Loading...
HomeMy WebLinkAboutItem 15 - Agreement for Manage Detection and Response ServicesInformation Technology www.santa-ana.org/IT Item # 15 o`7, City of Santa Ana 20 Civic Center Plaza, Santa Ana, CA 92701 Staff Report April 15, 2025 TOPIC: Managed Detection and Response (MDR) Services AGENDA TITLE Agreement with eSentire, Inc. for Managed Detection and Response (MDR) Services (Specification No. 25-028) (Non -General Fund) RECOMMENDED ACTION Authorize the City Manager to execute an agreement with eSentire, Inc. to provide Managed Detection and Response (MDR) Services in an amount not to exceed $592,433, plus a 10% contingency of $59,243 totaling $651,676, for a term beginning April 15, 2025 and expiring April 14, 2028 (Agreement No. A-2025-XXX). GOVERNMENT CODE 484308 APPLIES: No DISCUSSION The City of Santa Ana depends on a robust cybersecurity infrastructure to safeguard its digital assets, sensitive data, and critical public services. With the increasing sophistication and frequency of cyber threats, traditional security measures are no longer sufficient to mitigate risks effectively. Cyberattacks such as ransomware, phishing, and zero -day vulnerabilities pose a significant threat to the City's operations and public trust. Managed Detection and Response (MDR) services are proactive cybersecurity solutions that provide 24/7 monitoring, threat detection, and incident response capabilities. MDR services leverage advanced threat intelligence, behavioral analysis, and artificial intelligence to identify and neutralize cyber threats before they can cause damage. By implementing MDR services, the City will strengthen its ability to detect, analyze, and respond to security incidents in real time, reducing the risk of operational disruptions and data breaches. The MDR service will integrate seamlessly with the City's existing cybersecurity infrastructure, protecting its framework through continuous threat hunting, automated remediation, and expert -led investigations. Additionally, MDR services will ensure Managed Detection and Response (MDR) Service April 15, 2025 Page 2 compliance with cybersecurity regulations and industry best practices, maintaining the City's resilience against evolving threats. As the City grows and its digital infrastructure expands, cybersecurity demands will rise. To meet these increasing needs, incorporating contingency is essential. Scalable MDR services will enable the City to protect larger data volumes, secure new systems, and adapt to emerging threats without costly overhauls, ensuring long-term resilience and the uninterrupted protection of critical operations. Santa Ana City Ordinance No. NS-3041 authorizes the City to purchase against contracts from any public agency utilizing a competitive bid process. The City of Moreno Valley awarded a contract to eSentire, Inc. (Exhibit 1) for cybersecurity services as a result of open, competitive bidding. Staff researched available procurement options and determined that eSentire, Inc. meets the City's specifications and can provide MDR serviced to be utilized by IT. By leveraging the procurement power through cooperative purchasing, the City of Santa Ana is able to obtain vetted, high quality products at competitive volume pricing, and is in accordance with the City's existing Purchasing Guidelines. ENVIRONMENTAL IMPACT There is no environmental impact associated with this action. FISCAL IMPACT Funding is available in the current FY 2024-25 budget and funding for subsequent fiscal years will be included in the proposed budget for City Council consideration. Accounting Accounting Unit, Fiscal Unit — Fund Account Annual Year Account Description Description Amount Contingency Total FY 24- 10920149- Information Contract 25 62300 Technology Services- $210,144 $21,014 $231,158 Professional FY 25- 10920149- Information Contract 26 62300 Technology Services- $191,144 $19,114 $210,259 Professional FY 26- 10920149- Information Contract 27 62300 Technology Services- $191,144 $19,114 $210,259 Professional Managed Detection and Response (MDR) Service April 15, 2025 Page 3 Total $592,433 1 $59,243 1 $651,676 EXHIBIT(S) 1. City of Moreno Valley Master Security Services Agreement (MSSA # 00036602) 2. eSentire Master Security Services Agreement 3. eSentire Order Form Submitted By: Jack Ciulla, Chief Technology Innovations Officer Approved By: Alvaro Nunez, City Manager DocuSign Envelope ID: C810BDDC-DA5A-4F91-BF26-2652C2DCB8FC MSSA #: 00036602 Master Security Services Agreement This Master Security Services Agreement (this "Agreement") is by and between City of Moreno Valley ("Client"), with offices at 14177 Frederick Street, Moreno Valley, CA, United States, 92553, and eSentire America, Inc. ("eSentire"), with offices at 451 Phillip Street Unit 135, Waterloo, ON, Canada N2L 3X2, each a "Party" and together the "Parties." This Agreement is effective on the date of the last signature below (the "Effective Date"). 1. Definitions In addition to the capitalized terms defined elsewhere in this Agreement or in the applicable Order Form, the following terms will have the meanings ascribed to them in this Section 1. "Affiliate" of a Party means any corporation or other legal entity that such Party directly or indirectly controls, is controlled by, or is under common control with. In this context, a Party "controls" a corporation or other entity if it or any combination of it and/or its Affiliates owns more than 50% of the voting rights for the board of directors or other mechanism of control for such corporation or other entity. "Client Data" means (a) data, records, files of Client including e-mail sent or received by personnel of Client, and (b) all reports generated for or by Client as a result of the provision or use of the Services, except to the extent such reports contain eSentire Intellectual Property. "Confidential Information" means any and all information disclosed by either Party ("Disclosing Party") to the other ("Receiving Party") that is not deemed public information, that is not protected by Requirements of Law applicable to information that is Personal Information and that is marked "confidential" or "proprietary," or similar designation or which the recipient knows or has reason to know is regarded by the Disclosing Party as such, including oral information. For the avoidance of doubt, Confidential Information does not include any information that the Receiving Party can demonstrate: (a) was known to it prior to its disclosure hereunder by the Disclosing Party; (b) is or becomes known through no wrongful act of the Receiving Party; (c) has been rightfully received from a third party without restriction or disclosure and without breach by such third party of a non -disclosure obligation; (d) is independently developed by the Receiving Party; or (e) has been approved for release by the Disclosing Party's prior written authorization. "Day" or "Days" means calendar days, unless otherwise specified. "Encrypt" or "Encryption" means the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without the use of a confidential process or key; "Intellectual Property" means (a) any rights provided under (i) patent law, (ii) copyright law, (iii) trade -mark law, (iv) design patent or industrial design law or (v) any other statutory provision or common law principle applicable to this Agreement, including trade dress and trade secret law, which may provide a right in either ideas, formulae, algorithms, concepts, inventions or know-how generally, or the expression or use of such ideas, formulae, algorithms, concepts, inventions or know-how; and (b) any and all applications, registrations, licenses, sub -licenses, franchises, agreements or any other evidence of a right in any of the foregoing. eSentire's Intellectual Property includes New Intellectual Property, as defined in Section 2.4 below. "Order Form" means an ordering document, executed by the Parties, that specifies the Services to be provided to Client, including any amendments and supplements thereto. Each such Order Form, and any schedules, documents or other attachments thereto, incorporates and is subject to the terms and conditions of this Agreement. "Participating Affiliate" means a Client Affiliate authorized by Client under eSentire's processes to contract for Services in Participating Affiliate's own name subject to the terms of this Agreement. "Personal Information" means information that can be used on its own or in combination with other information to identify, contact, or locate a particular individual, including but not limited to, name, address, telephone number, email address, IP address, place of birth, mother's maiden name, sexual orientation, social insurance or social security numbers, credit history and score, financial records, password and login information, biometric data, medical records, health insurance number, employment information and driver's license number, as applicable and/or as defined and protected by Requirements of Law. "Requirements of Law" mean all laws, statutes, codes, acts, ordinances, orders, decrees, injunctions, by-laws, rules, regulations, official plans, permits, licenses, authorizations, directions, and agreements with any government authority, agency, body or department, whether federal, provincial, state, municipal or law of a jurisdiction outside City of Moreno Valley — 2023-06-29 Page 1 of 10 (202305) DocuSign Envelope ID: C810BDDC-DA5A-4F91-BF26-2652C2DCB8FC MSSA #: 00036602 Master Security Services Agreement Canada or the U.S. that now or at any time hereafter may be applicable to a Party in the performance of its obligations under this Agreement or any part of them (including all applicable privacy and data protection laws). "Services" means the services specified in an Order Form. "Systems" means any combination of hardware and software, including without limitation any telecommunication lines or other networking devices used to link such combination of hardware and software. 2. Services, License Grants and Restrictions 2.1 Services. eSentire shall provide to Client the Services as set forth in the Order Form during the Term. eSentire personnel shall remain under the direction and control of eSentire. 2.2 Usage Restrictions. Except as expressly permitted by eSentire, Client will not (and will not allow any third party to): (i) reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code, or underlying structure, ideas, or algorithms of the software provided or used by eSentire in delivering the Services ("Software") or the Services; (ii) copy or duplicate the Software or modify, translate, or create derivative works based on the Software; (iii) rent, lease, distribute, sublicense, resell, pledge, assign, or otherwise transfer, provide access to or encumber rights to Software or the other Services; or (iv) use the Services or Software for service bureau purposes or otherwise for the benefit of a third party. Client will use the Services solely in compliance with all Requirements of Laws. 2.3 Ownership and Use of Client Data. Except as provided below, eSentire expressly acknowledges and agrees that as between Client and eSentire, Client is the owner of and has exclusive rights, title and interest in and to Client Data. Notwithstanding the foregoing, to the extent any reports provided by eSentire to Client hereunder include any eSentire Intellectual Property including without limitation, the format of such reports, eSentire shall retain all rights in and to such eSentire Intellectual Property. eSentire hereby grants to Client a nonexclusive, nontransferable, limited license to use such eSentire Intellectual Property solely for the purposes for which such reports are provided by eSentire to Client pursuant to this Agreement. Client will not create derivative works based upon, using or incorporating any eSentire Intellectual Property, disassemble or reverse engineer, decompile or design around any eSentire Intellectual Property. eSentire will have the right to access and use such Client Data solely (i) as necessary to provide the Services and (ii) for trend analysis that may assist eSentire in the provision of its services in its business generally, provided that no such trend analysis will result in the disclosure of any Personal or Confidential Information about or from Client or its employees or customers. eSentire will not retain, use, disclose, sell, or otherwise process Client Data for any purpose other than the specific purpose of performing the Services under this Agreement. 2.4 Freedom to Use Ideas. The ideas, formulae, algorithms, concepts, inventions, know how, improvements, discoveries, processes and other information and materials ("New Intellectual Property") developed during the course of performing Services for Client under this Agreement by eSentire and/or eSentire personnel will become the sole Intellectual Property of eSentire, except to the limited extent such New Intellectual Property contains Client Data. eSentire may use any such New Intellectual Property without limitation, including by or for its clients or customers other than Client, notwithstanding anything to the contrary contained in this Agreement. 2.5 Retention of Rights. Except for the rights expressly granted under this Section 2, eSentire, or its third -party vendor(s) or licensor(s), as applicable, retains all right, title, and interest in and to all Software, eSentire hardware and embedded proprietary software ("Equipment"), Services, and all Intellectual Property created, used, or provided by eSentire to Client pursuant to this Agreement. eSentire will also own all right, title, and interest in and to all modifications or derivatives of, and improvements to, Software, eSentire Equipment and Services. Client acknowledges that nothing contained herein will constitute an assignment or transfer of any such eSentire Intellectual Property to Client. 2.6 Update of the Services. eSentire reserves the right in future to make additions, changes or updates to components of the Services (including end of life, removal of features) (collectively, "Changes"). If such components are no longer supported or made available by eSentire, eSentire will give Client at least 90 Days' prior written notice of any planned, material Changes to the Services together with associated City of Moreno Valley — 2023-06-29 Page 2 of 10 (202305) DocuSign Envelope ID: C810BDDC-DA5A-4F91-BF26-2652C2DCB8FC MSSA #: 00036602 Master Security Services Agreement implementation timelines. If Client believes any such Change will have a material adverse impact on its use of such Services, and eSentire cannot reasonably mitigate the impact of such Change within 30 Days after receipt of Client's written notice of such material adverse impact then Client may, following the end of such 30-Day Period, terminate the affected Service(s) upon 60 Days' prior written notice to eSentire. 2.7 Client Responsibilities. Client hereby agrees to perform its obligations as set forth in the applicable Order Form. 3. Fees and Payment Terms 3.1 Fees. The fees for Services are set forth on the Order Form (the "Fees"). If Client requests or eSentire recommends additional Services, the Parties will execute a separate Order Form for such additional Services. 3.2 Invoicing. eSentire will invoice Client as indicated in the applicable Order Form and Client agrees to pay all invoices within 30 Days after the date of each invoice. If Client in good faith believes that eSentire has billed Client incorrectly, Client must notify eSentire in writing no later than 30 Days after the date of such invoice. The Parties will cooperate in good faith to resolve any billing concern raised by Client within such 30-Day period. eSentire reserves the right to charge interest at the rate of the lesser of (i) 1.5% per month or (ii) the maximum amount allowed by law, in respect of invoiced amounts that have remained unpaid for more than 30 Days after the date of the applicable invoice. If eSentire pursues collection efforts against Client due to Client's failure to pay Fees when due hereunder, Client will pay eSentire's reasonable costs of collection, including any legal fees related thereto. 3.3 Taxes. All Fees are exclusive of any taxes, levies, duties or similar governmental assessments of any nature including, without limitation, fees, value-added, sales, use or withholding taxes, assessable by anyjurisdiction whatsoever (collectively, "Taxes"). Client is responsible for self -assessment of and self -remission of any and all Taxes associated with this Agreement to the applicable collecting agency or party. In the event that eSentire pays Taxes on behalf of the Client, the Client will reimburse eSentire for its payment of all such Taxes imposed upon the services provided hereunder to Client (excluding Taxes based upon eSentire's income). 3.4 Suspension of Services. eSentire reserves the right, but assumes no obligation, to suspend performance of the Services with immediate effect on written notice to Client in the event Client is more than 30 days overdue in making payments that have not been disputed in good faith. 4. Warranties 4.1 Mutual. Each Party represents and warrants to the other that it has the right to enter into this Agreement, and that the consent of no other person or entity is necessary for it to enter into or fully perform this Agreement. 4.2 eSentire Warranties. eSentire represents, warrants and covenants to Client as follows: 4.2.1 the Services will be performed by qualified personnel in a good, workmanlike, professional manner and substantially in accordance with the applicable Service description provided in the applicable Order Form; 4.2.2 it is not under any contractual obligation that would preclude it from entering into this Agreement or providing the Services hereunder; 4.2.3 it is the owner or licensee of the Software used in providing the Services and has all rights necessary to grant the rights herein and to perform its obligations hereunder. In the event that the Software is held to or believed by eSentire to infringe third party Intellectual Property, Client's sole remedy will be the remedy set forth in Section 9.1; 4.2.4 in performing its obligations under this Agreement, it will comply with all data protection laws applicable to eSentire in the performance of its obligations hereunder and will use the same efforts to safeguard and City of Moreno Valley — 2023-06-29 Page 3 of 10 (202305) DocuSign Envelope ID: C810BDDC-DA5A-4F91-BF26-2652C2DCB8FC MSSA #: 00036602 Master Security Services Agreement prevent the misuse of all Personal Information disclosed to it under this Agreement or in the course of providing the Services as it does in protecting its own Confidential Information; 4.2.5 neither this Agreement nor the performance of or exercise of rights under this Agreement will violate, conflict with, or result in the breach of any term, condition, or provision of any agreement or legal obligation (whether or not existing at the Effective Date) to which eSentire is a party or by which it may be bound, or constitute a default thereunder; and 4.2.6 deliverables will conform substantially to the specifications for the same, if any, set out in the applicable Order Form. 4.3 Client Warranties. Client represents, warrants and covenants to eSentire as follows: 4.3.1 it is duly organized and existing under the laws of its own jurisdiction and is not under any contractual obligation that would preclude it from entering into this Agreement or granting access to eSentire as provided herein to provide the Services; 4.3.2 in accessing and using the Services and in otherwise performing its obligations under this Agreement, Client will comply with all applicable Requirements of Law and all applicable export and encryption laws and regulations, and will not provide or provide access to a decryption key to eSentire; 4.3.3 Client has all rights necessary to provide eSentire with access to Client Data and Systems for use in accordance with the terms of this Agreement, and eSentire's use of any Client Data in accordance with the terms of this Agreement will not violate the rights of any third party; 4.3.4 if Client (1) orders Services hereunder to be performed by eSentire with respect to any third -party devices, data, facilities or environments or (2) deploys agents to third -party endpoints for purposes of Services ordered hereunder (collectively, "Third Party Services"), Client has obtained all required authorizations including, without limitation, the prior consent of all such third parties for any such Third Party Services; and 4.3.5 neither this Agreement nor the performance of or exercise of rights under this Agreement will violate, conflict with, or result in the breach of any term, condition, or provision of any agreement or legal obligation (whether or not existing at the Effective Date) to which Client is a party or by which it may be bound, or constitute a default thereunder. 4.4 EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, EACH PARTY HEREBY SPECIFICALLY DISCLAIMS ALL OTHER REPRESENTATIONS AND WARRANTIES WITH RESPECTTO THE SUBJECT MATTER OF THIS AGREEMENT, EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CLIENT HEREBY ACKNOWLEDGES AND AGREES THAT, WHILE ESENTIRE WILL USE ITS BEST EFFORTS TO DETECT INAPPROPRIATE OR UNAUTHORIZED TRAFFIC OR CONTENT WITHIN CLIENT'S SYSTEMS AND NETWORK, DUE TO THE NATURE OF THE INTERNET AND ITS USERS, ESENTIRE DOES NOT WARRANT THAT IT WILL BE ABLE TO DETECT ALL SUCH CONTENT AND TRAFFIC. 5. Supply of Software and Hardware 5.1 To provide the Services, certain eSentire Equipment may be installed at Client's premises as set forth in the applicable Order Form. Client acknowledges and agrees that all such eSentire Equipment shall, at all times, be considered to be personal property of eSentire and its licensors and not Client's property or a part of Client's premises. Client will take all reasonable action to protect the eSentire Equipment from theft, damage or destruction as if such hardware and software were owned by Client. 5.2 With Client's consent, eSentire, or its authorized third parties, may during normal business hours and upon reasonable notice, enter upon Client's premises and remove the eSentire Equipment, provided that such removal is not disruptive to the provision of the Services. City of Moreno Valley — 2023-06-29 Page 4 of 10 (202305) DocuSign Envelope ID: C810BDDC-DA5A-4F91-BF26-2652C2DCB8FC MSSA #: 00036602 Master Security Services Agreement 5.3 Client will not place or allow any lien or other encumbrance to be placed on such eSentire Equipment. Client will not remove the eSentire Equipment from its premises without the prior written consent of eSentire. Client authorizes eSentire to file any and all appropriate documentation, with no prior requirement to obtain Client's signature, to acknowledge and secure eSentire's ownership of such eSentire Equipment. 6. Term and Termination 6.1 The term of this Agreement will commence on the Effective Date and will continue in effect for an initial term of three years unless terminated earlier by either party. Client may terminate this Agreement at any time by giving eSentire written notice of its intent to terminate not less than 60 Days prior notice. The termination of this Agreement pursuant to Section 6.1 will not affect the validity of any Order Form(s) then in effect and any such Order Form(s) will continue in effect until termination of such Order Form(s) pursuant to the terms set forth therein. 6.2 Termination for Breach. Without prejudice to any other rights or remedies which it may have, either Party may terminate this Agreement if the other Party fails to cure a material breach of this Agreement and such material breach remains uncured 30 Days after receiving written notice of the breach from the non -breaching Party. For the avoidance of doubt, this cure period will not apply to any Client failure to pay Fees due under this Agreement and, in addition to eSentire's remedies under Section 3.4, eSentire may immediately terminate this Agreement by written notice to Client if Client fails to pay any Fees. 6.3 Insolvency. A Party may also terminate this Agreement immediately by written notice to the other party (i) if the other Party is declared insolvent or bankrupt by a court of competent jurisdiction; or (ii) if a petition is filed in any court of competent jurisdiction to declare the other Party bankrupt or for a reorganization under bankruptcy law or any similar statute and such petition is not dismissed within 60 Days after such filing or if a trustee in bankruptcy or a receiver or similar entity is appointed for the other Party or (iii) the affected Party has been unable to reasonably satisfy the other Party that it is able to perform its obligations in accordance with this Agreement and with no adverse impact to the other Party. 7. Effect of Termination 7.1 In the event either Party terminates this Agreement pursuant to Section 6.2 such Party may terminate any and all Order Forms then in effect between eSentire and Client with immediate effect, upon written notice to the other Party. 7.2 Upon termination of this Agreement, all rights granted by either Party to the other Party hereunder will revert to the granting Party, all licenses will terminate and Client's access to or use of the Services will immediately terminate, with the exception of eSentire's right to remove eSentire Equipment from Client's premises. All accrued rights to payment under this Agreement will survive termination. 7.3 Upon termination of this Agreement, Client will delete all copies of any Software provided by eSentire and all related materials. At eSentire's request, Client agrees to certify the deletion of such Software and/or return of the related materials to eSentire in writing. 7.4 Within 30 Days after any termination of this Agreement, each Party will return to the other Party or destroy all Confidential Information of the other Party, at the receiving Party's option. 7.5 Within 60 Days after any termination of this Agreement, Client will return the eSentire Equipment eSentire, at Client's expense. Client acknowledges and agrees that, if Client does not so deliver such eSentire Equipment within such 60-Day period, Client will pay eSentire a reasonable replacement charge per sensor to cover eSentire's costs to replace the eSentire Equipment. 8. Liability Limitations EXCLUDING LOSSES ARISING PURSUANT TO SECTION 9 OR FOR A PARTY'S GROSS NEGLIGENCE, WILLFUL OR INTENTIONAL MISCONDUCT OR FRAUD, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY'S LIABILITY TO THE OTHER HEREUNDER FOR ANY LOSSES, LIABILITIES, DAMAGES, FINES, PENALTIES, DEFICIENCIES, City of Moreno Valley — 2023-06-29 Page 5 of 10 (202305) DocuSign Envelope ID: C810BDDC-DA5A-4F91-BF26-2652C2DCB8FC MSSA #: 00036602 Master Security Services Agreement COSTS OR EXPENSES, INCLUDING THE REASONABLE FEES AND REASONABLE EXPENSES OF LEGAL COUNSEL, ACCOUNTANTS OR OTHER EXPERTS AND PROFESSIONAL ADVISERS (COLLECTIVELY, "LOSS"), ARISING FROM OR RELATING TO THIS AGREEMENT OR THE PROVISION OF THE SERVICES HEREUNDER WILL NOT EXCEED THE AMOUNT PAID BY CLIENT TO ESENTIRE FOR THE SPECIFIC SERVICE TO WHICH SUCH CLAIM RELATES DURING THE SIX-MONTH PERIOD PRIOR TO THE DATE THE LOSS OCCURRED. REGARDLESS OF THE NATURE OF THE CLAIM OR THEORY OF LIABILITY (INCLUDING, WITHOUT LIMITATION, VIOLATION OF ANY REQUIREMENTS OF LAW, BREACH OF CONTRACT, STRICT LIABILITY, NEGLIGENCE OR OTHER TORT), NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY FOR ANY: INDIRECT, EXEMPLARY, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES (EVEN IF THE PARTY CAUSING SUCH LOSS OR DAMAGE HAS BEEN ADVISED OR HAD KNOWLEDGE OF THE POSSIBILITY OF SAME OR COULD REASONABLY HAVE FORESEEN SAME), INCLUDING LOST BUSINESS REVENUE, LOSS OF DATA, BUSINESS INTERRUPTION, LOSS OF PROFITS OR FAILURE TO REALIZE EXPECTED PROFITS OR SAVINGS). THE PARTIES AGREE THAT THIS SECTION 8 REPRESENTS A REASONABLE ALLOCATION OF RISK. 9. Indemnities 9.1 eSentire Intellectual Property Infringement Indemnity. eSentire will defend or settle, indemnify and hold Client and its Affiliates, subsidiaries, officers, directors, employees, agents and assigns harmless from and against any third party claim, suit or proceeding, and pay any damages awarded in a final judgment against Client, based on a claim that any eSentire Service or eSentire Equipment (for purposes of convenience in this Section 9, collectively "Services" or "Service") as provided under this Agreement infringes any U.S. copyright, patent right, trademark or similar proprietary right of any third party (a "Third Party IP Claim"). eSentire will also pay reasonable attorneys' fees and expenses incurred in connection with such defense or settlement. Notwithstanding the foregoing, eSentire will have no indemnity obligation or liability hereunder to Client for any Third Party IP Claim which is due in whole or in part, directly or indirectly, to: (i) modification by Client or any third party on Client's behalf or direction of the Services or associated technology, provision of the Services other than by eSentire or by another party at the direction or instruction of eSentire, including any portion of the Software or hardware provided to Client as part of the Services; or (ii) combination of eSentire's Services with parts, equipment, software, devices or third -party services not provided by eSentire where such infringement would not exist but for such combination; or (iii) any willful misconduct or fraudulent action of Client or any third party. For greater certainty, eSentire will not settle any Third Party IP Claim in a manner that attributes liability to Client without Client's written consent (which consent will not unreasonably be withheld). In the event that the Services are held to or believed by eSentire to infringe any third party U.S. copyright or patent right, eSentire will have the option to: (x) replace or modify the Services to be non - infringing, provided that such modification or replacement provides substantially similar features and functionality; (y) obtain for Client the right to continue using the Services; or (z) if both (x) and (y) are not reasonably practicable, terminate this Agreement on written notice to Client and refund to Client the prorata portion of the Fees paid to eSentire for the Services not provided by eSentire after the date eSentire received notice of the Third Party IP Claim. eSentire will not have any obligation to indemnify Client hereunder with respect to any claim that any third -party "open source" or "shareware" software incorporated into any Software provided hereunder infringes any third -party U.S. copyright, patent or similar proprietary right. ESENTIRE WILL HAVE NO OBLIGATION TO CLIENT IF ANY ALLEGED THIRD PARTY IP CLAIM IS BASED UPON THE USE OF THE SERVICES FOR A PURPOSE FOR WHICH THE SERVICES WERE NOT INTENDED OR UPON USE OF ANYTHING OTHER THAN THE MOST CURRENT VERSION OF THE SERVICES. 9.2 Mutual General Indemnity. Each Party will defend or settle, indemnify and hold harmless the other Party and its Affiliates, subsidiaries, officers, directors, employees and agents (individually and collectively, "Indemnitee") harmless from and against any and all third -party claims, actions, damages, losses, liabilities and expenses (of whatever form or nature including, without limitation, reasonable attorneys' fees and expenses and all costs of litigation), whether direct or indirect, alleging damages (each a "Covered Claim") (i) to real or personal property or personal injury and caused by the active negligence or willful or intentional misconduct of the indemnifying Party or its Affiliates, officers, directors, employees or agents (individually and collectively, "Indemnitor"); (ii) arising out of or relating to Indemnitor's violation of any Requirements of Law; (iii) with respect to any Third Party Services, arising out of or relating to Client's failure to obtain the required authorizations or third -party consents, or the adequacy of such consents; or (iv) with respect to Client's indemnification obligations under this section, arising out of or relating to a Client Indemnitor's failure City of Moreno Valley — 2023-06-29 Page 6 of 10 (202305) DocuSign Envelope ID: C810BDDC-DA5A-4F91-BF26-2652C2DCB8FC MSSA #: 00036602 Master Security Services Agreement to Encrypt Confidential Information or personal information pursuant to Requirements of Law or this Agreement. Client will Encrypt all Confidential Information and Personal Information provided or made available to eSentire under this Agreement. "Covered Claims" exclude any claim alleging damages to the extent caused by the negligence, fraud or willful misconduct of an Indemnitee or for which eSentire is responsible under Section 9.1. 9.3 Procedure. Each Party's (as "Indemnitor") indemnity obligations under this Section 9 are contingent on the other party promptly notifying the Indemnitor in writing of any claim or threat thereof, promptly tendering to the Indemnitor sole control of the defense and any settlement of such claim, and providing to Indemnitor (at Indemnitor's cost) any reasonable assistance necessary to such defense or settlement. Indemnitor will not be responsible for any settlement it does not approve in writing (which consent will not unreasonably be withheld). THIS SECTION 9 SETS FORTH THE PARTIES' ENTIRE LIABILITY, AND THE PARTIES' SOLE REMEDIES, IN THE EVENT OF ANY THIRD PARTY IP CLAIMS OR COVERED CLAIMS HEREUNDER. 10. Confidentiality 10.1 The Receivine Partv: 10.1.1 will not, directly or indirectly, use or disclose such Confidential Information or any part thereof to any person or entity or for any purpose whatsoever except as expressly permitted hereunder or unless and until expressly authorized to do so by the Disclosing Party; 10.1.2 will use, disclose and reproduce the Confidential Information of the Disclosing Party only to the extent necessary to fulfill the Receiving Party's obligations or exercise its rights under this Agreement; 10.1.3 will promptly comply with requests made by the Disclosing Party to delete Confidential Information when such Confidential Information is no longer needed by the Receiving Party to perform its obligations hereunder; 10.1.4 will disclose the Confidential Information of the Disclosing Party only to those of its representatives, professional advisors, subcontractors and its Affiliates and their representatives, professional advisors and subcontractors (collectively, "Representatives" for purposes of this Section 10) who have a need to know such Confidential Information for the purposes of fulfilling the Receiving Party's obligations or exercising its rights under this Agreement, and who have assumed obligations of confidentiality equal to or greater than the obligations of the Receiving Party under this Section 10 with respect to the Confidential Information. In all cases, the Receiving Party will be responsible for any (a) loss or theft of, or unauthorized access to the Disclosing Party's Confidential Information or (b) violation of Requirements of Law applicable to Confidential Information by its Representatives; 10.1.5 will use reasonable efforts to treat, and to cause all of its Representatives to treat, the Disclosing Party's Confidential Information with at least the same degree of care the Receiving Party exercises in protecting its own Confidential Information and, in any event, with no less than a reasonable standard of care; and 10.1.6 will be entitled to disclose Confidential Information if such disclosure is required (i) by a court, administrative or regulatory body (including a stock exchange) of competent jurisdiction, whether as a result of any application made by the Receiving Party, a request made by an individual Data Subject, as defined in the General Data Protection Regulation, (ii) pursuant to an investigation initiated by a regulatory body, other governmental authority or pursuant to court order, or (iii) pursuant to the California Public Records Act, provided that the Receiving Party will: 10.1.6.1 give prompt written notice of any such requirement for disclosure to the Disclosing Party so that the Disclosing Party may seek a protective order or other appropriate remedy or response; 10.1.6.2 take such steps as are reasonably necessary and available to maintain the confidentiality of the Confidential Information by such court, administrative or regulatory body; 10.1.6.3 in any event, make such disclosure only to the extent so legally required; and 10.1.6.4 except as otherwise provided in this Agreement, not use or disclose to third parties any Confidential City of Moreno Valley — 2023-06-29 Page 7 of 10 (202305) DocuSign Envelope ID: C810BDDC-DA5A-4F91-BF26-2652C2DCB8FC MSSA #: 00036602 Master Security Services Agreement Information of the Disclosing Party unless required by law or expressly consented to by the Disclosing Party. 11. General Provisions 11.1 Interpretation. In this Agreement: (i) words denoting the singular include the plural and vice versa and words denoting any gender include all genders; (ii) all usage of the word "including" or the phrase "e.g.," in this Agreement mean "including, without limitation," throughout this Agreement; (iii) all monetary amounts are expressed in United States dollars, unless expressly provided otherwise. Headings and the division of this Agreement into articles and sections are for convenience of reference only and is not intended to and will not affect the interpretation hereof. In the event of any conflict or inconsistency between the terms and conditions of this Agreement and the terms and conditions contained in an Order Form, the terms and conditions of the Order Form will take precedence. 11.2 eSentire Affiliates. eSentire reserves the right to invoice Client or deliver Services to Client via any eSentire Affiliate in full satisfaction of its obligations under this Agreement. 11.3 No Licenses. Unless otherwise expressly provided in this Agreement, no licenses to any technology, trademarks, or any other Intellectual Property rights of a Party or any third party are granted by virtue of this Agreement. 11.4 Force Majeure. With the exception of Client's obligation to make payment hereunder, either Party may be excused for any delay or failure to perform its duties and obligations hereunder to the extent such failure is caused by any circumstances beyond such Party's reasonable control including, but not limited to, acts of God, fire, flood, war, sabotage, terrorism, civil or military authority, labor disputes, accidents, power surges or failures, internet connectivity, or the act or omission of any third party (a "Force Majeure Condition"). The Party affected by the Force Majeure Condition will be excused from such performance for a period no longer than the delay or failure in performance caused by the Force Majeure Condition, provided such Party uses (i) industry standard procedures to minimize the disruption caused by and (ii) reasonable efforts to remove the cause(s) of the Force Majeure Condition. 11.5 Entire Agreement. This Agreement supersedes and cancels all previous agreements, proposals or representations related to the subject matter. 11.6 Assignment. Client will not assign this Agreement without the prior written consent of eSentire. Notwithstanding the foregoing, Client may assign this Agreement without such consent in connection with the transfer or sale of all or substantially all of its stock, assets or business relating to the Services to which this Agreement relates. Client will give eSentire written notice of any such permitted Assignment within 30 days after the closing date of such transfer or sale. Notwithstanding the foregoing, in order for any assignment to be effective, the assignee must (i) agree in writing to be bound by the terms of this Agreement and (ii) demonstrate to eSentire's reasonable satisfaction that it possesses the financial ability to perform Client's obligations hereunder. 11.7 Severability. In the event that any provision of this Agreement is found to be illegal, void or unenforceable, that provision will be enforced to the maximum extent permissible and the remainder of the Agreement will remain in full force and effect. 11.8 Relationship of Parties. No agency, partnership, joint venture, or employment relationship is created as a result of this Agreement, and neither Party has any authority of any kind to bind the other in any respect whatsoever. Neither Party has any right to or will make any contracts, warranties or representations or assume or create any other obligations, express or implied, in the other Party's name or on its behalf. 11.9 Non -Exclusive Nature of Relationship. Notwithstanding anything to the contrary herein, nothing contained in this Agreement prohibits either Party from entering into a similar arrangement with a third party irrespective of the potential similarity thereof to services which might be provided by eSentire to Client. 11.10 No Third Party Beneficiaries; Inurement. There are no third party beneficiaries to this Agreement, except as may otherwise be provided herein. This Agreement will inure to the benefit of and be binding upon the Parties and their respective successors and permitted assigns. City of Moreno Valley — 2023-06-29 Page 8 of 10 (202305) DocuSign Envelope ID: C810BDDC-DA5A-4F91-BF26-2652C2DCB8FC MSSA #: 00036602 Master Security Services Agreement 11.11 Publicity. Client acknowledges and agrees that eSentire may use Client's name and logo for the purpose of identifying Client as a customer of eSentire. 11.12 Survival. Section 2.3 (Ownership and Use of Client Data), Section 2.4 (Freedom to Use Ideas), Section 2.5 (Retention of Rights), Section 8 (Liability Limitations), Section 9 (Indemnities), Section 10 (Confidentiality), Section 11 (General Provisions) and any other provisions which by their nature ought to survive termination of this Agreement will survive the termination of this Agreement. 11.13 Notices. All notices, demands, consents, authorizations, approvals and other communications under this Agreement will be in writing and will be deemed to have been duly given (i) if delivered in person, on the date of such delivery; (ii) if sent by facsimile or email, when receipt is electronically confirmed; (iii) if sent by recognized commercial overnight courier, on the delivery date stated in the receipt provided by such courier; and (iv) upon receipt, if sent by certified or registered mail, return receipt requested to the respective Party's address set forth on the Order Form. Either Party may change its address for notice under this Agreement by giving written notice to the other Party by the means set forth in this Section 11.12. 11.14 Governing Law and Modification. This Agreement will be governed by and construed in accordance with the laws of the state of California, without regard to its choice of law provisions. Any action seeking legal or equitable relief arising out of or relating to this Agreement will be brought only in the courts of the state of California. The United Nations Convention on Contracts for the International Sale of Goods will not apply to this Agreement. Any changes to this Agreement, or any additional or different terms in Client's purchase orders, acknowledgments or other documents will have no effect and will not supersede the terms of this Agreement. Any modifications or amendments to this Agreement must be in writing and signed by both Parties. 11.15 Rights and Remedies. Except as specifically provided in this Agreement, the rights and remedies provided in this Agreement and all other rights and remedies available to either Party at law or in equity are, to the extent permitted by law, cumulative and not exclusive of any other right or remedy now or hereafter available at law or in equity, neither asserting a right nor employing a remedy will preclude the concurrent assertion of any other right or employment of any other remedy. 11.16 Further Assurances. Each Party will from time to time and at all times do such further acts and execute and deliver such further documents as may be reasonably required in order to evidence, carry out and give full effect to the terms, conditions, intent and meaning of this Agreement. 11.17 Non -Solicitation. Client will not solicit for employment, hire or enter into any independent contractor or other similar relationship with any employee of eSentire who has been involved, directly or indirectly, in the provision of any of the Services hereunder to Client during the immediately preceding 12-month period without the express prior written consent of an authorized eSentire executive. This Section 11.16 will not prohibit Client from hiring an employee of eSentire in response to an employment or contracting advertisement or other general solicitation not specifically targeted at such employee. 11.18 Counterparts. This Agreement may be executed by the Parties in one or more counterparts, each of which will be considered one and the same agreement. This Agreement may be delivered by facsimile, email or other functionally equivalent electronic means of transmission. [signature page follows] City of Moreno Valley — 2023-06-29 Page 9 of 10 (202305) DocuSign Envelope ID: C810BDDC-DA5A-4F91-BF26-2652C2DCB8FC MSSA #: 00036602 Master Security Services Agreement IN WITNESS WHEREOF, each of the Parties hereto has caused this Agreement to be executed and delivered by its duly authorized representative as of the date set forth below. eSentire DocuSigned by: bail 9326D6C620EE4C0... Signature Kerry Bailey Full Name CEO Title July 10, 2023 Date Approved by eSentire Legal DS W p� July 10, 2023 Initials and Date City of Moreno Valley IDocuSigned by: 9tiLb, (kG 2366EE983B0941E... Signature Mike Lee Full Name City Manager Title July 9, 2023 Date Approved as to legal form. City Attorney: Steven Quintanilla EDS vfi July 6, 2023 Initials and Date City of Moreno Valley — 2023-06-29 Page 10 of 10 (202305) Docusign Envelope ID: DA411727-B3A7-4B6F-AC98-ED7692626C6A MSSA tt: 00045246 Master Security Services Agreement This Master Security Services Agreement (this "Agreement") is by and between City of Santa Ana ("Client"), with offices at 20 Civic Center Plaza Santa Ana, California, United States 92701, and eSentire, Inc. ("eSentire"), with offices at 451 Phillip Street Unit 135, Waterloo, ON, Canada N2L 3X2, each a "Party" and together the "Parties." This Agreement is effective on the date of the last signature below (the "Effective Date"). 1, Definitions In addition to the capitalized terms defined elsewhere in this Agreement or in the applicable Order Form, the following terms will have the meanings ascribed to them in this Section 1. "Affiliate" of a Party means any corporation or other legal entity that such Party directly or indirectly controls, is controlled by, or is under common control with. In this context, a Party "controls" a corporation or other entity if it or any combination of it and/or its Affiliates owns more than 50% of the voting rights for the board of directors or other mechanism of control for such corporation or other entity. "Client Data" means (a) data, records, files of Client including e-mail sent or received by personnel of Client, and (b) all reports generated for or by Client as a result of the provision or use of the Services, except to the extent such reports contain eSentire Intellectual Property. "Confidential Information" means any and all information disclosed by either Party ("Disclosing Party") to the other ("Receiving party") that is not deemed public information, that is not protected by Requirements of Law applicable to information that is Personal Information and that is marked "confidential" or "proprietary," or similar designation or which the recipient knows or has reason to know is regarded by the Disclosing Party as such, including oral information. For the avoidance of doubt, Confidential Information does not include any information that the Receiving Party can demonstrate: (a) was known to it prior to its disclosure hereunder by the Disclosing Party; (b) is or becomes known through no wrongful act of the Receiving Party; (c) has been rightfully received from a third party without restriction or disclosure and without breach by such third party of a non -disclosure obligation; (d) is independently developed by the Receiving Party; or (e) has been approved for release by the Disclosing Party's prior written authorization. "Day" or "Days" means calendar days, unless otherwise specified. "Encrypt" or "Encryption" means the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without the use of a confidential process or key; "Intellectual Property" means (a) any rights provided under (i) patent law, (ii) copyright law, (iii) trade -mark law, (iv) design patent or industrial design law or (v) any other statutory provision or common law principle applicable to this Agreement, including trade dress and trade secret law, which may provide a right in either ideas, formulae, algorithms, concepts, inventions or know-how generally, or the expression or use of such ideas, formulae, algorithms, concepts, inventions or know-how; and (b) any and all applications, registrations, licenses, sub -licenses, franchises, agreements or any other evidence of a right in any of the foregoing. eSentire's Intellectual Property includes New Intellectual Property, as defined in Section 2.4 below. "Order Form" means an ordering document, executed by the Parties, that specifies the Services to be provided to Client, including any amendments and supplements thereto. Each such Order Form, and any schedules, documents, or other attachments thereto, incorporates and is subject to the terms and conditions of this Agreement. "Participating Affiliate" means a Client Affiliate authorized by Client under eSentire's processes to contract for Services in Participating Affiliate's own name subject to the terms of this Agreement. "Personal Information" means information that can be used on its own or in combination with other information to identify, contact, or locate a particular individual, including but not limited to, name, address, telephone number, email address, IP address, place of birth, mother's maiden name, sexual orientation, social insurance or social security numbers, credit history and score, financial records, password and login information, biometric data, medical records, health insurance number, employment information and driver's license number, as applicable and/or as defined and protected by Requirements of Law. City of Santa Ana - March 26, 2025 Page 1 of 12 (2023-11) Docusign Envelope ID: DA411727-B3A7-4B6F-AC98-ED7692626C6A M55A 9: 00045246 Master Security Services Agreement "Requirements of Law" mean all laws, statutes, codes, acts, ordinances, orders, decrees, injunctions, by-laws, rules, regulations, official plans, permits, licenses, authorizations, directions, and agreements with any government authority, agency, body or department, whether federal, provincial, state, municipal or law of a jurisdiction outside Canada or the U.S. that now or at any time hereafter may be applicable to a Party in the performance of its obligations under this Agreement or any part of them (including all applicable privacy and data protection laws). "Services" means the services specified in an Order Form. "Systems" means any combination of hardware and software, including without limitation any telecommunication lines or other networking devices used to link such combination of hardware and software. 2. Services, License Grants and Restrictions 2.1 Services. eSentire shall provide to Client the Services as set forth in the order Form during the Term. eSentire personnel shall remain under the direction and control of eSentire. 2.2 Usage Restrictions. Except as expressly permitted by eSentire, Client will not (and will not allow any third party to): (i) reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code, or underlying structure, ideas, or algorithms of the software provided or used by eSentire in delivering the Services ("Software") or the Services; (ii) copy or duplicate the Software or modify, translate, or create derivative works based on the Software; (iii) rent, lease, distribute, sublicense, resell, pledge, assign, or otherwise transfer, provide access to or encumber rights to Software or the other Services; or (iv) use the Services or Software for service bureau purposes or otherwise for the benefit of a third party. Client will use the Services solely in compliance with all Requirements of Laws. 2.3 Ownership -and Use of Client Data. Except as provided below, eSentire expressly acknowledges and agrees that as between Client and eSentire, Client is the owner of and has exclusive rights, title, and interest in and to Client Data. Notwithstanding the foregoing, to the extent any reports provided by eSentire to Client hereunder include any eSentire Intellectual Property including without limitation, the format of such reports, e5entire shall retain all rights in and to such eSentire Intellectual Property, eSentire hereby grants to Client a nonexclusive, nontransferable, limited license to use such eSentire Intellectual Property solely for the purposes for which such reports are provided by eSentire to Client pursuant to this Agreement. Client will not create derivative works based upon, using, or incorporating any eSentire Intellectual Property, disassemble or reverse engineer, decompile or design around any eSentire Intellectual Property. eSentire will have the right to access and use such Client Data solely (i) as necessary to provide the Services and (ii) for trend analysis that may assist eSentire in the provision of its services in its business generally, provided that no such trend analysis will result in the disclosure of any Personal or Confidential Information about or from Client or its employees or customers, eSentire will not retain, use, disclose, sell, or otherwise process Client Data for any purpose other than the specific purpose of performing the Services under this Agreement. 2A Freedom to Use Ideas. The ideas, formulae, algorithms, concepts, inventions, know how, improvements, discoveries, processes and other information and materials ("New Intellectual Property") developed during the course of performing Services for Client under this Agreement by eSentire and/or eSentire personnel will become the sole Intellectual Property of eSentire, except to the limited extent such New Intellectual Property contains Client Data. eSentire may use any such New Intellectual Property without limitation, including by or for its clients or customers other than Client, notwithstanding anything to the contrary contained in this Agreement. 2.5 Retention of Rights. Except for the rights expressly granted under this Section 2, eSentire, or its third -party vendor(s) or licensor(s), as applicable, retains all right, title, and interest in and to all Software, eSentire hardware and embedded proprietary software ("Equipment"), Services, and all Intellectual Property created, used, or provided by eSentire to Client pursuant to this Agreement. eSentire will also own all right, title, and interest in and to all modifications or derivatives of, and improvements to, Software, eSentire Equipment and Services. Client acknowledges that nothing contained herein will constitute an assignment or transfer of any such eSentire Intellectual Property to Client. City of Santa Ana - March 26, 2025 Page 2 of 12 (2023-11) Docusign Envelope ID: DA411727-B3A7-486F-AC98-ED7692626C6A M55A 9: 00045246 Master Security Services Agreement 2.6 Update of the Services, eSentire reserves the right in future to make additions, changes, or updates to components of the Services (including end of life, removal of features) (collectively, "Changes"). If such components are no longer supported or made available by eSentire, eSentire will give Client at least 90 Days' prior written notice of any planned, material Changes to the Services together with associated implementation timelines. If Client believes any such Change will have a material adverse impact on its use of such Services, and eSentire cannot reasonably mitigate the impact of such Change within 30 Days after receipt of Client's written notice of such material adverse impact then Client may, following the end of such 30-Day Period, terminate the affected Service(s) upon 60 Days' prior written notice to eSentire. 2.7 Client Responsibilities. Client hereby agrees to perform its obligations as set forth in the applicable Order Form. 3. Fees and Payment Terms 3.1 Fees. The fees for Services are set forth on the Order Form (the "Fees"). If Client requests or eSentire recommends additional Services, the Parties will execute a separate Order Form for such additional Services. 3.2 Invoicing. eSentire will invoice Client as indicated in the applicable Order Form and Client agrees to pay all invoices upon receipt. If Client in good faith believes that eSentire has billed Client incorrectly, Client must notify eSentire in writing no later than 30 Days after the date of such invoice. The Parties will cooperate in good faith to resolve any billing concern raised by Client within such 30-Day period. eSentire reserves the right to charge interest at the rate of the lesser of (i) 1.5% per month or (ii) the maximum amount allowed by law, in respect of invoiced amounts that have remained unpaid for more than 30 Days after the date of the applicable invoice. If eSentire pursues collection efforts against Client due to Client's failure to pay Fees when due hereunder, Client will pay eSentire's reasonable costs of collection, including any legal fees related thereto. 3.3 Taxes. All Fees are exclusive of any taxes, levies, duties, or similar governmental assessments of any nature including, without limitation, fees, value-added, sales, use or withholding taxes, assessable by any jurisdiction whatsoever (collectively, "Taxes"). Client is responsible for self -assessment of and self -remission of any and all Taxes associated with this Agreement to the applicable collecting agency or party. In the event that eSentire pays Taxes on behalf of the Client, the Client will reimburse eSentire for its payment of all such Taxes imposed upon the services provided hereunder to Client (excluding Taxes based upon e5entire's income). 3.4 Suspension of Services. eSentire reserves the right, but assumes no obligation, to suspend performance of the Services with immediate effect on written notice to Client in the event Client is more than 30 days overdue in making payments that have not been disputed in good faith. 4. Warranties 4.1 Mutual. Each Party represents and warrants to the other that it has the right to enter into this Agreement, and that the consent of no other person or entity is necessary for it to enter into or fully perform this Agreement. 4.2 eSentire Warranties. eSentire represents, warrants, and covenants to Client as follows: 4.2.1 the Services will be performed by qualified personnel in a good, workmanlike, professional manner and substantially in accordance with the applicable Service description provided in the applicable Order Form; 4.2.2 it is not under any contractual obligation that would preclude it from entering into this Agreement or providing the Services hereunder; 4.2.3 it is the owner or licensee of the Software used in providing the Services and has all rights necessary to grant the rights herein and to perform its obligations hereunder. In the event that the Software is held to or believed by e5entire to infringe third party Intellectual Property, Client's sole remedy will be the remedy set forth in Section 9.1; City of Santa Ana - March 26, 2025 Page 3 of 12 (2023-11) Docusign Envelope ID: DA411727-B3A7-4B6F-AC98-ED7692626C6A MSSA H: 00045246 Master Security Services Agreement 4.2.4 in performing its obligations under this Agreement, it will comply with all data protection laws applicable to eSentire in the performance of its obligations hereunder (which, for the avoidance of doubt, excludes any laws exclusively applicable to Client) and will use the same efforts to safeguard and prevent the misuse of all Personal Information disclosed to it under this Agreement or in the course of providing the Services as it does in protecting its own Confidential Information; 4.2.5 neither this Agreement nor the performance of or exercise of rights under this Agreement will violate, conflict with, or result in the breach of any term, condition, or provision of any agreement or legal obligation (whether or not existing at the Effective Date) to which eSentire is a party or by which it may be bound, or constitute a default thereunder; and 4.2.6 deliverables will conform substantially to the specifications for the same, if any, set out in the applicable Order Form. 4.3 Client Warranties. Client represents, warrants, and covenants to eSentire as follows: 4.3.1 it is duly organized and existing under the laws of its own jurisdiction and is not under any contractual obligation that would preclude it from entering into this Agreement or granting access to eSentire as provided herein to provide the Services, 4.3.2 in accessing and using the Services and in otherwise performing its obligations under this Agreement, Client will comply with all applicable Requirements of Law and all applicable export and encryption laws and regulations, and will not provide or provide access to a decryption key to eSentire; 4.3.3 Client has all rights necessary to provide e5entire with access to Client Data and Systems for use in accordance with the terms of this Agreement, and eSentire's use of any Client Data in accordance with the terms of this Agreement will not violate the rights of any third party; 4.3.4 if Client (1) orders Services hereunder to be performed by eSentire with respect to any third -party devices, data, facilities, or environments or (2) deploys agents to third -party endpoints for purposes of Services ordered hereunder (collectively, "Third Party Services"), Client has obtained all required authorizations including, without limitation, the prior consent of all such third parties for any such Third Party Services; and 4.3.5 neither this Agreement nor the performance of or exercise of rights under this Agreement will violate, conflict with, or result in the breach of any term, condition, or provision of any agreement or legal obligation (whether or not existing at the Effective Date) to which Client is a party or by which it may be bound, or constitute a default thereunder. 4.4 EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, EACH PARTY HEREBY SPECIFICALLY DISCLAIMS ALL OTHER REPRESENTATIONS AND WARRANTIES WITH RESPECT TO THE SUBJECT MATTER OF THIS AGREEMENT, EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CLIENT HEREBY ACKNOWLEDGES AND AGREES THAT, WHILE ESENTIRE WILL USE ITS BEST EFFORTS TO DETECT INAPPROPRIATE OR UNAUTHORIZED TRAFFIC OR CONTENT WITHIN CLIENT'S SYSTEMS AND NETWORK, DUE TO THE NATURE OF THE INTERNET AND ITS USERS, ESENTIRE DOES NOT WARRANT THAT IT WILL BE ABLE TO DETECT ALL SUCH CONTENT AND TRAFFIC. 5. Supply of Software and Hardware 5.1 To provide the Services, certain eSentire Equipment may be installed at Client's premises as set forth in the applicable Order Form. Client acknowledges and agrees that all such eSentire Equipment shall, at all times, be considered to be personal property of eSentire and its licensors and not Client's property or a part of Client's premises. Client wil I take all reasonable action to protect the eSentire Equipment from theft, damage, or destruction as if such hardware and software were owned by Client. 5.2 With Client's consent, eSentire, or its authorized third parties, may during normal business hours and upon reasonable notice, enter upon Client's premises and remove the eSentire Equipment, provided that such removal is not disruptive to the provision of the Services. City of Santa Ana - March 26, 2025 Page 4 of 12 (2023-11) Docusign Envelope ID: DA411727-B3A7-4B6F-AC98-ED7692626C6A M55A 4: 00045246 Master Security Services Agreement 5.3 Client will not place or allow any lien or other encumbrance to be placed on such eSentire Equipment. Client will not remove the eSentire Equipment from its premises without the prior written consent of eSentire. Client authorizes eSentire to file any and all appropriate documentation, with no prior requirement to obtain Client's signature, to acknowledge and secure eSentire's ownership of such eSentire Equipment. 6. Term and Termination 6A The term of this Agreement will commence on the Effective Date and will continue in effect for an initial term of three years. Upon expiration of the initial term, this Agreement will automatically terminate, unless Client provides eSentire with at least 60 Days' written notice prior to the end of the term of its intention to renew, in which case this Agreement will renew for a period of 12 calendar months (each a "Renewal Term"). The initial term and any Renewal Term are collectively referred to as the "Term". The termination of this Agreement pursuant to Section 6.1 will not affect the validity of any Order Form(s) then in effect and any such Order Form(s) will continue in effect until termination of such Order Form(s) pursuant to the terms set forth therein. 6.2 Termination for Breach. Without prejudice to any other rights or remedies which it may have, either Party may terminate this Agreement if the other Party fails to cure a material breach of this Agreement and such material breach remains uncured 30 Days after receiving written notice of the breach from the non -breaching Party. For the avoidance of doubt, this cure period will not apply to any Client failure to pay Fees due under this Agreement and, in addition to eSentire's remedies under Section 3.4, eSentire may immediately terminate this Agreement by written notice to Client if Client fails to pay any Fees. 6.3 Insolvency. A Party may also terminate this Agreement immediately by written notice to the other party (i) if the other Party is declared insolvent or bankrupt by a court of competent jurisdiction; or (ii) if a petition is filed in any court of competent jurisdiction to declare the other Party bankrupt or for a reorganization under bankruptcy law or any similar statute and such petition is not dismissed within 60 Days after such filing or if a trustee in bankruptcy or a receiver or similar entity is appointed for the other Party or (iii) the affected Party has been unable to reasonably satisfy the other Party that it is able to perform its obligations in accordance with this Agreement and with no adverse impact to the other Party. 7. Effect of Termination 7.1 In the event either Party terminates this Agreement pursuant to Section 6.2 such Party may terminate any and all Order Forms then in effect between eSentire and Client with immediate effect, upon written notice to the other Party. 7.2 Upon termination of this Agreement, all rights granted by either Party to the other Party hereunder will revert to the granting Party, all licenses will terminate and Client's access to or use of the Services will immediately terminate, with the exception of eSentire's right to remove eSentire Equipment from Client's premises. All accrued rights to payment under this Agreement will survive termination. 7.3 Upon termination of this Agreement, Client will delete all copies of any Software provided by eSentire and all related materials. At e5entire's request, Client agrees to certify the deletion of such Software and/or return of the related materials to eSentire in writing. 7.4 Within 30 Days after any termination of this Agreement, each Party will return to the other Party or destroy all Confidential Information of the other Party, at the receiving Party's option. 7.5 Within 30 Days after any termination of this Agreement, Client will return the eSentire Equipment to a location specified by eSentire, at Client's expense. Client acknowledges and agrees that, if Client does not deliver such eSentire Equipment within such 30-Day period, Client will pay eSentire a reasonable replacement charge per sensor to cover eSentire's costs to replace the eSentire Equipment. City of Santa Ana - March 26, 2025 Page 5 of 12 (2023-11) Docusign Envelope ID: DA411727-B3A7-4B6F-AC98-ED7692626C6A MSSA #: 00045246 Master Security Services Agreement 8. Liability Limitations EXCLUDING LOSSES ARISING PURSUANT TO SECTION 9 OR FOR A PARTY'S GROSS NEGLIGENCE, WILLFUL OR INTENTIONAL MISCONDUCT OR FRAUD, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY'S LIABILITY TO THE OTHER HEREUNDER FOR ANY LOSSES, LIABILITIES, DAMAGES, FINES, PENALTIES, DEFICIENCIES, COSTS OR EXPENSES, INCLUDING THE REASONABLE FEES AND REASONABLE EXPENSES OF LEGAL COUNSEL, ACCOUNTANTS OR OTHER EXPERTS AND PROFESSIONAL ADVISERS (COLLECTIVELY, "LOSS"), ARISING FROM OR RELATING TO THIS AGREEMENT OR THE PROVISION OF THE SERVICES HEREUNDER WILL NOT EXCEED TWO TIMES THE AMOUNT DUE BY CLIENTTO ESENTIRE ON AN ANNUAL BASIS FOR THE SPECIFIC SERVICETO WHICH SUCH CLAIM RELATES DURING THE THEN -CURRENT CONTRACT PERIOD. REGARDLESS OF THE NATURE OF THE CLAIM OR THEORY OF LIABILITY (INCLUDING, WITHOUT LIMITATION, VIOLATION OF ANY REQUIREMENTS OF LAW, BREACH OF CONTRACT, STRICT LIABILITY, NEGLIGENCE OR OTHER TORT), NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY FOR ANY: INDIRECT, EXEMPLARY, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES (EVEN IF THE PARTY CAUSING SUCH LOSS OR DAMAGE HAS BEEN ADVISED OR HAD KNOWLEDGE OF THE POSSIBILITY OF SAME OR COULD REASONABLY HAVE FORESEEN SAME), INCLUDING LOST BUSINESS REVENUE, LOSS OF DATA, BUSINESS INTERRUPTION, LOSS OF PROFITS OR FAILURE TO REALIZE EXPECTED PROFITS OR SAVINGS). THE PARTIES AGREE THAT THIS SECTION S REPRESENTS A REASONABLE ALLOCATION OF RISK. 9. Indemnities 9.1 e5entire Intellectual Property Infringement Indemnity. eSentire will defend or settle, indemnify and hold Client and its Affiliates, subsidiaries, officers, directors, employees, agents and assigns harmless from and against any third party claim, suit or proceeding, and pay any damages awarded in a final judgment against Client, based on a claim that any eSentire Service or eSentire Equipment (for purposes of convenience in this Section 9, collectively "Services" or "Service") as provided under this Agreement infringes any U.S. copyright, patent right, trademark or similar proprietary right of any third party (a "Third Party IP Claim"). eSentire will also pay reasonable attorneys' fees and expenses incurred in connection with such defense or settlement. Notwithstanding the foregoing, eSentire will have no indemnity obligation or liability hereunder to Client for any Third Party IP Claim which is due in whole or in part, directly or indirectly, to: (i) modification by Client or any third party on Client's behalf or direction of the Services or associated technology, provision of the Services other than by eSentire or by another party at the direction or instruction of eSentire, including any portion of the Software or hardware provided to Client as part of the Services; or (ii) combination of eSentire's Services with parts, equipment, software, devices or third -party services not provided by eSentire where such infringement would not exist but for such combination; or (iii) any willful misconduct or fraudulent action of Client or any third party. For greater certainty, eSentire will not settle any Third Party IP Claim in a manner that attributes liability to Client without Client's written consent (which consent will not unreasonably be withheld). In the event that the Services are held to or believed by eSentire to infringe any third party U.S. copyright or patent right, eSentire will have the option to: (x) replace or modify the Services to be non - infringing, provided that such modification or replacement provides substantially similar features and functionality; (y) obtain for Client the right to continue using the Services; or (z) if both (x) and (y) are not reasonably practicable, terminate this Agreement on written notice to Client and refund to Client the prorata portion of the Fees paid to eSentire for the Services not provided by eSentire after the date eSentire received notice of the Third Party IP Claim. eSentire will not have any obligation to indemnify Client hereunder with respect to any claim that any third -party "open source" or "shareware" software incorporated into any Software provided hereunder infringes any third -party U.S. copyright, patent, or similar proprietary right. ESENTIRE WILL HAVE NO OBLIGATION TO CLIENT IF ANY ALLEGED THIRD PARTY IP CLAIM 15 BASED UPON THE USE OF THE SERVICES FOR A PURPOSE FOR WHICH THE SERVICES WERE NOT INTENDED OR UPON USE OF ANYTHING OTHER THAN THE MOST CURRENT VERSION OF THE SERVICES. 9.2 Mutual General Indemnity. Each Party will defend or settle, indemnify and hold harmless the other Party and its Affiliates, subsidiaries, officers, directors, employees and agents (individually and collectively, "Indemnitee") from and against any and all third -party claims, actions, damages, losses, liabilities and expenses (of whatever form or nature including, without limitation, reasonab{e attorneys' fees and expenses and all costs of litigation), whether direct or indirect, alleging damages (each a "Covered Claim") (i) to real or personal property or personal injury and caused by the active negligence or willful or intentional misconduct City of Santa Ana - March 25, 2025 Page 6 of 12 (2023-11) Docusign Envelope ID: DA411727-B3A7-4B6F-AC98-ED7692626C6A MSSA H: 00045246 Master Security Services Agreement of the indemnifying Party or its Affiliates, officers, directors, employees or agents (individually and collectively, "Indemnitor"); (ii) arising out of or relating to Indemnitor's violation of any Requirements of Law; (iii) with respect to any Third Party Services, arising out of or relating to Client's failure to obtain the required authorizations or third -party consents, or the adequacy of such consents; or (iv) with respect to Client's indemnification obligations under this section, arising out of or relating to a Client Indemnitor's failure to Encrypt Confidential Information or personal information pursuant to Requirements of Law or this Agreement. Client will Encrypt all Confidential Information and Personal Information provided or made available to eSentire under this Agreement. "Covered Claims" exclude any claim alleging damages to the extent caused by the negligence, fraud, or willful misconduct of an Indemnitee or for which eSentire is responsible under Section 9.1. 9.3 Procedure. Each Party's (as "Indemnitor") indemnity obiigations under this Section 9 are contingent on the other party promptly notifying the Indemnitor in writing of any claim or threat thereof, promptly tendering to the Indemnitor sole control of the defense and any settlement of such claim, and providing to Indemnitor (at Indemnitor's cost) any reasonable assistance necessary to such defense or settlement. Indemnitor will not be responsible for any settlement it does not approve in writing (which consent will not unreasonably be withheld). THIS SECTION 9 SETS FORTH THE PARTIES' ENTIRE LIABILITY, AND THE PARTIES' SOLE REMEDIES, IN THE EVENT OF ANY THIRD PARTY IP CLAIMS OR COVERED CLAIMS HEREUNDER. 10. Confidentiality 10.1 The Receiving Party: 10.1.1 will not, directly, or indirectly, use or disclose such Confidential Information or any part thereof to any person or entity or for any purpose whatsoever except as expressly permitted hereunder or unless and until expressly authorized to do so by the Disclosing Party; 10.1.2 will use, disclose, and reproduce the Confidential Information of the Disclosing Party only to the extent necessary to fulfill the Receiving Party's obligations or exercise its rights under this Agreement; 10.1.3 will promptly comply with requests made by the Disclosing Party to delete Confidential Information when such Confidential Information is no longer needed by the Receiving Party to perform its obligations hereunder; 10.1.4 will disclose the Confidential Information of the Disclosing Party only to those of its representatives, professional advisors, subcontractors and its Affiliates and their representatives, professional advisors and subcontractors (collectively, "Representatives" for purposes of this Section 10) who have a need to know such Confidential Information for the purposes of fulfilling the Receiving Party's obligations or exercising its rights under this Agreement, and who have assumed obligations of confidentiality equal to or greater than the obligations of the Receiving Party under this Section 10 with respect to the Confidential Information. In all cases, the Receiving Party will be responsible for any (a) loss or theft of, or unauthorized access to the Disclosing Party's Confidential Information or (b) violation of Requirements of Law applicable to Confidential Information by its Representatives; 10.1.S will use reasonable efforts to treat, and to cause all of its Representatives to treat, the Disclosing Party's Confidential Information with at least the same degree of care the Receiving Party exercises in protecting its own Confidentiai Information and, in any event, with no less than a reasonable standard of care; and 10.1.6 will be entitled to disclose Confidential Information if such disclosure is required (i) by a court, administrative or regulatory body (including a stock exchange) of competent jurisdiction, whether as a result of any application made by the Receiving Party, a request made by an individual Data Subject, as defined in the General Data Protection Regulation, or (ii) pursuant to an investigation initiated by a regulatory body, other governmental authority or pursuant to court order, provided that the Receiving Party will: City of Santa Ana - March 26, 2025 Page 7 of 12 (2023-11) Docusign Envelope ID: DA411727-B3A7-4B6F-AC98-ED7692626C6A MSSA 4; 00045246 Master Security Services Agreement 10.1.6.1 give prompt written notice of any such requirement for disclosure to the Disclosing Party so that the Disclosing Party may seek a protective order or other appropriate remedy or response; 10.1.6.2 take such steps as are reasonably necessary and available to maintain the confidentiality of the Confidential Information by such court, administrative or regulatory body; 10.1.6.3 in any event, make such disclosure only to the extent so legally required; and 10.1.6.4 except as otherwise provided in this Agreement, not use, or disclose to third parties any Confidential Information of the Disclosing Party unless required by law or expressly consented to by the Disclosing Party. 11. General Provisions 11.1 Interpretation. In this Agreement: (i) words denoting the singular include the plural and vice versa and words denoting any gender include all genders; (ii) all usage of the ward "including" or the phrase "e.g.," in this Agreement mean "including, without limitation," throughout this Agreement; (iii) all monetary amounts are expressed in United States dollars, unless expressly provided otherwise. Headings and the division of this Agreement into articles and sections are for convenience of reference only and is not intended to and will not affect the interpretation hereof. In the event of any conflict or inconsistency between the terms and conditions of this Agreement and the terms and conditions contained in an Order Form, the terms and conditions of the Order Form will take precedence. 11.2 No Licenses. Unless otherwise expressly provided in this Agreement, no licenses to any technology, trademarks, or any other Intellectual Property rights of a Party or any third party are granted by virtue of this Agreement, 11.3 Force Majeure. With the exception of Client's obligation to make payment hereunder, either Party may be excused for any delay or failure to perform its duties and obligations hereunder to the extent such failure is caused by any circumstances beyond such Party's reasonable control including, but not limited to, acts of God, fire, flood, war, sabotage, terrorism, civil or military authority, labor disputes, accidents, power surges or failures, internet connectivity, or the act or omission of any third party (a "Force Majeure Condition"). The Party affected by the Force Majeure Condition will be excused from such performance for a period no longer than the delay or failure in performance caused by the Force Majeure Condition, provided such Party uses (i) industry standard procedures to minimize the disruption caused by and (ii) reasonable efforts to remove the cause(s) of the Force Majeure Condition. 11.4 Entire Agreement. This Agreement supersedes and cancels all previous agreements, proposals or representations related to the subject matter. 11.5 Assignment. Client will not assign this Agreement without the prior written consent of eSentire. Notwithstanding the foregoing, Client may assign this Agreement without such consent in connection with the transfer or sale of all or substantially all of its stock, assets or business relating to the Services to which this Agreement relates. Client will give eSentire written notice of any such permitted Assignment within 30 days after the closing date of such transfer or sale. Notwithstanding the foregoing, in order for any assignment to be effective, the assignee must (i) agree in writing to be bound by the terms of this Agreement and (ii) demonstrate to eSentire's reasonable satisfaction that it possesses the financial ability to perform Client's obligations hereunder. 11.6 Severability. In the event that any provision of this Agreement is found to be illegal, void, or unenforceable, that provision will be enforced to the maximum extent permissible, and the remainder of the Agreement will remain in full force and effect. 11.7 Relationship of Parties. No agency, partnership, joint venture, or employment relationship is created as a result of this Agreement, and neither Party has any authority of any kind to bind the other in any respect whatsoever. Neither Party has any right to or will make any contracts, warranties or representations or assume or create any other obligations, express or implied, in the other Party's name or on its behalf. City of Santa Ana - March 26, 2025 Page 8 of 12 (2023-11) Docusign Envelope ID: DA411727-B3A7-4B6F-AC98-ED7692626C6A MSSA #: 00045246 Master Security Services Agreement 11.8 Non -Exclusive Nature of Relationship. Notwithstanding anything to the contrary herein, nothing contained in this Agreement prohibits either Party from entering into a similar arrangement with a third party irrespective of the potential similarity thereof to services which might be provided by eSentire to Client. 11.9 No Third Party Beneficiaries; Inurement. There are no third party beneficiaries to this Agreement, except as may otherwise be provided herein. This Agreement will inure to the benefit of and be binding upon the Parties and their respective successors and permitted assigns. 11.10 Publicity. eSentire may not use Client's name and logo for the purpose of identifying Client as a customer of eSentire. 11.11 Survival. Section 2.3 (Ownership and Use of Client Data), Section 2.4 (Freedom to Use Ideas), Section 2.5 (Retention of Rights), Section 8 (Liability Limitations), Section 9 (Indemnities), Section 10 (Confidentiality), 5ection 11 (General Provisions) and any other provisions which by their nature ought to survive termination of this Agreement will survive the termination of this Agreement. 11.12 Notices. All notices, demands, consents, authorizations, approvals and other communications under this Agreement will be in writing and will be deemed to have been duly given (i) if delivered in person, on the date of such delivery; (ii) if sent by facsimile or email, when receipt is electronically confirmed; (iii) if sent by recognized commercial overnight courier, on the delivery date stated in the receipt provided by such courier; and (iv) upon receipt, if sent by certified or registered mail, return receipt requested to the respective Party's address set forth on the Order Form. Either Party may change its address for notice under this Agreement by giving written notice to the other Party by the means set forth in this Section 11.12. 11.13 Governing Law and Modification. This Agreement will be governed by and construed in accordance with the laws of the state of New York, without regard to its choice of law provisions. Any action seeking legal or equitable relief arising out of or relating to this Agreement will be brought only in the courts of the state of New York. The United Nations Convention on Contracts for the International Sale of Goods will not apply to this Agreement. Any changes to this Agreement, or any additional or different terms in Client's purchase orders, acknowledgments or other documents will have no effect and will not supersede the terms of this Agreement. Any modifications or amendments to this Agreement must be in writing and signed by both Parties. 11.14 Rights and Remedies. Except as specifically provided in this Agreement, the rights and remedies provided in this Agreement and all other rights and remedies available to either Party at law or in equity are, to the extent permitted by law, cumulative and not exclusive of any other right or remedy now or hereafter available at law or in equity, neither asserting a right nor employing a remedy will preclude the concurrent assertion of any other right or employment of any other remedy. 11.15 Further Assurances. Each Party will from time to time and at all times do such further acts and execute and deliver such further documents as may be reasonably required in order to evidence, carry out and give full effect to the terms, conditions, intent and meaning of this Agreement. 11.16 Non -Solicitation. Client will not solicit for employment, hire, or enter into any independent contractor or other similar relationship with any employee of eSentire who has been involved, directly or indirectly, in the provision of any of the Services hereunder to Client during the immediately preceding 12-month period without the express prior written consent of an authorized eSentire executive. This Section 11.16 will not prohibit Client from hiring an employee of eSentire in response to an employment or contracting advertisement or other general solicitation not specifically targeted at such employee. 11.17 Counterparts. This Agreement may be executed by the Parties in one or more counterparts, each of which will be considered one and the same agreement. This Agreement may be delivered by facsimile, email, or other functionally equivalent electronic means of transmission. City of Santa Ana - March 26, 2025 Page 9 of 12 (2023-11) Docusign Envelope ID: DA411727-B3A7-4B6F-AC98-ED7692626C6A MS5A 4: 00045246 Master Security Services Agreement 12. Insurance 12.1 Minimum Scope and Limit of Insurance eSentire shall procure and maintain for the duration of the contract insurance against claims for security breaches, system failures, injuries to persons, damages to software, and damages to property (including computer equipment), theft, or other misuse of Client's data, infringement of intellectual property, invasion of privacy and breach of data, which may arise from or in connection with the performance of the work hereunder by e5entire, its agents, representatives, or employees. Coverage shall be at least as broad as: a. Commercial General Liability (CGL): Insurance Services Office Form CG 00 01 covering CGL on an "occurrence" basis, including products and completed operations, property damage, bodily injury and personal & advertising injury with limits no less than $1,000,000 per occurrence and $2,000,000 general aggregate. b. Cyber Liability: Insurance, with limits not less than $2,000,000 per occurrence or claim and $2,000,000 aggregate. Coverage shall be sufficiently broad to respond to the duties and obligations as is undertaken by eSentire in this agreement and shall include, but not be limited to, claims involving security breach, system failure, data recovery, business interruption, cyber extortion, social engineering, infringement of intellectual property, including but not limited to infringement of copyright, trademark, trade dress, invasion of privacy violations, information theft, and release of private information. The policy shall provide coverage for breach response costs, regulatory fines and penalties as well as credit monitoring expenses. c. Technology Professional Liability Errors and Omissions Insurance (E&O): appropriate to e5entire's profession and work hereunder, with limits not less than $2,000,000 per occurrence and $2,000,000 aggregate. Coverage shall be sufficiently broad to respond to the duties and obligations as is undertaken by eSentire in this agreement and shall include, but not be limited to, claims involving business interruption, damage to or destruction of electronic information, and alteration of electronic information. The policy shall provide coverage for eSentire's failure to provide professional services and/or products under this Agreement. The Policy shall include, or be endorsed to include, damage to, alteration of, loss of, or destruction of electronic data and/or information "property" of Client in the care, custody, or control of e5entire. d. Workers' Compensation as required by the State of California, with statutory limits, and Employer's Liability insurance with limits of no less than $1,000,000 per accident, policy, employee, for bodily injury or disease. 12.2 Other Insurance Provisions The above required insurance policies are to contain or be endorsed to contain the following provisions: a. City of Santa Ana, its City Council, its officers, officials, employees, agents, and volunteers are to be covered as additional insureds, under e5entire's CGL and E&O policies, with respect to any liability arising out of work or operations performed by or on behalf of the e5entire including materials, parts, equipment, and personnel furnished in connection with such work or operations, b. e5entire's insurance companies agree to waive all rights of subrogation against City of Santa Ana, its City Council, its officers, officials, employees, agents, and volunteers for losses paid under the terms of any policy which arise from work performed by eSentire under this Agreement. c. For any claims related to this contract, e5entire's insurance coverage shall be primary and any insurance maintained by City of Santa Ana, its City Council, its officers, officials, employees, agents, or volunteers shall not contribute with it. d. A severability of interest provision must apply for all the additional insureds, ensuring that eSentire's insurance shall apply separately to each insured against whore a claim is made or suit is brought, except with respect to the insurer's limits of liability. City of Santa Ana -March 26, 2025 Page 10 of 17 (2023-11) Docusign Envelope ID: DA411727-B3A7-4B6i=-AC98-ED7692626C6A MSSA H: 00045246 Master Security Services Agreement e. Insurance policies required herein shall provide that coverage shall not be canceled, suspended, voided, reduced in coverage or in limits, non -renewed by the carrier, or materially changed except after thirty (30) days prior written notice has been given to City. Ten (10) days prior written notice shall be provided to City for policy cancellation or non -renewal due to non-payment of premium. Certificate Holder on each Evidence of Insurance certificate shall be: City of Santa Ana, Attention: (Name of Department Staff Responsible for Agreement), Address of Department Responsible for Agreement, M-XX, Santa Ana, CA 92701. The name and location of project must be included in the Description of Operations section of each certificate. Self -Insured Retentions Self -insured retentions must be declared to and approved by Client. Customer may require eSentire to provide proof of ability to pay losses and related investigations, claim administration, and defense expenses within the retention. Acceptability of Insurers Insurance is to be placed with insurers authorized to conduct business in the state of California with a current A.M. Best rating of no less than A-: VII, unless otherwise acceptable to Customer. Claims Made Policies If any of the required policies provide coverage on a claims -made basis: a. The retroactive date must be shown and must be before the date of the contract. b. Insurance must be maintained and evidence of insurance must be provided for at least three (3) years after completion of work. c. If coverage is canceled or non -renewed, and not replaced with another claims -made policy form with a retroactive date prior to the contract effective date, eSentire must purchase "extended reporting" coverage for a minimum of three (3) years after completion of work. Verification of Coverage eSentire shall furnish Customer with original Certificates of Insurance including all required amendatory endorsements (or copies of the applicable policy language effecting coverage required by this clause), Failure to obtain the required documents prior to the work beginning shall not waive eSentire's obligation to provide them. Customer reserves the right to require complete, certified copies of all required insurance policies, including endorsements required by these specifications, at any time. Subcontractors eSentire shall require and verify that all subcontractors maintain insurance meeting all the requirements stated herein. Special Risks or Circumstances Subject to eSentire's review and prior written consent, Client may request to modify these requirements, including limits, based on the nature of the risk, prior experience, insurer, coverage, or other special circumstances. Failure to Maintain Insurance Coverage If e5entire, for any reason, fails to maintain insurance coverage, which is required pursuant to this Agreement, for the entire term of this contract, the same shall be deemed a material breach of Agreement. [signature page follows] City of Santa Ana - March 26, 2025 Page 11 of 12 (2023-11) Docusign Envelope ID: DA411727-B3A7-4B6F-AC98-ED7692626C6A MSSA #; 00045246 Master Security Services Agreement IN WITNESS WHEREOF, each of the Parties hereto has caused this Agreement to be executed and delivered by its duly authorized representative as of the date set forth below. e5entire, Inc. City of Santa Ana QocuSigned by: Ate,- HAt 4 igna ure Signature Aran Matier Full Name CLO Title March 27, 2025 Date Approved by e5entire Legal j l March 27, 2025 Initials & Date ATTEST: Jennifer L. Hall City Clerk APPROVED AS TO FORM SONIA R. CARVALHO City Attorney" ' Jonathan T. Martinez Assistant City Attorney Full Name Title [late CITY OF SANTA ANA Alvaro Nunez City Manager RECOMMENDED FOR APPROVAL jjt " Jack iulla Exe tive Director Information Technology Department City of Santa Ana - March 26, 2025 Page 12 of 12 (2023-11) Docusign Envelope ID: DA411727-B3A7-4B6F-AC9d-ED7692626C6A ORDER FORM MSSA #: 00045246 Order Form #: 00046471 This "Order Form" is between City of Santa Ana (the "Client") and e5entire, Inc. ("eSentire"), each a "Party" and together the "Parties" and incorporates by reference and is governed by the Master Security Services Agreement #00045246 (the "MSSA") between the Parties. Capitalized terms used and not otherwise defined in this Order Form or Service Description(s) have the meaning set forth in the MSSA. The Parties have executed this Order Form on the date of the last signature (the "Effective Date"). "Day" or "Days" means calendar days, unless otherwise specified. Client acknowledges and agrees to all terms of this Order Form, the MSSA, and the service particulars outlined herein (together, for the purposes of this Order Form, referred to as the "Agreement"). 1. TERM AND TERMINATION. a. The term of the Services will begin 15 Days from the Effective Date (the "Service Commencement Date") and will continue for 36 consecutive months ("Initial Term"). b, Upon expiration of the Initial Term, the term of this Order Form will automatically terminate, unless the Client provides eSentire with at least 60 Days' written notice prior to the end of the Term of its intention to renew, in which case this Order Form will renew for a period of 12 calendar months (each a "Renewal Term"). The Initial Term and any Renewal Term are collectively referred to in this Order Form as the "Term." C. The date of expiration of any 12 consecutive month period beginning on the Service Commencement Date will be known as a "Contract Year." 2. SERVICE FEES. All Fees are in USD. Client acknowledges that pricing is based on the Services specified in this Order Form and the attached schedules. Client agrees to execute additional Order Forms to document any material increase to the scope of such Services and acknowledges that additional Fees will apply to any such increases. Additionally, if applicable, Client acknowledges and agrees that additional shipping charges will apply for eSentire Equipment shipped by eSentire to a Client location outside of Canada, United States, United Kingdom or Ireland. 3. RENEWAL TERM PRICING. Upon expiry of the Initial Term, and at each subsequent Renewal Term, eSentire will be entitled to increase the price of the Services. Any such annual increase will not exceed an amount equal to 5%. If a greater increase is required, eSentire will notify Client of same at least 90 Days prior to the commencement of the Renewal Term. 4. PAYMENT TERMS. Fees are exclusive of all Taxes. eSentire will invoice Client for Fees annually in advance. eSentire will invoice Client for total one-time Fees on or about the Effective Date. Payment for all Fees is due net 45 Days from invoice date. 5. TRAVEL AND RELATED EXPENSES. If, at the request and with approval of Client, eSentire personnel are assigned to provide Services at Client's premises or another location designated by Client, Client will reimburse eSentire for reasonable travel directly attributable to the provision of such Services, in addition to the applicable Fees. 6. SERVICES. eSentire will provide the following Services at the Fees set forth below: i. MANAGED DETECTION AND RESPONSE ("MDR") SERVICES. Client acknowledges and agrees to the MDR Service details and applicable Service Descriptions for the Services ordered pursuant to this Order Form found at: https://www.esentire,com/legal/documents?Service=MDR ("MDR Link"), MDR Services ordered and associated Fees are listed below: a. Endpoint Services — CrowdStrike as described in the MDR Link above, and further detailed below. Annual Fees Prevent, Detect & Respond - Managed Only 1 2,100 endpoints 1 $86,879.12 NOTE: For this Service, Client must procure and maintain the applicable vendor licensing (the "License") with CrowdStrike ("Product Publisher"), during the entire Term of the 5ervice, and coordinate proper licensing permissions with the Product Publisherto allow eSentire full administrative access and credentials into the Client's License instance. Client will retain ownership of the License and will continue to have all access to utilize its License. Client acknowledges and agrees that: (i) any changes made by Client in the Licensed environment could have a negative impact on eSentise's ability to deliver the Services and, therefore, Client will review with e5entire any changes made by Client during the term of this Service and (iil if Client fails to comply with its obligations under (i) above, e5entire will be released from any and all obligations to provide the Services as contemplated herein. City of Santa Ana Page 1 of 3 Date Generated: March 26, 2025 Docusign Envelope ID: DA411727-B3A7-4B6F-AC98-ED7692626G6A MSSA 4: 00045246 Order Form 4:00046471 b. Network Services as described in the MDR Link above, and further detailed below. Description Quantity Annual Fees 200 Series Sensor 1 sensor $20,955,25 Users 50 users Log Services — Sumo Logic as described in the MDR Link above, and further detailed below. Description Hosting Location Quantity Annual Fees* Daily Ingestion Rate (Log Standard) North America 30 GB/Days $48,240.00 Daily Ingestion Rate (Log Essentials) North America 5 GB/Day' $ 4,920.00 TOTAL $53,160.00 'Should Client's ingestion usage as a daily average exceed 10% of the daily ingestion quota (measured on an average over one calendar month), notwithstanding any security event (the "Overage"), then Client will either (i) take steps to reduce its usage within 30 Days of such Overage, or (ii) move to the next ingestion level as set out in the below tables to accommodate its usage for the remainder of the Term. *Table 1: Additional Storage Fees for Log Standard Daily Ingestion rate [GB%day] Annual Fees 35 $54,660,00 40 $61,920,00 50 $74,640.00 60 $87,360.00 70 $100,020.00 *Table 2: Additional Storage Fees for Log Essentials Daily Ingestion rate (GB/day) Annual.Fees. 7 $ 6, 360.00 9 $7,380.00 12 $8,820.00 15 $10,200.00 20 $12, 240.00 MANAGED RISK SERVICES ("MRS-). Client acknowledges and agrees to the MRS details and applicable Service Description for the Service ordered pursuant to this Order Form found at: https://www.esentire.com/legal/documents?Service=MRS ("MRS Link"). MRS ordered and associated Fees are listed below: Managed Vulnerability Service — Cloud, Co -managed as described in the MRS Link above, and further detailed below. Description Quantity Annual Fees MVS Hybrid Sensor 1 $30,200.00 IP Addresses 2,300 b. Technical Testing— Internal Penetration Testing as described in the MRS Link above, and further detailed below. Description Frequency Quantity One -Time Fees IP Addresses I One time 2,300 IPs $19,000.00 -Signature Page Follows - City of Santa Ana Page 2 of 3 Date Generated: March 26, 2025 Docusign Envelope ID: DA411727-63A7-486F-AC98-ED7692626C6A MSSA 4: 00045246 Order Form #: 00046471 IN WITNESS WHEREOF, each of the Parties hereto has caused this Order Form to be executed and delivered by its duly authorized representative as of the Effective Date. eSentire, Inc. EA oocusignea by: 4" H Signature Aran Matier Full Name CLO Title March 27, 2025 Date AlSentire Legal Ft7t/ March 27, 2025 Initials and Date ATTEST: Jennifer L. Hall City Clerk APPROVED AS TO FORM SONIA R. CARVALHO City Attorney By: Jonathan T. Martinez Assistant City Attorney City of Santa Ana Signature Full Name Title Date CITY OF SANTA ANA Alvaro Nunez City Manager RECOMMENDED FOR APPROVAL J� 0 Jac iulla Executive Director Information Technology Department City of Santa Ana Page 3 of 3 Date Generated: March 26, 2025