Loading...
HomeMy WebLinkAbout6751 Docusign Envelope ID: OB7C2B11-A457-4B30-A652-D6CE1A691E87 C Critical Insight STATEMENT OF SERVICE Name:Kevin Rolnick Quote Date: 08-05-2024 Email:kevin.rolnick@criticalinsight.com Quote Expiration: 09-04-2024 Ph one: +1206-307-8035 Quote ID:Q-17753 Bill To: Ship To: Name: Name: Company: City of Bremerton Company: City of Bremerton Address: 345 6th St, Ste 600,Bremerton, Address: 345 6th St,Ste 600, Bremerton, WA, US,98310 WA,US, 98310 Phone: Phone: SERVICE SUBSCRIPTION Description city Annual Net Rice CI-PS- Virtual CISO Lite:1 uu Hours(SCP;r;-21124-O l7753-As) 1 S3F_6,300.OiJ vCISOLITE 'Line itans subjectto Sales Tac and are not included in this quote. 'Annual cost of these line items are billed on the Initial Invoice of each year they occur. 'Intern al Reference Initial Annual Tobi: $36,300.00 Total Contract Value: $36,300.00 Critics Insights and the Critics Insight logo are the trademarks of Critical Insght,Inc. ©20 24 Critics Insight,Inc.All rights reserved. 1/16 Docusign Envelope ID:OB7C2B11-A457-4B30-A652-D6CE1A691E87 TERMS AND CONDITIONS This Statement of Service ("SOS"),effective as of the date of the signature of the last party to sign (the "Effective Date") is subject to the Critical Insight Master Services Agreement,the Critical Insight Description of Service attached here as Exhibit A, and any other Exhibits, Attachments or Amendments hereto,which are each incorporated herein by reference,and which together with this SOS constitute the "Agreement". Unless otherwise provided in this SOS, capitalized terms herein shall be as defined elsewhere in the Agreement. The terms of this Agreement constitute the final expression of the parties' binding understanding in respect to the subject matter hereof and supersede all prior or contemporaneous agreements, representations and understandings, written and oral, in respect to same. Customer acknowledges that it has read the Agreement and agrees to be bound by its terms. • The term of this SOS is 12 month(s) commencing the Effective Date hereof,which upon expiration shall automatically renew for successive annual renewal terms until terminated as provided in the Master Services Agreement. • Billing shall be based on Critical Insight reporting. Critical Insight and Customer shall reconcile in good faith any discrepancies in their respective tracking records, provided Critical Insight's reporting shall control in the event of an irreconcilable discrepancy. • Customer shall be invoiced on an annual basis in advance. • The first invoice shall be issued thirty (30) days following the Effective Date. • Payment of invoiced amounts due no later than thirty (30) calendar days from date of invoice. Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2024 Critical Insight,Inc.All rights reserved. 2/16 Docusign Envelope ID: OB7C2B11-A457-4B30-A652-D6CE1A691E87 C Critical Insight Critical Insight, Inc. City of Bremerton ■ Name Garrett Silver Name Greg wheeler Title Chief Executive Officer Title Mayor slgneu by: Signed try: Signature Signature P3V-0.6 lAktebtiv F4711a9F9lJ!R76r.F ;AF4R.'A5=fF94?R Date 8/20/2024 IDate 8/20/2024 For Internal Purposes. Contents will be Confirmed in the DealRoom and Fully Render Upon Signature Company&Billing Information Company Legal Name: Billing Street 345 6th St, Ste 600 Billing Contact Name: ▪Billing City: Bremerton Billing Phone: ▪Billing State:WA Billing Email: ▪Billing Zip: 98310 Purchase Order Required: Affiliate:NSA Critical Insights and the Critical Insight logo are the trademarks of Critical Insght,Inc. ©20 24 Critics Insight,Inc.All rights reserved. 3/16 Docusign Envelope ID:OB7C2B11-A457-4B30-A652-D6CE1A691 E87 EXHIBIT A Cidab ri •ica • ht nsi CITY OF BREMERTON VIRTUAL CHIEF INFORMATION SECURITY OFFICER SERVICES SCOPE OF WORK 08-05-2024 Presented To: Submitted by: Randy Oppenborn Consulting Practice Director City of Bremerton Critical Insight, Inc. 345 6th St, Ste 600, Bremerton, WA, US, 98310 500 Pacific Ave., Suite 650 Bremerton, WA 98337 (630) 346-3525 Randy.Oppenborn@Criticallnsight.com Critical Insight°and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2024 Critica I Insight,Inc.All rights reserved. 4/16 Docusign Envelope ID:OB7C2B11-A457-4B30-A652-D6CE1A691E87 NOTICE Critical Insight has made every reasonable attempt to ensure that the information contained within this statement of work is correct, current and properly sets forth the requirements as have been determined to date. The parties acknowledge and agree that the other party assumes no responsibility for errors that may be contained in or for misinterpretations that readers may infer from this document. NON-DISCLOSURE STATEMENT The information in this document is Critical Insight Confidential, and cannot be reproduced or redistributed in any way, shape, or form without prior written consent from Critical Insight, Inc. TRADEMARK NOTICE 2024 Critical Insight, Inc. All Rights Reserved, the Critical Insight®, Kraken and Critical Insight logo and other trademarks, service marks, and designs are registered or unregistered trademarks of Critical Insight in the United States and in foreign countries. © Copyright 2024 Critical Insight, Inc. Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2024 Critical Insight,Inc.All rights reserved. 5/16 Docusign Envelope ID:OB7C2B11-A457-4B30-A652-D6CE1A691E87 General Information Background & Objectives Purpose This SOW presents Critical Insight's approach to assisting City of Bremerton and the City of Bremerton's technology and executive teams with information security, cyber security, and information governance, risk, and compliance needs. The virtual CISO (vCISO) service provides the following services: • Participation in one monthly call with the City of Bremerton executives • Participation at one annual board meeting • Annual policy review • Monthly site visits and onsite day at City of Bremerton o The monthly visit will be to review the results of access authorizations, firewall rules review, change control approval documentation Remediation of controls not fully implemented, or emergency/incident response services are not included herein but can be covered in a separate SOW if requested. This SOW includes: • Scope of Work - Critical Insight's methodology for assisting and supporting City of Bremerton's technology & executive teams, and the scope of work that will be performed • Deliverables - Description of the deliverables for this project • Project Assumptions - any assumptions that were used to derive the scope of work or pricing for this engagement Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2024 Critical Insight,Inc.All rights reserved. 6/16 Docusign Envelope ID:OB7C2B11-A457-4B30-A652-D6CE1A691E87 Key Business and Technical Contacts Customer Business Contact Information Name: Dave Sorensen, IT Manager Mailing Address: City of Bremerton 345 6th St, Ste 600, Bremerton, WA, US, 98310 E-Mail Address: Phone Number: 360-473-5306 Critical Insight Business Contact Information Name: Randy Oppenborn Consulting Practice Director Mailing Address: Critical Insight, Inc. 245 4th Street, Suite 405 Bremerton WA 98337 E-Mail Address: Randy.Oppenborn@Criticallnsight.com Phone Number: (630) 346-3525 Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2024 Critical Insight,Inc.All rights reserved. 7/16 Docusign Envelope ID:OB7C2B11-A457-4B30-A652-D6CE1A691E87 Service Description and Scope This section provides a description of services, scope of activity, and support requirements associated with the services. General Description The scope of work to be performed includes advisory and consulting services on retainer for a Critical Insight virtual CISO (vCISO) and other Critical Insight resources as necessary. The scope includes: • Participation in one monthly meeting/conference call with the City of Bremerton management o The monthly site visit or remote conference call will be to review the results of access authorizations, firewall rules review, change control approval documentation o Address Ad Hoc security issues occurring over the last month • Participation at one annual board meeting • Annual policy review Notably, this scope of work excludes: • Emergency and/or Incident Response Services, which can be requested in a separate Scope of Work • Implementation or remediation of technical controls Scope of Activity The scope outlined below depicts the scope of activity associated with this engagement. Table 1: SOW Scope Statement Activity or Focus Scope & Delivery Requirements Phone, Email, and • Up to 100 hours of general information security, cyber In-Person security, and GRC consulting and advisory services, Consulting provided by phone, email, and/or in-person. Services • Hours are available to be used as needed by City of Bremerton within 1 year/365 days of the execution of this SOW. • Hours not used within one year of the Effective Date will be lost if not used within 1 year/365 days from the execution of this SOW. Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2024 Critical Insight,Inc.All rights reserved. 8/16 Docusign Envelope ID:OB7C2B11-A457-4B30-A652-D6CE1A691E87 • Hours can be extended or replenished when depleted through either extensions/renewals to this SOW or under a new engagement. Coordination, Planning, & Project Initiation Critical Insight will assign a Lead Consultant to be the primary point of contact for all project work. The Lead Consultant will coordinate, plan, manage, and report all project activities and findings to City of Bremerton's designated Project Sponsor and/or Project Manager. Critical Insight will provide project management for all aspects of this project, including tracking and resolution of project related issues, progress tracking, project reporting, and communication. A key component of Critical Insight's project management approach is timely reporting of project progress and findings. This enables a proactive approach to addressing security risks discovered during the course of the project and ensures that all project stakeholders are completely informed at all times. To support this, Critical Insight will conduct a monthly status report or check-in teleconference with City of Bremerton's project team. Follow-up discussions and deliverables will occur on a case-by-case basis to ensure clear and timely communication of all issues. Customer Resource Requirements Achieving City of Bremerton's objectives will require active participation from both the Critical Insight Project Lead Consultant as well as City of Bremerton's own personnel. To ensure the timely and successful completion of this project, City of Bremerton should expect at least the following resource time commitments from its own personnel: • A Project Sponsor should be assigned to provide resolution of issues, escalation of issues, clarification of requirements, sign-off deliverables, and access to resources as required by the project team. This role will require only a 2-3 hour per week of commitment to the project. Additionally, the following activities and estimated time allocations will be performed as part of the project in which City of Bremerton-identified staff will participate: • Logistics Planning meeting: 1 hour • Monthly onsite days/remote conference calls: Up to 8 hours o Each meeting or call to include at least the following agenda: • Status of previous or currently open activities and deliverables • Number of project hours remaining • New questions or emerging needs • Annual board meeting: Up to 8 hours Critical Insights and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2024 Critical Insight,Inc.All rights reserved. 9/16 Docusign Envelope ID:OB7C2B11-A457-4B30-A652-D6CE1A691E87 • Annual Policy Review: Up to 8 hours Project Initiation Meeting Critical Insight recognizes the value of communication and ongoing collaboration with our customers. As such, we include a project initiation meeting (logistics planning meeting) with all our engagements. During the meeting, Critical Insight will address the following topics: • Introduce key people at City of Bremerton and Critical Insight • Exchange contact information (for regular reporting and emergencies) • Review communication, notification, and issue escalation procedures • Discuss other specific City of Bremerton requests and rules of engagement Critical Insight will discuss the nature and time requirements for specific deliverable types that might be requested by City of Bremerton during the project, the designated recipient, and the method which Critical Insight will forward those deliverables. The project activities will be performed remotely unless onsite is explicitly requested. Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2024 Critical Insight,Inc.All rights reserved. 10/16 Docusign Envelope ID:OB7C2B11-A457-4B30-A652-D6CE1A691E87 Schedule Period of Performance City of Bremerton understands and agrees that changes in critical factors (such as those listed below in Project Change Control, or a delay in signature of this document) may impact Critical Insight's ability to meet certain dates. Project Start Date: Within Eight (8) Weeks of the Effective Date Project Completion Date: Within One Year (1) of the Project Start Date Project Change Control Critical Insight has made every attempt to accurately estimate time required to successfully complete the project. City of Bremerton acknowledges and agrees that if impediments, complications, or City of Bremerton requested changes in scope arise, these factors are out of the control of Critical Insight, and the length of the project and associated price could be impacted. Examples of valid impediments, complications, and changes in scope consist of (but are not limited to): • City of Bremerton initiated delay where City of Bremerton is not prepared to allow Critical Insight to begin work on the agreed upon start date thus resulting in additional cost to Critical Insight for resources that have been sent to the City of Bremerton's site but cannot begin the services • City of Bremerton provided information necessary for timely delivery by Critical Insight is not accurate • Delays or problems associated with third party telecommunication equipment o This includes, but is not limited to, cabling, servers, routers, hubs, and switches managed or installed by third parties o Malfunctioning hardware • Inability to access equipment or personnel that are required to complete the project • Conflicts or incompatibilities associated with the installation of hardware or software installed by Critical Insight • The City of Bremerton increases the scope of services requiring additional labor, hardware, software, materials, travel, lodging, meals, or other direct costs If any change(s) from impediments, complications, or the City of Bremerton changes in the scope of services cause an increase or decrease in the price or level of effort of the SOW, or the time required for the performance of any part of the work to be accomplished hereunder, whether or not such work is specifically identified in the written change, then the Critical Insights and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2024 Critical Insight,Inc.All rights reserved. 11/16 Docusign Envelope ID:OB7C2B11-A457-4B30-A652-D6CE1A691E87 price, delivery schedules and other affected provision(s), if any, as applicable, shall be equitably adjusted and this SOW shall be modified in writing by the mutual agreement of the parties in accordance with this Section. Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2024 Critical Insight,Inc.All rights reserved. 12/16 Docusign Envelope ID:OB7C2B11-A457-4B30-A652-D6CE1A691E87 Service Deliverables Description Critical Insight will provide the following deliverables as part of this project: Figure 1 - Deliverable Description Name of Deliverable Description of Deliverable Monthly Status A written status report sent monthly, including: Reports • Status of previous or currently open activities and deliverables • Number of project hours remaining • New questions or emerging needs Annual Policy A set of updated information security and data protection Review policies that are required for compliance and to increase the level of security at City of Bremerton Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2024 Critical Insight,Inc.All rights reserved. 13/16 Docusign Envelope ID:OB7C2B11-A457-4B30-A652-D6CE1A691E87 Assumptions Critical Insight used the following assumptions during development of this SOW. Any changes to these assumptions may affect the price and schedule commitments. • City of Bremerton will provide Critical Insight access to the business, customer, and technical information and facilities necessary to execute the solution • City of Bremerton will provide Critical Insight on-site and off-site access to documents necessary for this assessment • City of Bremerton will ensure that appropriate personnel are available to meet with Critical Insight, as necessary • Layer-3 devices will allow the protocols needed to discover and identify network services • Critical Insight will have approved access to vendors, for the purpose of obtaining device configurations, network diagrams, and details on monitoring or other processes that are performed on behalf of the City of Bremerton o If required, City of Bremerton will assist with obtaining this access • During this engagement, any vulnerabilities, sensitive data, or configuration data found will not be exploited or disclosed except to specified City of Bremerton staff o Discovery and investigation processes should not interrupt any processes or services or cause any impact to the availability of operations • Critical Insight will not be obligated to extend engagements when delays result from City of Bremerton's inability to meet stated prerequisites prior to an engagement, nor when delays result from City of Bremerton personnel not being available to provide required support • During this effort, Critical Insight will not be responsible for negotiations with hardware, software, or other vendors, or any other contractual relationship between City of Bremerton and third parties o Critical Insight, at the request of the City of Bremerton, will provide input to City of Bremerton regarding optimal product or vendor selection • Critical Insight will perform the work between 8:30 a.m. and 5:00 p.m. (local time) • After-hour and weekend work (when required), must be explicitly identified below or as otherwise agreed to in writing by the parties: After-hours upon request? Yes ❑ No Weekend upon request? Yes ❑ No Critical Insights and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2024 Critical Insight,Inc.All rights reserved. 14/16 Docusign Envelope ID:OB7C2B11-A457-4B30-A652-D6CE1A691E87 Location of onsite services? City of Bremerton 345 6th St, Ste 600, Bremerton, WA, US, 98310 AND/OR Remotely, especially if pandemic restrictions remain in place Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2024 Critical Insight,Inc.All rights reserved. 15/16 Docusign Envelope ID:OB7C2B11-A457-4B30-A652-D6CE1A691E87 Cost NOTE: The entire value of this contract will be paid in advance and payment is due on the Effective Date. All hours must be expended before the contract expires one year from the Effective Date. No rollover of hours will occur when this contract expires, and unused hours will be lost. Travel and Expense Reimbursement Travel, meals, lodging, and other direct costs for the described effort are expected for this project and are not included in the quote above. Where travel, meals, lodging, and other direct costs for the described effort are incurred, those expenses shall be reimbursed by City of Bremerton at actual cost. Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2024 Critical Insight,Inc.All rights reserved. 16/16