Loading...
HomeMy WebLinkAbout25-169 - Contract - Granicus dba SmartGov - Permitting Software SystemDocusign Envelope ID: 9915DD1 B-Al5B-4AF9-91AGD8EA56D92379 City of Tukwila 25-169 Council Approval 5/5/25 5200 Southeenter Boulevard, Tukwila WA 98188 CONTRACT FOR SERVICES This Agreement is entered into by and between the City of Tukwila, Washington, a non -charter optional municipal code city hereinafter referred to as "the City," and Granicus hereinafter referred to as "the Contractor," whose principal office is located at Washington. DC The City and the Contractor are each individually a "Party" and collectively the "Parties." WHEREAS, the City has determined the need to have certain services performed for its citizens but does not have the manpower or expertise to perform such services; and WHEREAS, the City desires to have the Contractor perform such services pursuant to certain terms and conditions; now, therefore, IN CONSIDERATION OF the mutual benefits and conditions hereinafter contained, the parties hereto agree as follows: 1. Scope and Schedule of Seryices to be Performed by Contractor. The Contractor shall perform those services described on Exhibit A attached hereto and incorporated herein by this reference as if fully set forth. In performing such services, the Contractor shall at all times comply with all Federal, State, and local statutes, rules and ordinances applicable to the performance of such services and the handling of any funds used in connection therewith. The Contractor shall request and obtain prior written approval from the City if the scope or schedule is to be modified in any way. 2 Compensation and Method of Payment. The City shall pay the Contractor for services rendered according to the rate and method set forth on Exhibit B attached hereto and incorporated herein by this reference. The total amount to be paid shall not exceed 8103.337.85 at a rate of Net 30 days 3 Contractor Budget. The Contractor shall apply the funds received under this Agreement within the maximum limits set forth in this Agreement. The Contractor shall request prior approval from the City whenever the Contractor desires to amend its budget in any way. 4.a t. This Ag re II f and effect for a period commencing A ril 1 20 25, and ending ril 1 2 26 unless sooner terminated under the provisions hereinafter specified. S Indeuendent Contractor. The Contractor and the City agree that the Contractor is an independent contractor with respect to the services provided pursuant to this Agreement. Nothing in this Agreement shall be considered to create the relationship of employer and employee between the parties hereto. Neither the Contractor nor any employee of Contractor shall be entitled to any benefits accorded City employees by virtue of the services provided under this Agreement. The City shall not be responsible for withholding or otherwise deducting federal income tax or social security or contributing to the State Industrial Insurance Program, or otherwise assuming the duties of an employer with respect to the Contractor, or any employee of the Contractor. TIS Contract for Svcs Template 02-2021 Page 1 of 9 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 6► Indemnification. A. Contractor Indemnification. The Contractor shall indemnify, defend and hold harmless the City its officers, officials, employees, volunteers and permitted successors and assigns harmless from any and all claims, injuries, damages, losses or suits including attorney fees (collectively, "Losses"), in connection with any claims, demands, suits or proceedings (collectively, "Claims") made or alleged against the City by a third party arising out of or resulting from the acts, errors or omissions, or the intentional or negligent performance of the Contractor in performance of this Agreement, except for injuries and damages caused by the sole negligence of the City. B. RCW 4.24.115. However, should a court of competent jurisdiction determine that this Agreement is subject to RCW 4.24.115, then, in the event of liability for damages arising out of bodily injury to persons or damages to property caused by or resulting from the concurrent negligence of the Contractor and the City, its officers, officials, employees, and volunteers, Contractor's liability, including the duty and cost to defend, hereunder shall be only to the extent of Contractor's negligence. It is further specifically and expressly understood that the indemnification provided herein constitutes Contractor's waiver of immunity under Industrial Insurance, Title 51 RCW, solely for the purposes of this indemnification. This waiver has been mutually negotiated by the parties. The provisions of this section shall survive the expiration or termination of this Agreement. C. Infringement Indemnification. In addition to Contractor's obligations under Section 6.A., the Contractor shall indemnify, defend, and hold harmless the City and its directors, officers, employees, agents and other representatives against any Losses in connection with Claims made or alleged against the City by a third party that the services, software or deliverables infringes a U.S. patent, copyright or other intellectual property rights of any third party. The foregoing indemnification obligation does not apply to any Claims or Losses arising out of or relating to any: (a) access to or use of the software in combination with any hardware, system, software, network or other materials or service not provided or authorized by this Agreement or otherwise in writing by the Contractor; or (b) modification of the software other than: (i) by or on behalf of the Contractor; or (ii) with the Contractor's written approval or in accordance with Contractor's written specifications. D. Mitigation. If any of the services, software or deliverables are, or in Contractor's opinion are likely to be, claimed to infringe, misappropriate or otherwise violate any third -party intellectual property right, or if the City's or any Authorized User's use of the services, software or deliverables is enjoined or threatened to be enjoined, the Contractor may, at its option and sole cost and expense: i. obtain the right for the City to continue to use the Services, Software and Deliverables materially as contemplated by this Agreement; ii. modify or replace the services, software and deliverables, in whole or in part, to seek to make the services, software and deliverables (as so modified or replaced) non -infringing, while providing materially equivalent features and functionality; or iii. by written notice to the City, terminate this Agreement with respect to all or part of the Services, Software and Deliverables, and require the City to immediately cease any use of the Services, Software and Deliverables or any specified part or feature thereof, provided that if such termination occurs, the Contractor shall refund any prepaid fees to the City and provide transition services free of charge. TIS Contract for Svcs Template 02-2021 Page 2 of 9 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 E. Limitation of Liability. In no event will either party be liable under or in connection with this agreement or its subject matter under any legal or equitable theory, including breach of contract, tort (including negligence), strict liability and otherwise, for any: (i) loss of revenue or profit; or (ii) consequential, incidental, indirect, exemplary, special, or punitive damages, regardless of whether such persons were advised of the possibility of such losses or damages or such losses or damages were otherwise foreseeable, and notwithstanding the failure of any agreed or other remedy of its essential purpose. In no event shall the aggregate liability of either party arising out of or related to this agreement exceed the greater of two times the fees paid under the agreement or $1,000,000; provided however, the limitation of liability set forth in this section shall not apply to: (i) Contractor's indemnification obligations for infringement claims made or brought against the City by a third party as described herein. The provisions of this section shall survive the expiration or termination of this agreement. 7. Insurance. Prior to commencing the Services, the Contractor shall procure and maintain at its sole cost and expense at least the following insurance, covering its obligations underthis Agreement. A. Insurance Policies. Commercial General Liability: With coverage of not less than $2,000,000 per occurrence, $2,000,000 general aggregate, and $2,000,000 products -completed operations aggregate limit, which shall cover liability arising from premises, operations, independent contractors, products -completed operations, stop gap liability, personal injury and advertising injury, and liability assumed under an insured contract. Commercial General Liability insurance shall be as least at broad as ISO occurrence form CG 00 01 and shall cover liability arising from premises, operations, independent contractors, products -completed operations, stop gap liability, personal injury and advertising injury, and liability assumed under an insured contract. The Commercial General Liability insurance shall be endorsed to provide a per project general aggregate limit using ISO form CG 25 03 05 09 or an equivalent endorsement. There shall be no exclusion for liability arising from explosion, collapse or underground property damage. The City shall be named as an additional insured under the Contractor's Commercial General Liability insurance policy with respect to the work performed for the City using ISO Additional Insured endorsement CG 20 10 10 01 and Additional Insured -Completed Operations endorsement CG 20 37 10 01 or substitute endorsements providing at least as broad coverage. ii. Cyber Liability Insurance: With coverage of not less than $1,000,000 per occurrence and $5,000,000 in the annual aggregate which shall include, but not be limited to, coverage, including defense, for the following losses or services: (1) Breach of City's Data, including but not limited to liability arising from theft, dissemination, and/or use of City's confidential and Personal Information as defined by RCW 42.56.590, including but not limited to, any information about an individual maintained by City, including: (a) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and (b) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information regardless of how or where the information is stored or transmitted. TIS Contract for Svcs Template 02-2021 Page 3 of 9 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 (2) Network security liability arising from: (a) the unauthorized access to, use of, or tampering with computer systems, by an outside party, including hacker attacks or a virus introduced by a third party; or (b) the inability of an authorized third party to gain access to supplier systems and/or City Data, including denial of service, unless caused by a mechanical or electrical failure; (c) introduction of any unauthorized software computer code or virus causing damage to City Data or any other third party data. (3) Event management services and first -party loss expenses for a data breach response including crisis management services, credit monitoring for individuals, public relations, legal service advice, notification of affected parties, independent information security forensics firm, and costs to re -secure, re-create and restore data or systems. iii. Workers' Compensation coverage as required by the Industrial Insurance laws of the State of Washington. iv. Automobile Liability Insurance of a minimum combined single limit for per occurrence for bodily injury and property damage of $1,000,000 per accident, covering all owned, non - owned, hired and leased vehicles. Coverage shall be written on Insurance Services Office (ISO) form CA 00 01 or a substitute form providing equivalent liability coverage. If necessary, the policy shall be endorsed to provide contractual liability coverage. V. Professional Liability/Errors and Omissions Insurance (including Technology Errors and Omissions) of at least $1,000,000 per occurrence and $2,000,000 in the annual aggregate. B. Additional Insurance Reauirements. If the Contractor maintains higher insurance limits than the minimums shown above, the City shall be insured for the full available limits of Commercial General and Excess or Umbrella liability maintained by the Contractor, irrespective of whether such limits maintained by the Contractor are greater than those required by this Agreement or whether any certificate of insurance furnished to the City evidences limits of liability lower than those maintained by the Contractor. ii. The insurance required in Section 7 shall be in a form and on terms and written by insurers with a current A.M. Best rating of not less than A: VII. The Commercial General Liability, Cyber Liability Insurance and Automobile Liability Insurance shall name the City as an additional insured, and shall contain, or be endorsed to contain, that they shall be primary insurance as respect to the City. Any insurance, self-insurance, or self-insured pool coverage maintained by the City shall be excess of the Contractor's insurance and shall not contribute with it. iii. The Contractor shall provide the City with written notice of any policy cancellation within two business days of the receipt of such notice. Contractor shall obtain replacement insurance policies meeting the requirements of this Section 7. iv. Failure of the Contractor to maintain the insurance as required shall constitute a material breach of this Agreement, upon which the City may, after giving five business days' notice to the Contractor to correct such breach, immediately terminate this Agreement. V. The Contractor's maintenance of insurance, its scope of coverage and limits as required herein shall not be construed to limit the liability of the Contractor to the coverage provided by such insurance, or otherwise limit the City's recourse to any remedy available at law or in equity. TIS Contract for Svcs Template 02-2021 Page 4 of 9 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 vi. Subcontractor's Insurance. The Contractor shall cause each and every subcontractor utilized by the Contractor in connection with the provision of Services ("Subcontractors"), to provide insurance coverage that complies with all applicable requirements of the Contractor -provided insurance as set forth herein, except the Contractor shall have sole responsibility for determining the limits of coverage required to be obtained by Subcontractors. The Contractor shall ensure the City is an additional insured on each and every Subcontractor's Commercial General liability insurance policy, using an endorsement as least as broad as ISO CG 20 10 10 01 for ongoing operations and CG 20 37 10 01 for completed operations. vii. The Contractor shall furnish the City with original certificates and a copy of the amendatory endorsements, including but not necessarily limited to the additional insured endorsements, evidencing the insurance requirements of the Contractor before commencement of the work. Upon request by the City, the Contractor shall furnish certified copies of all required insurance policies, including endorsements, required in this Agreement and evidence of all subcontractors' coverage. 8 Record Keeping and_Reaortina. A. Records Maintenance. The Contractor shall maintain accounts and records, including personnel, property, financial and programmatic records which sufficiently and properly reflect all direct and indirect costs of any nature expended and services performed in the performance of this Agreement and other such records as may be deemed necessary by the City to ensure the performance of this Agreement. B. Retention Period. These records shall be maintained for a period of seven years after termination hereof unless permission to destroy them is granted by the office of the archivist in accordance with RCW Chapter 40.14 and by the City. C. Public Records Requests. The Contractor acknowledges that the City is a public entity and is subject to the Public Records Act under Chapter 42.56 RCW. To the extent permitted by law, the City shall treat as exempt from treatment as a public record, and shall not disclose in response to a request made pursuant to any applicable public records law, any of the Contractor's Confidential Information. If a request is received for records the Contractor has submitted to the City and has identified as Confidential Information, the City will use its best efforts to provide the Contractor with notice of the request in accordance with RCW 42.56.540 and a reasonable time within which the Contractor may seek an injunction to prohibit the City's disclosure of the requested record. The City shall comply with any injunction or court order requested by the Contractor which prohibits the disclosure of any such Confidential Information; however, in the event a higher court overturns such injunction or court order, the Contractor shall reimburse the City for any fines or penalties imposed for failure to disclose such records. Nothing in this section prohibits the City from complying with RCW 42.56, or any other applicable law or court order requiring the release of public records, and the City shall not be liable to the Contractor for compliance with any law or court order requiring the release of public records. D. Compelled Disclosures. If either the Party or any of its Representatives is compelled by applicable law to disclose any Confidential Information then, to the extent permitted by law, that Party shall: (a) promptly, and prior to such disclosure, notify the other Party in writing of such requirement so that they can seek a protective order or other remedy or waive its rights under Section 3; and (b) provide reasonable assistance, at the Disclosing Party's cost, to the Disclosing Party in opposing such disclosure or seeking a protective order or other limitations on disclosure. If the Disclosing Party waives compliance or, after providing the notice and assistance required underthis section, the Receiving Party remains required by lawto disclose TIS Contract for Svcs Template 02-2021 Page 5 of 9 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 any Confidential Information, the Receiving Party shall disclose only that portion of the Confidential Information that the Receiving Party is legally required to disclose. This Section 8.2 shall not apply to Subscriber's response to a request made under the Public Records Act, Chapter 42.56 RCW. 9L Breach Notification. A. The Contractor shall maintain a data breach plan and shall implement the procedures required under such data breach plan on the occurrence of a data breach, in compliance with the requirements of Washington's data breach notification law codified at RCW 42.56.590. The Contractor shall report, in writing, to the City any data breach involving data maintained by the Contractor on behalf of the City ("City Data") including any reasonable belief that an unauthorized individual has accessed City Data. The report shall identify the nature of the event, a list of the affected individuals and the types of data, and the mitigation and investigation efforts of the Contractor. The Contractor shall make the report to the City within 72 hours of conformation of the data breach, but in no event more than five business days after discovery of the data breach. The Contractor shall provide investigation updates to the City. B. The Contractor shall promptly reimburse the City in full for all costs incurred by the City in any investigation, remediation or litigation resulting from any data breach. The Contractor's duty to reimburse the City includes but is not limited to, reimbursing to the City its cost incurred in doing the following: i. Notification to third parties whose information may have been or were compromised and to regulatory bodies, law enforcement agencies or other entities as may be required by law or contract; ii. Establishing and monitoring call center(s) and credit monitoring and/or identity restoration services to assist each person impacted by a data breach of a nature that, in the City's sole discretion, could lead to identity theft; and iii. Payment of legal fees and expenses, audit costs, fines and penalties, and other fees imposed upon the City by a regulatory agency, court of law, or contracting partner as a result of the data breach. C. Upon a data breach, the Contractor is not permitted to notify affected individuals without the express written consent of the City. Unless the Contractor is required by law to provide notification to third parties or the affected individuals in a particular manner, the City shall control the time, place, and manner of such notification. 1Q QyQata. The Contractor does not claim ownership of, and assumes no responsibility with respect to any City Data defined as information, data, and content, in any form or medium, collected, downloaded, or otherwise received, directly or indirectly from the City, an Authorized Personnel or end-users by or through the Contractor's Services. 11. Audits and Inspections. The records and documents with respect to all matters covered by this Agreement shall be subject at all times to inspection, review or audit by law during the performance of this Agreement. 12 Termination. This Agreement may at any time be terminated by the City giving to the Contractor 30 days written notice of the City's intention to terminate the same. Failure to provide products on schedule may result in contract termination. If the Contractor's insurance coverage is canceled for any reason, the City shall have the right to terminate this Agreement immediately. TIS Contract for Svcs Template 02-2021 Page 6 of 9 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 1S. Effect of Termination or Exoiration. On the expiration or earlier termination of this Agreement: A. Each Party shall continue to hold such Confidential Information in confidence pursuant to Section 8; and B. Each Party shall pay to the other all undisputed amounts accrued prior to and through the date of termination of this Agreement; and C. The provisions set forth in the following sections, and any other right or obligation of the parties in this Agreement that, by its nature should survive termination or expiration of this Agreement, will survive any expiration or termination of this Agreement. D. Within 60 days following such expiration or termination, the Contractor shall deliver to the City, in a format as requested by the City, the then most recent version of City Data maintained by the Contractor, provided that the City has at that time paid all undisputed fees then outstanding and any amounts payable after or as a result of such expiration or termination. E. In the event of (i) expiration or earlier termination of this Agreement, or (ii) the City no longer purchasing certain Services from the Contractor, if the City requests assistance in the transfer of City Data to a different vendor's applications ("Deconversion"), the Contractor will provide reasonable assistance. The Parties will negotiate in good faith to establish the relative roles and responsibilities of the Parties in effecting Deconversion, as well as the appropriate date for completion. 14 Taxes. The Contractor shall be solely responsible for the payment of any and all applicable taxes related to the Services provided under this Agreement; if such taxes are required to be passed through to the City by law, the same shall be duly itemized on timely billings submitted to the City by the Contractor. 15. Waiver. A waiver of any breach by either Party shall not constitute a waiver of any subsequent breach. 16 Third Party Beneficiaries. This Agreement is solely for the conveniences of the Parties and there are no third party beneficiaries to this Agreement. 17. Compliance with Laws. The Consultant shall comply with all applicable federal, state, and local laws and regulations in performing this Agreement. 18. Discrimination Prohibited. The Consultant, with regard to the work performed by it under this Agreement, will not discriminate on the grounds of race, religion, creed, color, national origin, age, veteran status, sex, sexual orientation, gender identity, marital status, political affiliation, the presence of any disability, or any other protected class status under state or federal law, in the selection and retention of employees or procurement of materials or supplies. 19 Assignment and Subcontract. Neither Party may assign, delegate, or otherwise transfer this Agreement or any of its rights or obligations hereunder without the prior written consent of the other Party (such consent not to be unreasonably withheld). Notwithstanding the foregoing, either Party may assign this Agreement with reasonable notice to the other party to an affiliate or to a successor in interest resulting from acquisition of all, or substantially all, of the assigning party's business by means of merger, stock or asset purchase, or otherwise. Any assignment or attempted assignment in violation of this Agreement will be null and void. This Contract will bind and inure to the benefit of each party's permitted successors and assigns. 2Q Entire Agreement; Modification. This Agreement, together with attachments or addenda, represents the entire and integrated Agreement between the City and the Contractor and supersedes all prior negotiations, representations, or agreements written or oral. No amendment TIS Contract for Svcs Template 02-2021 Page 7 of 9 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 or modification of this Agreement shall be of any force or effect unless it is in writing and signed by the parties. TIS Contract for Svcs Template 02-2021 Page 8 of 9 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 21. Severability and Survival. If any term, condition or provision of this Agreement is declared void or unenforceable or limited in its application or effect, such event shall not affect any other provisions hereof and all other provisions shall remain fully enforceable. The provisions of this Agreement, which by their sense and context are reasonably intended to survive the completion, expiration or cancellation of this Agreement, shall survive termination of this Agreement. 22 Notices. Notices to the City of Tukwila shall be sent to the following address: City Clerk City of Tukwila 6200 Southcenter Blvd. Tukwila, Washington 98188 Notices to the Contractor shall be sent to the address provided by the Contractor upon the signature line below. 2a Applicable Law; Venue; Attorney's Fees. This Agreement shall be governed by and construed in accordance with the laws of the State of Washington. In the event any suit, arbitration, or other proceeding is instituted to enforce any term of this Agreement, the parties specifically understand and agree that venue shall be properly laid in King County, Washington. The prevailing party in any such action shall be entitled to its attorney's fees and costs of suit. 24 Force Majeure, Neither Party shall be responsible for failure to fulfill its obligations hereunder or liable for damages resulting from delay in performance as a result of war, fire, strike, pandemic, riot or insurrection, natural disaster, delay of carriers, governmental order or regulation, complete or partial shutdown of plant, unavailability of equipment, software, or services from suppliers, default of a subcontractor or vendor to the Party if such default arises out of causes beyond the reasonable control of such subcontractor or vendor, the acts or omissions of the other Party, or its officers, directors, employees, agents, contractors, or elected officials, and/or other occurrences beyond the Party's reasonable control ("Excusable Delay" hereunder). In the event of such Excusable Delay, performance shall be extended on a day for day basis or as otherwise reasonably necessary to compensate for such delay. 26. Counterparts. This Agreement may be executed in several counterparts, each of which when so executed shall be deemed to be an original, and such counterparts shall constitute one and the same instrument. This Amendment shall be considered properly executed by a Party if executed by that Party and transmitted by facsimile or other electronic means including, without limitation, SeamlessDocs or other City -approved program, Tagged Image Format Files (TIFF), or Portable Document Format (PDF). 26. Conflict in Terms. In the event of a conflict between the terms of this Agreement and the terms in any other document, including but not limited to all Exhibits hereto, the terms of this Agreement shall prevail. Exhibit A: Scope of Services Exhibit B: Compensation Schedule Exhibit C: Service Level Agreement (SLA) Exhibit D: City of Tukwila Security Requirements Exhibit E: Data Protection and Information Security Exhibit TIS Contract for Svcs Template 02-2021 Page 9 of 9 Docusign Envelope ID: 9915DDIB-A15B-4AF9-91AC-D8EA56D92378 CITY OF TUKWILA Signed by: 1lwus k�"� NG Thomas c eod, Mayor 5/12/2025 1 12:15 PM PDT Date ATTEST/AUTHENTICATED: Signed by: I Jennifer Marshall, Deputy City Clerk APPROVED AS TO FORM: Signed by: C_�. Ste. Office of the City Attorney CONTRACTOR: Granicus, LLC DocuSigned by: JU By:���g�g� Printed Name: Greg Eck Title: senior Manager, Contracts Address: 1152 15th street NW, suite 800 Date: Washington, DC 20005 4/28/2025 TIS Contract for Svcs Template 02-2021 Page 10 of Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 Scope of Services Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 GRAN ICUS THIS IS NOT AN INVOICE Granicus Proposal for Tukwila, WA III? IIID II[;;; II IIIA III Prepared By: Taylor Brodersen Phone: (814) 720-4368 Email: taylor.brodersen@granicus.com Order #: Q-384417 Prepared On: 18 Mar 2025 Expires On: 31 Dec 2024 1111111) 111? "T°II[III IIS Order Form Prepared for Tukwila, WA Currency: USD Payment Terms: Net 30 (Payments for subscriptions are due at the beginning of the period of performance.) Period of Performance: The term of the Agreement will commence on the date this document is signed and will continue for 12 months. Order #: Q-384417 Prepared: 18 Mar 2025 Page 1 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 E(c J GRAN ICUS Order Form Tukwila, WA III°'IIIIII III II ,,,, SUMMARY The pricing and terms within this Proposal are specific to the products and volumes contained within this Proposal. Order #: Q-384417 Prepared: 18 Mar 2025 Page 2 of 21 Solution Billing Frequency Quantity/Unit Sine-Time Fee SmartGov Training Upon Delivery 1 Each $2,896.00 SmartGov Custom Implementation Upon Delivery 1 Each $0.00 BlueBeam Connector Configuration Upon Delivery 1 Each $1,500.00 Project Management - SmartGov Upon Delivery 1 Each $8,447.85 Map Connector Configuration Upon Delivery 1 Each $1,250.00 Parcel Connector Configuration Upon Delivery 1 Each $3,125.00 Portal Configuration Upon Delivery 1 Each $1,250.00 Fees Configuration (Pages) Upon Delivery 8 Each $4,248.00 General Config Upon Delivery 1 Each $2,500.00 Workflow template customization Upon Delivery 1 Each $10,050.00 Standardized Data Migration - Permits Upon Delivery 1 Each $5,000.00 Base Standardized Migration Cost Upon Delivery 1 Each $1,875.00 Data Migration - Documents 8 Attachments Upon Delivery 1 Each $3,000.00 Standardized Data Migration - Code Enforcement Upon Delivery 1 Each $3,125.00 Standardized Data Migration - Licensing Upon Delivery 1 Each $6,250.00 Contractor Connector Configuration Upon Delivery 1 Each $1,250.00 Financial Export Connector Configuration Upon Delivery 1 Each $2,500.00 Existing Merchant Connector Configuration Upon Delivery 1 Each $1,500.00 Laserfiche Connector Configuration Upon Delivery 1 Each $3,125.00 Active Directory Connector Configuration Upon Delivery 1 Each $1,875.00 SUBTOTAL:' $64,766.85 . Order #: Q-384417 Prepared: 18 Mar 2025 Page 2 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS Order Form Tukwila, WA SmartGov - Enterprise Annual 1 Each $27,424.00 SmartGov Code Enforcement Annual 1 Each $0.00 SmartGov Licensing Annual 1 Each $0.00 SmartGov Permitting Annual 1 Each $0.00 SmartGov Connector BlueBeam Annual 1 Each $1,372.00 SmartGov Connector Contractor Annual 1 Each $1,372.00 SmartGov Connector Financial Annual 1 Each $1,372.00 SmartGov Connector Merchant Annual 1 Each $1,372.00 SmartGov API Annual 1 Each $2,915.00 SmartGov Connector ECM-Laserfiche Annual 1 Each $1,372.00 SmartGov Connector Active Directory Annual 1 Each $1,372.00 Order #: Q-384417 Prepared: 18 Mar 2025 Page 3 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS IIIA IIIA IIID T III) 111:11:11:sc R111 II11,111 III IIS Order Form Tukwila, WA Solutio, Description SmartGov - Enterprise Annual subscription to SmartGov software for: Permitting, Licensing, and Code Enforcement. Subscription includes the Public Portal. SmartGov Code Enforcement Annual subscription for SmartGov Code Enforcement Module for managing service requests and complaints. SmartGov Licensing Annual subscription for SmartGov Licensing Module for contractor registration, rental registration, business licensing. SmartGov Permitting Annual subscription for SmartGov Permitting Module for building and planning permits, inspections, and contacts. SmartGov Connector The SmartGov Bluebeam connector provides the ability to check out BlueBeam documents for plan review and markup using the subscriber's Bluebeam subscription. Bluebeam Studio is the repository for Bluebeam Projects and Sessions. Only one license/subscription is required for each jurisdiction. SmartGov Training Includes up to two (2) hours of User Acceptance Training to prepare primary users for Validation, focused on navigation and testing best practices. Go -Live training will span a one (1) week period, provided in three (3) hour sessions focused on Permit/Application Intake, Review, Inspections and Code Enforcement processes (as needed). SmartGov Custom SmartGov Configuration based on implementation options selected. Implementation Order #: Q-384417 Prepared: 18 Mar 2025 Page 4 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS BlueBeam Connector Assist Subscriber in configuring Bluebeam connection. Configuration Testing connection with Subscriber. Order #: Q-384417 Prepared: 18 Mar 2025 Order Form Tukwila, WA Training provided on SmartGov check-out and check-in process only. The service and subscription for this connector does NOT include a subscription to Bluebeam or training on how to install or use the Bluebeam software. Subscriber is responsible for providing an active subscription to Bluebeam Studio Prime with REVU 21 to use the SmartGov Bluebeam Connector. Each user that will be checking permits out to Bluebeam from SmartGov or accessing the submittal documents from SmartGov for review in Bluebeam will need to be a member of the Studio Prime account. Bluebeam Software is comprised of a document management component, known as Studio, and a client -side application, Revu. Each component has three (3) editions with various features. Bluebeam Studio is the repository for Bluebeam Projects and Sessions. Only one license/subscription is required for each jurisdiction. It is available in the following editions: Bluebeam Studio Prime (Compatible with SmartGov) - Cloud -based (allows third party integrations with the Bluebeam Studio API), additional Bluebeam cost Bluebeam Studio (Not Compatible with SmartGov) - Cloud -based, included with the Bluebeam Revu user license at no additional Bluebeam cost Bluebeam Studio Enterprise (Not Compatible with SmartGov) - On - Premises Bluebeam Revu is the client -side software that provides the tools necessary to review and mark up documents. This software must be installed on each client computer that will be used to perform review and mark up tasks. Revu is available in the following editions: Revu Standard (Compatible with SmartGov) -Standard tool set Revu CAD (Compatible with SmartGov) - Includes all of the standard tools, along with plugins for 2D and 3D PDF creation Revu eXtreme (Compatible with SmartGov) - Includes all of the standard tools and CAD plugins, with additional features like Optical Character Recognition (OCR) and batch processes. The Revu user license includes access to Bluebeam Studio, but Bluebeam Studio is not sufficient for integration with SmartGov. Each SmartGov user that will be checking projects in and out of Bluebeam or performing review and mark up tasks must also be a member of the Bluebeam Studio Prime Page 5 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS Order Form Tukwila, WA Solution Descll0ition account. Project Management - Project Management: Company Project Manager will act as an extension SmartGov of the Subscriber's team and manage the implementation from start to finish. The Subscriber will have access to a personalized timeline which will be reviewed on a regular cadence. The Project Manager will partner with the Subscriber to coordinate all services, management of the project timeline, and help identify risks and/or issues. Project Management Services include: • Project planning and kickoff meetings. • Project schedule developed and maintained according to the SOW tasks, deliverables, dependencies, and resource assignments. • Status reporting and coordination of status meetings, bi-weekly, or as required. • Schedule monitoring and scope management. • Risk Management planning to identify, analyze, and mitigate risks. • Action Item and decision tracking, as well as resolving and escalating issues. • Change control management and issue tracking. • Company project resource management. • Verify product and deliverable acceptance with Subscriber. • Facilitating transition to Support. • Company's Project Manager will serve as the single point of contact for the project related to this SOW. Order #: Q-384417 Prepared: 18 Mar 2025 Page 6 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS Map Connector Configuration Configure subscribers ESRI GIS layers into SmartGov Troubleshooting the incoming data Train client on how to maintain the service in SmartGov. MAP/GIS Connector: Order Form Tukwila, WA Company will connect to ESRI Map Service provided by Subscriber and secured by a publicly trusted certificate issued by a Certificate Authority. Subscriber is responsible for contracting separately with ESRI map service provider and ESRI configuration. SmartGov Requirements for Map Connector Integration: ArcGIS for Server 10.4 or ArcGIS for server Enterprise Standard 10.7.1 (OR) ArcGIS Online. Subscriber Map Service must be publicly accessible and require no user authentication of any kind. The Map Service must include a parcel layer with a designated field having parcel numbers that exactly match those provided in the Parcel Connector source data (this layer may be the same as that provided for the Parcel Connector if no authentication is required for access). Support for Feature, Tiled, and Web Map Services is notincluded. Custom base maps are not supported. Base maps from the ESRI base map library will be available for use. The following base maps are currently included (subject to change): Imagery Imagery Hybrid Streets Topographic Navigation Streets (Night) Terrain with Labels Light Gray Canvas Dark Gray Canvas Oceans National Geographic Style Map Open Street Map Charted Territory Map Community Map Navigation (Dark Mode) Newspaper Map Human Geography Map Human Geography Dark Map Modern Antique Map Mid -Century Map Nova Map Colored Pencil Map Firefly Imagery Hybrid Order #: Q-384417 Prepared: 18 Mar 2025 Page 7 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS Solution Desc1loition USA Topo Maps Order #: Q-384417 Prepared: 18 Mar 2025 Order Form Tukwila, WA Page 8 of 21 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS Order Form Tukwila, WA Parcel Connector Company will configure EITHER a Delimited Parcel Job OR ARCGIS Parcel Configuration Job on behalf of the Subscriber. Order #: Q-384417 Prepared: 18 Mar 2025 Configure Subscribers parcel fields into SmartGov. Troubleshooting the incoming data and providing recommendations for Subscriber to resolve data gaps. Train Subscriber on how to maintain the service in SmartGov. Delimited File - A delimited file may be uploaded to the job at runtime. The delimited file option supports a single address for each individual parcel. Subscriber must use the template provided by Company. Parcel Layer- A parcel layer must be accessible by URL through an ESRI REST service. A secondary address -only layer may also be provided for parcels that have more than one address. The layer(s) must be publicly accessible and may be secured with a username and password. Subscriber is responsible for obtaining, cleaning, and maintaining all parcel data within the delimited file and/or ESRI Rest service. The configured parcel job will be available for Subscriber to run on - demand after go -live. The Parcel Layer Job can be set to run daily, weekly, monthly, or annually defined by how often Subscriber intends to update the Rest Service. Parcel source data (delimited file or parcel layer) must include the following fields, at a minimum: Parcel Number Primary Situs Address Primary Situs City Primary Situs State Primary Situs Zip Code Owner Name Owner Street Address Owner City populated for USA addresses only Owner State populated for USA addresses only Owner Zip Code populated for USA addresses only International Indicator with a value of "Y" for any owner address outside of the USA International line including the full regional equivalent of the city, state and zip code for any owner address outside of the USA Inclusion of the following additional fields is recommended: Parcel center point latitude in decimal degrees Parcel center point longitude in decimal degrees If using a secondary address layer with the ARCGIS Parcel job, the address layer must contain the following fields: Parcel Number Page 9 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS Order Form Tukwila, WA Solution Descl l0ition Secondary Situs Address Secondary Situs City Secondary Situs Zip Code Inclusion of the following additional fields is recommended for the secondary address layer: Address point latitude in decimal degrees Address point longitude in decimal degrees Portal Configuration Company will customize Subscriber's Portal by: • Loading Subscriber logo. • Exposing all permits/business licenses identified in Configuration workbook in which citizens will have access. • Advising on best practices for public release timeline and access code configuration. • Load Subscriber custom verbiage into limited fields. • Provide the access URL (Uniform Resource Locator) for Subscriber to add link to jurisdiction web pages. Includes consultant -led end-to-end walkthrough and demonstration of UAT/Validation process to Subscriber to confirm functionality meets configuration requirements. Fees Configuration (Pages) Subscriber Fees configured based on provided Fee schedule and according to Configuration Workbook. Based on Subscriber fee schedule, defined in the Order Form, Company will: • Setup Subscriber fee code calculations. • Load Subscriber FMS (Financial Management System) / GL (General Ledger Code) (according to Configuration Workbook). • Load Subscriber Valuation table (according to Configuration Workbook or ICC (International Chamber of Commerce) table). Setup Subscriber fixture costs (according to Configuration Workbook). • Load other Subscriber custom attributes / details as required for Subscriber fee calculations (according to Configuration Workbook). Order #: Q-384417 Prepared: 18 Mar 2025 Page 10 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS Order Form Tukwila, WA Solution Desclloltion General Config General Configuration: As part of the General Configuration, Company will: • Create Subscriber database with best practice defaults. • Provide Validation environment access to Subscriber. • Load Subscriber users with Company standard permissions (according to Configuration Workbook). • Configure system values (locality, time zone, header and footer detail, standard report settings). • Load Client Code References/Violation types (according to Configuration Workbook). • Set up General Ledger accounts. • Load Subscriber logo. • Provide access to over 100 reports and output document templates. Subscriber receives credentials for environment when initial configuration items under General Configuration deliverable are completed. Workflow template Workflow Template Configuration: Company will configure process customization templates as defined in the Business Process Analysis phase for each department in scope: Building/Permits, Code Enforcement, Licensing and/or Recurring Inspections. Company will: Load Subscriber Code References/Violation types (according to Configuration Workbook). Load custom attributes/details within the limited fields available (not associated with fees, according to Configuration Workbook). Configure workflow to meet business requirements defined in Configuration Workbook. Consultant -led end-to-end walkthrough and demonstration of UAT/Validation process to Subscriber to confirm functionality meets configuration requirements. Completed upon configuration according to documentation in the Configuration Workbook Percentage: 100% Order #: Q-384417 Prepared: 18 Mar 2025 Page 11 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS Order Form Tukwila, WA Solution Desclloition Standardized Data Migration - Company will import permit data from a single client database source, Permits approved by Company as standard source data. Multiple databases or unapproved source data will be subject to a change order for a custom data migration. The fields below are considered in -scope of a standard Permit data migration. The final output has many factors, including the fields available from the source data. Fields: Basic Permit Info, Parcel Contacts (Contractors will be listed on Contacts), Inspections, Fees as Notes, Notes The data migration process assumptions: Subscriber will provide an initial data set from source database. Company will provide a mapping workbook to Subscriber where Subscriber is responsible for mapping data fields to the preconfigured database fields. Subscriber will have two (2) weeks ten (10) business days to validate the initial data load and provide feedback. There is a maximum of two (2) rounds of feedback within that 10 -day period. Thorough validation is necessary for any successful SmartGov data migration as there is no additional data cleansing possible after the final migration. No more system changes will be permitted after successful Validation. Subscriber to provide a final data set three (3) business days before Go -Live. Final data load will occur the day before Go -Live. Order #: Q-384417 Prepared: 18 Mar 2025 Page 12 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS Order Form Tukwila, WA Solution Desclloition Base Standardized Migration Base Data Migration includes non -module data such as contacts and is Cost included in all standard data migration packages with one or more module data migrations. Company will import permit data from a single client database source, approved by Company as standard source data. Multiple databases or unapproved source data will be subject to a change order for a custom data migration. The Standard Data Migration includes the Base fields and one or more of the additional datasets per the Sales Order Form. The fields below are considered in -scope of a standard data migration. The final output has many factors, including the fields available from the source data. Parcels: Ownership Addresses Contacts: Phone Address Email The data migration process assumptions: Subscriber will provide an initial data set from source database. Company will provide a mapping workbook to Subscriber where Subscriber is responsible for mapping data fields to the preconfigured database fields. Subscriber will have two (2) weeks ten (10) business days to validate the initial data load and provide feedback. There is a maximum of two (2) rounds of feedback within that 10 -day period. Thorough validation is necessary for any successful SmartGov data migration as there is no additional data cleansing possible after the final migration. No more system changes will be permitted after successful Validation. Subscriber to provide a final data set three (3) business days before Go -Live. Final data load will occur the day before Go -Live. SmartGov Connector Contractor Connector links to state database to verify licenses and Contractor update contractor license information automatically. Alternatively, SmartGov Contractor Connector provides a one-time CSV upload that may include data out of scope of the standard contact -contractor upload. SmartGov Connector Financial The SmartGov Financial Connector outputs a financial extract with a pre- determined format which may be written to the customer's FTP site, if desired, to facilitate automated external processing of the file. The customer may request the use of an alternate delimiter if a comma is not acceptable. The financial extract job may be run on demand or scheduled to run on a consistent basis (e.g., daily, weekly, monthly, etc.). Companion reports designed for reconciliation and extract verification are also available. SmartGov Connector Merchant Connection to one merchant in the back office and/or portal from a list of available options. Subscriber remains responsible for the relationship with the provider. Order #: Q-384417 Prepared: 18 Mar 2025 Page 13 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS Order Form Tukwila, WA Solution Desclloition Data Migration - Documents & Includes migration of clients documents/images as attachments to Attachments notes on permits, parcels, code enforcement cases or licenses. Client must provide easy mapping from documents to the object (permit, parcel, case etc...) it will be attached to Standardized Data Migration - Company will import Code Enforcement data from a single client Code Enforcement database source, approved by Company as standard source data. Multiple databases or unapproved source data will be subject to a change order for a custom data migration. The fields below are considered in -scope of a standard Code Enforcement data migration. The final output has many factors, including the fields available from the source data. Migration includes only current occurrence, no history. Fields: Case Request, Basic Case, Info Complainant, Contacts, Inspections, Fees as Notes, Notes The data migration process assumptions: Subscriber will provide an initial data set from source database. Company will provide a mapping workbook to Subscriber where Subscriber is responsible for mapping data fields to the preconfigured database fields. Subscriber will have two (2) weeks ten (10) business days to validate the initial data load and provide feedback. There is a maximum of two (2) rounds of feedback within that 10 -day period. Thorough validation is necessary for any successful SmartGov data migration as there is no additional data cleansing possible after the final migration. No more system changes will be permitted after successful Validation. Subscriber to provide a final data set three (3) business days before Go -Live. Final data load will occur the day before Go -Live. Order #: Q-384417 Prepared: 18 Mar 2025 Page 14 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS Order Form Tukwila, WA Solution Desclloition Standardized Data Migration - Company will import Licensing data from a single client database source, Licensing approved by Company as standard source data. Multiple databases or unapproved source data will be subject to a change order for a custom data migration. The fields below are considered in -scope of a standard Licensing data migration. The final output has many factors, including the fields available from the source data. Migration includes only current occurrence, no history. Fields: License Info, Contacts, Parcels, Inspections, Fees as Notes, Notes The data migration process assumptions: Subscriber will provide an initial data set from source database. Company will provide a mapping workbook to Subscriber where Subscriber is responsible for mapping data fields to the preconfigured database fields. Subscriber will have two (2) weeks ten (10) business days to validate the initial data load and provide feedback. There is a maximum of two (2) rounds of feedback within that 10 -day period. Thorough validation is necessary for any successful SmartGov data migration as there is no additional data cleansing possible after the final migration. No more system changes will be permitted after successful Validation. Subscriber to provide a final data set three (3) business days before Go -Live. Final data load will occur the day before Go -Live. Order #: Q-384417 Prepared: 18 Mar 2025 Page 15 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS Order Form Tukwila, WA Solution Desclloition Contractor Connector Import of contractors from a delimited file or a SODA query (Washington Configuration and Arizona clients only). SODA Imports. Includes completed configuration of field mapping and credential link. The states of Washington and Arizona have access to a SODA load which will be configured according to existing keys. This runs on a scheduled recurrence. Delimited File Imports. The contractor data load is a one-time delimited file import. Future additions and changes to contractor information will be managed through manual updates in SmartGov. The Subscriber is responsible for any data cleansing and parsing. Includes: .csv data load (one-time data load) Provide Subscriber a .csv file to be completed by Subscriber. Configure to Subscriber's provided fields. Troubleshoot errors and provide Subscriber guidance on resolutions that Subscriber will need to resolve within the file. Delimited File Import Required fields below: Contractor Display Name Contractor Address Contractor City Contractor State Contractor Zip Contractor License Number License Type License Exp. D Order #: Q-384417 Prepared: 18 Mar 2025 Page 16 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS Order Form Tukwila, WA Financial Export Connector Configure financial export according to subscribers FMS (financial Configuration management system) as provided by Subscriber. Order #: Q-384417 Prepared: 18 Mar 2025 Train Subscriber on how to export and set scheduler. Company will customize the configuration of the export to match Subscriber financial system input needs as documented. Available customizations include: Additional data fields Altered order of column information Alternate delimiter or fixed width formatting A header line is not part of the export. Financial Connector does not connect directly with any Financial Management System. If Subscriber provides a local (FTP) File Transfer Protocol, the Financial Connector can automatically upload to the defined FTP destination. By default, financial extract jobs are pre -configured and the included configuration of the Receipt Extract job will produce a comma -delimited file with the following data points: Receipt Number Receipt Date FMS/GL Code Fund GL Account Fee Amount Paid Fee Code Name Permit/License/Case Number Payer Name The included configuration of the Receipt Extract - FMS/GL Summary job will produce a comma -delimited file with the following data points: FMS/GL Code Fund GL Account Fee Amount Paid The file output of the financial extract may be written to the customer's FTP site, if desired, to facilitate automated external processing of the file. The customer may request the use of an alternate delimiter if a comma is not acceptable. The financial extract job may be run on demand or scheduled to run on a consistent basis (e.g., daily, weekly, monthly, etc.). Companion reports designed for reconciliation and extract verification are also available. Page 17 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS Order Form Tukwila, WA Solution Desclloition Existing Merchant Connector Configure merchant connection. Configuration Test and troubleshoot connection during test process. Subscriber to provide the required linking information for Company to complete the setup. These will often include connection URLs, Login IDs, and Transaction Keys. Requirements vary slightly depending on the selected Merchant. SmartGov will not test in Production environments. SmartGov API SmartGov API includes standard REST API Endpoints with documentation. The following information can be requested from SmartGov: Case assignments: All inspections and code enforcement cases assigned to a person Contact, Parcel and Custom Details, Inspections, Associations, attached photos, documents, and plans on Permits, Licenses, Recurring Inspections and Code Enforcement Cases with additional information available for: - Permits - Contractor license status, conditions - Licenses - Activities, conditions - Code enforcement Cases - Workflow, Items, Violations, Citations Parcel information including Lat/Long, situs address and parcel number Contact information such as name, phone number, email, address The following information can be updated: All inspection information including assignment, requesting, scheduling, inspection status (pass/fail) and results and adding photos and notes Code enforcement case information including workflow, details, notes and attachments contact names, addresses, emails, phone numbers, points of contact The following information can be created: Contacts Inspections, including creation of inspection actions, corrections and code references, notes Code enforcement case requests Code enforcement cases including violations, citations, details, workflow steps and inspections on the case Financial specific endpoints:Obtain fees due on licenses, permits, code enforcement cases and recurring inspections Apply payments to pending receipts SmartGov Connector ECM- Laserfiche connector allows file attachments in SmartGov to be stored Laserfiche within Laserfiche, an ECM (Enterprise Content Management) system. The Laserfiche integration was built in compliance with CMIS (Content Management Interoperability Services) standards. Subscriber must have the Laserfiche CMIS Gateway, version 10 or higher, installed and configured for the desired repository and be able to provide a browser binding URL that SmartGov can reach from the cloud. The service and subscription for this connector does NOT include a subscription to Laserfiche or training on how to install or use the Laserfiche software. Order #: Q-384417 Prepared: 18 Mar 2025 Page 18 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS Order Form Tukwila, WA Solution Desclloltion Laserfiche Connector This connector allows file attachments in SmartGov to be stored within an Configuration ECM (Enterprise Content Management) system. The Laserfiche integration was built in compliance with CMIS (Content Management Interoperability Services) standards. Subscriber must have the Laserfiche CMIS Gateway, version 10 or higher, installed and configured for the desired repository and be able to provide a browser binding URL that SmartGov can reach from the cloud. The service and subscription for this connector does NOT include a subscription to Laserfiche or training on how to install or use the Laserfiche software. There are three Secured Functions that control access to the Laserfiche configuration options: Admin.JurisdictionBlob Provider - Allow user to all ECM settings and mappings Admin.JurisdictionBlob Provider. ConfigureCMISConnection - Allow user to configure CMIS connection settings Admin.JurisdictionBlob Provider. ConfigureECMTemplates - Allow user to configure metadata template mappings Configure Subscriber's credentials and mapping in SmartGov. Meet with Subscriber and guide them through SmartGov to test the connection. SmartGov Connector Active Connector for integration with Active Directory. SmartGov Requirements Directory for integration with Active Directory: ADFS (Active Directory Federation Services) version 5.0 or higher (Windows server 2019 or higher). Mobile ADFS in Azure to support PKCE (Proof Key for Code Exchange) for OAuth 2.0 Azure AD expires every 24 -months and the Subscriber has to maintain their secret keys in Production. For SSO (Single Sign On) SAML v2 Active Directory Connector Configure Subscribers credentials in SmartGov. Configuration Meet with Subscribers and guide through the connection in SmartGov for testing and maintaining. Subscriber is responsible for the installation and configuration of active directory technology. Order #: Q-384417 Prepared: 18 Mar 2025 Page 19 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 E(c J GRAN ICUS Order Form Tukwila, WA T111:11:11:11RMS & C011MIDIT11101INS • This quote, and all products and services delivered hereunder are governed by the terms located at_ https://aranicus.com/legal/licensing, including any product -specific terms included therein (the "License Agreement"). If your organization and Granicus has entered into a separate agreement or is utilizing a contract vehicle for this transaction, the terms of the License Agreement are incorporated into such separate agreement or contract vehicle by reference, with any directly conflicting terms and conditions being resolved in favor of the separate agreement or contract vehicle to the extent applicable. • If submitting a Purchase Order, please include the following language: The pricing, terms and conditions of quote Q-384417 dated 18 Mar 2025 are incorporated into this Purchase Order by reference and shall take precedence over any terms and conditions included in this Purchase Order. • This quote is exclusive of applicable state, local, and federal taxes, which, if any, will be included in the invoice. It is the responsibility of Tukwila, WA to provide applicable exemption certificate(s). • Any lapse in payment may result in suspension of service and will require the payment of a setup fee to reinstate the subscription. Order #: Q-384417 Prepared: 18 Mar 2025 Page 20 of 21 Docusign Envelope ID: 9915DDIB-A15B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS 1113111111 III,,,, IIIIIMG IIII II Ilf m IIIA "r i II Billing Contact: Purchase Order [ ] - No Re uired? [ ] - Yes Billing Address: PO Number: If PO required Billing Email: Billing Phone: F Order Form Tukwila, WA If submitting a Purchase Order, please include the following language: The pricing, terms, and conditions of quote 0-384417 dated 18 Mar 2025 are incorporated into this Purchase Order by reference and shall take precedence over any terms and conditions included in this Purchase Order. III? 11[111II[III II[III ii"iim"r A1114111[) 111::11"AlIM CIII..... By signing this document, the undersigned certifies they have authority to enter the agreement. The undersigned also understands the services and terms. Tukwild; W, A � Signature: .. Signed by. was hc(,u 8EE243°8fl545B44C... Name: <Thomas MCLeod Title: Mayor s Date: `5/12/2025 1 12:15 PM PDT Order #: Q-384417 Prepared: 18 Mar 2025 Page 21 of 21 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 Compensation Schedule Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 GRAN ICUS THIS IS NOT AN INVOICE Granicus Proposal for Tukwila, WA III? IIID II[;;; II IIIA III Prepared By: Taylor Brodersen Phone: (814) 720-4368 Email: taylor.brodersen@granicus.com Order #: Q-384417 Prepared On: 18 Mar 2025 Expires On: 31 Dec 2024 1111111) 111? "T°II[III IIS Order Form Prepared for Tukwila, WA Currency: USD Payment Terms: Net 30 (Payments for subscriptions are due at the beginning of the period of performance.) Period of Performance: The term of the Agreement will commence on the date this document is signed and will continue for 12 months. Order #: Q-384417 Prepared: 18 Mar 2025 Page 1 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 E(c J GRAN ICUS Order Form Tukwila, WA III°'IIIIII III II ,,,, SUMMARY The pricing and terms within this Proposal are specific to the products and volumes contained within this Proposal. Order #: Q-384417 Prepared: 18 Mar 2025 Page 2 of 21 Solution Billing Frequency Quantity/Unit Sine-Time Fee SmartGov Training Upon Delivery 1 Each $2,896.00 SmartGov Custom Implementation Upon Delivery 1 Each $0.00 BlueBeam Connector Configuration Upon Delivery 1 Each $1,500.00 Project Management - SmartGov Upon Delivery 1 Each $8,447.85 Map Connector Configuration Upon Delivery 1 Each $1,250.00 Parcel Connector Configuration Upon Delivery 1 Each $3,125.00 Portal Configuration Upon Delivery 1 Each $1,250.00 Fees Configuration (Pages) Upon Delivery 8 Each $4,248.00 General Config Upon Delivery 1 Each $2,500.00 Workflow template customization Upon Delivery 1 Each $10,050.00 Standardized Data Migration - Permits Upon Delivery 1 Each $5,000.00 Base Standardized Migration Cost Upon Delivery 1 Each $1,875.00 Data Migration - Documents 8 Attachments Upon Delivery 1 Each $3,000.00 Standardized Data Migration - Code Enforcement Upon Delivery 1 Each $3,125.00 Standardized Data Migration - Licensing Upon Delivery 1 Each $6,250.00 Contractor Connector Configuration Upon Delivery 1 Each $1,250.00 Financial Export Connector Configuration Upon Delivery 1 Each $2,500.00 Existing Merchant Connector Configuration Upon Delivery 1 Each $1,500.00 Laserfiche Connector Configuration Upon Delivery 1 Each $3,125.00 Active Directory Connector Configuration Upon Delivery 1 Each $1,875.00 SUBTOTAL:' $64,766.85 . Order #: Q-384417 Prepared: 18 Mar 2025 Page 2 of 21 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 �(( GRAN ICUS Order Form Tukwila, WA SmartGov - Enterprise Annual 1 Each $27,424.00 SmartGov Code Enforcement Annual 1 Each $0.00 SmartGov Licensing Annual 1 Each $0.00 SmartGov Permitting Annual 1 Each $0.00 SmartGov Connector BlueBeam Annual 1 Each $1,372.00 SmartGov Connector Contractor Annual 1 Each $1,372.00 SmartGov Connector Financial Annual 1 Each $1,372.00 SmartGov Connector Merchant Annual 1 Each $1,372.00 SmartGov API Annual 1 Each $2,915.00 SmartGov Connector ECM-Laserfiche Annual 1 Each $1,372.00 SmartGov Connector Active Directory Annual 1 Each $1,372.00 Order #: Q-384417 Prepared: 18 Mar 2025 Page 3 of 21 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 EXHIBIT C SERVICE LEVEL AGREEMENT (SLA) TIS EXH—Service Level Agreement 02-2021 Page 3 of 3 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 CC` GR AN ICU S granicus.com Region Regular Support Hours Support Contact Channels USA Monday - Friday suppc�Vt,,,c�rarricus.com Response 8:00 AM -8:00 PM EST 1-800-314-0147 Incident represents Excluding Federal Holidays Incident response process is initiated upon verification. Work Canada Monday - Friday su,ppct ranicus.com on a resolution begins immediately (24/7/365). Notifications 8:00 AM -8:00 PM EST 1-800-314-0147 hours Excluding Statutory Holidays EMERGENCY Europe Monday - Friday su.poVt,.c�rarricus.com 9:00 AM -5:00 PM GMT +44 (0) 800 032 7764 status.granicus.com. Excluding Statutory Holidays available Australia & New Monday - Fridayu.pcaVt.,.cirarricus.cover Zealand 9:00 AM -5:30 PM AEST +61 3 9913 0020 Level 2 Excluding National Holidays and Victorian four (4) is evaluated whether a solution or acceptable work around public holida s product is not working or Subscribers Monday - Friday subscriberhell„ru,,,. ranicus.com ................................................................ govDelivery Help 8:00 AM -8:00 PM EST subscriberhel....1p@granicus.corn ............................................................... Excluding US Federal Holidays 1-800-439-1420 USA +44 0 808 234 7450 Europe Emergency Support Emergency technical support is available 24/7 by phone only for customers Level 3 experiencing a Level 1 outage as defined below Severity Time to Is' Level Description Response Granicus Action Incident represents Within Incident response process is initiated upon verification. Work complete unavailability of two(2) on a resolution begins immediately (24/7/365). Notifications Level 1 the Granicus Products for all hours and updates of resolution or work arounds are provided to EMERGENCY users and no workaround is affected clients via case, or if several clients are affected, via status.granicus.com. available Incident occurs when a Within Incident response process is initiated upon verification. Case Level 2 major feature of the four (4) is evaluated whether a solution or acceptable work around SEVERELY product is not working or hours can be achieved. Notifications and updates of resolutions or work arounds are provided to affected clients via case, or if IMPAIRED fails repeatedly and there several clients are affected, via status.granicus.com is no workaround available Incident occurs when a Within Upon verification case is assigned and work on resolution Level 3 primary feature of the one (1) begins within 1 business day. If the issue is reported after hours, IMPAIRED product is not working as business it will not be assigned until the next business day. expected and an day acceptable workaround is available Incident that has a limited Within Upon verification case is assigned and work on resolution Level 4 business impact, primary three (3) begins within 3 business days. If the issue is reported after LOW IMPACT functionality is unaffected business hours, it will not be assigned until the next business day. days Granicus shall use commercially reasonable efforts to resolve incidents affecting Granicus Products. Incidents that require debugging of programming code may need to be corrected during the next regular update cycle. Resolution time will be based on the details and severity of an incident. Regular follow-ups will be communicated with the customer until final resolution is reached granicus.com I info@granicus.com page 1 Docusign Envelope ID: 9915DD1 B -Al 5B-4AF9-91AC-D8EA56D92378 CC` GR AN ICU S granicus.com Granicus will use commercially reasonable efforts to make the Granicus Products Available 99.9% of the Available Hours of Operation, calculated on a calendar quarter basis, as follows: [(Total time in a quarter - Unexpected Downtime - Scheduled Downtime - Service Disruption) / (Total time in a quarter -Schedule Downtime -Service Disruption)] * 100 Reasonable efforts are made to avoid Scheduled Downtime to perform maintenance, however, in circumstances where Scheduled Downtime is required, notification will be posted at least 10 days in advance for all Product Suites, scope of maintenance activities may be refined to ensure adherence to published schedule. Customers can subscribe to product specific email notifications on the status page status.granicus.com Notifications for Granicus Products of any system -wide outages will be posted to.s. and will; occur within one (1) hour from the time the issues are first recognized by Granicus. Reports of Unscheduled Downtime will be provided upon request up to once per calendar quarter. Term Definition Availability ability of a user to access the Granicus Product via the internet. Granicus uses industry - standard fhird-parfy monitoring to measure Availability through URL monitoring HTTP Available twenty-four hours a day, seven days per week, minus Scheduled Downtime Hours of Operation Maintenance updates, upgrades, bug fixes, and patches to the Granicus Products. Maintenance times vary by Product. An up-to-date maintenance schedule can be found at s'ta'tus. ranicus.com. Scheduled is the period when the Granicus Product may be inaccessible to permit Granicus to perform Downtime Maintenance services Service is the downtime arising from causes beyond the reasonable direct control of Granicus, such Disruption as events caused by Client's action or inaction, force majeure, interruption or failure of digital transmission links or telecommunications, certificate expirations, hostile network attacks, issues arising with customer Domain Name Systems (DNS), or Client Web Application Firewall (WAF). Unscheduled is any time after the first five minutes of downtime where the Granicus Product is not Available Downtime in anyway. Any credit provided within this Technical Support and Availability document will be referred to as an Outage Credit. The Outage Credit shall be applied as credit to the customer's following renewal term for the customer's affected Granicus Product and will be added to the end of the then -current period of performance and shall be provided upon the customer's request. Outage Credit is available solely to the extent Unscheduled Downtime created unavailability of the entire Granicus product. Unscheduled Downtime does not include Service Disruption. In no event shall any credit for a calendar quarter exceed the seven (7) days of Outage Credit. Granicus shall have the ability to determine at its reasonable discretion whether Unscheduled Downtime has occurred. Per calendar quarter, Granicus will provide Outage Credit as follows: granicus.com I info@granicus.com page 2 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 Exhibit D City of Tukwila Security Requirements Introduction During the term of this agreement, Contractor shall operate an information security program designed to meet the confidentiality, integrity, and availability requirements of the service or product being supplied. The program shall include at a minimum the following security measures. Governance 1. Information Security Policy: Contractor shall develop, implement, and maintain an information security policy and shall communicate the policy to all staff and contractors. 2. Information Security Accountability: Contractor shall appoint an employee of at least manager level who shall be accountable for the overall information security program. 3. Risk Management: Contractor shall employ a formal risk assessment process to identify security risks which may impact the products or services being supplied, and mitigate risks in a timely manner commensurate with the risk. Asset Management 4. Asset Inventory: Contractor shall maintain an inventory of all hardware and software assets, including asset ownership. 5. Data Classification: Contractor shall develop, implement, and maintain a data classification scheme and process designed to ensure that data is protected according to its confidentiality requirements. Supply Chain Risk Management 6. Supplier Security Assessments: Contractor shall engage in appropriate due diligence assessments of potential suppliers which may impact the security of the services or products being supplied. 7. Security in Supplier Agreements: Contractor shall ensure that agreements with suppliers who may impact the security of the services or products being supplied contain appropriate security requirements. Human Resource Security 8. Information Security Awareness: Contractor shall develop and implement an information security awareness program designed to ensure that all employees and contractors receive security education as relevant to their job function. 9. Background Checks: Contractor shall conduct appropriate background checks on all new employees based on the sensitivity of the role that they are being hired for. Identity Management, Authentication and Access Control 10. Authentication: Contractor shall ensure that all access, by employees or contractors, to its information systems used to provide services or products being supplied shall require appropriate authentication controls that at a minimum will include: TIS EXH—Security Requirements 02-2021 Page 1 of 3 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 a. Strong passwords or multi -factor authentication for users b. Multi -factor authentication for all remote access 11. Authorization: Contractor shall ensure that all access to its information systems used to provide services or products being supplied shall be approved by management. 12. Privileged Account Management: Contractor shall appropriately manage and control privileged accounts on its information systems that at a minimum will include: a. Use of dedicated accounts for privileged activity b. Maintaining an inventory of privileged accounts 13. Access Termination: Contractor shall develop and maintain a process designed to ensure that user access is revoked upon termination of employment, or contract for contractors. Data Security 14. Encryption: Contractor shall ensure that all laptops, mobile devices, and removable media, including those that are owned by Contractor employees or contractors, which may be used to store, process, or transport organizational data are encrypted at all times. SCC�1l u11'ig gu.uudiuuu . Rius may Iliauamo,,j I ui I e°:( ected ii I ci!3!3a3'3 ary cclnfiii lJent4 i ,II" 3 1. si iv irgariu z fl ,:: �'.. cunc ii�Jata. 15. Secure Disposal: Contractor shall ensure that all media which may be used to store, process, or transport organizational data is disposed of in a secure manner. II'Sccll iiri i.udeflri IIluu it u..uuir uuu uul a uah Il, u u u a ull uuluau I u a u, 1 ., puc 1 ,I I c c aunh ,.ionf �l cir ensu iJv sir an" 1. .. �,..„ u�::lcu„iwI p :. :, � � wasp,,,.„ ,., a u� ��� � I �:;�. System Acquisition, Development and Maintenance la Security Requirements: Contractor shall ensure that information security requirements are defined for all new information systems, whether acquired ordeveloped. 17. Separation of Environments: Contractor shall ensure that development and testing environments are separate from their production environment. 18. Data Anonymization: Contractor shall ensure that the City of Tukwila's data will not be used in the development or testing of new systems unless the data is appropriately anonymized. 19. Secure Coding: Contractor shall ensure that all applications are developed with secure coding practices, including OWASP Top 10 Most Critical Web Application Security Risks. Physical and Environmental Security 20. Risk Assessment: Contractor shall use a formal risk assessment methodology to identify physical and environmental threats and shall implement controls to minimize the risks. TIS EXH—Security Requirements 02-2021 Page 2 of 3 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 Information Protection Processes and Procedure 21. Hardening: Contractor shall develop and implement security configuration baselines for all endpoint and network devices types. 22. Network Segregation: Contractor shall segregate its network into zones based on trust levels, and control the flow of traffic between zones. 23. Anti-Malware: Contractor shall ensure that all information systems that are susceptible to malware are protected by up-to-date anti-malware software. 24. Wireless Access Control: Contractor shall ensure that wireless network access is protected, including at a minimum: a. All wireless network access should be encrypted b. All wireless network access to the production network should be authenticated using multi -factor authentication such as machine certificates c. Wireless network access for personal devices and guest access should be segregated from the production network 25. Patching: Contractor shall evaluate, test, and apply information system patches in a timely fashion according to their risk. 26. Backup and Recovery: Contractor shall implement a backup and recovery process designed to ensure that data can be recovered in the event of unexpected loss. Protective Technology 27. Logging: Contractor shall ensure that security event logging requirements have been defined, and that all information systems are configured to meet logging requirements. 28. Intrusion Detection: Contractor shall deploy intrusion detection or prevention systems at the network perimeter. 29. URL Filtering: Contractor shall deploy tools to limit web browsing activity based on URL categories. 30. Denial of Service Protection: Contractor shall deploy controls to detect and mitigate denial of service attacks. Security Continuous Monitoring 31. Security Monitoring: Contractor shall deploy automated tools to collect, correlate, and analyze security event logs from multiple sources, and monitor them for suspected security incidents. 32. Vulnerability Assessments: Contractor shall conduct vulnerability assessments against all Internet -facing information systems on a regular basis, no less often than quarterly. 33. Penetration Testing: Contractor shall perform penetration tests on all web applications and services, in accordance with standard penetration testing methodologies, on a regular basis, no less often than annually. Information Security Incident Management 34. Incident Response: Contractor shall develop, implement, and maintain an information security incident response process, and will test the process on a regular basis, no less often than annually. TIS EXH—Security Requirements 02-2021 Page 3 of 3 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 Exhibit E Data Protection and Information Security This Data Protection and Information Security Exhibit ("Exhibit") is an attachment to the Agreement and sets forth the data protection and information security requirements of City of Tukwila. This Exhibit includes by reference the terms and conditions of the Agreement. In the event of any inconsistencies between this Exhibit and the Agreement, the parties agree that the terms and conditions of the Exhibit will prevail. Throughout the term of the Agreement and for as long as Contractor controls, possesses, stores, transmits, or processes Confidential Information as part of the Services provided to City of Tukwila, Contractor will comply with the requirements set forth in this Exhibit. Any breach of this Exhibit will be deemed a material breach under the Agreement. 1. Definitions "Authorized Personnel" for the purposes of this Exhibit, means Contractor's employees or subcontractors who: (i) have a need to receive or access Confidential Information or Personal Information to enable Contractor to perform its obligations under the Agreement; and (ii) are bound in writing with Contractor by confidentiality obligations sufficient for the protection of Confidential Information and Personal Information in accordance with the terms and conditions set forth in the Agreement and this Exhibit. "Common Software Vulnerabilities" (CSV) are application defects and errors that are commonly exploited in software. This includes but is not limited to: (i) The CWE/SANS Top 25 Programming Errors –see http://cwe.mitre.org/top25/ and httio://www.sans.ora/toiD25-software-errors/ (ii) The Open Web Application Security Project's (OWASP) "Top Ten Project" – see_ httio://www.owasip.org "Confidential Information" means certain non-public proprietary information that has economic value and is protected with reasonable safeguards to maintain its secrecy. Confidential Information may include, but is not limited to any financial data, business and other plans, specifications, equipment designs, electronic configurations, design information, product architecture algorithms, quality assurance plans, inventions (whether or not the subject of pending patent applications), ideas, discoveries, formulae, models, requirements, standards, trade and manufacturing secrets, drawings, samples, devices, demonstrations, technical information, all Personal Information as defined in RCW 42.56.590 that come within the Contractor's possession in the course of performance under this Agreement, as well as any and all intellectual and industrial property rights contained therein or in relation thereto; provided that, Personal Information shall remain Confidential Information even if at the time of disclosure or collection, or later, it is or becomes known to the public. "Industry Standards" mean generally recognized industry standards, best practices, and benchmarks including but not limited to: (i) Payment Card Industry Data Security Standards ("PCI DSS") – see httr)://www.i3cisecuritystandards.orci/ (ii) National Institute for Standards and Technology – see http://csrc.nist.gov/ (iii) ISO/ IEC 27000 -series –see http://www.iso27001 security.com/ TIS EXH—Data Protection and Info Security 02-2021 Page 1 of 10 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 (iv) COBIT 5 – http://www.isaca.orci/cobit/ (v) Cyber Security Framework– see http://www.nist.gov/cyberframework/ (vi) Cloud Security Alliance – see https://cloudsecurityalliance.org/ (vii) Other standards applicable to the services provided by Contractor to City of Tukwila "Information Protection Laws" mean all local, state, federal and international laws, standards, guidelines, policies, regulations and procedures applicable to Contractor or City of Tukwila pertaining to data security, confidentiality, privacy, and breach notification. "Personal Information" also known as Personally Identifiable Information (PII), is defined in RCW 42.56.590 and includes information of City of Tukwila customers, employees and subcontractors or their devices gathered or used by Contractor that can be used on its own or combined with other information to identify, contact, or locate a person, or to identify an individual or his or her device in context. Examples of Personal Information include name, social security number or national identifier, biometric records, driver's license number, device identifier, IP address, MAC address, either alone or when combined with other personal or identifying information which is linked or linkable to a specific individual or device, such as date and place of birth, mother's maiden name, etc. "Security Incident" is any actual or suspected occurrence of: (i) Unauthorized access, use, alteration, disclosure, loss, theft of, or destruction of Confidential Information or the systems / storage media containing Confidential Information (ii) Illicit or malicious code, phishing, spamming, spoofing (iii) Unauthorized use of, or unauthorized access to, Contractor's systems (iv) Inability to access Confidential Information or Contractor systems as a result of a Denial of Service (DOS) or Distributed Denial of Service (DDOS) attack (v) Loss of Confidential Information due to a breach of security "Security Vulnerability" is an application, operating system, or system flaw (including but not limited to associated process, computer, device, network, or software weakness) that can be exploited resulting in a Security Incident. 2. Roles of the Parties and Compliance with Information Protection Laws As between City of Tukwila and Contractor, City of Tukwila shall be the principal and Contractor shall be its agent with respect to the collection, use, processing and disclosure of all Confidential Information. The Parties shall comply with their respective obligations as the principal (e.g., data owner/controller/covered entity) and agent (e.g., data processor/business associate/trading partner) under all Information Protection Laws. The Parties acknowledge that, with respect to all Confidential Information processed by Contractor for the purpose of providing the Services under this Agreement: a. City of Tukwila shall determine the scope, purpose, and manner in which such Confidential Information may be accessed or processed by Contractor, and Contractor shall limit its access to or use of Confidential Information to that which is necessary to TIS EXH—Data Protection and Info Security 02-2021 Page 2 of 10 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 provide the Services, comply with applicable laws, or as otherwise directed by City of Tukwila, b. Each party shall be responsible for compliance with Information Protection Laws in accordance with their respective roles; and Contractor and City of Tukwila shall implement the technical and organizational measures specified in this Exhibit and any additional procedures agreed upon pursuant to a Statement of Work ("SOW') to protect Confidential Information against unauthorized use, destruction or loss, alteration, disclosure or access. 3. General Security Requirements Contractor will have an information security program that has been developed, implemented and maintained in accordance with Industry Standards. At a minimum, Contractor's information security program will include, but not be limited to, the following elements: 3.1 Information Security Program Management. Contractor will have or assign a qualified member of its workforce or commission a reputable third -party service provider to be responsible for the development, implementation and maintenance of Contractor's enterprise information security program. 32 Policies and Standards. To protect City of Tukwila Confidential Information, Contractor will implement and maintain reasonable security that complies with Information Protection Laws and meets data security Industry Standards. a Security Policies and Standards. Contractor will maintain formal written information security policies and standards that: 0 Define the administrative, physical, and technological controls to protect the confidentiality, integrity, and availability of Confidential Information, City of Tukwila systems, and Contractor systems (including mobile devices) used in providing Services to City of Tukwila (i) Encompasses secure access, retention, and transport of Confidential Information (i) Provide for disciplinary or legal action in the event of violation of policy by employees or Contractor subcontractors and vendors (Iv) Prevent unauthorized access to City of Tukwila data, City of Tukwila systems, and Contractor systems, including access by Contractor's terminated employees and subcontractors (v) Employ the requirements for assessment, monitoring and auditing procedures to ensure Contractor is compliant with the policies (v) Conduct an annual assessment of the policies, and upon City of Tukwila written request, provide attestation of compliance. b. In the SOW or other document, Contractor will identify to City of Tukwila all third -party vendors (including those providing subcontractors to Contractor) involved in the provision of the Services to City of Tukwila, and will specify those third -party vendors that will have access to Confidential Information. TIS EXH—Data Protection and Info Security 02-2021 Page 3 of 10 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 3.3 Security and Privacy Training. Maintain a security awareness program that includes at minimum, annual training. a.4 Access Control. Contractor will ensure that City of Tukwila Confidential Information will be accessible only by Authorized Personnel after appropriate user authentication and access controls (including but not limited to two -factor authentication) that satisfy the requirements of this Exhibit. Each Authorized Personnel shall have unique access credentials and shall receive training which includes a prohibition on sharing access credentials with any other person. Contractor should maintain access logs relevant to City of Tukwila Confidential Information for a minimum of six years or other mutually agreed upon duration. 3.5 Data Backup. The parties shall agree in an SOW or other document upon the categories of City of Tukwila Confidential Information that are required to be backed up by Contractor. Unless otherwise agreed to in writing by City of Tukwila, backups of City of Tukwila Confidential Information shall reside solely in the United States. For the orderly and timely recovery of Confidential Information in the event of a service interruption: a Contractor will store a backup of Confidential Information at a secure offsite facility and maintain a contemporaneous backup of Confidential Information on-site to meet needed data recovery time objectives. b. Contractor will encrypt and isolate all City of Tukwila backup data on portable media from any backup data of Contractor's other customers. 3.6 Business Continuity Planning (BCP) and Disaster Recovery (DR). Contractor will maintain an appropriate business continuity and disaster recovery plan to enable Contractor to adequately respond to, and recover from, business interruptions involving City of Tukwila Confidential Information or services provided by Contractor to City of Tukwila. a At a minimum, Contractor will test the BCP and DR plan annually, in accordance with Industry Standards, to ensure that the business interruption and disaster objectives set forth in this Exhibit have been met and will promptly remedy any failures. Upon City of Tukwila's request, Contractor will provide City of Tukwila with a written summary of the annual test results. b. In the event of a business interruption that activates the BCP and DR plan affecting the Services or Confidential Information of City of Tukwila, Contractor will notify City of Tukwila's designated Security Contact as soon as possible. c. Contractor will allow City of Tukwila or its authorized third party, upon a minimum of 30 days' notice to Contractor's designated Security Contact, to perform an assessment of Contractor's BCP and DR plan once annually, or more frequently if agreed to in an SOW or other document. Following notice provided by City of Tukwila, the parties will meet to determine the scope and timing of the assessment. TIS EXH—Data Protection and Info Security 02-2021 Page 4 of 10 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 3.7 Network Security. Contractor agrees to implement and maintain network security controls that conform to Industry Standards including but not limited to the following: a Firewalls. Contractor will utilize firewalls to manage and restrict inbound, outbound and internal network traffic to only the necessary hosts and network resources. b. Network Architecture. Contractor will appropriately segment its network to only allow authorized hosts and users to traverse areas of the network and access resources that are required for their job responsibilities. c Demilitarized Zone (DMZ). Contractor will ensure that publicly accessible servers are placed on a separate, isolated network segment typically referred to as the DMZ. d. Wireless Security. Contractor will ensure that its wireless network(s) only utilize strong encryption, such as WPA2. e. Intrusion Detection/Intrusion Prevention (IDS/IPS) System. Contractor will have an IDS and/or IPS in place to detect inappropriate, incorrect, or anomalous activity and determine whether Contractor's computer network and/or server(s) have experienced an unauthorized intrusion. a.8 Application and Software Security. Contractor, should it provide software applications or Software as a Service (SaaS) to City of Tukwila, agrees that its product(s) will remain secure from Software Vulnerabilities and, at a minimum, incorporate the following: a Malicious Code Protection. Contractor's software development processes and environment must protect against malicious code being introduced into its product(s) future releases and/or updates. b. Application Level Security. Contractor must use a reputable third party tool to conduct dynamic/static/manual application vulnerability scans on the application(s) software provided to City of Tukwila for each major code release or at the time of contract renewal. Contractor can provide executive summary of dynamic test results if requested by the City of Tukwila. Results of the application testing will be provided to City of Tukwila in a summary report and vulnerabilities categorized as Very High, High or that have been identified as part of the OWASP Top 10 and SANS Top 25 within 30 days of identification. c. Vulnerability Management. Contractor agrees at all times to provide, maintain and support its software and subsequent updates, upgrades, and bug fixes such that the software is and remains secure from Common Software Vulnerabilities. d. Logging. Contractor software that controls access to Confidential Information must log and track all access to the information. a Updates and Patches. Contractor agrees to promptly provide updates and patches to remediate Security Vulnerabilities that are exploitable. Upon City of Tukwila's request, Contractor shall provide information on remediation efforts of known Security Vulnerabilities. 3.9 Data Security. Contractor agrees to preserve the confidentiality, integrity and accessibility of City of Tukwila Confidential Information with administrative, technical and physical measures that conform to Industry Standards that Contractor then applies to its own systems and processing environment. Unless otherwise agreed to in writing by City of Tukwila, Contractor agrees that any and all City of Tukwila Confidential Information will be stored, processed, and maintained solely on designated systems located in the continental United States. Additionally: TIS EXH—Data Protection and Info Security 02-2021 Page 5 of 10 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 a Encryption. Contractor agrees that all City of Tukwila Confidential Information and Personal Information will be encrypted with a Federal Information Processing Standard (FIPS) compliant encryption product, also referred to as 140-2 compliant. Symmetric keys will be encrypted with a minimum of 128 -bit key and asymmetric encryption requires a minimum of 1024 bit key length. Encryption will be utilized in the following instances: • City of Tukwila Confidential Information and Personal Information will be stored on any portable computing device or any portable storage medium. • City of Tukwila Confidential Information and Personal Information will be transmitted or exchanged over a public network. b. Data Segregation. Contractor will segregate City of Tukwila Confidential Information and Personal Information from Contractor's data and from the data of Contractor's other customers or third parties. 3.10 Data Re -Use. Contractor agrees that any and all data exchanged shall be used expressly and solely for the purposes enumerated in the Agreement. Data shall not be distributed, repurposed or shared across other applications, environments, or business units of Contractor. Contractor further agrees that no Confidential Information of any kind shall be transmitted, exchanged or otherwise passed to other parties except on a case-by-case basis as specifically agreed to in writing by City of Tukwila. all Data Destruction and Data Retention. Upon expiration or termination of this Agreement or upon City of Tukwila's written request, Contractor and its Authorized Personnel will promptly return to City of Tukwila all City of Tukwila Confidential Information and/or securely destroy City of Tukwila Confidential Information. At a minimum, destruction of data activity is to be performed according to the standards enumerated by the National Institute of Standards, Guidelines for Media Sanitization – see httio://csrc.nist.gov/. If destroyed, an officer of Contractor must certify to City of Tukwila in writing within 10 business days all destruction of City of Tukwila Confidential Information. If Contractor is required to retain any City of Tukwila Confidential Information or metadata to comply with a legal requirement, Contractor shall provide notice to both the general notice contact in the Agreement as well as City of Tukwila's designated Security Contact. 3.12 Right to Audit. Upon a minimum of 30 days' written notice to Contractor, Contractor agrees to allow City of Tukwila or a mutually agreed upon independent third party under a Non - Disclosure Agreement to perform an audit of Contractor's policies, procedures, software, system(s), and data processing environment at City of Tukwila's expense to confirm compliance with this Exhibit. Prior to commencement of the audit, the parties will discuss the scope of the audit and the schedule. Contractor shall provide reasonable support to the audit team. Upon request Contractor will provide any relevant third party assessment reports such as SOC 2, PCI DSS Report on Compliance, or ISO 27001 certification. Unless critical issues are identified during the audit, such audits will be restricted to once in any 12 month period. If issues are identified, Contractor shall provide a remediation plan to City of Tukwila to remedy such issues at Contractor's expense. TIS EXH—Data Protection and Info Security 02-2021 Page 6 of 10 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 3.13 Security Testing. Contractor, at its expense, will allow City of Tukwila to conduct static, dynamic, automated, and/or manual security testing on its software products and/or services, hardware, devices, and systems to identify Security Vulnerabilities on an ongoing basis. Should any vulnerabilities be discovered, Contractor agrees to notify City of Tukwila and create a mutually agreed upon remediation plan to resolve all vulnerabilities identified. City of Tukwila has the right to request or conduct additional reasonable security testing throughout the Term of the Agreement. 4. Security Incident / Data Breach 4.1 Security Contact. The individuals identified below shall serve as each party's designated Security Contact for security issues under this Agreement. City of Tukwila Security Contact: Name Bao Trinh Address 6300 Southcenter Blvd 91 _ l ,i GT Email TISDepartment@TukwilaWA. Contractor Security Contact: Kristoffer von Bonsdorff Name Address 1152 15th street NW, suite 800 Washington, Dc 20005 1-800-314-0147 Phone Email legal@granicus.com TIS EXH—Data Protection and Info Security 02-2021 Page 7 of 10 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 4.2 Requirements. Contractor will take commercially reasonable actions to ensure that City of Tukwila is protected against any and all reasonably anticipated Security Incidents, including but not limited to: 0 Contractor's systems are continually monitored to detect evidence of a Security Incident (i) Contractor has a Security Incident response process to manage and to take corrective action for any suspected or realized Security Incident (i) Upon request Contractor will provide City of Tukwila with a copy of its Security Incident policies and procedures. If a Security Incident affecting City of Tukwila occurs, Contractor, at its expense and in accordance with applicable Information Protection Laws, will immediately take action to prevent the continuation of the Security Incident. 4.3 Notification. Within eight hours of Contractor's initial awareness of a Security Incident or other mutually agreed upon time period, Contractor will notify City of Tukwila of the incident by calling by phone the City of Tukwila Security Contact(s) listed above. 4.4 Investigation and Remediation. Upon Contractor's notification to City of Tukwila of a Security Incident, the parties will coordinate to investigate the Security Incident. Contractor shall be responsible for leading the investigation of the Security Incident, but shall cooperate with City of Tukwila to the extent City of Tukwila requires involvement in the investigation. Contractor shall involve law enforcement in the investigation if requested by City of Tukwila. Depending upon the type and scope of the Security Incident, City of Tukwila personnel may participate in: (i) interviews with Contractor's employees and subcontractors involved in the incident; and (ii) review of all relevant records, logs, files, reporting data, systems, Contractor devices, and other materials as otherwise required by City of Tukwila. Contractor will cooperate, at its expense, with City of Tukwila in any litigation or investigation deemed reasonably necessary by City of Tukwila to protect its rights relating to the use, disclosure, protection and maintenance of Confidential Information. Contractor will reimburse City of Tukwila for actual costs incurred by City of Tukwila in responding to, and mitigating damages caused by any Security Incident, including all costs of notice and remediation which City of Tukwila, in its sole discretion, deems necessary to protect such affected individuals in light of the risks posed by the Security Incident. Contractor will, at Contractor's own expense, provide City of Tukwila with all information necessary for City of Tukwila to comply with data breach recordkeeping, reporting and notification requirements pursuant to Information Protection Laws. Contractor will use reasonable efforts to prevent a recurrence of any such Security Incident. Additionally, Contractor will provide (or reimburse City of Tukwila) for at least one year of complimentary access for one credit monitoring service, credit protection service, credit fraud alert and/or similar services, which City of Tukwila deems necessary to protect affected individuals in light of risks posed by a Security Incident. 4.5 Reporting. Contractor will provide City of Tukwila with a final written incident report within five business days after resolution of a Security Incident or upon determination that the Security Incident cannot be sufficiently resolved. TIS EXH—Data Protection and Info Security 02-2021 Page 8 of 10 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 5. Confidential Information or Personal Information 5.1 Authorized Personnel. Contractor will require all Authorized Personnel to meet Contractor's obligations under the Agreement with respect to Confidential Information or Personal Information. Contractor will screen and evaluate all Authorized Personnel andwill provide appropriate privacy and security training, as set forth above, in order to meet Contractor's obligations under the Agreement. Upon City of Tukwila's written request, Contractor will provide City of Tukwila with a list of Authorized Personnel. Contractor will remain fully responsible for any act, error, or omission of its Authorized Personnel. 5.2 Handling of Confidential Information or Personal Information. Contractor will: a. Keep and maintain all Confidential Information and Personal Information in strict confidence in accordance with the terms of the Agreement b. Use and disclose Confidential Information and/or Personal Information solely and exclusively for the purpose for which the Confidential Information or Personal Information is provided pursuant to the terms and conditions of the Agreement. Contractor will not disclose Confidential Information or Personal Information to any person other than to Authorized Personnel without City of Tukwila's prior written consent, unless and to the extent required by applicable law, in which case, Contractor will use best efforts to notify City of Tukwila before any such disclosure or as soon thereafter as reasonably possible. In addition, Contractor will not produce any Confidential Information or Personal Information in response to a non -legally binding request for disclosure of such Personal Information. 5.3 Data and Privacy Protection Laws. Contractor represents and warrants that its collection, access, use, storage, disposal, and disclosure of Personal Information complies with all applicable federal, state, local and foreign data and privacy protection laws, as well as all other applicable regulations and directives. 6. Third Party Security 6.1 Contractor will conduct thorough background checks and due diligence on any third and fourth parties which materially impact Contractor's ability to provide the products and/or Services to City of Tukwila as described in the Agreement. 62 Contractor will not outsource any work related to its products or the Services provided to City of Tukwila in countries outside the United States of America, which have not been disclosed in the Agreement or without prior written approval from City of Tukwila Legal and Information Security. If Contractor desires to outsource certain work during the Term of the Agreement, Contractor shall first notify City of Tukwila so that the parties can ensure adequate security protections are in place with respect to the Services provided to City of Tukwila. TIS EXH—Data Protection and Info Security 02-2021 Page 9 of 10 Docusign Envelope ID: 9915DD1B-A15B-4AF9-91AC-D8EA56D92378 7. Payment Cardholder Data 7.1 If Contractor accesses, collects, processes, uses, stores, transmits, discloses, or disposes of City of Tukwila and/or City of Tukwila customer credit, debit, or other payment cardholder information, Contractor agrees to the following additional requirements: a Contractor, at its sole expense, will comply with the Payment Card Industry Data Security Standard ("PCI DSS"), as may be amended or changed from time to time, including without limitation, any and all payment card industry validation actions (e.g., third party assessments, self -assessments, security vulnerability scans, or any other actions identified by payment card companies for the purpose of validating Contractor's compliance with the PCI DSS). b. Contractor will maintain a continuous PCI DSS compliance program. Annually, Contractor agrees to provide evidence of PCI DSS compliance in the form of a Qualified Security Assessor ("QSK) Assessment Certificate, a PCI Report on Compliance ("ROC"), or evidence that Contractor is included on the Visa or MasterCard list of PCI DSS Validated Service Providers. a Contractor will ensure that subcontractors approved by City of Tukwila, in accordance with Section 6.2, comply with and maintain a continuous PCI DSS compliance program if the subcontractor provides any service on behalf of Contractor that falls within PCI DSS scope. The Subcontractor must provide evidence of PCI DSS compliance in the form of a Qualified Security Assessor ("QSA") Assessment Certificate, a PCI Report on Compliance ("ROC"), or evidence that Subcontractor is included on the Visa or MasterCard list of PCI DSS Validated Service Providers. d Contractor will immediately notify City of Tukwila if Contractor is found to be non- compliant with a PCI DSS requirement or if there is any breach of cardholder data impacting City of Tukwila or its customers. 8. Changes In the event of any change in City of Tukwila's data protection or privacy obligations due to legislative or regulatory actions, industry standards, technology advances, or contractual obligations, Contractor will work in good faith with City of Tukwila to promptly amend this Exhibit accordingly. TIS EXH—Data Protection and Info Security 02-2021 Page 10 of 10