17-024 Arctic Wolf Networks, Cyber Security Operations Centre (SOC) ServiceAGREEMENT BETWEEN THE CITY OF CUPERTINO AND
ARCTIC WOLF NETWORKS FOR
CYBER SECURITY OPERA TIO NS CENTRE ("SOC") SERVICE
THIS AGREEMENT, is entered into this ib.fl day of February 2017 , by and
between the CITY OF CUPERTINO , a California municipal corporation ("City"), and
ARCTIC WOLF NETWORKS, a v .2\ww.t., corporation whose address is 440 N.
Wolfe Road , Sunnyvale , CA 94085 (hereinafter referred to as "Consultant") (collectively
referred to as the "Parties").
RECITALS :
A. City is a municipal corporation duly organized and validly existing under
the laws of the State of California with the power to carry on its business as it is now
being conducted under the Constitution and the statutes of the State of California and the
Cupertino Municipal Code .
B . Consultant is specially trained , experienced and competent to perform the
special services which will be required by this Agreement.
C . Consultant possesses the skill , experience , ability , background ,
certification and knowl edge to pro vid e the services describ ed in thi s Ag r eement on the
terms and conditions described herein .
D . City and Consultant desire to enter into an agreement for internet/website
security information management (SIM) and security eve nt management (S EM)
pertaining to City 's online systems. Through this Agreement, Consultant shall provide to
City real-time analysis of security alerts generated by the City 's network hardware and
applications , including continuous monitoring , anal ysis and correlations of events , logs
and user information relating to the City 's network. The full scope of services covered by
this agreement is described in the attached Appendix A : Service Level Agreement 1.2.
NOW, THEREFORE , the Parties mutually agree as follows:
I. TERM
The term of this Agreement shall commence on February ;2..8, 2017. The term of
this Agreement is 24 months, unless the Agreement is terminated prior thereto under the
provisions of Section 20 , below.
2 . SERVICES TO BE PERFORMED AND CONDITIONS THEREOF
Consultant shall perform each and every service to the schedule of performance
set forth in Appendix A: Service Level Agreement 1.2 (hereinafter "SLA "), attached
hereto and incorporated herein by this reference ( collectively "Services").
A. Services Provided and Equipment. A description of services provided by
Consultant is provided in the SLA. Consultant may ship to City certain equipment
that is necessary to provide the Services (the "Equipment"). City agrees to install
the Equipment at the location(s) and in the manner specified by Consultant and as
directed by Consultant. The Equipment is a part of the Service and loaned to City
by Consultant, no t sold. City acknowledges that any attempt to install or use the
Equipment at a location other than City Premises may result in failing of the
Page I of 16
Equipment to function properly. City agrees to return the Equipment to
Consultant in an undamaged condition, less ordinary wear and tear.
B. Registration. Prior to using the Services, City shall identify the administrative
users for its account ("Administrators"). Each Administrator will be provided an
administrator ID and password.
c. License Grant. Subject to the terms and conditions of this Agreement, City and
its Administrators may access and use the Services for internal business
operations and not for the benefit of any third party . In some cases , City may need
to download , install and operate software provided by Consultant in order to
access the Services (Such software shall be included in the term "Software" as
hereinafter defined) and Consultant licenses City to do so provided City uses the
Software only in object code form solely for the permitted purpose of accessing
the Services. Consultant may provide City with technical documentation for the
Services in hard copy form or online (hereinafter "Documentation"). City
acknowledges that integration between the Services and other Consultant software
may require upgrades to such other software , as such upgrades become available.
D. Reservation of Rights and Ownership. Consultant owns the Services, the
Software, the Documentation and any underlying infrastructure. City
acknowledges and agrees that (a) the Services, any Software and Documentation
are protected by United States and international copy right, trademark, patent,
trade secret and other intellectual property or proprietary rights laws , (b)
Consultant retains all right, title and interest (including, without limitation, all
patent, copyright, trade secret and other intellectual property rights) in and to the
Services, the Software, any Documentation, any other deliverables , any and all
related and underlying technology and any derivative works or modifications of
any of the foregoing , including , without limitation, as may incorporate
suggestions from City as contemplated by Section 11 below, (c) there are no
implied licenses and any rights not expressly granted to City hereunder are
reserved by Consultant, ( d) the Software and access to the Services are licensed
on a subscription basis, not sold, and City acquires no ownership or other interest
( other than the license rights expressly stated herein) in or to the Services , any
Software and Documentation and (e) the Services are offered as an on-line , hosted
solution, and that City has no right to obtain a copy of the Services.
E. Restrictions . City agrees not to , directly or indirectly: (i) modify , translate , copy
or create derivative works based on the Service or any element of the Software,
(ii) interfere with or disrupt the integrity or performance of the Services or the
data contained therein or block or disrupt any use or enjoyment of the Services by
any third party , (iii) attempt to gain unauthorized access to the Services or their
related systems or networks or (iv) remove or obscure any proprietary or other
notice contained in the Services, including on any reports or data printed from the
Services. City agrees to abide by the terms of Acceptable Use Policy in Appendix
B , attached hereto.
F. Responsibilities of Consultant. Consultant shall provide the CyberSOC
Managed Services as further described in the Service Level Agreement (SLA) in
Appendix A. The Services provided under this Agreement shall include (a) any
software, plug-ins or extensions related to the Services or upon which the
Services are based including any and all updates , upgrades , bug fixes , dot
Page 2 o f 16
releases , version upgrades or any similar changes that may be made available to
you from time to time (the "Software"), (b) the Documentation, (c) regular
maintenance of Consultant's system, and ( d) other technology , user interfaces ,
know-how and other trade secrets , techniques , designs , inventions , data , images,
text, content, APis , and tools provided in conjunction with the Services.
G. Responsibilities of City. City acknowledges and agrees that its Administrators
will be able to view all traffic and activities that occur on the City's network and
that it is responsible for all activities that occur under its Administrator accounts.
Administrator IDs are granted to individual , named persons and cannot be shared
or used by more than one Administrator but may be reassigned from time to time
to new Administrators replacing former Administrators who have terminated an
employment or some other prior relationship with City, changed job status or
function, or otherwise no longer require ongoing access to the Services. City shall
(i) obtain any licenses and /or consents necessary for Consultant to perform its
obligations under this Agreement, (ii) be responsible for ensuring the security and
confidentiality of all Administrator IDs and passwords, (iii) prevent unauthorized
access to, or use of, the Services , (iv) notify Consultant promptly of any
unauthorized use of the Services or any breach, or attempted breach, of security of
the Services and (v) not use the Services in a manner that would violate the laws
of the United States . Consultant shall notify City promptly of any breach of
security of the Services , Administrator accounts , passwords , or City data of which
it becomes aware .
H. Customer Data. City grants Consultant the right to store , process and retrieve
data that City transmits to it in connection with City 's use of the Services
("Customer Data"). City warrants that it has the necessary r ights to transfer
Customer Data to Consultant to process the Customer Data as contemplated by
the Services. City retains all rights to the Customer Data transmitted to the
Services and such Customer Data is protected by Consultant as described in
Section 10. Consultant may utilize the information obtained by the Services to (i)
maintain and improve the Services, (ii) comply with legal or contractual
requirements , (iii) statistically analyze anonymous aggregated information and
(iv) otherwise analyze the Services. City represents and warrants that: (i) it has all
rights , title , interest, licenses and consents , and has made any and all notices and
disclosures , necessary for the collection and provision to , and use by , Consultant
of all data provided or made available to Consultant for use in connection with
Consultant 's Platform ("Data") without violation of any law, rule or regulation
(including any privacy laws); and (ii) the Data does not include any social
security numbers , financial account numbers or other sensitive information. City
shall indemnify and hold Consultant harmless from any claim , loss , liability ,
damage, cost or expense (including reasonable attorneys fees) incurred by
Consultant arising out of or relating to any alleged breach of the foregoing or any
allegation that the Data is inaccurate or incomplete . Consultant shall indemnify
and hold City harmless from any claim, loss , liability , damage , cost or expense
(including reasonable attorney 's fees) incurred by City arising out of relating to
any negligent performance of this Agreement not related to inaccurate or
incomplete Data provided by the City .
Pa ge 3 o f 16
3 . COMPENSATION TO CONSULTANT
Consultant shall be compensated for services performed pursuant to this
Agreement in a total amount not to exceed forty-eight thousand dollars ($48 ,000 .00).
Consultant shall invoice City according to the following schedule of milestones/
deliverables:
$6 ,000 .00 (25% of initial year 's fees) upon execution of this Agreement by
the Parties ;
$6,000.00 (25% of initial year 's fees) upon demonstration of (a) Consultant's
installation and integration with City 's systems of all hardware and software
needed for the Services described herein and (b) commencement of service by
Consultant (presumed to be within thirty (30) days of acceptance of
Agreement by the Parties ;
$12 ,000.00 (balance of initial year 's fees) on the first day of the seventh
month of satisfactory performance under this Agreement;
$24 ,000 .00 (second year 's fees) on the first day of the thirteenth month of
satisfactory performance under this Agreement.
City shall return to Contractor any payment request determined not to be a proper
payment request as soon as practicable, but not later than seven (7) day s after receipt, and
shall explain in writing the reasons why the payment request is not proper.
4 . TIME IS OF THE ESSENCE
Consultant and City agree that time is of the essence regarding the performance of
this Agreement.
5 . STANDARD OF CARE
Consultant agrees to perform all services required by this Agreement in a manner
commensurate with the prevailing standards of like professional s in the San Francisco
Bay Area and agrees that all services shall be performed by qualified and experienced
personnel who are not employed by the City nor have any contractual relationship with
City .
6. INDEPENDENT PARTIES
City and Consultant intend that the relationship between them created by this
Agreement is that of independent contractor. The manner and means of conducting the
work are under the control of Consultant, except to the extent they are limited by statute,
rule or regulation and the express terms of this Agreement. No civil service status or
other right of employment will be acquired by virtue of Consultant's services. None of
the benefits provided by City to its employees , including but not limited to ,
unemployment insurance , workers' compensation plans, vacation and sick leave are
available from City to Consultant, its employees or agents. Deductions shall not be made
for any state or federal taxes , FICA payments, PERS pay ments , or other purposes
normally associated with an employer-employee relationship from any fees due
Consultant. Pay ments of the above items , if required , are the responsibility of
Consultant.
7. IMMIGRATION REFORM AND CONTROL ACT (IRCA)
Consultant assumes any and all responsibility for verifying the identity and
Page 4 of 16
employment authorization of all of his/her employees performing work hereunder,
pursuant to all applicable IRCA or other federal , or state rules and regulations.
Consultant shall indemnify and hold City harmless from and against any loss , damage,
liability, costs or expenses arising from any noncompliance of this provision by
Consultant.
8. NON-DISCRIMINATION
Consistent with City's policy prohibiting harassment and discrimination,
Consultant agrees that neither it nor its employee or subcontractors shall harass or
discriminate against a job applicant, a City employee , or a citizen on the basis of race ,
religious creed , color, national origin, ancestry, handicap , disability , marital status ,
pregnancy , sex, age , sexual orientation, or any other protected class status. Consultant
agrees that any and all violations of this provision shall constitute a material breach of
this Agreement.
9. INTELLECTUAL PROPERTY INDEMNIFICATION
Consultant agrees to , at its expense , defend and/or settle any claim made by a
third party against City alleging that the Platform infringes such third party 's United
States patent, copyright, trademark or trade secret (an "IP Claim"), and pay those
amounts finall y awarded by a court of competent jurisdiction against City (including
damages , interest, losses , costs and expenses including attorneys' fees) or payable
pursuant to a settlement agreed to Consultant with respect to such IP Claim, provided that
City provides Consultant with (i) prompt written notice of the IP Claim , except that any
failure to provide this notice promptly onl y relieves Consultant of its responsibility
pursuant to this Section 11 to the extent its defense is materially prejudiced by the delay ,
(ii) sole control over the defense and settlement of the IP Claim , provided that Consultant
will not admit fault by City or agree to any settlement that would impose obligations or
restrictions on City ( other than payment of sums which would be paid by Consultant
under this Section 11) without City 's prior written consent, not to be unreasonably
withheld , delayed or conditioned ; and (iii) all assistance, information and authority
reasonably requested by Consultant for the defense and/or settlement of the IP Claim.
Consultant shall have no obligation with respect to any claim arising out of or relating to:
(x) any unauthorized use , distribution or display of the Platform; (y) any modifications to
the Platform not authorized or made by Consultant or its subcontractors under this
Agreement; or (z) any combination of the Platform with any third party hardware,
software , service or technology if such claim would not have arisen but for such
combination. If Consultant, in its sole discretion, believes an IP Claim or an adverse
judgment in connection with an IP Claim is likely , then Consultant may , at its expense ,
(a) obtain a license from such third party claimant that allows for continued operation of
the Platform , (b) modify the Platform so as to be non-infringing, or (c) if neither (a) nor
(b) is available to Consultant at a commercially reasonable terms , terminate this
Agreement upon written notice to City. This Section 11 sets forth the entire liability of
Consultant and the sole and exclusive remedy of City in the event of any IP Claim
brought against City.
Page 5 of 16
10. HOLD HARMLESS
Standard Indemnification:
Consultant shall , to the fullest extent allowed by law and without limitation of the
provisions of this Agreement related to insurance, with respect to all services performed
in connection with the Agreement, indemnify , defend , and hold harmless the City and its
officers , officials, agents , employees and volunteers from and against any and all liability ,
claims, actions , causes of action or demands whatsoever against any of them, including
any injury to or death of any person or damage to property or other liability of any nature ,
whether physical, emotional, consequential or otherwise, arising out , pertaining to , or
related to the performance of this Agreement by Consultant or Consultant's employees,
officers, officials, agents or independent contractors. Such costs and expenses shall
include reasonable attorneys' fees of counsel of City 's choice , expert fees and all other
costs and fees of litigation. The acceptance of the Services by City shall not operate as a
waiver of the right of indemnification. The provisions of this Section survive the
completion of the Services or termination of this Contract.
11. INSURANCE :
A. General Requirements. On or before the commencement of the term of this
Agreement, Consultant shall furnish City with certificates showing the type , amount ,
class of operations covered, effective dates and dates of expiration of insurance coverage
in compliance with the requirements listed in Exhibit "C". Such certificates , which do
not limit Consultant's indemnification , shall also contain substantially the following
statement: "Should any of the above insurance covered by this certificate be canceled or
co verage reduced before the expiration date thereof, the insurer affording coverage shall
provide thirty (30) days' advance written notice to the City of Cupertino by certified mail ,
Attention : City Manager." Consultant shall maintain in force at all times during the
performance of this Agreement all appropriate coverage of insurance required by this
Agreement with an insurance company that is acceptable to City and licensed to do
insurance business in the State of California . Endorsements naming the City as
additional insured shall be submitted with the insurance certificates.
B. Subrogation Waiver. Consultant agrees that in the event of loss due to any
of the perils for which it has agreed to provide comprehensive general and automotive
liability insurance , Consultant shall look solely to its insurance for recovery. Consultant
hereby grants to City , on behalf of any insurer providing comprehensive general and
automotive liability insurance to either Consultant or City with respect to the services of
Consultant herein, a waiver of any right to subrogation which any such insurer of said
Consultant may acquire against City by virtue of the payment of any loss under such
msurance .
C. Failure to secure or maintain insurance. If Consultant at any time during
the term hereof should fail to secure or maintain the foregoing insurance , City shall be
permitted to obtain such insurance in the Consultant's name or as an agent of the
Consultant and shall be compensated by the Consultant for the costs of the insurance
premiums at the maximum rate permitted by law and computed from the date written
notice is received that the premiums have not been paid.
D. Additional Insured. City , its City Council , boards and commissions ,
officers , emplo yees and volunteers shall be named as an additional insured under all
Page 6 of 16
insurance coverages, except any professional liability insurance, required by this
Agreement. The naming of an additional insured shall not affect any recovery to which
such additional insured would be entitled under this policy if not named as such
additional insured. An additional insured named herein shall not be held liable for any
premium, deductible portion of any loss , or expense of any nature on this policy or any
extension thereof. Any other insurance held by an additional insured shall not be
required to contribute anything toward any loss or expense covered by the insurance
provided by this policy.
E. Sufficiency of Insurance. The insurance limits required by City are not
represented as being sufficient to protect Consultant. Consultant is advised to confer with
Consultant's insurance broker to determine adequate coverage for Consultant.
F. Maximum Coverage and Limits. It shall be a requirement under this
Agreement that any available insurance proceeds broader than or in excess of the
specified minimum insurance coverage requirements and/or limits shall be available to
the additional insured City. Furthermore, the requirements for coverage and limits shall
be the minimum coverage and limits specified in this Agreement, or the broader coverage
and maximum limits of coverage of any insurance policy or proceeds available to the
named insured , whichever is greater.
12 . CONFLICT OF INTEREST
Consultant warrants that it presently has no interest, and will not acquire any
interest, direct or indirect, financial or otherwise , that would conflict in any way with the
performance of this Agreement, and that it will not employ any person having such an
interest. Consultant agrees to advise City immediately if any conflict arises and
understands that it may be required to fill out a conflict of interest form if the services
prov ided under this Agreement require Consultant to make certain governmental
decisions or serve in a staff capacity as defined in Title 2 , Division 6 , Section 18700 of
the California Code of Regulations .
13. PROHIBITION AGAINST TRANSFERS
Consultant shall not assign, sublease , hypothecate , or transfer this Agreement, or
any interest therein, directly or indirectly, by operation of law or otherwise, without prior
written consent of City. Such consent to assignment shall not be unreasonably withheld
by. Any assignee shall be competent to perform the obligations under this agreement.,
However, claims for money by Consultant from City under this Agreement may be
assigned to a bank , trust company or other financial institution without prior written
consent. Written notice of such assignment shall be promptly furnished to City by
Consultant.
14. PERMITS AND LICENSES
Consultant, at its sole expense, shall obtain and maintain during the term of this
Agreement all appropriate permits, certificates and licenses including , but not limited to ,
a City Business License , that may be required in connection with the performance of
services hereunder.
15. REPORTS
A. Each and every report, draft, work product, map, record and other
Pa ge 7 of 16
document, hereinafter collectively refe1Ted to as "Report", reproduced, prepared or
caused to be prepared by Consultant pursuant to or in connection with this Agreement,
shall be the exclusive property of City . Consultant shall not copyright any Report
required by this Agreement and shall execute appropriate documents to assign to City the
copyright to Reports created pursuant to this Agreement. Any Report, information and
data acquired or required by this Agreement shall become the property of City, and all
publication rights are reserved to City. Consultant may retain a copy of any report
furnished to the City pursuant to this Agreement.
B . All Reports prepared by Consultant may be used by City in execution or
implementation of: (1) The original Project for which Consultant was hired; (2)
Completion of the original Project by others; (3) Subsequent additions to the original
project; and/or ( 4) Other City projects as City deems appropriate.
C . Consultant shall , at such time and in such form as City may require,
furnish reports concerning the status of services required under this Agreement.
D. All Reports required to be provided by this Agreement shall be printed on
recycled paper. All Reports shall be copied on both sides of the paper except for one
original , which shall be single sided.
E. No Report, information or other data given to or prepared or assembled by
Consultant pursuant to this Agreement shall be made available to any individual or
organization by Consultant without prior approval by City.
16 . RECORDS
Consultant shall maintain internal records reflecting that the Services were
performed by Consultant hereunder in accordance with customary recordkeeping
practices in the software development industry. Consultant shall provide free access to
such records to the representatives of City or its designee 's at all reasonable and proper
times, and gives City the right to examine and audit same, and to make transcripts
therefrom as necessary . No such examination and audit shall give City the right to access
records relating to other Consultant customers. Such records shall be maintained for a
period of three (3) years after Consultant receives final payment from City for all services
required under this agreement.
17. NONAPPROPRIATION
This Agreement is subject to the fiscal provisions of the Cupertino Municipal
Code and Agreement will terminate without any penalty (a) at the end of any fiscal year
in the event that funds are not appropriated for the following fiscal year, or (b) at any
time within a fiscal year in the event that funds are only appropriated for a portion of the
fiscal year and funds for this Agreement are no longer available . This Section shall take
precedence in the event of a conflict with any other covenant, term, condition, or
provision of this Agreement.
18. ENVIRONMENTALLY PREFERABLE PURCHASING
Consultant shall comply with the City 's Environmentally Preferable Procurement
Policy whenever practicable in completing any work under this agreement, including but
not limited to:
• Using paper products made with recycled content and recycled/
Page 8 of 16
remanufactured toner and ink jet cartridges ;
• Printing with soy or low volatile organic compounds (VOC) inks;
• Using energy-star compliant equipment;
• Using cleansers and working with janitorial contractors to meet Green Seal 's
Industrial and Institutional Cleaners Standard; and
• Ordering supplies electronically and practicing other internal waste reduction
and reuse protocols.
19. NOTICES
All notices, demands , requests or approvals to be given under this Agreement
shall be given in writing and conclusively shall be deemed served when delivered
personally or on the second business day after the deposit thereof in the United States
Mail , postage prepaid , registered or certified , addressed as hereinafter provided.
All notices , demands , requests , or approvals shall be addressed as follows:
TO CITY:
City of Cupertino
10300 Torre Ave .
Cupertino CA 95014
Attention: William Mitchell
TO CONSUL TANT:
Arctic WolfNetworks
440 N. Wolfe Road
Sunnyvale, CA 94085 \r
Attention : ')4-\v (.\..!l}t-®, c-.rv~c.,IJi) -,. ,.,u_,
20 . TERMINATION
In the event Consultant fails or refuses to perform any of the provisions hereof at
the time and in the manner required hereunder , Consultant shall be deemed in default in
the performance of this Agreement. If Consultant fails to cure the default within the time
specified and according to the requirements set forth in City 's written notice of default ,
and in addition to any other remedy available to the City by law, the City Manager may
terminate the Agreement by giving Consultant written notice thereof, which shall be
effective immediately. The City Manager shall also have the option, at its sole discretion
and without cause, of terminating this Agreement by giving seven (7) calendar days' prior
written notice to Consultant as provided herein. Upon receipt of any notice of
termination , Consultant shall immediately discontinue performance.
City shall pay Consultant for services satisfactorily performed up to the effective
date of termination. In such event, a calculation of the amounts due shall be deemed
correct as computed on a pro rata basis with compensation provided for the period of
service paid as a percentage of the total contract amount. If the termination if for cause,
City may deduct from such payment the amount of actual damage , if any , sustained by
City due to Consultant's failure to perform its material obligations under this Agreement.
Upon termination , Consultant shall immediately deliver to the City any and all copies of
studies , sketches , drawings , computations , and other material or products , whether or not
Pa ge 9 of 16
completed, prepared by Consultant or given to Consultant, m connection with this
Agreement. Such materials shall become the property of City.
21 . CONFIDENTIALITY
Either party ( as a "Discloser") may disclose confidential and proprietary
information, orally or in writing ("Confidential Info1mation") to the other party (as a
"Recipient"). All such information shall be marked with a restrictive legend of the
Discloser or, if disclosed orally, it shall be identified as confidential at the time of
disclosure and summarized in writing within 30 days in order to be protected hereunder.
Notwithstanding the foregoing marking requirements, Consultant acknowledges that
Customer Data and any data that Consultant collects from City in the course of providing
the Services is City 's Confidential Information and is therefore protected as such under
this Section. Notwithstanding the marking requirements of this section, City
acknowledges that the following constitutes Confidential Information of Consultant: any
trade secrets, know-how, inventions (whether or not patentable), techniques , ideas, or
processes related to the Services; the Software; the design and architecture of the
Services; the computer code, internal documentation, and design and functional
specifications of the Services; and any problem reports , analysis and performance
information related to the Services. Each party agrees to hold the other party 's
Confidential Information in strict confidence , not to disclose such Confidential
Information to third parties not authorized by the Discloser to receive such Confidential
Information, and not to use such Confidential Information for any purpose except as
expressly permitted hereunder. Each party agrees to take commercially reasonable steps
to protect the other party's Confidential Information and to ensure that such Confidential
Information is not disclosed , distributed or used in violation of the provisions of this
Agreement. The Recipient may disclose Confidential Information only (a) with the
Discloser 's prior written consent and (b) to those employees , officers and directors with a
clear and well-defined "need to know" purpose who are informed of and bound by the
obligations of this Agreement. Notwithstanding the foregoing , the Recipient may disclose
Confidential Information to the extent required by law. However, the Recipient will give
the Discloser prompt notice to allow the Discloser a reasonable opportunity to obtain a
protective order and such Confidential Information disclosed to the extent required by
law shall otherwise remain confidential and subject to the protections and obligations of
this Agreement. The Discloser agrees that the foregoing obligations shall not apply with
respect to any information that the Recipient can document (i) is rightfully in its
possession or known to it prior to receipt from the Discloser, (ii) is or has become public
knowledge through no fault of the Recipient, (iii) is rightfully obtained by the Recipient
from a third party without breach of any confidentiality obligation or (iv) is
independently developed by employees of the Recipient who had no access to Discloser's
Confidential Information. Upon expiration or termination of this Agreement for any
reason, each party shall promptly return to the other party or destroy all copies of the
other party's Confidential Information and copies , notes or other derivative material
relating to the Confidential Information.
22. SUGGESTIONS
City agrees that Consultant, in its sole discretion, may use or incorporate into the
Services or the Software any suggestions , ideas , enhancement requests , feedback,
Pa ge 10 of 16
recommendations or other info1mation prov id ed by C ity or its Administrators or other
personnel relating to the Services or the Software. Any such suggestions shall not be
deemed to constitute Confidential Information or to impose any confidentiality
obligations on Consultant. City hereby grants to Consultant and its assigns a royalty-free ,
worldwide , perpetual , irrevocable , full y transferable and sublicenseable right and license
to use, disclose , reproduce , modify , create derivative works from , distribute , display or
otherwise distribute and exploit any such suggestions as Consultant sees fit , entirely
without obligation or restriction of any kind on account of intellectual property rights or
otherwise.
23. WARRANTY AND WARRANTY DISCLAIMER
Consultant warrants that, (i) the services shall be provided in a diligent,
professional, and workmanlike manner in accordance with industry standards , (ii) the
services prov ided under this agreement do not infringe or misappropriate any intellectual
property rights of any third party , and (iii) the services shall substantially perform in all
material respects as described in the SLA in the event of any breach of section (iii),
above , Consultant shall , as its sole liability and your sole remedy , repair or replace the
services that are subject to the warranty claim at no cost to City or if Consultant is unable
to repair or replace , then it will refund any pre-paid fee s for services not rendered.
Except for the warranty described in this section , the serv ices are provided without
warranty of any kind , express or implied including, but no t limited to , the implied
warranties or conditions of design, merchantability , fitness for a particular purpose, and
any warranties of title and non-infringement. y ou acknowledge that the services are
provided "as is " and further acknowledge that Consultant does not warrant that (a) the
operation of the service s w ill be uninte rrupted , or error fre e , (b) the services are not
vulnerable to fraud or unauthorized use or ( c) the features or functionalities of the
serv ices w ill be available at any time in the futur e. City is responsible and Consultant
shall have no responsibility for determining that City 's proposed use of the services
complies with applicable laws in its jurisdiction(s).
24 . COMPLIANCE
Consultant shall comply with all state or federal laws and all ordinances, rules ,
policies and regulations enacted or issued by City .
25. CONFLICTOFLAW
This A greement shall be interpreted under, and enforced by the laws of the State
of California excepting any choice of law rules which may direct the application of laws
of another jurisdiction . The Agreement and obligations of the parties are subject to all
valid laws , orders , rules , and regulations of the authorities having jurisdiction over this
Agreement (or the successors of those authorities). Any suits brought pursuant to this
Agreement shall be filed with the Superior Court for the County o f Santa Clara, State of
California.
26 . ADVERTISEMENT
Consultant shall not post, exhibit, display or allo w to be posted , exhibited,
displayed any signs , advertising , show bills , lithographs , posters or cards of any kind
pertaining to the serv ice s performed und er this A greem ent unles s prior written appro val
Page I I of 16
has been secured from City to do otherwise.
27. WAIVER
A waiver by City of any breach of any term, covenant, or condition contained
herein shall not be deemed to be a waiver of any subsequent breach of the same or any
other term, covenant, or condition contained herein, whether of the same or a different
character.
28. INTEGRATED CONTRACT
This Agreement represents the full and complete understanding of every kind or
nature whatsoever between the Parties , and all preliminary negotiations and agreements
of whatsoever kind or nature are merged herein. No verbal agreement or implied
covenant shall be held to vary the provisions hereof. Any modification of this Agreement
will be effective only by written execution signed by both City and Consultant.
29. AUTHORITY
The individual(s) executing this Agreement represent and warrant that they have
the legal capacity and authority to do so on behalf of their respective legal entities.
30 . INSERTED PROVISIONS
Each provision and clause required by law to be inserted into the Agreement shall
be deemed to be enacted herein, and the Agreement shall be read and enforced as though
each were included herein. If through mistake or otherwise, any such provision is not
inserted or is not correctly inserted , the Agreement shall be amended to make such
insertion on application by either party .
31. CAPTIONS AND TERMS
The captions in this Agreement are for convenience only , are not a part of the
Agreement and in no way affect, limit or amplify the terms or provisions of this
Agreement. All unchecked boxes do not apply to this Agreement.
IN WITNESS WHEREOF, the parties have caused the Agreement to be executed.
CONSULTANT ::ct~e~
Title r3.t Ct.. D
Date t \~ W{)
I
CITY OF CUPERTINO
A Municipal Corporation
By~~
Title e;-eJ
Date 2 /; r /l~/i1-
o Over $175 ,000-Co uncil Approval Required
C8l Over $45,000-Department Head Approval Required
D Up to $45 ,000-Designated Supervisor Approval Required
Pa ge 12 of 16
RECOMMENDED FOR APPROVAL
Name, Title
APPROVED AS TO FORM :
~ ~ City Attorney
ATTEST: ~
~ rJ.t
City Clerk J-{ -(1
Exhibits:
Appendix A: Service Level Agreement 1.2
Appendix B : Acceptable Use Policy 1.2
Appendix C: Insurance Requirements and Proof oflnsurance
Pa ge 13 of 16
Contract No. ----
Appendix A : Service Level Agreement 1.2
This is a Service Level Agreement (SLA) between Arctic Wolf Networks, Inc. ("Arctic Wolf") and Customer for Arctic
Wolf's Cyber SOC Service. Specific services are identified in the Order Form at the time of purchase . CyberSOC is
a premium service that includes detecting breaches , vulnerabilities , misuse , misappropriation, and any threat or
exposure to an organizations Network or Information Technology (IT) infrastructure . Specific services provided as
part of CyberSOC include : collecting data from Arctic Wolf Sensors and logs from customer's systems , analysis of
both sensor and log data , correlation of customer data with threat and vulnerability information , analysis of data by
Arctic Wolf Security Engineers, scanning of internal and external systems , escalation of security events that need
attention by the customer, recommendations to improve security robustness , and regular summary reports.
Sensors from Arctic Wolf are deployed to monitor system traffic . Sensor data is augmented with additional sources of
log data as required to deliver the service. Collecting any particular log format is dependent on Arctic Wolf's then
current support for that log format. Customer must provide appropriate security credentials for the data sources
collected as part of the service . Arctic Wolf collects this data through a secure tunnel into our cloud service where the
data is analyzed . Arctic Wolf keeps this data for 90 days (or longer) as required to perform its services. Customer can
pay additional fees for storing data longer than 90 days . This data is correlated , analyzed , and examined by our
Security Engineers daily.
Arctic Wolf cloud services are redundant with back-up services to minimize service interruptions. Hosting providers
for Arctic Wolf cloud services may experience service interruptions and service outages outside the control of Arctic
Wolf . If hosting provider issues impact security-monitoring service , Arctic Wolf will promptly notify customer about
outage and planned recovery time .
Automated maintenance and update cycles do not require customer participation . Any replacement or upgrades of
sensors are the responsibility of Arctic Wolf.
Security Engineers are available 8 AM to 5 PM ("Business Hours") in the customer 's time zone Monday through
Friday. Customers can schedule specific activities with their Security Engineer outside those hours by contacting
Arctic Wolf at support@arcticwolf.com. Arctic Wolf will acknowledge any ticket submitted to support@arcticwolf.com
within 1 Business Hour and will respond or provide an estimate of response determined by scope, size , and urgency.
Tickets submitted outside of normal work hours will be acknowledged within 1 hour of the next Business Day.
Security Incidents identified by Arctic Wolf to be Emergency will be escalated to the customer 24x7 within 30 minutes
of discovery. The Customer and Arctic Wolf will need to define what constitutes an Emergency Incident but will
typically include Ransomware.
Any Emergency tickets should be escalated to Arctic Wolf by calling 855-785-0022 . The Customer should state this
is an emergency and Arctic Wolf will respond within 5 minutes 24x7.
Arctic Wolf will notify and escalate to customer any security events in a timely manner but no more than 2 hours after
discovery. Typical notification is through e-mail by a trouble ticket but customer can request special notification
through phone or other means if supported. Arctic Wolf and customer will agree on notification and escalation of
security incidents . Notifications will include a description of the security event , the level of exposure , and a suggested
remediation strategy. Customers can request validation that any fixes the Customer has implemented are working as
expected.
On a monthly basis, vulnerability assessment scans are run . Vulnerability and exploit information is normalized and
correlated with other data sources to determine security risk profiles and prioritization . Arctic Wolf will deliver a
summary security report including event and incident notification activity to Customer typically monthly or quarterly as
desired by Customer, but no more than weekly .
CyberSOC also includes ad hoc requests for Information to Security Engineers . Ad hoc request response will be as
timely as possible given the scope and definition of the request and availability of data and tools .
What services are NOT included?
The remediation of security event issues , re-imaging systems or changing policy settings is outside the scope of this
service .
14
Contract No. ----
Appendix B : Acceptable Use Policy 1.2
Many companies use Arctic Wolf services to identify security risks of plausible concern and we are proud of the trust
you have placed in us . In exchange , we trust you will use our services responsibly.
You agree to not misuse Arctic Wolf services ("Services"). For example , you must not , and must not attempt to do the
following :
• Probe , scan, or test the vulnerability of any sensor , system or network ;
• Breach or otherwise circumvent any security or authentication measures ;
• Access , tamper with, or use non-public areas or parts of the Services , or shared areas of the Services you
haven 't been invited to ;
• Interfere with or disrupt any user, host , or network , for example by send ing a virus , overloading , flooding,
spamming , or mail-bombing any part of the Services ;
• Access or search the Services by any means other t han our publ icly supported interfaces (for example,
"scraping ");
• Restrict, inhibit, interfere w ith , or otherwise disrupt or cause a performance degradation to the Services , or
otherwise cause a performance degradation to any Arct ic Wolf (or A rct ic Wolf supplier) facil ities used to
deliver the Services ;
• Alter , modify, or tamper with t he Services or pe rmi t any other person to do the same who is not authorized
by Arctic Wolf ;
• Prov ide guidance , info rmation or assistance w ith respect to causing damage or secur it y breach to Arct ic
Wol f's netwo rk or systems.
ARCTIC WOLF RESERVES THE RIGHT TO NOTIFY ITS SUBSCRIBERS OF ANY INFORMATION THAT
AFFECTS THE SECURITY OF ARCTIC WOLF'S PRODUCTS OR SERVICES .
15
Contract No . ---
Exhibit C
Insurance Requirements and Proof of Insurance
Proof of insurance coverage described below is attached to this Exhibit, with City named as
additional insured.
Consultant shall maintain the following minimum insurance coverage:
A. COVERAGE:
(I) Workers' Compensation:
Statuto1y coverage as required by the State of California.
(2) Liability:
Commercial general liability coverage in the following minimum limits:
Bodily Injury: $500,000 each occurrence
$1,000 ,000 aggregate -all other
Property Damage: $100,000 each occurrence
$250 ,000 aggregate
If submitted, combined single limit policy with aggregate limits in the amounts
of $1,000 ,000 wi ll be considered equivalent to the required minimum lim it s
shown above.
16