor, such as a locked office where public or other unauthorized access is not allowed. d. If the Contractor's remote access equipment is moved to a non -secured site, such as a repair location, the Authentication Token will be kept under Contractor control. e. The Authentication Token is issued to an individual employee of the Contractor and may only be used by the designated individual. f. If the Authentication Token is misplaced, stolen, or damaged, the Contractor will notify County by phone within one (1) business day. g. Contractor agrees to use the Authentication Token as part of its normal business operations and for legitimate business purposes only. Page 7 of 10 Board of Supervisors: Mike Wasserman, Dave Cortese, Ken Yeager, Joe Simitian, Cindy Chavez. County Executive: Jeffrey V. Smith Network Services Billing for Access to CJIC System (Gilroy PD) DocuSign Envelope ID: CF31E5F6-605A-44E8-92D1-655C3766C9B8 h. The Authentication Token will be issued to Contractor following execution of this Agreement. The Authentication Token will be returned to the County's designee within five (5) business days following contract termination, or upon written request of the County for any reason. Contractor will notify County's designee within one working day of any change in personnel affecting use and possession of the Authentication Token. Contractor will obtain the Authentication Token from any employee who no longer has a legitimate need to possess the Authentication Token. Lost or non -returned Authentication Tokens will be billed to the Contractor in the amount of $300 per card. i. Contractor will not store password documentation or PINs with Authentication Tokens. j. Contractor agrees that all employees, agents, contractors, and subcontractors who are issued the Authentication Token will be made aware of the responsibilities set forth in this Agreement in written form. Each person having possession of an Authentication Token will execute this Agreement where indicated below certifying that they have read and understood the terms of this Agreement. 3. County -Controlled VPN Client Access _ Primary _ Backup X N/A This form of Remote Access is similar to VPN Client access, except that the County will maintain control of the Authentication Token authentication token and a PIN number will be provided to the Contractor for use as identification for Remote Access purposes. When the Contractor needs to access County IS, the Contractor must first notify the County's designee. The County's designee will verify the PIN number provided by the Contractor. After verification of the PIN the County's designee will give the Contractor a onetime password which will be used to authenticate Contractor when accessing the County's IS. Contractor agrees to the following: a. Because the PIN number allows access to privileged or confidential information residing on the County's IS, the Contractor agrees to treat the PIN number as it would a signature authorizing a financial commitment on the part of the Contractor. b. The PIN number is confidential, County -owned, and will be identified as such. c. The PIN number must be kept in a secured environment under the direct control of the Contractor, such as a locked office where public or other unauthorized access is not allowed. Page 8 of 10 Board of Supervisors: Mike Wasserman, Dave Cortese, Ken Yeager, Joe Simitian, Cindy Chavez. County Executive: Jefti-ey V. Smith Network Services Billing for Access to CJIC System (Gilroy PD) DocuSign Envelope ID: CF31E5F6-605A-44E8-92D1-655C3766C9B8 d. If the Contractor's remote access equipment is moved to a non -secured site, such as a repair location, the PIN number will be kept under Contractor control. e. The PIN number can only be released to an authorized employee of the Contractor and may only be used by the designated individual. f. If the PIN number is compromised or misused, the Contractor will notify the County's designee within one (1) business day. g. Contractor will use the PIN number as part its normal business operations and for legitimate business purposes only. Any access to IS and/or County data information that is not specifically authorized under the terms of this Agreement is prohibited and may result in contract termination and any other penalty allowed by law. h. The PIN number will be issued to Contractor following execution of this Agreement. i. The PIN number will be inactivated by the County's designee within five (5) business days following contract termination, or as required by the County for any reason. 4. Manually Switched Dialup Modem _ Primary _ Backup X N/A Although not generally used, the Contractor may be provided Remote Access to County IS using a dialup modem. Contractor agrees to the following if using Switched Dialup Modem access: a. Contractor will use reasonable efforts to notify the County's Technical Services Manager or designee at least'/2 hour prior to access to allow County to activate the Switched Dialup Modem connection. Contractor will give the estimated time that the connection will be required, and specify when the access can be deactivated by County. b. County acknowledges that Contractor may not be able to provide certain of its services (including, but not limited to, implementation services, maintenance and support (including Standard Support Services) and training services) using a Switched Dialup Modem connection. c. County is solely responsible and liable for any inability or delay in Contractor performing its obligations under the Agreement where such inability or delay is caused by the use of a Switched Dialup Modem connection. Page 9 of 10 Board of Supervisors: Mike Wassennan, Dave Cortese, Ken Yeager, Joe Simitian, Cindy Chavez. County Executive: Jeffrey V. Smith Network Services Billing for Access to CJ1C System (Gilroy PD) DocuSign Envelope ID: CF31E5F6-605A-44E8-92D1-655C3766C9B8 Signatures of Contractor Employees receiving Authentication Tokens (if issued by County): CONTRACTOR: Date: [TITLE] CONTRACTOR: Date: [TITLE] CONTRACTOR: Date: [TITLE] [TYPE NAME HERE] [TYPE NAME HERE] [TYPE NAME HERE] Page 10 of 10 Board of Supervisors: Mike Wasserman, Dave Cortese, Ken Yeager, Joe Simitian, Cindy Chavez. County Executive: Jeffrey V. Smith Network Services Billing for Access to CJ1C System (Gilroy PD)