The URL can be used to link to this page

Home My WebLink AboutSOFTWARE SECURED CAUTUS INC. 1 - 2012rf � lry �v� WC required if consultant has employees N -2012 -085 O � M S /fit -rho S�rv�ces �� Tom G AGREEMENT FOR PROVISION OF Lyr.da�e-Il y TECHNOL(H:IY fiRCURITI' SERVICES i'HIS AGREEMEIV "l', evade and entered into this 3rj ~day ofJ'une, 2012 by and between Sotiware Secured Caxxtus lnc_, a _ corporation (hereixxat}er "Consultant"), and the City of Santa Ana, a chartrr city and xnuxucipal corporation organized and existing under the Constitution and laws of the State of California ( hereinafer "City "). RECiTAI,S A. Tlxe City desires to rehaux a consultant having special skill and knowledge in the field of application programtning and infrastructure security, to provide a security review of the City's proposed extranet public portal. B. lxx undertaking the perfoxrnarxce of this Agreemene, Consultant represents that iC is knowledgeable in its field arxd that any sc- xvices pert "ormed by Consultant under this Agx•ee�ux -nt will be performed in compliarxee with such standax•ds as may reasonably be expected from a professional consulting fine in the T.eld. N'OW THEREFORE, in consideration of the mutual and respectivei promises, and subjcx.-t to the terms and conditions hereinafter set forth, the •parties agree as follows- 1. SCOPE OF SERVICES Consultant shall perform an application secxnity review of'the proposed Extranet system, as set fox-th in Exhibit A, attached hereto and incorporatcxl by this reference. 2_ REPIiESENTATIVE5 For purposes of urxpleexxenting this Agreaxnent, the representative of City shall be the Executive Director of the Finance and Management Services Abency, or his designated r�ypresentati ve, and the representative of the Corxsultarxt shall be Sherif lioussa, or his designated representative. Except as may be otherwise stated hrnrein, such representatives shall have the authority to act on behalFof their respective pax'I'ies in carrying out the teruts of this Agrueinent. 3. DELIVERY OF WORK I�RODUCT - OWNERSIIIP Consultant warrants and represents that it has the absolute right to enter uito and perform this Agx-eemerxt and will porfornx its oblilratioxts hereunder in accordance with standards and practices prevailing in the industry. Consultant's contribution to the Project, •including works to be produced by Consultant hereunder, will not inti•inge or misappropriate the proprietary or personal rights of any third person or pax-ly- Consultant shall. deliver to City any work product which results i:�oxr1 the services provided. Said work product sha[1 be submitted in hard copy and produced ur a fonn compatible with City's information systems, as agreed between the Project Manager and Consultant. 4. COMPENSATION a_ City agrees to pay, and Consul taut agrees to accept as total payment' :far its services, a flat Yee of $7,000.00. • ��. b. 1'ayxmeut by City shall be made in one payment within thirty (3U) days after• City's acceptauce of all deliverables set forth in Exhibit A_ payment nand not be made for work which fails to rxLeet the standards ofperfonnartce set forth in the 12ecitals which may reasonably be expected by City. 5. TERM This Agreement shall connnenca on the date first wx-itcen above and tetYnirtate on December 3 1, 2012, ualess terminated earlier in accordance with Section 14, below_ 6. 1NDI✓PCNDENI' COLV`I'12ACTOIi Consultant shall, during the entix•e farm of this Agreement, be construed to be an independent contx•actor and not an employee of the City. This Af*�•eement :is not intended nor shall it ba construed to create an employer - employee xelaiYOnship, a joint venture relationship, or to allow the City to exercise discretion or contaal over the professional manner in which Consultant performs the services which are the subject matter of'titis Agrdurnent; however, the services to be provided by Consultant shall be provided in a manner consistent with all applicable sta�udards and regLilatians governinb such services. Consultant shall pay all salax•ies and wages, employer's social security taxes, unemployment insut•ance� and similar taxes relatinb to .it's employees and shall be responsible far all applicable withholding taxis pertaitLing to compensation paid by City. 7. 1NS1UI2AlYCE Prior to undetYaldtig perFonnaace ofwork under this Agreement, Consultant shall .tnauitain and shall requires its subcontractors, if aziy, to obtain and maintain insurance as deseribacl below: Worker's Compenuttiou Insurance. In accordance with the provisions of Section 3300 of the Labor Coda, Consultant, if Consultant has any employees, is required to be insured against liability for worker's compensation or to undertake self- insmrance. Prior to cotrLmencing the performance ot•the work Linder this AgreetnenC, Consultant abx•ves to obtain and maintain any employer's liability ina- urance with limits not loss than $1,OOO,U00 par accident. S. INDEIVCN IFICATION Consultant agrees to and shall indemnify and !Cold harmless the City, its officers, agents, employees, consultants, special counsel, and representatives from liability for lxyrsonal injury, damages, just compensation, restitution, judicial or equitable relief arising; out of claims for personal injury, including death, and cla; ■„� for property daanage, which ma'y arise ti•om the negligence, recklessness or willful misconduct of the Consultant or its contractors, subcontractors, agents, employees, or other persons acting on their behalf which relates to the services described in section 1 of this Agreement. The Consultant fiu•t1Ler abrees to indeurnify, hold .harmless, and pay all costs :tor the defense of the City, including fees anal costs for special cotutsel to be selected by the City, regarding any action by a third party asserting personal injury, damages, just compensation, restitution, judicial or equitable raliefdue to :personal or property riF;hts arising ti•om this Agreement. City may snake all reasonable decisions with respect to its representation in any legal proceeding_ 9. CONFIDEIVTIALI'I'Y if Consultant receives 'from tlxa City information which due to the nature of such informmation is reasonably understood to be confidential and/or proprietary, C_onsaltaxtt agrees that it shall not use or disclose such information except in the perfonmance of this Agreement, and further agrees to exercise the . %L saxxie degree of care it uses to grotaot its own infonmation of like importance, but in no event less tharx reasonable cares. "Confidential In£orrrxation" shall includes all nonpublic infortnalion. Confidential information includes not only written information, but also infonnatio :x transfexz•ed orally, visual:ty, alactt-onically, or by other means- ConfZdential infoxznatiou disclosed 'to either party by any subsidiary and/or agent of the other• party is covered by this Agreement. "1'he foregoiuxg obligations of non -uses and nondisclosure shall not apply to arty information that (a) has been disclosed in publicly availabl.a sources (b) is, througlx no £salt oftha Consultant disclosed in a publicly available source; (c) is in rightful possession of the Consultant without an obligation of coxxtiderxtiality; (d) is required to ba disclosed by operation of law; or (e) is independently developed by the Consultant without retex•erxce Co information disclosed by the City. 1U. CONFLICT OF IlY'I'EREST CLAUSE Consultant covenants that it presently has no interests and shall not have i[rterasts, direct or indirect, which would conl3ict in any msinner with parforxnaiice ofservYCaS specified ender this Agreement. il<_ xoTlc>r. .Any notice, tender, datrxanrt, delivery, or other communication pursuant to this Agreement shall be in writing and shall be deemed to be properly given if delivered in parson. or m�vled by first class or certified mail, postage prepaid, or sent by facsimile or other telegraphic cox�.**+■��ication in the **�?r��er provided in this Section, to the following parsons: To City: Clark of the Ciiy Council City of $antes Ans 20 Civic Canter Plaza (M -30) l?.O. Box 1988 Santa Ana, CA 92702 -:1988 Fax 7 1 4 - 64 769 5 6 "With courtesy Copy to: Executive Director of the Finance and Managc�rnent Services Agency City of Santa Ana 20 Civic Caner Plaza (M -12) P.O. Aox 1988 Santa Ana, California 92702 Fax 714 -647 -5406 To Consultant: Sherif houssa Software Secured Cautus Tnc 3248 River Rock Avexzue Napean, ON - 1C21 OT3 - Canada A party rosy change its address by hiving notice in writing to the other party. Thereafter•, any CO11nllljnlCatr011 shall be addressed and transmitted to the new address_ If sent by mail, cornmun.ication shall be af�ecrive or deettrad to haves been given thr•ae (3) days after it has bean deposited i•n the -United States mail, duly registered or certifed, with postage prepaid, and addressed as set forth above. If sent by facsimile, coirnnrrnicaUion shall be etf�ctive or deemed to have bean given twenty -fom• (24) hours after �� - the lima set forth on the transmission report issued by the ixansmitLing, facsimile machine, addressed as set 'forth above_ For ptu-posas of calculatinb these time frames, wealcands, federal, state, County or City holidays shall ba excluded. 1.2. E7l;CI.USI`VI "I'Y AND AMENDMENT This Agrwmdnt represents the complete and exclusive statement betwaon the City and Consultant, and supersedes any and all other a�eements, oral or written, bcntween the pasties. In the avant o'F: a conflict between the terms of this Agreement and any attachments hereto, the terans of this Agreement shall prevail. This A�•eement 'imay not be modified except by written irlsiruiment signed by the City and by an authorized representative o•f Consultant. 11ie parties agree that any terms or conditions of any purchaso order or other instrument that• era inconsistent with, or in addition Yo, the terms and conditions hereof; shall not bind or obligates Consultant nor the City_ Each party to this Al;reeinent acknowledges that no representations, inducements, promises or agreements, orally or otherwise, have been invade by any party, or anyone acting on behalf pf arty party, which are not embodied herein. Y3. ASSIGNIVIEIVT Inasmuch as this Agreeniertt is intended to secure the specialized services of °Consultant, Consultant niay not assign, transfer, delegate, or subcontract awry interest herein without the prior ven•itten consent of the Ciiy and any such assigt�rnent, h•ansfar, clelebation or subcontract without the City's prior written. consent shall be considered null and void_ Nothing in this Agref:rnent shall be construed to limit the City's ability to have any of the services which are the subject to this Agreement performed by City personnel or by other consultants retained by City_ I4. TERMINATION Tlus Agreement may be terminated by the City upon thirty (30) days written notice oi• lamination_ In such ovont, Consultant shall be entitled to receive and the Ciiy shall pay Consultant coimpei�,sation for all seavices perfomed by Consultant prior to receipt of such notice oftarm;nation. As a condition of such payment, the Executive Director may require Consultant to deliver to the City all work product completed as of such date, acid in such case such wou'k product shall be the property of the City unless p�'ohibited. by law, and Consultant cansants to the City's use thereof for such purposes as the City deems appropriate. However, any use of unfiiushed work product shall be at City's sol.a risk. I5. DiSCRIMIlYATION Consultant shall not discruninatr because ofrac;e, color, creed, religion, sex, marital status, sexual orientation, age, national ors', ancastey, or disability, as defined and prohibited by applicable law, in the recruitment, selection, training, utilization, promotion, termination or other employment related activities. Consultant affinms that it is an equal oppox-tunity employer and shall comply with all applicable tedeial, state and local laws and reguiations. 16. JURISDICTION - 'VENUE •This Agreement has been ax�uted and delivered in the State of California and the validity, interpretation, performance, and anforcetixent ofsuiy ot•the clauses of this Agreeniernt shall lx9 detei•tnined and governed by the laws of the State of California. Both partia�s f,,. -rhE>r agree that Oranges County, Califonua, shall lx. the venues for any action or proceeding that ii�ay be brought or arise out of, in connection with or by reason of this Agreement. S- �� 1.7_ i'KOFESSIONAI. LICENSES Consultant shall, 'throughout the term of this Agreeinexxt, maintain all necessary lieexises, perxruts, approvals, waivers, and exemptions necessary for the provision of the services hereunder and requiraxi by the laws and re�ilations of the United States, the States of Califoniia, the City of Santa Axxa and a1] other govarnmairtal agencies. Consultant shall notify the City itmnediately and in writuip; of its inability to obtain or maintain such p��rxiuts, licensors, approvals, waivers, and exarnptions. Said inability shall be cause for termination of this Agreement. IS. M15CELLANEOiTS I'I20VISiONS a_ Each undarsi�ed represents and waxr -ants that its signature hereinbelow has the power, authox-ity and right to bind tlxair respective partial to each ofthe t�•�+ +� of this AgrP�� -*•t, and shat! i.Ttdarnnify City folly, including reasonable costs and attorney's fees, for any injuries or damages to City in the ev�rxt thee such aul}xority or power is not, in fact, held by the signatory or is withdrawn_ b_ Captiorxs and headings in this Agreement, including the title of this Agx'eament, are far convenience only and are not to be considered ui construing this Ab�reement. c. All Exhibits refexencord herein zuzd attached hereto shall be incorporated as if #ally set forth in th.a body ofthis Ageenient. IN WITNESS WI- LEREOF', the paa-ties hereto have exorcutad this Agree:mant the date and year �hrst above written. ATTEST: �7�w� � - �j�� MARIA I?. HUIZAR .� Clerk ofthe Coxxtticil APPROVED AS TU FORM: By: ��l '. La -a Sheerly —��` Assistant City Attoranay RECONIMI =NIXED F012 APPROVAL- . `�_ �' iStLCC�cn �r J ]FRAi�fCISCO GLlITE12 -FZF�' Executive ]>ireetor — FMSA �C�I�"IpY_' �Of SANTA ANA � �� PACJL, M. WAY.1 "ERS City Manager SOFTWARE SF.CUREY) CA lJT US, I1V C_ �' - srlExiF ltoussA (Tide) Ex�rrarr A Lxtranet Security Technical F�evtew Statement of Services. Background The City of Santa Ana is implementing an Extranet so that residents and businesses can take advantage of on -line services as they become available. This is the first time that the City is exposing internal systems to external access by non - employee Internet users. The Inspection Scheduling application is the first to be implemented_ The purpose of this project is to provide a security review of the City's programming code for the Inspection Scheduling application. Scone The Vendor is an expert in the field of application programming and infrastructure security. This engagement will include an audit of the City's Inspection Scheduling application utilizing a combination of proprietary and publidy available software tools coupled with a manual review of the application source code. Obiectives The objectiv ®s of this engagement are to ensure that the City understands the nature and severity of any security vulnerabilities in order to assess risk assodated with the Extranet; to gain recommendations as to their resolution- and to gain additional internal security expertise through the transfer of knowledge obtained by this engagement. Services Vendor will perform a standard security code review of the Inspection Scheduling application, an estimated 10,356 lines of code. Scan and audit the source code using Vendor's proprietary static code analysis tools Perform a manual code review of high /critical areas of the application based on threat analysis of the application using results from questionnaires completed by application team, runtime /dynamic environment, etc_ Check the code base against the Vendor's proprietary Application Security Checklist. Provide all deliverables under the Deliverables section of this Statement of Services_ Deliverables No later than 1 week after the audit has been completed, the Vendor will provide all deliverables defined herein: 1. Provide a report similar to the sample report provided in the proposal. The report should comprised of the following (the sample report is found in Attachment A)' o Project Summary o Introduction v Project Scope and Timeline o Risk Rating Profiler o Exception Listing Description o Summary of Findings o Testing Methodology o Approach and Scope a Source Code and Application Environment o Overview of Application Architecture and Security Controls o Majar Findings by Severity Level s�l� o Findings Details o Remediation recommendations. 2. Provide a _NET spec security checklist far the City's development team based on the results of the security Code neview_ 3. Conduct a presentation of findings via teleconferencing to describe fhe overall vulnerability and risk issues_ 4_ Conduct a "Transfer of Knowledge" presentation to the development team, which will inGude: n Explaining the remediation recommendations identified in the report o Answering questions regarding the remediation recommendations after reading the report. o Describe and explain the usage of the checklist ident�ed in point #2 above. Compensation The Vendor will be compensated aflat -fee $7,000 (USD) for the entire project due net paid in full aftEr delivery of all the items specified in the deliverables section_ Place of Performance All work may be perFOrrned at City facilities or from the Vendor's place of business via telecommunication. Period of Performance This work must be performed at a mutually agreed upon time. The Vendor and the City both consider this to be a high priority, high urgency project_ The audit is expelled to have a duration of two weeks with all deliverables completed within a week following the audit. Technical Contacts. Cify of Santa Ana Jim LEntz, Operations Lead for Network Support Phone: 714.641.6909 Email: JLentzt�santa- ana_org Bill Bertovich, Consukant Phone: 949.283.fi689 Email: BBertovich @septa- ana.org �'��_ it C�J -� �� -� C a� L1. C]. g� � � �� 8 $� � g � �� a � �� s � �� LL � �g � �� _' � � =�� e �� .�' g g � .$ i� s � �d 4 s � � � �� 8 cn