Loading...
HomeMy WebLinkAbout6624 DocuSign Envelope ID: 1CC19709-4FE3-4381-82D5-93727F153A5E CONTRACT MODIFICATION AGREEMENT NO. 1 BETWEEN THE CITY OF BREMERTON AND CRITICAL INSIGHT, INC. PROJECT 22SLCP Focused Security Gap Assessment THIS CONTRACT MODIFICATION AGREEMENT SPECIFICALLY AMENDS THE AGREEMENT(the "Contract")entered into between the City of Bremerton and Critical Insight, Inc. on Januarv5, 2024 All provisions in the Contract shall remain in full force and effect except as expressly modified by this document. For valuable consideration and by mutual consent of the parties,the modifications to the Contract are as follows: Section I.TERMS AND CONDITIONS is a modified as follows: The parties agree that, the Subrecipient, the City of Bremerton, shall use a competitive procurement process in the procurement and award of any contracts with contractors or subcontractors that are entered into under the original agreement award.The procurement process followed shall be in accordance with 2 CFR Part 200.318, General procurement standards, through 200.327, Contract provisions. Further the parties agree to the addition of the following as required by Appendix II to 2 CFR Part 200,all contracts entered into by the Subrecipient under this Agreement must include the following provisions,as applicable: 1) Contracts for more than the simplified acquisition threshold currently set at$250,000,which is the inflation adjusted amount determined by the Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council (Councils) as authorized by 41 U.S.C. 1908, must address administrative, contractual, or legal remedies in instances where contractors violate or breach contract terms, and provide for such sanctions and penalties as appropriate. 2) All contracts in excess of$10,000 must address termination for cause and for convenience by the non-federal entity including the manner by which it will be affected and the basis for settlement. 3) Equal Employment Opportunity. Except as otherwise provided under 41 CFR Part 60,all contracts that meet the definition of"federally assisted construction contract" in 41 CFR Part 60-1.3 must include the equal opportunity clause provided under 41 CFR 60-1.4(b), in accordance with Executive Order 11246, "Equal Employment Opportunity" (30 FR 12319, 12935, 3 CFR Part, 1964- 1965 Comp., p. 339), as amended by Executive Order 11375, "Amending Executive Order 11246 Relating to Equal Employment Opportunity," and implementing regulations at 41 CFR part 60, "Office of Federal Contract Compliance Programs, Equal Employment Opportunity, Department of Labor." 4) Davis-Bacon Act,as amended (40 U.S.C. 3141-3148). When required by Federal program legislation,all prime construction contracts in excess of$2,000 awarded by non-federal entities must include a provision for compliance with the Davis-Bacon Act (40 U.S.C. 3141-3144, and 3146-3148) as supplemented by Department of Labor regulations(29 CFR Part 5, "Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction"). In accordance with the statute, contractors must be required to pay wages to laborers and mechanics at a rate not less than the prevailing wages specified in a wage Page 1 of 4 Contract Modification 1 to City of Bremerton contract no. 6624 Rev. 09/2021 DocuSign Envelope ID: 1CC19709-4FE3-4381-82D5-93727F153A5E determination made by the Secretary of Labor. In addition,contractors must be required to pay wages not less than once a week. The non-federal entity must place a copy of the current prevailing wage determination issued by the Department of Labor in each solicitation. The decision to award a contract or subcontract must be conditioned upon the acceptance of the wage determination. The non-federal entity must report all suspected or reported violations to the federal awarding agency.The contracts must also include a provision for compliance with the Copeland "Anti-Kickback"Act(40 U.S.C. 3145),as supplemented by Department of Labor regulations(29 CFR Part 3, "Contractors and Subcontractors on Public Building or Public Work Financed in Whole or in Part by Loans or Grants from the United States"). The Act provides that each contractor or Subrecipient must be prohibited from inducing, by any means, any person employed in the construction,completion, or repair of public work, to give up any part of the compensation to which he or she is otherwise entitled. The non-federal entity must report all suspected or reported violations to the federal awarding agency. 5) Contract Work Hours and Safety Standards Act (40 U.S.C. 3701-3708). Where applicable, all contracts awarded by the non-federal entity in excess of $100,000 that involve the employment of mechanics or laborers must include a provision for compliance with 40 U.S.C. 3702 and 3704, as supplemented by Department of Labor regulations (29 CFR Part 5). Under 40 U.S.C. 3702 of the Act, each contractor must be required to compute the wages of every mechanic and laborer on the basis of a standard work week of 40 hours. Work in excess of the standard work week is permissible provided that the worker is compensated at a rate of not less than one and a half times the basic rate of pay for all hours worked in excess of 40 hours in the work week. The requirements of 40 U.S.C. 3704 are applicable to construction work and provide that no laborer or mechanic must be required to work in surroundings or under working conditions which are unsanitary, hazardous or dangerous. These requirements do not apply to the purchases of supplies or materials or articles ordinarily available on the open market, or contracts for transportation or transmission of intelligence. 6) Rights to Inventions Made Under a Contract or Agreement. If the federal award meets the definition of "funding agreement" under 37 CFR §401.2 (a) and the recipient or Subrecipient wishes to enter into a contract with a small business firm or nonprofit organization regarding the substitution of parties, assignment or performance of experimental, developmental, or research work under that "funding agreement," the recipient or Subrecipient must comply with the requirements of 37 CFR Part 401, "Rights to Inventions Made by Nonprofit Organizations and Small Business Firms Under Government Grants, Contracts and Cooperative Agreements,"and any implementing regulations issued by the awarding agency. 7) Clean Air Act (42 U.S.C. 7401-7671q.) and the Federal Water Pollution Control Act (33 U.S.C. 1251-1387),as amended—Contracts and subgrants of amounts in excess of $150,000 must contain a provision that requires the non-federal award to agree to comply with all applicable standards, orders or regulations issued pursuant to the Clean Air Act (42 U.S.C. 7401- 7671q) and the Federal Water Pollution Control Act as amended (33 U.S.C. 1251-1387). Violations must be reported to the federal awarding agency and the Regional Office of the Environmental Protection Agency(EPA). 8) Debarment and Suspension (Executive Orders 12549 and 12689)—A contract award (see 2 CFR 180.220) must not be made to parties listed on the government-wide exclusions in the System for Award Management (SAM), in accordance with the OMB guidelines at 2 CFR 180 that implement Executive Orders 12549 (3 CFR part 1986 Comp., p. 189) and 12689 (3 CFR part 1989 Comp., p. 235), "Debarment and Suspension." SAM Exclusions contains the names of parties debarred, Page 2 of 4 Contract Modification 1 to City of Bremerton contract no. 6624 Rev. 09/2021 DocuSign Envelope ID: 1CC19709-4FE3-4381-82D5-93727F153A5E suspended, or otherwise excluded by agencies, as well as parties declared ineligible under statutory or regulatory authority other than Executive Order 12549. 9) Byrd Anti-Lobbying Amendment (31 U.S.C. 1352)—Contractors that apply or bid for an award exceeding$100,000 must file the required certification. Each tier certifies to the tier above that it will not and has not used federal appropriated funds to pay any person or organization for influencing or attempting to influence an officer or employee of any agency, a member of Congress,officer or employee of Congress,or an employee of a member of Congress in connection with obtaining any federal contract,grant or any other award covered by 31 U.S.C. 1352. Each tier must also disclose any lobbying with non-federal funds that takes place in connection with obtaining any federal award. Such disclosures are forwarded from tier to tier up to the non-federal award. 10) Procurement of recovered materials—As required by 2 CFR 200.323, a non-federal entity that is a state agency or agency of a political subdivision of a state and its contractors must comply with section 6002 of the Solid Waste Disposal Act, as amended by the Resource Conservation and Recovery Act. The requirements of Section 6002 include procuring only items designated in guidelines of the Environmental Protection Agency (EPA) at 40 CFR part 247 that contain the highest percentage of recovered materials practicable, consistent with maintaining a satisfactory level of competition, where the purchase price of the item exceeds $10,000 or the value of the quantity acquired during the preceding fiscal year exceeded $10,000; procuring solid waste management services in a manner that maximizes energy procurement of recovered materials identified in the EPA guidelines. Notice of federal awarding agency requirements and regulations pertaining to reporting. Federal awarding agency requirements and regulations pertaining to copyrights and rights in data. 11) Access by the Department, the Subrecipient, the federal awarding agency, the Comptroller General of the United States, or any of their duly authorized representatives to any books, documents, papers, and records of the contractor which are directly pertinent to that specific contract for the purpose of making audit, examination, excerpts,and transcriptions. 12) Retention of all required records for six years after the Subrecipient has made final payments and all other pending matters are closed. 13) Mandatory standards and policies relating to energy efficiency which are contained in the state energy conservation plan issued in compliance with the Energy Policy and Conservation Act(Pub. L. 94-163, 89 Stat. 871). 14) Pursuant to Executive Order 13858 "Strengthening Buy-American Preferences for Infrastructure Projects," and as appropriate and to the extent consistent with law, the non- Federal entity should, to the greatest extent practicable under a Federal award, provide a preference for the purchase, acquisition, or use of goods, products, or materials produced in the United States, as required in 2 CFR Part 200.322, in every contract, subcontract, purchase order,or sub-award that is chargeable against federal financial assistance awards. 15) Per 2 C.F.R. § 200.216, prohibitions regarding certain telecommunications and video surveillance services or equipment are mandated by section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019(FY2019 NDAA), Pub. L. No. 115-232 (2018). 16)The Department reserves the right to review the Subrecipient's procurement plans and documents and require the Subrecipient to make changes to bring its plans and documents into compliance with the requirements of 2 CFR Part 200.317 through 200.327. The Subrecipient must ensure that its procurement process requires contractors and subcontractors to provide adequate documentation with sufficient detail to support the costs of the project and to allow both the Subrecipient and Department to make a determination on eligibility of project costs. Page 3 of 4 Contract Modification 1 to City of Bremerton contract no. 6624 Rev. 09/2021 DocuSign Envelope ID: 1CC19709-4FE3-4381-82D5-93727F153A5E 17) All contracting agreements entered into pursuant to this Agreement shall incorporate this Agreement by reference. II. Critical Insight, Inc. accepts all requirements of this Contract Modification by endorsing below. The undersigned approves the foregoing Contract Modification as to the changes, if any, in the contract price specified for each item, including any and all supervision costs and other miscellaneous costs relating to the change in work, and as to the extension of time allowed, if any, for completion of the entire work due to said Contract Modification. This document will become a supplement of the contract and all provisions will apply hereto. It is understood that this Contract Modification shall be effective when approved by the City of Bremerton. The parties whose names appear below warrant that they are authorized to enter into a contract modification that is binding on the parties of this contract. In addition,Critical Insight,Inc warrants that it has or will inform the surety of this change, and shall take appropriate action to modify any bonds required under the contract to address this change. IN WITNESS WHEREOF, the parties have executed this Contract Modification on the day and year first written above. CRITIC. c ,T, NC. THE CI ��us,: I .ERTON riGu7 By. E4313D2E2A3A74CF... By. r2M e Rl e Print Name: Garrett Silver Print Name: y Its: CEO Its: Di rector of Financial Services 3/8/2024 3/14/2024 Date: Date: APPROVED AS TO FORM: ATTEST: DocuSigned by: DocuSigned by: By: '"U thief ' 1'' B : dU��i;..{.A. tkbb� ,V` Y E=tS.itS tSU40,... y 24i`D ED E4bC4 I F... KYLIE J. FINNELL, Bremerton City Attorney ANGELA HOOVER, City Clerk Page 4 of 4 Contract Modification 1 to City of Bremerton contract no. 6624 Rev. 09/2021 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D CCritical Insight STATEMENT OF SERVICE Name:Kevin Rolnick Quote Date: 12-04-2023 Email:kevin.rolnick@criticalindght.com Quote Expiration: 12-31-2023 Ph one: +1206-307-8035 Bill To: Ship To: Name: Hans Nilsson Name: Hans Nilsson Company: City of Bremerton Company: City of Bremerton Address: 345 6th Street,Suite 100, Address: 345 6th Street,Suite 100, Bremerton,WA,98337 Bremerton,WA,98337 Phone: 360-473-5477 Phone: 360-473-5477 Contract Name:OMNIA Partners-Cyber Security Solutions and Associated Products&Services Contract It: R200803 SERVICE SUBSCRIPTION Descriptio Qty auj Annual Disc Annu. MSRP I% Net Price CI-PS-FSA Focused Security Gap Assessment(NIST-CSF)' (SLEW-2023,O-12372,2-A=) 1 S20,352.00 4% S19,537.92 'Line items aibjectto Sales Tac and are not included in this quote. 'Annual cost of these line items are billed on the Initial Invoice of each year they occur. 'Intern al Reference Initial Annual Total: $19,537.92 Total Contract Value: $19,537.92 Critics Insights and the Critics Insight logo are the trademarks of Critical Insght,Inc. ©20 23 Critics Insight,Inc.All rights reserved. 1/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D TERMS AND CONDITIONS This Statement of Service ("SOS"),effective as of the date of the signature of the last party to sign (the "Effective Date") is subject to the Critical Insight Master Services Agreement,and any other Exhibits, Attachments or Amendments hereto,which are each incorporated herein by reference, and which together with this SOS constitute the "Agreement". Unless otherwise provided in this SOS,capitalized terms herein shall be as defined elsewhere in the Agreement. The terms of this Agreement constitute the final expression of the parties' binding understanding in respect to the subject matter hereof and supersede all prior or contemporaneous agreements, representations and understandings, written and oral, in respect to same. Customer acknowledges that it has read the Agreement and agrees to be bound by its terms. • The term of this SOS is 12 month(s) commencing the Effective Date hereof. • Billing shall be based on Critical Insight reporting. Critical Insight and Customer shall reconcile in good faith any discrepancies in their respective tracking records, provided Critical Insight's reporting shall control in the event of an irreconcilable discrepancy. • Customer shall be invoiced on an annual basis in advance. • The first invoice shall be issued thirty (30) days following the Effective Date. • Payment of invoiced amounts due no later than thirty (30) calendar days from date of invoice. • Pricing is based on the OMNIA Partners—Cyber Security Solutions and Associated Products & Services Contract#R200803. Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 2/32 DocuSign Envelope ID:1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D ue Critical Insight Check one of the following: ❑ Purchase Order Required ❑ Purchase Order Not Required DocuSigned by: Customer ivu FA,3 tI, Billing Contact Hans Nilsson Signature 1 Name 72E3670895-F42.4... Billing Street 345 6th Street, STE 100 Name Mike Riley Address Title Director of Financial Services City,State,Zip Bremerton, WA 98337 Billing Contact 12/20/2023 Date Phone 360 473 5306 Billing Email hans.nilsson@ci .bremerton.wa.us Critical Insight, ,—DocuSignedby: Inc. Signature C438B2E2A8A74CF... Name Garrett Silver Title CEO Date 1/2/2024 Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 3/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D EXHIBIT A eid46 C ri •ica nsi • ht ii. CITY OF BREMERTON FOCUSED SECURITY ASSESSMENT SCOPE OF WORK 12-04-2023 Presented To: Submitted by: Hans Nilsson Randy Oppenborn Network Engineer Consulting Practice Director City of Bremerton Critical Insight, Inc. 345 6th Street, Suite 100, Bremerton, WA,98337 500 Pacific Ave., Suite 650 hans.nilsson@ci.bremerton.wa.us Bremerton, WA 98337 360-473-5477 (630) 346-3525 Randy.Oppenborn@Criticallnsight.com Critical Insight°and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 4/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D Notice Critical Insight has made every reasonable attempt to ensure that the information contained within this statement of work is correct, current and properly sets forth the requirements as have been determined to date. The parties acknowledge and agree that the other party assumes no responsibility for errors that may be contained in or for misinterpretations that readers may infer from this document. Non-Disclosure Statement The information in this document is Critical Insight Confidential, and cannot be reproduced or redistributed in any way, shape, or form without prior written consent from Critical Insight, Inc. Trademark Notice 2023 Critical Insight, Inc. All Rights Reserved, Critical Insight®, the Critical Insight and Kraken logos and other trademarks, service marks, and designs are registered or unregistered trademarks of Critical Insight in the United States and in foreign countries. © Copyright 2023 Critical Insight, Inc. Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 5/32 DocuSign Envelope ID:1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D General Information Background & Objectives Purpose This SOW presents Critical Insight's approach and methodology for the following services: • A Focused Security Assessment (FSA) based on the NIST CyberSecurity Framework (CSF) and, possibly, the Health Insurance Privacy and Accountability Act (HIPAA) and the Payment Card Industry Data Security Standard (PCI DSS) This SOW includes: • Scope of Work - Critical Insight's methodology for assisting and supporting City of Bremerton's technology & executive teams, and the scope of work that will be performed • Deliverables - Description of the deliverables for this project • Project Assumptions - any assumptions that were used to derive the scope of work or pricing for this engagement Critical Insights and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 6/32 DocuSign Envelope ID:1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D Key Business and Technical Contacts Customer Business Contact Information Name: Hans Nilsson Network Engineer Mailing Address: City of Bremerton 345 6th Street, Suite 100, Bremerton, WA, 98337 E-Mail Address: hans.nilsson@ci.bremerton.wa.us Phone Number: 360-473-5477 Critical Insight Business Contact &Technical Contact Information Name: Randy Oppenborn Consulting Practice Director Mailing Address: Critical Insight, Inc. 500 Pacific Ave., Suite 650 Bremerton WA 98337 E-Mail Address: Randy.Oppenborn@Criticallnsight.com Phone Number: (630) 346-3525 Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 7/32 DocuSign Envelope ID:1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D Service Description and Scope This section provides a description of services, scope of activity, and support requirements associated with the services. Focused Security Assessment Our Focused Security Assessment approach may be summarized as a computer and network security assessment intended to provide a point-in-time snapshot of City of Bremerton's security posture, coupled with a set of prioritized recommendations for increasing the security throughout the organization. The Focused Security Assessment will focus on City of Bremerton's enterprise environment and the security management practices supporting that environment. The assessment methodology is based on standards of practice drawn from multiple sources that include the NIST Cyber Security Framework and, possibly, the PCI DSS, HIPAA and CJIS encryption and data security standards. Approach and Methodology Critical Insight will conduct up to six (6) focused information-gathering facilitation sessions at City of Bremerton. The sessions will discuss the required controls, while adding context from the current threat landscape that is relevant. The sessions will address the control standards as components that are relevant to each of the audiences (with some overlap), and conduct the delivery of information, as well as its solicitation. As the requirements are presented, a conversational narrative will be used to interview the audience as to how effectively each requirement is being currently met. This conversation will include ideas on how gaps in compliance may be met using open-source, managed services, and other methods that fit their people, process and technology with respect to cost and management requirements. Critical Insight will review the results of the interviews and develop a presentation described in the Deliverables section below. A draft of the deliverable will be provided to City of Bremerton's point of contact for approval prior to delivery in the de-brief sessions listed below. Coordination, Planning, & Project Initiation Critical Insight will provide day-to-day project management for all aspects of this project, including tracking and resolution of project related issues, progress tracking, project reporting, and communication. A key component of Critical Insight's project management approach is timely reporting of project progress and findings. This enables a proactive approach to addressing security risks discovered during the course of the project and ensures that all project stakeholders are completely informed at all times. Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 8/32 DocuSign Envelope ID:1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D Customer Resource Requirements Achieving City of Bremerton's objectives will require active participation from both the Critical Insight Project Team as well as City of Bremerton's own personnel. To ensure the timely and successful completion of this project, City of Bremerton should expect at least the following resource time commitments from its own personnel: • A Project Manager should be assigned to the project to serve as the single point of contact for the Critical Insight Project Team o The City of Bremerton may choose to assign the Project Sponsor and Project Manager role to the same person o This role will require a commitment of approximately 4 hours during the course of the project • Report Review Team o Up to 4 hours per member to conduct report reviews Project Initiation Meeting Critical Insight recognizes the value of communication and ongoing collaboration with our customers. As such, we include a project initiation meeting (kick-off meeting) with all of our engagements. During the meeting, Critical Insight will address the following topics: • Introduce key people at City of Bremerton and Critical Insight • Exchange contact information (for regular reporting and emergencies) • Review scope of services • Review communication, notification, and issue escalation procedures • Discuss other specific City of Bremerton requests and rules of engagement • Discuss the involvement of City of Bremerton staff in the project for the purpose of knowledge transfer and security • Critical Insight will discuss the deliverables required at completion of the project, the designated recipient, and the manner in which Critical Insight will forward those deliverables See Appendix: A Interview Guide for details of people, questions and times required to obtain the information requested. Approach Step 1 — Information Gathering Critical Insight will collect all relevant information from document reviews and staff interviews, and review and verify gathered data. This project will include a combination of onsite and remote work. During this time, Critical Insight focuses on information gathering Critical Insights and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 9/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D to gain a better understanding of the information security program, policy and procedural implementation, and the environment including: • Identification of the organizational structure and essential stakeholders in security management activities • The information risk environment • Governance, policy management, acceptable risk tolerance • Information security planning activities • Additional functional components of the security program and the key practices supporting the security program components • Operational risk and compliance activities • Critical issues confronting City of Bremerton • Prior information security-related assessments • The general technical architecture • Security training needs for staff • Encryption — especially on mobile devices • Limitations on information being passed (especially sensitive or regulated data) • Strengthen passwords with apps, VoIP, voicemail PINs • Incident response • Specific SSL/TLS vulnerabilities As stated, Critical Insight will derive most of the information necessary to assess the environment and supporting key practices through documentation reviews, such as policies, procedures, and plans related to information security, and interviews and subsequent discussions with knowledgeable staff responsible for various aspects of information security management including: • Executive Management • Key business unit leaders • Information Security staff • CIO, IT Management, Administrators • Developers • Staff focused on Business Continuity and Disaster Recovery • Support Functions (HR, Legal, Facilities) Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 10/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D • Others, as applicable Step 2 — Review and Analysis During remote work activities, Critical Insight professionals will analyze the information gleaned from documents provided by City of Bremerton and our interviews with various staff. The objective is to identify critical issues and develop the prioritized recommendations for improvement. Critical Insight will assess the current environment and security management practices against a standard of practice such as the NIST Cybersecurity Framework, with specifics that may draw on various regulatory requirements, for example, the PCI DSS, depending on how data housed by City of Bremerton may be within the purview of those requirements. Critical Insight will provide prioritized recommendations, based upon risk, so that City of Bremerton can meet the compliance objectives and strengthen its overall security program. Step 3 — Reporting Using the results from Steps 1 & 2, Critical Insight will develop prioritized recommendations to improve City of Bremerton's information security program. The recommendations to improve the environment will be based on aforementioned standards of practice, business requirements, internal security-related requirements, and practices used by peers. As part of this activity, Critical Insight will ensure that our recommendations and supporting rationale are clearly understood and appropriate for City of Bremerton's environment. Critical Insight will present any documentation detailing our findings and recommendations in draft form so that City of Bremerton has an opportunity to review, comment, correct, and approve the format and content prior to finalizing the deliverable documentation. This iterative process helps to ensure that City of Bremerton can make informed, incremental decisions regarding specific courses of action throughout this review. Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 11/32 DocuSign Envelope ID:1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D Schedule Period of Performance City of Bremerton understands and agrees that changes in critical factors (such as those listed below in Project Change Control, or a delay in signature of this document) may impact Critical Insight's ability to meet certain dates. Project Start Date Within Eight (8) weeks of Effective Date Project Completion Date Within Eight (8) weeks of Start Date Project Change Control Critical Insight has made every attempt to accurately estimate time required to successfully complete the project. City of Bremerton acknowledges and agrees that if impediments, complications, or City of Bremerton requested changes in scope arise, these factors are out of the control of Critical Insight, and the length of the project and associated price could be impacted. Examples of valid impediments, complications, and changes in scope consist of (but are not limited to): • City of Bremerton initiated delay where Customer is not prepared to allow Critical Insight to begin work on the agreed upon start date thus resulting in additional cost to Critical Insight for resources that have been sent to City of Bremerton's site but cannot begin the Services • City of Bremerton provided information necessary for timely delivery by Critical Insight is not accurate • Delays or problems associated with third party telecommunication equipment o This includes, but is not limited to, cabling, servers, routers, hubs, and switches managed or installed by third parties • Malfunctioning hardware • Inability to access equipment or personnel that are required to complete the project • Conflicts or incompatibilities associated with the installation of hardware or software installed by Critical Insight • City of Bremerton increases the scope of services requiring additional labor, hardware, software, materials, travel, lodging, meals, or other direct costs If any change(s) from impediments, complications, or City of Bremerton changes in the scope of services cause an increase or decrease in the price or level of effort of the SOW, or the time required for the performance of any part of the work to be accomplished Critical Insights and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 12/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D hereunder, whether or not such work is specifically identified in the written change, then the price, delivery schedules and other affected provision(s), if any, as applicable, shall be equitably adjusted and this SOW shall be modified in writing by the mutual agreement of the parties in accordance with this Section. Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 13/32 DocuSign Envelope ID:1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D Service Deliverables Description Critical Insight will provide the following deliverables as part of this project: Table 1: Deliverable Description Name of Deliverable Description of Deliverable Focused Security A report describing the activities performed, the findings and Assessment Report risk identified along with a 2-year roadmap containing a set of prioritized recommendations and next steps to mitigate the risks and increase the security posture of City of Bremerton Executive Presentation A presentation to technical, management and/or executive staff describing the finding and recommendations. Acceptance of Deliverables City of Bremerton has five (5) business days to inspect and acknowledge full delivery of the Services to be provided by Critical Insight hereunder upon completion and delivery of the Services by Critical Insight. City of Bremerton will indicate such acknowledgement by signing Critical Insight's Project Completion Form, a sample of which is attached as Appendix A: Project Completion Form. If City of Bremerton believes that Critical Insight has not fully delivered the Services to be provided hereunder and refuses to sign the Project Completion Form on that basis, City of Bremerton shall identify in reasonable detail the specific Services or deliverables which City of Bremerton believes were not delivered, with specific reference to the corresponding sections of this SOW, via written notice to Critical Insight within such five (5) business day period. Following Critical Insight's receipt of any such notification, the parties shall cooperate in good faith to promptly address and resolve any remaining Service delivery requirements. Upon Critical Insight's delivery of the remaining Services, if any, City of Bremerton's right to inspect and acknowledge full delivery shall be as stated above. If City of Bremerton fails to provide such acknowledgement or notice within the five (5) business days of receiving final deliverables, City of Bremerton agrees that the services shall be deemed fully delivered to City of Bremerton, even if City of Bremerton has not signed the Critical Insight Project Completion Form. Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 14/32 DocuSign Envelope ID:1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D Assumptions Critical Insight used the following assumptions during development of this SOW. Any changes to these assumptions may affect the price and schedule commitment. • City of Bremerton will provide Critical Insight access to the business, customer, and technical information, and facilities necessary to execute the solution • City of Bremerton will provide Critical Insight on-site and off-site access to documents necessary for this assessment • City of Bremerton will ensure that appropriate personnel are available to meet with Critical Insight, as necessary • The Critical Insight professional working day is eight hours, including reasonable time for meals o Critical Insight understands that occasions arise during customer engagements that require a longer or shorter working day • Critical Insight will not be obligated to extend engagements when delays result from City of Bremerton's inability to meet stated prerequisites prior to an engagement, nor when delays result from City of Bremerton personnel not being available to provide required support • During this effort, Critical Insight will not be responsible for negotiations with hardware, software, or other vendors, or any other contractual relationship between City of Bremerton and third parties o Critical Insight, at the request of City of Bremerton, will provide input to City of Bremerton regarding optimal product or vendor selection • Any application code, documentation, and/or presentations developed under this SOW will be in English • Critical Insight will perform the work between 8:30 a.m. and 5:00 p.m. (local time) • After-hour and weekend work (when required), must be explicitly identified below or as otherwise agreed to in writing by the parties: After-hours upon request? Yes ❑ No Weekend upon request? Yes ❑ No Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 15/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D Location of onsite services? All work can be conducted remotely Or City of Bremerton 345 6th Street, Suite 100, Bremerton, WA, 98337 Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 16/32 DocuSign Envelope ID:1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D Cost Travel and Expense Reimbursement All work can be conducted remotely, if desired or requested. Travel and expenses are not required on this engagement, especially if pandemic restrictions are in place. If travel, meals, lodging, and other direct costs for the described effort are incurred after obtaining approval from the City of Bremerton, those expenses shall be reimbursed by City of Bremerton at actual cost. Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 17/32 DocuSign Envelope ID:1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D Appendix A: Interview Guide Onsite Meetings • Personnel for Interviews, time commitments and questions: • IT Administration / Network Ops / Telecom / Infrastructure / Wireless Networking / Desktop Support / InfoSec Interview Session: Desktop admins, AD admins, Helpdesk, Network Admins, Wireless admins, architects (add InfoSec staff if the same people of if we want to combine efforts) meet for up to 2 hours (or 3-4 hours if we include the Information Security Operations staff if you have that role, which is up to you but might be a good idea. At many places, InfoSec is the same as IT, so these happen together anyway.) • Network Team • Go over network diagram or whiteboard • Describe the use of VPNs • Describe WAN connections • Are VLANs used and are they ACLed? • Do you control what network services and protocols are allowed on the inside of your network? • How do you grant and remove administrative access to network devices? • How do you maintain the patch levels and update to new versions for the network devices? • Do you apply role-based access to network devices? • Do you follow the Principle of Least Privilege when assigning access roles? • Do you follow the manufacturers configuration guides or other secure configuration benchmark like The Center for Internet Security or NIST? • Do you conduct security testing of the network after every significant update or major configuration change? • Describe any RADIUS implementations • Do you use secure configuration benchmarks such as NIST or CIS for guiding configuration of security and network devices? • IT Administrators • Describe IT and IS policies that apply to your work Critical Insights and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 18/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D • Describe desktop and server build and management practices and technologies as well as laptop/mobile workstation build and management practices and technologies • Secure configuration baseline from CIS, NIST, MSFT? • Do you use Shared Accounts such as the Local Administrative Password or Root Account? • Is the Windows Firewall up by default or controlled by the network profile? • What Antivirus is used and how are alerts, missed signature updates and missed software updates alerted and resolved? • Is full disk encryption, such as BitLocker, in use and are Additional Decryption Keys managed by IT? • Describe your AD/LDAP management practices? • Is Role-Based Access Control (RBAC) used for access in applications? Are AD groups used to provide Role-Based Access Control (RBAC) for users access to systems, file shares or applications? How about machines being restricted to what other machines they can access using AG groups? • Are AD Domain Admin and other highly privileged accounts provided limited to only those needing that level of access to do their job? • Do users have local administrator rights on their workstations and are they able to install their own software? • How does the staff find out about the publication of security patches, updates and security fixes and how are they tested, implemented, and validated? • Is local software, like Adobe Acrobat, Flash, Java, etc. patched along with other software on workstations, laptops and servers? • GPOs applied to enforce security: • Password requirements • Account lockout requirements • Logging configuration for servers and workstations • Firewall policy • Describe Mobile device management practices and technologies • Describe VoIP/phone architecture and management practices and technologies including if an IVR is in use Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 19/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D • Using PKI or AD certificates? Describe how. • Do you use Shared Accounts such a shared Linux/Unix Root Account or admin on networking gear like switches? • Describe Change control practices • How do you grant and remove access to onsite and SaaS applications? • How do you connect to systems when conducting administrative activities? • Have you documented justification for every rule in your Firewall configurations? • Describe remote access uses and capabilities. • Operational Technologies (OT) • List all OT in use: water, wastewater/sewer, stormwater, electric utility distribution, water production/distribution, Adaptive Traffic Management Systems (ATMS), waste-to-energy plants with technologies such as SCADA, ICS, PLCs, industrial ethernet, RF, HVAC, Card Key, Video Monitoring, parking systems • How is OT in the field, like ATMS cabinets on street corners, secured from tampering? • How are they managed and by whom (Vendor managed?) • How and when are security patches installed on OT systems? • Are Vendors servicing these systems required to get preapproval before working on any OT systems? • Are there employees background checked (usually enforced by contract)? • Are Vendor's laptops or systems connecting to your network checked for current antivirus protection before being allowed to connect? • CIO/Dir. of IT/CISO/Dir. of Security, Security Personnel: Administrators and Designers of Firewalls, VPNs and Gateways, Intrusion Detection Systems/Intrusion Prevention Systems, Data Loss Prevention, AV/Anti-malware, File Interiority Monitoring, Encryption Systems • Do you have cyber-insurance? Does it also cover fraud (phishing, phone scams, Business Email Compromise (BEC))? • Is data security and ownership covered in the procurement process and in vendor contracts? Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 20/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D • How is Information Security Governance conducted? Describe the decision- making processes for procurement, security decision making processes for projects or decision-making processes for outsourcing, change control and change management, compliance, risk management and governance? • How are requests for exceptions to policy handled? • Are Information Security and Acceptable Use Policies and Operational Security Procedures documented? Are they maintained and reapproved annually? Are they well known and do employees receive training on them? • Is Security Awareness training conducted and how often? • Is there an IR Plan and is it tested periodically with Tabletop Exercises (TTEs)? • Do you incorporate security into your procurement process and if so how? • Is an Enterprise Security Risk assessment conducted annually? • What regulations are you required to comply with and have you achieved compliance with those regulations and standards (i.e. HIPAA, PCI, HIPAA, CJIS, NERC CIP etc.)? • Describe Monitoring, Alerting and Incident Response technology and process • Describe the Vulnerability Management process • Describe any security testing processes • Describe Security Requirements gathering for projects and procurement • Describe the nature and management of operational Security • Do you run security testing and how often? Vulnerability assessment? Network penetration testing? Web application pentesting and security code review? Wireless assessments? Phishing exercise? Password cracking to test for strong passwords? Security testing for digital printers, HVAC, other operational technology (GT)? • Describe the operational security controls and technologies in use such as Firewalls, IDS/IPS, DLP, Encryption, email security, SIEM, etc. in use and how they systems are monitored for alerts? • Do you require secure baseline configurations for all IT systems and do you regular monitor those configurations? • Do you use Network Access Control technologies? • Is your firewall in a Default Deny configuration? • Are all rules documented with a business function? Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 21/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D • Are the firewalls and any network ACLs reviewed regularly? • Describe the Monitoring, Alerting and Incident Response systems and processes • Describe the Vulnerability Management systems and processes • Describe the process of gathering security requirements for new or updated technology and infrastructure • Describe the Security Testing systems and processes in use and how the findings are incorporated into the environment and processes • Do you conduct audits on the network and on system to find regulated or classified data and assess if it is being handled correctly? • Do you use any data monitoring technologies or is DLP incorporated into the regulated or classified data protection measures? • How are resets performed and how are identities verified prior to issuance of a new password? • HR Interview Session: Staff who are knowledgeable about hiring, termination, job role change, and training practices, approximately 1/2 hour. • Hiring process, termination process, training requirements policy enforcement • Do you conduct Background Checks prior to hiring and for what positions? • Describe standard and hostile terminations or job position shifts? • Do you assist in enforcement of Policy violations? Do you use a progressive discipline system? • How does HR notify other departments and the facilities managers of an upcoming separation? Are there forms used to track the collection of assets and the removal of both physical and logical access? • Procurement Interview Session: Purchasing, Contracts, approximately 1/2 hour. • Describe security in the procurement process - Are security risks weighed as a part of the procurement process? • Do you have a process to determine security requirements prior to evaluating products, vendors and services and are security or regulatory requirements made a part of the procurement evaluation process? • Are specific statements required to be in contracts that cover security of CCL assets and data? • Do you have regulated data or operations that requires singing of data sharing agreements or business associate agreements? Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 22/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D • Is there a process to monitor vendor compliance and are there measures taken if a vendor is found to not be in compliance? • Development Teams and Managers and Applications/Database Interview Session: In-house development staff and managers and staff who are knowledgeable about the team's practices, methods of operation, use of encryption in apps and databases and the development process, up to 1-1 1/2 hours • Dev Team and Dev Managers: • Describe the SDLC? • Waterfall, Agile, DevSecOps methods used? • What coding standards are being used and are they documented? • Are developers required to take OWASP security training? • When and how often is testing performed and what kind of testing is performed? Security code reviews? Web application penetration tests? Testing based on OWASP? • Is there logical separation of Dev, Test, and Prod environments? • Who is allowed to promote code and how is it approved? • Is there segregation of duties between developers and production administrators? • Is live data every used in Dev or Prod? • Describe developer training. • Describe the results of the last or typical security code review. • Describe the last or typical web application security assessment. • What is the process for incorporating lessons learned back into the coding standards and practices? • How do you assess the controls expected on classified systems or systems and networks handling regulated or classified data? • Do you apply role-based access to applications and systems using regulated or classified data? • Do you follow the Principle of Least Privilege when creating Windows, applications and SaaS access roles for regulated or classified data? • DBAs and Application Administrators: • Cloud SaaS or on premises? • How do you provide access based on the principle of least privilege? Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 23/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D • Is all access to the application for users entirely role-based access control (RBAC) and what are those roles based on? • Is access reviewed periodically and how often? • How is access approved? • Do you use multifactor authentication for access whether by users or by administrators? • How are users decommissioned? • How are connections made to the DB, stored procedures or direct DB calls? • Is data encryption enforced at the application layer or the DB layer and how and what ciphers? • What authentication methods are used for the application and where can the application be accessed from, i.e. the Internet or internal only? • Is the application using a fat client, thin client, Citrix/RDP or VPN? • Facilities and Plant Interview Session: People whose responsibilities include building and facility access control, employee and visitor badging and escorting, video monitoring, card key and physical key systems, datacenter controls such as back-up power, temperature sensors, water sensors, fire suppression, paper and media management and disposal (shredding), up to 1 hour • Describe physical security controls • Card keys • Duplicates allowed? • Temp card keys issued to employees when left 'at home'? • Are access records logged, where are they logged, and how long are the logs being retained for? • Fail open or fail closed? • Is the card key system patched regular (just like other computers on the network)? • Door force alarms? Who responds? • Keys • Masters/submasters in use? How are they issued, to whom? • Do you re-core any affected lock when a key is lost or not returned upon employee separation/termination? Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 24/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D • Are key safes in use? • Does your team control file cabinet keys? If not, who does? • PIN pad entry • Are all codes unique to an individual? • Do the PIN system log accesses and identify the person who used the PIN pad for entry? • Cameras/Video Monitoring • All locations? • Are videos streams monitored in real time or only after an incident? • Where are the videos stored, and how long are they being retained for? • Is the video monitoring system patched regular (just like other computers on the network)? • For the video monitoring in datacenters, are all ingress/egress cameras located within the datacenter and facing the door from the inside? • Describe Fire/Water/Temp alerts in Datacenters • Describe business continuity plan for facilities including back-up generators and the amount of time available based on fuel storage • Describe media destruction and disposal — shred bins? Contracted destruction services? Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 25/32 DocuSign Envelope ID:1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D Cr Critical Insight CRITICAL INSIGHT MASTER SERVICES AGREEMENT THIS MASTER SERVICES AGREEMENT ("MSA"), together with any then-current Statement of Service ("SOS") between Customer and Critical Insight, Inc.("CI") and the related exhibits, documentation and specifications CI may from time to time deliver or make available to Customer, govern and control the Services described in the ordering SOS. Capitalized terms not otherwise defined below shall have the meaning assigned to them in the SOS. Unless otherwise stated in a SOS,the terms of this MSA shall control any conflicting or inconsistent term in such SOS. 1. Definitions. Capitalized terms in this Agreement not otherwise defined have the meaning described below, for both singular and plural form. a. "Agreement" means this MSA, each SOS, and each exhibit that supplements the MSA and/or a SOS, as each such document may be amended from time to time. b. "Appliance" means the computer hardware unit integrated in Customer's Internet server stack as part of Cl's provisioning process and included in, and required to enable activation and performance of,the CI Products. c. "Cl Assets" means all computer hardware, software, networking tools and equipment, appliances and devices owned and operated by CI that are deployed or engaged in performance, in whole or part, of the Services, including any Appliance(s) provided to Customer in connection with the Services. d. "Cl Products" means the CI Programs, Appliances, monitoring and response services, action plans, Reports, graphics, pictorial and functional representations, spreadsheets, presentations, analyses, processes, methods, procedures, concepts, know-how, techniques, practices, and all related manuals and Documentation, and modifications and improvements in respect to any of the foregoing, provided, delivered or made available to Customer by CI pursuant to a mutually executed SOS. e. "Cl Programs" means the Critical InsightTM monitoring software programs and applications, designs, inventions, source code, tools, patches, updates and new versions to any of the foregoing, user ID's, user interfaces, tokens, passwords and portals licensed to Customer by CI as part of the CI Products but excludes third-party software and custom programs, if any, developed by CI for Customer. f. "Cl Services" means the consulting services described in the ordering SOS and any other professional services that CI provides to Customer at Customer's request g. "Customer Data" means the in-bound and out-bound Internet borne data hosted on Customer's proprietary servers that is accessed and monitored by the CI Programs. h. "Customer Infringement Exclusion" means (i) Customer's use of the CI Programs except as permitted under this Agreement or Customer's combination of the CI Programs with any hardware, software or other materials either that are not provided by CI, or that could not reasonably have been anticipated to be used in combination with the CI Programs, in each case where absent such combination the CI Programs would be non-infringing, (ii) Customer's use of other than the most current release of the CI Programs that results in a claim or action for infringement that could have been avoided by use of the current release, provided that CI has supplied Customer with the most current release at no additional fee, or(iii) the provision by Customer to CI of materials, designs, know-how, software or other intellectual property with instructions to CI to use the same in connection with the CI Programs. i. "Confidential Information" means all information, data, and material one party hereto(the receiving party) obtains from the other party (the disclosing party) in connection with this Agreement; provided, that Confidential Information does not include information that: (i) was known to the receiving party without restriction before receipt from the disclosing party; (ii) is publicly available through no fault of the receiving party; (iii) is rightfully received by the receiving party from a third party without a duty of confidentiality; or(iv) is independently developed by the receiving party without reference to any Confidential Information of the disclosing party. Confidential Information also includes the terms of this Agreement, non-public personal or financial information relating to a party's employees, customers or contractors, all trade secrets, processes, proprietary data, information or documentation and any pricing or product information the disclosing party provides to the receiving party. j. "Documentation" means the Service descriptions, playbooks, instructions and protocols set forth in digital or hard copy format and provided or made available to Customer by Cl. k. "Effective Date" means the date set forth in the signature block of this Agreement. I. "Excused Downtime" means any of the following: (i)force majeure events as defined in Section 16.a. hereof; (ii) data transmission failures outside the control of CI; and (iii) scheduled and emergency maintenance outages. Schedule maintenance is generally conducted between the hours of 8 p.m. Saturday and 8 a.m. Sunday, U.S. Pacific Time. Maintenance outages include, without limitation, installation of software updates and patches,service packs and routine server and application configuration changes. CI may schedule a non- routine maintenance outage on an as needed basis in its sole discretion and,except in instances of emergency maintenance, will use commercially reasonable efforts to notify Customer forty-eight(48) hours in advance of any such outage. Critical Insight''and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 26/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D m. "Report" means any written summary, analysis, finding, schedule or other, similar document prepared for Customer by CI as part of the Services specified in the ordering SOS. n. "Security Breach" means the actual or suspected unauthorized third-party access to or use of the CI Assets that compromises the security or functionality of such assets or the confidentiality or integrity of any Customer Confidential Information stored thereon. o. "Services" means the CI Products and CI Services together. p. "Services Term" shall have the meaning set forth in Section 11.a. hereof. q. "Termination Event" means with respect to either party, that party becomes the subject of a proceeding under the Bankruptcy Code, (i) seeking the appointment of a trustee, receiver or custodian or(ii) seeking the liquidation, winding-up, dissolution, reorganization or the like of such party, and the proceeding is not dismissed within 30 days of its commencement. If a party is subject to a Termination Event, such party shall promptly use commercially reasonable efforts to seek court authorization to pay all post-petition fees as an administrative expense. r. "Termination Fee" means the pro-rated portion of the total Service fee specified in the ordering SOS applicable to the period remaining in the then current Services Term as of the effective date of termination. 2. Services. CI will provide Customer the Services set forth in one or more SOS's, which the parties may enter into from time to time,for the term of such SOS. Each SOS, and any related exhibits,will provide additional terms and conditions specific to the Services described in such SOS. 3. Implementation &Performance. At all times during the term of the SOS, Customer will provide to CI such access to Customer's technology infrastructure, including proprietary and licensed software and service programs and applications, and authorized personnel as specified in the SOS, the Documentation, and as CI may otherwise reasonably require to configure, integrate, enable, deliver and perform the Services set forth in the SOS.Customer will promptly obtain and provide to CI any required licenses, approvals, consents, permissions and credentials to Customer's facilities, systems, hardware, devices, software and services, as necessary for Cl's timely access, performance and delivery of the Services. Customer acknowledges and agrees (a)that Cl's performance and delivery of the Services are at all times conditioned upon (i) Customer providing timely, secure and unencumbered access to Customer's authorized personnel, facilities, equipment, systems, hardware, software, devices, network and data, and (ii) Customer's timely decision-making and granting of approvals, authorizations or permissions; and (b) that CI shall not be in breach of its Services obligations hereunder, or liable for any resulting loss, damage or injury, arising from or in any way related to (A) Customer's failure to timely satisfy and perform the conditions to Cl's performance herein specified, or (B) Cl's implementation and performance of Documentation-authorized protocols. 4. CI Program License. Upon mutual execution of an SOS for delivery of CI Program support, payment of the fees set forth in such SOS and for the duration of the term of such SOS, Customer will have a nonexclusive, non-assignable (except as provided in Section 16.e.), non-sublicensable, royalty-free, worldwide limited right to access and use the CI Programs solely for Customer's internal business operations and subject to the terms of this Agreement. Only Customer's authorized personnel may access and use the CI Programs, and Customer is solely responsible for compliance with this Agreement by users accessing the CI Programs with Customer's credentials. 5. Ownership and Restrictions.Customer retains all ownership and intellectual property rights in and to Customer Data and, subject to timely payment of applicable Service fees, any Reports prepared by CI for Customer. CI irrevocably assigns and transfers to Customer all of its worldwide right and title to, and interest in, the Reports, including all associated copyright, patent, trade secret, trademark and any other intellectual property or proprietary rights ("Intellectual Property Rights"). Additionally, CI grants to Customer a non-exclusive, worldwide, royalty-free, irrevocable, perpetual, non-terminable,transferable, sublicensable license to all Intellectual Property Rights used in the creation of the Reports in order for Customer to exercise its rights in the Reports as contemplated by the applicable SOS. Without limiting the foregoing, (i)the Reports are"works made for hire"to the extent permitted by law, and (ii) CI will not assert, and otherwise waives, any"moral rights" in the Reports and CI hereby assigns all right,title and interest in such materials to Customer and agrees to reasonably assist Customer, at Customer's expense, to perfect such interest. Except for Reports provided to Customer as part of the Services, CI retains all ownership and Intellectual Property Rights in and to the Services, and in furtherance thereof, Customer may not a. Remove or modify any proprietary marking or notice of Cl's proprietary rights; b. Make any aspect of the Services available in any manner to any third party for commercial use by such party, unless such access in expressly permitted in a SOS; c. Modify, make derivative works from, disassemble, reverse engineer or reverse compile any part of the Services (the foregoing prohibition includes, without limitation, review of data structures, signatures or similar materials produced by the Services), or access or use the Services in order to build or support, and/or assist a third party in building or supporting, products or services competitive to CI; d. Except for Reports and as required by applicable law, disclose to any third party the results of any Service without Cl's prior written consent; e. License, sell, rent, lease, transfer, assign, distribute, display, host, outsource, disclose, permit timeshare or service bureau use, or otherwise commercially exploit or make the Services available to any third party other than as expressly authorized under this Agreement. Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 27/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D 6. Exclusions. Customer is solely responsible for any hardware, software and networking tools, devices and appliances that are not provided by CI pursuant to this Agreement.Customer's responsibilities include,without limitation, Customer systems installation, maintenance and administrator activities, software and application licensing requirements, conditions and related financial commitments. Customer is solely responsible, at Customer's expense,for establishing, maintaining, operating and regulating Customer's access to the Internet, including without limitation, all computer hardware and software and properly configured and installed systems, browsers, modems,access lines and distributed networks necessary to enable, maintain, monitor and control Customer's Internet access. 7. CI Assets. During the term of this Agreement, CI shall observe and maintain data, technical and physical systems and asset security, personnel practices, and continuous monitoring and maintenance protocols in respect to each of the foregoing, all in design, manner and practice consistent with then prevailing industry standards, to: (a) protect and maintain the integrity of (i) all Customer Data and Customer Confidential Information in Cl's possession, and (ii) CI Assets, from unauthorized use, alteration, access, disclosure, damage or destruction; (b) detect, protect against and prevent a Security Breach; and (c) provide CI employees and agents the appropriate training necessary to maintain the confidentiality, security and physical integrity of (i) Customer Data and Customer Confidential Information in Cl's possession, (ii) Critical Insights Confidential Information, and (iii)the CI Assets. CI shall promptly notify Customer upon discovery of a confirmed Security Breach. 8. CI Programs Service Levels. CI will use commercially reasonable efforts to achieve the minimum availability of the CI Programs set forth in the Documentation, not including the Excused Downtime, and CI will monitor the availability of its systems on a 24/7 basis. 9. Warranties, Disclaimers and Exclusive Remedies. CI warrants (i) that the CI Products will be performed in all material respects in accordance with the Service Documentation referenced in the ordering SOS, (ii) that the CI Programs shall be maintained and available at the service levels specified in Section 8 hereof, and (iii) that the CI Services will be performed in a good and workmanlike manner substantially in accordance with industry standards. If the Services provided to Customer for any given calendar month during the Services Term are not performed as warranted, Customer must provide written notice to CI no later than five (5) business days after the last calendar day of such month or, if different, as provided in the ordering SOS. CI DOES NOT GUARANTEE THAT THE SERVICES WILL BE PERFORMED ERROR-FREE OR UNINTERRUPTED, OR THAT CI WLL CORRECT ALL SERVICE ERRORS. CUSTOMER ACKNOWLEDGES THAT CI DOES NOT CONTROL THE TRANSFER OF DATA OVER COMMUNICATIONS FACILITIES, INCLUDING WITHOUT LIMITATION,THE INTERNET, AND THAT THE SERVICES MAY BE SUBJECT TO THE LIMITATION, DELAYS, AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. IN ADDITION, DELIVERY OF THE CI SERVICES MAY BE CONTINGENT UPON THE ACCESS, SUPPORT AND COOPERATION OF CUSTOMER, WITHOUT WHICH SUCH SERVICES CANNOT BE PERFORMED. CI IS NOT RESPONSIBLE FOR, AND SPECIFICALLY DISCLAIMES LIABILITY FOR, ANY DELAYS, DELIVERY OR SERVICE FAILURES OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS AND CONDITIONS. FOR ANY BREACH OF THE ABOVE WARRANTIES, CI WLL REMIT A SERVICE FEE CREDIT TO CUSTOMER EQUAL TO TEN PERCENT (10%) OF (A), IF FOR CI PRODUCTS, THE NET MONTHLY FEES FOR THE APPLICABLE CI PRODUCTS FOR THE MONTH IN WHICH THE BREACH OCCURRED; AND (B), IF FOR CI SERVICES, THE NET SERVICE FEE SET FORTH IN THE ORDERING SOS. THE CREDIT WLL BE APPLIED AS FOLLOWS: (X) FOR CI PRODUCTS, AT CUSTOMER'S SOLE ELECTION, (i) AS AN OFFSET AGAINST ACCRUED BUT UNPAID FEES THEN OWED TO CI, IF ANY, (ii) AS A CREDIT TOWARD RENEWAL TERM FEES, IF ANY, NEXT COMING DUE, OR (iii) AS A REFUND PAYMENT BY CI; AND (Y) FOR CI SERVICES, ONLY AS AN OFFSET TOWARD ANY ACCRUED BUT UNPAID FEES OWED TO CI FOR THE RELATED SERVICES, AND APPLICATION OR REMITTANCE, AS THE CASE MAY BE, OF SUCH CREDIT WLL REPRESENT CUSTOMER'S EXCLUSIVE REMEDY, AND FULL SATISFACTION OF CI'S SOLE LIABILITY, FOR ALL WARRANTIES SPECIFIED IN THIS AGREEMENT. EXCEPT AS SPECIFICALLY SET FORTH HEREIN, THE SERVICES, INCLUDING ANY REPORTS OR OTHER TANGIBLE OR INTANGIBLE ITEMS FURNISHED BY CI TO CUSTOMER, ARE PROVIDED ON AN "AS IS" BASIS WITH NO WARRANTIES OR REPRESENTATIONS OF ANY KIND. CI MAKES NO WARRANTY, EXPRESS OR IMPLIED, THAT THE SERVICES WILL RENDER CUSTOMER'S NETWORK AND SYSTEMS SAFE FROM MALICIOUS CODE, INTRUSIONS, OR OTHER SECURITY RISKS OR BREACHES OR THAT THE SERVICES WLL DETECT, REPORT OR NEUTRALIZE ALL SUCH MALICIOUS CODE, INTRUSIONS, SECURITY RISKS OR BREACHES. TO THE EXTENT NOT PROHIBITED BY LAW, THE FOREGOING WARRANTIES ARE EXCLUSIVE AND THERE ARE NO OTHER EXPRESS OR IMPLIED WARRANTIES OR CONDITIONS OF ANY KIND, INCLUDING FOR HARDWARE, SOFTWARE, SYSTEMS, NETWORKS, ENVIRONMENTS OR SERVICES OR FOR MERCHANTABILITY, NONINFRINGEMENT, SATISFACTORY QUALITY AND FITNESS FOR A PARTICULAR PURPOSE. 10. Indemnity. a. CI Infringement Indemnity. Subject to Section 10.c., CI will defend Customer in any suit or cause of action, and indemnify and hold Customer harmless against, and pay on behalf of Customer, any damages awarded to third parties in any such suit or cause of action (including reasonable attorneys'fees awarded to such third Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 28/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D parties and settlement amounts) alleging that the CI Programs as provided by CI and used in accordance with the terms of this Agreement infringe upon any United States patent, copyright,trade secret,or other proprietary right of a third party, provided that,the foregoing infringement indemnity will not apply and CI will not be liable for any damages assessed in any suit or cause of action to the extent resulting from a Customer Infringement Exclusion. If any CI Program is held or believed to infringe on any third party's intellectual property rights, CI may, in its sole discretion, (i) modify the CI Program to be non-infringing, (ii) obtain for Customer a license to continue using such CI Program, or (iii) if neither (i) nor (ii) are commercially practical, terminate this Agreement as to the infringing CI Program and return to Customer any unearned fees paid by Customer to CI in advance. This Section 10.a. states CI's entire liability and Customer's exclusive remedies for infringement of intellectual property rights of any kind. b. Customer Infringement Indemnity. Subject to Section 10.c., Customer will defend CI in any suit or cause of action, and indemnify and hold CI harmless against, and pay on behalf of CI, any damages awarded to third parties in any such suit or cause of action (including reasonable attorneys' fees awarded to such third parties and settlement amounts)alleging infringement upon any United States patent, copyright,trade secret, or other proprietary right of a third party, to the extent that any such suit or cause of action results from an allegation of a Customer Infringement Exclusion. This Section 10.b. states Customer's entire liability and CI's exclusive remedies for infringement arising from a Customer Infringement Exclusion. c. Indemnity Conditions.The indemnities set forth in this Agreement are conditioned upon the following: (i)the indemnitee ("Indemnitee") promptly notifies the indemnitor ("Indemnitor") in writing of such suit or cause of action, provided, that, any failure by Indemnitee to so promptly notify Indemnitor will not serve to reduce or forfeit an Indemnitee's rights hereunder unless and only to the extent such failure prejudices the rights and remedies of Indemnitor in respect to such suit or proceeding, (ii) the Indemnitor controls any negotiations or defense and the Indemnitee assists the Indemnitor as reasonably required by the Indemnitor, and (iii) the Indemnitee takes all reasonable steps to mitigate any potential damages that may result. 11. Term and Termination. a. Services under this Agreement shall be provided for the initial Services Term set forth in the ordering SOS. Unless CI receives written notice from Customer at least sixty (60) days prior to the expiration of the then current Services Term, the SOS and related Services shall automatically renew for successive renewal Services Terms of one(1)year each.The initial term of the Services and any renewal term thereof are, herein, the "Services Term". Upon expiration or earlier termination of the Services Term, (i) if CI Services, all obligations of CI to perform and deliver, and all rights of Customer to receive, the CI Services, including the CI Services listed on the ordering SOS, shall contemporaneously terminate, (ii) if CI Products, all rights of Customer to access and use, and all obligations of CI to enable and provide,the CI Products, including the CI Products listed in the ordering SOS, shall contemporaneously terminate, (iii) if no ordering SOS is then in effect, the term of this Agreement shall contemporaneously terminate or expire, as applicable, and (iv) Customer shall promptly assemble any Appliance(s) located on Customer's premises for retrieval by CI's designated vendor for delivery to CI (at CI's sole expense). Customer is responsible for (x) returning such Appliance(s)to CI in good and operable condition, normal wear and tear excepted,and (y)the full replacement cost of any Appliance that is damaged while in Customer's possession or that Customer otherwise fails to return to CI as herein required, which amount shall be due upon demand by Cl. b. If either party breaches a material term of the Agreement and fails to cure the breach within thirty(30)calendar days of delivery by the non-breaching party of written notice of breach and demand for cure thereof, then the breaching party is in default and the non-breaching party may without further notice to the breaching party immediately terminate the then current SOS. If CI terminates the SOS and related Services Term as specified in the immediately preceding sentence, Customer shall pay to CI all accrued but unpaid fees, if any, for the period prior to the effective date of termination, plus, as an early termination fee and not a penalty, the Termination Fee. In addition to the foregoing, any then current SOS will automatically terminate in the event of a Termination Event. c. In addition, CI may immediately upon written notice to Customer, at CI's sole election, either (i) suspend the Services under the ordering SOS, including without limitation and if applicable, Customer's passwords, account and access to and use of the CI Products, or (ii)terminate the ordering SOS, (A) if Customer fails to pay CI as required under this Agreement and fails to cure the non-payment within ten (10) calendar days of delivery by CI of written notice of breach due to non-payment, (B) if Customer violates any provision of Sections 3, 4, 5 or 13 hereof, or (C) if CI concludes that Customer's requests, requirements or commercial activities expose the Services or CI personnel to risk of harm, damage, injury, liability or violation of applicable law. Any suspension by CI of the Services under this Section 11.c. shall not excuse Customer from its continuing obligation to make payment(s) under the ordering SOS. d. Sections 1, 5, 6, 9, 10 and 12- 16 shall survive termination or expiration of this Agreement. 12. Fees, Expenses,Taxes and Invoicing. a. Customer shall pay the fees for the Services ordered as set forth in the ordering SOS. All fees due under this Agreement are non-cancelable and payments thereof are non-refundable. Customer shall reimburse CI for actual and reasonable expenses incurred by CI in performing the Services (i) only on a pass-through basis without markup, and (ii) only if preapproved by Customer in the ordering SOS or similar writing. Fees and Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 29/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D expenses, if any, listed in a SOS are exclusive of taxes. Customer is responsible for payment of any sales, value-added or similar taxes imposed by applicable law for the Services ordered by Customer, except for taxes based on Cl's income. b. Commencing the initial renewal Services Term (if any) and on an annual basis thereafter, all fees shall be subject to adjustment, in Cl's sole reasonable discretion, in an amount not to exceed the greater of (i) the change in the U.S. Department of Labor CPI-All Urban Consumers for the immediately preceding annual period, and (ii) 5%. c. Unless otherwise specified in the ordering SOS, (i)fees for CI Products are payable in advance on an annual basis, and (ii)fees for CI Services are payable in arrears on a monthly basis. In each instance payment is due within thirty (30) calendar days from the invoice date. Late payments shall accrue interest at the lesser of (i) 12% per annum, and (ii)the highest statutory rate,from the payment due date until paid in full. In the event of Customer's termination of a SOS for any reason prior to expiration of its stated Services Term, CI shall be entitled to receive, and Customer shall pay on demand, as an early termination fee and not a penalty, the Termination Fee. In the event Customer's past due account is submitted to an attorney or collections service for recovery, CI shall be entitled to recover the cost of collection, including reasonable attorneys' fees, in addition to all past due amounts. The rights and remedies set forth in this Section 12 are in addition to any other legal, equitable and contractual rights and remedies available to Cl. 13. Confidentiality; Security. a. The receiving party will use Confidential Information of the disclosing party solely for the purposes of performing its obligations under the Agreement. The receiving party will not disclose or make Confidential Information of the disclosing party available to any third party, except as specifically authorized by the disclosing party in writing. Upon the disclosing party's written request, the receiving party will promptly return to the disclosing party all of its Confidential Information, or certify in writing signed by an authorized representative that it has destroyed all such materials; provided that, in no event will the receiving party be obligated or required to amend, modify or destroy back up media and systems maintained in the ordinary course of business and designed in a manner to prevent the unauthorized access to or use of the data stored on such media and systems. Neither party will disclose to the other party or use in performance of its obligations hereunder any information, data, materials, or documents of a third party considered confidential or proprietary without the written authorization of such third party. Each party may disclose Confidential Information of the other party when compelled to do so by law if it provides, where legally permissible, reasonable prior notice to such other party. In furtherance of the foregoing, CI shall require each of its employees and agents providing any aspect of the Services hereunder to execute a confidentiality agreement incorporating confidentiality and non-use provisions consistent with, and no less restrictive than, the requirements of this Section 13.a. b. At all times during the Services Term, CI shall maintain reasonable and appropriate safeguards, security measures and protocols, which in no event shall be less effective than industry-standard safeguards, security measures and protocols, designed to (i) reasonably protect Customer's Confidential Information in Cl's possession or control from unauthorized use, alteration, access or disclosure; and (ii) detect and prevent a breach of such safeguards, security measures and protocols by any unauthorized party. c. Notwithstanding the foregoing, CI may use the Customer's information for purposes other than the performance of the Services but only in an aggregated, anonymized form,such that Customer is not identified, and Customer will have no ownership interest in such aggregated, anonymized data. 14. Limitation of Liability. WITHOUT LIMITING ANY INDEMNIFICATION OBLIGATIONS OF A PARTY UNDER SECTION 10 OF THIS AGREEMENT OR (EXCEPT AS EXPRESSLY PROVIDED OTHERWISE BELOW) THE LIABILITY OF A PARTY FOR ANY BREACH OF ITS OBLIGATIONS UNDER SECTION 13 OF THIS AGREEMENT, TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT WILL (A) EITHER PARTY BE LIABLE TO THE OTHER PARTY FOR ANY INDIRECT, INCIDENTIAL, OR CONSEQUENTIAL LOSSES OR DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, SPECIAL, PUNITIVE OR EXEMPLARY DAMAGES), WHETHER OR NOT SUCH PARTY WAS ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH LOSS OR DAMAGE AND (B) A PARTY'S TOTAL LIABILITY FOR ALL CLAIMS ARISING FROM OR RELATING TO THIS AGREEMENT, REGARDLESS OF THE NATURE OF THE CLAIM, EXCEED THE AMOUNT OF FEES PAID OR PAYABLE BY CUSTOMER UNDER THIS AGREEMENT FOR THE SERVICES DURING THE TWELVE (12)-MONTH PERIOD IMMEDIATELY PRIOR TO THE EVENT, ACT OR OMISSION GIVING RISE TO SUCH LIABILITY, EXCEPT THAT WITH REGARD TO LIABILITY OF A PARTY FOR BREACH OF ITS OBLIGATIONS UNDER SECTION 13 OF THIS AGREEMENT, IN NO EVENT SHALL EITHER PARTY'S CUMULATIVE LIABILITY EXCEED THE LESSER OF (X)THE TOTAL CONTRACT PRICE OF THE APPLICABLE SOS, OR (Y) TWO HUNDRED AND FIFTY THOUSAND DOLLARS ($250,000). THIS LIMITATION OF LIABILITY IS INTENDED TO APPLY WITHOUT REGARD TO WHETHER OTHER PROVISIONS OF THIS AGREEMENT HAVE BEEN BREACHED OR HAVE PROVEN INEFFECTIVE. 15. Export. Export laws of the United States and any other related local laws and regulations may apply to the Services. Such laws govern Customer's use of the Services and any data provided by CI to Customer under this Agreement, and Customer shall comply with all such laws and regulations. No data, information, software programs and/or other Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 30/32 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D materials resulting from the Services will be exported, directly or indirectly, in violation of these laws, or will be used for any purpose prohibited by these laws. 16. General. a. Force Majeure. Neither party shall be liable to the other party or deemed to be in default for any delay or failure in performance of any obligation under the Agreement or interruption of any Service resulting, directly or indirectly, from acts of God, civil or military authority, acts of the public enemy, acts of terrorism, acts of third parties over whom the party has no control, war, riots, civil disturbances, insurrections, accidents, fire, explosions, earthquakes, floods, epidemics, pandemics, the elements or any other similar cause beyond the reasonable control of such party. b. Audit.CI may audit, at its own expense, Customer's user logs and related data for the purpose of determining Customer's compliance with the terms of this Agreement, including any then operative SOS. Audits shall be conducted by CI or its designee and shall be limited to records from the Effective Date of the ordering SOS to the month of the audit. CI shall be limited to one(1) audit per twelve(12) consecutive calendar month period. CI shall give ten (10) business days prior written notice of its intention to perform an audit. If any audit reveals non-compliance by Customer of any material term of the Agreement, then (i) Customer shall promptly initiate and prosecute to completion any remedial action required to cure such non-compliance, provided such non- compliance is reasonably subject to cure, and (ii) if the non-compliance is a variance of 5%or more in the total count of network users upon which Customer's then-current annual subscription fee is based, then CI may adjust the annual subscription fee specified in the ordering SOS for the period then remaining in the Services. In addition, if any audit reveals actual network users exceeding contracted network users by 5% or more,then Customer shall pay CI for all underpayments, plus interest, and shall reimburse CI for the reasonable cost of the audit. c. Notice. Except as provided herein, any notice, approval or consent required or permitted hereunder shall be: (i) in writing; (ii) delivered by (A) hand or by overnight courier service, or (B) electronic mail to the respective addresses of the parties as set forth in the ordering SOS (or such other address a party may designate in writing); and (iii) effective upon actual delivery if by hand or courier service (or upon attempted delivery if receipt is refused), or upon electronic confirmation of successful delivery if by email. d. Integration; Waiver. This Agreement, including any SOS, Documentation, exhibit, document or information or policy accessed by referenced URL, is the complete agreement for the Services ordered by Customer, and supersedes all prior or contemporaneous agreements, representations and understandings, written or oral, regarding such Services. If any provision of this Agreement shall be judicially determined to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that the Agreement shall otherwise remain in full force and effect and enforceable. A party's rights, obligations and restrictions hereunder may not be waived except in a writing signed or digitally accepted by an authorized representative of each party. e. Non-Solicitation. During the term of this Agreement and for a period of twelve(12) months thereafter, neither party shall, directly or indirectly, solicit for employment, employ or engage, whether as an employee or independent contractor, any employee or independent contractor of the other party involved in the delivery, management, performance, review or acceptance of the Services or Deliverables hereunder. In the event a party hires a current or former employee or contractor of the other party in violation of this Section 16.e., the breaching party shall pay the other party, on demand, a placement fee equal to forty percent (40%) of the newly hired or engaged individual's annual base compensation (or budgeted first year aggregate fees). f. Assignment. No right or obligation under the Agreement (including the obligation to pay or right to receive monies due) may be assigned, delegated or subcontracted by a party without the prior written consent of the other party, and any purported assignment without such consent shall be void. g. Controlling Law.This Agreement shall be construed in accordance with the laws of the State of Washington without regard to its principles of conflict of laws.The exclusive jurisdiction and venue of any action relating to this Agreement shall be the Superior Court of Washington for the County of King or the United States District Court for the Western District of Washington and each party hereto submits itself to the exclusive jurisdiction of such courts and waives any argument relating to the convenience of forum. The rights and remedies herein provided are in addition to those available to either party at law or in equity. h. Customer Reference. CI may use Customer's name and logo to identify Customer as a CI customer on Cl's website and in other marketing materials so long as Customer's name and logo do not appear with greater prominence than Cl's other customers. i. Counterparts. This Agreement may be executed in any number of counterparts, each of which shall be deemed to be an original as against any party whose signature appears thereon,and all of which shall together constitute one and the same instrument. A faxed, .pdf or electronic signature shall have the same legally binding effect as an original signature. j. Modification. This Agreement and any SOS may not be changed, altered or modified except in a writing signed by an authorized representative of each of the parties hereto; provided, that, notwithstanding the foregoing, Documentation that by its terms may be modified by email communication among authorized representatives of the parties may be so modified with binding effect. Critical Insight®and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 31/32 DocuSign Envelope ID: 1 F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D IN WITNESS WHEREOF, the parties have executed this Agreement effective as of December 22, 2023 (the "Effective Date"). CRITICAL m i GIr ml COMPANY EicuSigned by: By: ritui By: ELHbH/4UF... 7 2 E Garrett Silver Mike Riley Print: Print: Title: CEO Title: Di rector of Financial Services Critical Insight°and the Critical Insight logo are the trademarks of Critical Insight,Inc. ©2023 Critical Insight,Inc.All rights reserved. 32/32 DocuSign Envelope ID: 1 F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D ®TD SYNNEX OMNIA neap Swam. 1 FARTMERS Reseller Name Full Name Email Address Diversity Status Phone Number Address City State Zip Code RATION Sanjay Shirude MO@accelbl.com Ace Solutions a rora@acesolutionsus.com MOSS,WOSB 2406033514 12000 B.CKBERRY TERRACE NORTH ACS International Resources Inc. Amit Rao procurement@acsintl.com 1330 Baltimore Pike Chadds Ford PA 90505 Advanced Network Management(ANM) ler@anm.com E Albuquerque NM Advantage Technology,LLC Michael Ferrari aMI@advantage.tech (304)342-0796 950 Kanawha Blvd East Charleston NN Advantage Technology,LLC Michael Ferrari m ari@advantage.tech (304)34 on NN e mley@advizex.com 190 Independence OH Agio�sWorld Wide,Inc. ah@agiosww.com DBE,WOBE 103 AIP US,LLC MIN WANG ANG@AIPUS.COM MBE 703O616427 27 Bleeker Alchemy Technology Group,LLC Travis Graham ravis@alchemytechgroup.com 11 Greenway Plaza,Suite 2600 Houston TX 19073 All Covered,a Division of Konica Minolta Business Solutions USA,Inc.formerly Compuquip Adam Goebel agoebel@allcovered.com 1704)972 3300 2101 Rexford Rd 416O Charlotte NC 7875O Alpha Data Tech Gino Valconi oni@alphadatatech.com SB,Minority Owned,DV,Hubzone 213 2974419 American Prison Data Systems Segun Olowofela era@apdscorporate.com 601 West 26th Street Suite 325 New York NY 34120 AMI Strategies,Inc. Jon Dezelsky JdezelskY@amistrategies.com [e 125 Livonia MI 90703 Anuvision Technologies Summer ne@anuvlslontech.com ANVIL WORKS,LLC Sara Nerenberg ara@anvilworks.com SBA,WO,VO,SDVBE,DBE ree Ranch Rd Scottsdale AZ 379, Applied Video Technology Ashley Buettner ley@applledvideo.com ArchAngel Education Technology Frandia Garcon con@arch-te.com 323 1,21 West Dixie Highway Unit11 North MiamiBeac Atrium Advisory Services Inc. Mikki Pierce info@atriumadvise.com WOSB,MBE Suite2OO Deerfield IL 12866 Attronica Don Bright onb@attronica.com (004)270 3200 11547 Nuckols Rd Glen Allen VA 11232 STEMS CONSULTING INCDBA AURORA ENTERPRISE Philip De Souza uza@aurorait.com (000)202-0696 Avexon Kern Glynn ynn@avexon.com WOSB 5048133053 141 Robert E Lee Blvd42O6 New Orleans LA 13202 Avixum,Inc. Chris McDaniel niel@Avixum.com WO 407-868-6183 3033 Winkler Ave. Ft.Myers FL 19348 AVVID IT Barry Beitz ei[z@ovitlltcom WOSB ar war@axelliant.comTorrance CA 10019 Barcodes,Inc. Carrie Woodson son@barcodesinc.com 312-5824862 200 W.Monroe Street,STE 2300 Chicago IL 28211 BEAR Cloud Technologies df@bearcloudtech.com SBFrancisco CA 33511 Bets Group Hernan Cortes rtes@betis.com 30 McLean VA 46250 ComputerBeyond Services,LLC Ervin Hughes III eahughes@beyondpcservices.com Small Business,Minority OwnedVictoria TX 20020 BIT Direct Inc Duane Turner duane@bltdirect.com 0135413571 22O2 N.West Shore Blvd,STE 2O0 Tampa FL 95045 PaganoBlackHawk Data LLC Maryann no@blackhawkll.com WBE Woman Business Enterprise 646..39061 03 New York NY 85251 Blackwood Associates Tim Hall im.hall@blackwood.alDRIVE Blue Plains Technology Steve Meany smeanY@blueplainstech.com Minority owned (3.)462-1.5 PO Box.0111 Pike Road AL 11580 Blue Plains Technology Steve Meany smeanY@blueplainstech.com Minority owned (3.)462-1.5 PO Box.0111 Pike Road AL 11727 JepsonBlueAlly,LLC Hope son@blueally.com 9192491500 1225 Crescent Green,Suite 115 3 BorderLAN Inc. Diane Rogers lane@borderlan.com tlr 0 950 Boardwalk,STE 300 San Marcos CA 60606 Brandywine Technology Group Michael McNeill mmcneill@brandywinetechnology.group 480.80,586 106 OSBORNE CIRCLE KENNETT SQUARE PA 145. BrightCentra Inc Frederick Wick frederick.wick@brightcentra.com co CA 10016 Btek Holdings LLC Bruce Banko uce@btekholdings.com Petersburg C&G Technologies Consulting itaV@CGTechnologiesconsul[ing.biz Small Business,Woman-Owned aven Drive Homosassa FL 20878 CAF TE.INC Jesse Wallace sse@caltechinc.com SB,Micro Business 40237 California Integrated Solutions,Inc. Jay Kishor lkishor@CISpc.com 90986.333 23342 Golden Springs Dr,Suite 102 Diamond Bar CA Call One Dawn Mays ays@email.calloneonllne.com al FL 40139 Can-Am Wireless Johan Rahardjo tllo@canamwireless.com MBE 5124134741 302 New Hope Or Ste 103 Cedar Park TX 3801 Can-Am Wireless,LC lo.n Rahardjo frahardjo@canamwireless.com MBE 5124134741 302 New Hope Or Ste 103 Cedar Park CARLNTECH LLC Carl Neidhardt arin@carintech.com VOSB Carpe Diem Technology Solutions LLC Kyle Lyon klyon@cdtsusa.com 216 063 6256 Raton FL 10005 CB Technologies,Inc. Rachel Nelson rachel.nelson@cbtechinc.com WOSB,WBE 770 T.City Dr S Suite 53OO Orange CA 92123 .20 Tom Frances, ski@c62O.com 518469-1281 11 Federal Street Saratoga NY 7645 .TS Technology Solutions Steve artl s ev artl@cbts.com CCT Technologies,Inc.dbaComputerLand of Silicon V y Cathy Souza uza@cland.com WO,Minority Owned STREET„SUITE 2O San Jose CA 953, COCE,Inc Brian Solomon bsolomon@cdce.com 714-282-8881 22641 Old Canal Road ',or.Linda CA 94111 COW Government LLC Anup Sreedharan ree@cdw.comAve Vernon Hills IL 77063 Challenge Innovation Technology,Inc. Kenneth Wells ells@challengetechinc.com 94591 7965 Charter Technology Solutions LLC Krone one@charterts.com Minority Owned Chi Corporation ...Thome ttme@chlcorporatlon.comPARKWAY Cincinnati Bell Technology Solutions Steve Lankard steve.lankard@cbts.com TechnologiesClear Inc Phil Godwin win@cleartechnologles.ne[ WBE,WOSB,HUB uie3OO Addison TX 7041 Clearwinds Craig Davenport ort@clearwinds.net CD,PSA 2054138323 13001 Liberty Parkway Vestavia Hills AL 90503 Cloud Revolution LLC Adam Ball adam@cloudrevolutlon.com 720.612.3454 277O Arapahoe Rd,41321O63 Lafayette CO 4116 NMSDC MBE,Arizona DBE,NYC Clutch SolLtions LLC Damien Norwood ood@clutchsolutlons.com NYS MBE Bldg.1,Suite 1O2 Mesa AZ 91789 Coast to Coast Computer Products,Inc. Melissa Servatdfoo melissa@coastcoast.com SB y CA 27608 Code 3 Technology LLC Jim Boubelik lim@code3technology.com Code 3 Technology,LLC Jim Boubelik rim@code3technology.com 0002 Mesa AZ 77099 CollabNow David Lemperle dlemperle@collabnow.biz NA 646 522 7910 370.W 22Oth Street St Polo MO 90104 Woman-Owned,Minority Owned, Commonwealth Trading Company,Inc.DBA Commonwealth Computer C p y Nikole Vaughn uhn@commonwealthcomputer.com Small Business sse@compWlnk.com (212)69 Compu-Link Denise a mile@compu-Ilnk.com MOSS (212)695-5466 261 West 39 Street,Suite 3O2 New York NY 92887 Computer Drive Amin Ismail amin@computerdrive.com Comsourcecia@comsourceny.com Comsource Inc. Adam is cia@comsourceny.com 00 Connect.Corporation Joel Raiber her@connectuscorp.com SB Continental ces,Inc.ConReS Louis Novakis Inovakis@conres.com 508-280-6465 ,5 Middlesex Turnpike Bedford MA 11961 61 Inc. her@convergeone.com (212) 3 1055 10900 NesbittAvenue S Bloomington MN 11961 Core BTS,Inc. Benjamin Golden benjamin.golden@corebts.com Parkway North Drive,Suite 32O s IN 100. Countertrade Products,Inc. m a mm@ccounntertrade.com CPAC Inc. Ace Garin arin@cpacinc.com Small Business,Woman Owned 714692-5044 4749 E.Wesley OR Anaheim CA 95635 Critical n ver@cri[icallnsight.com Crossconnect Engineering,Inc Jeff Kronlage age@crossconnect.com (719)559-5559 1155 Kelly Johnson Blvd Suite 460 Colorado Springs CO 8090 CSG Connected Solutions Group,LLC Regina Hawkins kns@thlslscsg.com SB 004 203 0605 8529 MeadowbridgeRoad Suite 300 Mechanicsville VA 13057 TELECOMMUNICATIONS NTRA CfORS INC Michael Bolling mbolling@cIcitechnology.com 152 Huron Ave Clifton NJ 7054 CTS obility°BA Complete Tablet Solutions L. tre)o@ctsmoblllry.com MBE,State of Texas HUBDrive,Ste.125 Austin TX 40114 CVE Technologies John Lee .lee@we.com (801)602-1T96 1338 Gustin Road Salt Lake dry UT 19317 CWPA Office Supplies&Services Michelle Kalkholl ring@cwpa.com WOSB 2812519814 PO Box 11309 Spring TX 83702 CWPA Office Supplies&Services Michelle Kalk holt marketing@cwpa.com WOSB 2812519814 PO Box 11309 Spring TX 98516 CyberNorth Jeremy Lombardo rdo@rybernorth.com 15 Cottage Road Unit 2433 South Portland ME 11001 Data Center Warehouse C mer@4dcw.com (949)32004509 23041 Avenida De La Carlota., Laguna Hills CA 14079 DataCom Solutions,Inc. Jerry Brooks oks)@tlatacomusa.net SB,SOB,MOSS,Hubzone Circle Huntsville AL 22003 DataPath Inc. Brian Jump mp@mytlatapath.com 209 312 9000 14151 St. Modesto CA 27514 Datel Systems Incorporated Kat Bell KBell@datelsys.com 4393 Viewridge Ave,STE C San Diego CA 22101 GroupDavenport Paul Cummings Paul.cummings@davenportgroup.com DBISP LLC Sara Vaughn sarah.vaughn@dbisplIc.com SB,MO,Ba D Indianapolis IN 66215 Derive Technologies, Martinez nez@tlerivetech.com HFLOOR New York NY 77046 Security sal@dgxsecurity.com SBE MBE DBE 2013704761 840 Bergern Ave Jersey Cry NJ 33027 Digital Scepter Jon Robinson Jon@digldlscepter.com (951)600 5000 29970 Technology Drive Ste 122B DiPersia Technology Solutions LLC Pat DIP ersia pat@dipersiatech.com e,42O6 Newton Square PA 60101 DISTINCTIVE TE.LLC Santiago Rodriguez sago@distinctivetechla.comWalnut Distributed Technology Group(DTG) Boson mark@dtg.com SDVOSB 501 Syracuse NY 55340 DITTA ENTERPRISES C Raj DrIta rogerditta@gmaLc°. 510-776-5219 235 Emerald Way Hercules CA 85262 DOF Creations,LLC Saeed el Gordon don@dofcreations.com 865.236.0498 12604 River Birch OR Riverview FL 92614 Dreadnoughtndeavors Inc Rowan Edge redge@dreadnoughtendeavors.comCalabasas CA 95126 DTG Gary Barker ker@dtgweb.com SB 8138890660 9051 Florida Mining Blvd Suite 103 Tampa FL 91381 DynTek Services,Inc. Darlene Pricher her@dyntek.com e CA 90275 EKC Enterprises,Inc Chris Shafer tee@ekccorp.com Enabling Tech Corp/Enabling Technologies Melissa Dean mtlean@enablingtechcorp.com 4436255130 20065 Corkscrew shores Blvd Estero FL 91302 Small Business, Enchanted Technology Solutions,LLC eRg@ets.us.com Minority-Owned Owned, Ownetl cost@envlsionsuccess.net 1.1)26 Envision Tech Advisors Karen iconi ePlus Technology,Inc. Amy Knower wer@eplus.com 919.010.2311 13595 Dulles Technology Drive Herndon VA 92127 HarterEsport Supply,LLC Derrek rrek@esportsupply.com O 11 Park KS 33216 Evolving Solutions Inc org@evolvingsol.com County Road 116 Hamel MN 85258 ee nga@temdel.com 240432-1422 400 E.Pratt St.,8th Floor Baltimore MD 926. TechnologiesFlagler LLC Tom Gregor om@orbcomm.com WO 5 61 229 1601 Rd Suite 2O1 on FL 94,7 Focus TS! Chris Capri° elo@roc Forward Edge(TO) Chip Logan clogan@forwartd-edge.net 2724 E Kemper Rd Sharonville OH 94566 Frontier Technology,LLC°BA MicroAge Larry Fulop lop@microage.com 480-366-2143 8160 S.Hardy Drive Tempe AZ 78759 FSR Consulting LLC e nes@clnusrystemsus.com (4O0)21 ba 4-6534 eat41O Suite2Lansdale PA 93101 Garden State Micro,In c Educate-me.net) e a ells@educate-me.ne[ GHA Technologies,Inc. Laurie Coon a oon@gha-associates.comSB 4809516865 8998 E.Raintree Drive Scottsdale AZ 98124 Global RNSC Technologies Ranult Ross _oss@globalmsc.com MBE,SDVOSB Parkway,Building 100,STE 5OO Atlanta GA 13104 Golden Gate Systems LLC Larry Suezaki Isuezaki@goldengatesystems.com 400 9464746 320 Spence Avenue Milpitas CA Small Business,Woman Owned, Golden Star Technology, c.DBA GST Dennis Wang dpwang@gstes.com Minority Owned 5623450111 C. Eric Young Brit@googoz.com 1255 Treat Blvd.,Suite 300 Walnut Creek CA 15668 GovOiirect,Inc. left Blair jblair@govtllrectcom (888)O6O4431 600 Cleveland Street,Suite 1O0 Clearwater FL 04107 Granite Financial Solutions dba Granite Data Solutions Brigg Goodwin gg@grani[edata.com Disabled Veteran Owned Company 5321 Luce Ave McClellan CA 87109 Holman's Inc Phil Abeyta yta@holmans.com 800-545-0932 ...Jefferson St Albuquerque NM 85260 HYPERTEC USA INC. Angela ino Ino@hypertec.com 95035 Copy Inc.DBA IBE DigitalSloan Varing Sloan@Ibedigl[al.com 562 921 0202 11266 Monarch St suite B Garden Grove CA Woman-Owned,Texas HUB,WBE, iBridgeGroup,Inc. Jennifer Cumpian jennifer.cumpian@ibridgegroup.com WOSB,SBE 512)031-3399 88.Business Park Dr.,STE 1OO Austin TX 9,92 ICP INC Anthony co aantico@icpcorp.com WBE 210 556 6952 20 Clifton Ave Staten Isla. NY 91502 imageOne Jason lnker floker@imageoneway.com 13201 CapitalS[ Oak Park MI 89123 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D SB 33755 55437 Pipd:a „44.4m ,dd Ellicott Cs. MD 11307 !ShiftRC Mark G.gins nec.girS@bhfft net Snell Sminess 430477-5C50 7014ECa melba..,Suite1452 Scottsdale AZ Kane Communicatbrs Paul Wan Paul Nobn@larecomm.com €02-536330 572 Whftehad Rced,Mg 2 Trenton f, 77391 SB SB Link HO T.hmkgies Inc Victor Liu victor@linkhth.com MBE (973) re6643 36364 Lucinda rr Ben Groff bgroff@lucif iait.com WOO,WBE 317-E2-7E0 Sr5Allimn Pointe T.Sufte 150 irdbrepolb IN Lynim,LLC KO Lyon m.m SB Mark ill Systems Inc Slan,A,yscai sten”scai@nerldisys.com Women Owned 713664-9350 3600buthGessner RJ,Ste 170 1,,Lston n SDK.,MOT DBE/SSE,C5E, Mk roStraregies Inc Milestone Cornputer m��.. ,tec.mm Sneimam.awene.o..m MinkblMbrs Inc Bill kgers billr@mink[orn 0511452-2022 1403 NMI..Dr Saint Paul MN s DIRECT 36 amp i ,31m NetvorkintegrationCornparry Partners,Inc dba MCFertners Sean Whfte swhfte@nicpartnersinc.com 11931 lick Ben,DhreSufte103 fenchDCucarronga CA SB SB NuWareCornmuntatiors Inc. a�� Pacack Data Services ht,„erd Adler hn-e@pacac Ida.... SOCEMRALAVE,SUITEICO HOWTIORNE f, Patrt ki Be nnettGroup Inc DBA PSG Netvorl. Scott Muse. scott.bromseau@pbgnet...corn WEIE-Won-en Sminess Enrerprbe 7 Lerepe Trail Wenmah NU com i�adad4.6a.4 MOSS am3® PC Uniiersfty ntributors,Inc Sandy Fe., sardy@pcuniiersfty.com Md.a oom.00.,i Manage o32-4646, ialCOM 33163 SB P ft Bull Secure dm�..,Inc 36 PP/MG LOSAL Ana Pow, Santa Barbara CA 33607 �"iM:3 ooa4dmmm4.aenter M4�is .< n p&hmm ces..mm ,�ss353 .6=>0 War. HY MA Mc F..Pyramid BobAsh M4 M SnellcebM`v Won-en o..a a PPOS/S INFORMATON,STEMS MalvinaSerge„.< neliire seree„hik@cornpulacenter corn 631-7E-3553 1797 Vetere rs A.m.!!Hth„e”ufte 10 War. HY RCN PresdioNetmrlad Solutims Group,LLC I..Arnett Ornett@presdb.com 312342E3S 3161.ple Lawn Slid,Suite150 Fuk,n MD tfl maaCoM OMQM.an Redline Netmrk,LP Nor Fbnnery aaountire@red linen.... 972-677-3.0 2:131Hutton Dn.,STE 303 Omit, n SAFARIMCF0 INC mile Cey mile day@safahrnim[orn 431,53662E 935 W Pecos Poi STE 9 [hand, AZ 3530 Seneca BbTek Inc Cht Peed chnsGsenecabbrekgorn veteran owned snell bmines 7164533301 297 f DM Ave nue Salamanca HY SS, way aan�Veu, Tempe AZ 75006 ao4�mm .4 SimpleCorn-Simple m.asmadia mm=® 33619 S,Degrees aSirimCornputerblMiors Michelle ope�30 .34 Spera Partners e*. 4m " tanax@tanthes.com 6o66s66.M66.M36 291-3262437 a„�� .Vela o-m» mC5 Incdms,.4mm..od4m�. SS,wo.w.MO M34ss d.re Tampa Seattle WA .015 3 Urten ,CoMTSA,Inc/Technical&Scientific Applicatim Inc Jeffrey Lore Off lore@ta Korn WOO,MSEI,40SEI 2:15-49-4932 1355 Ca DriieStel0 liDoier AL .015 SS,WO,Mo.w wMs Ve,� USAT,LLC Sales Group saksgre,up@makorp[orn Chapel HD NC 37091 aManLLCdMVIM Vardis ss�� ' w-2m m �s� m4 DocuSign Envelope ID: 1 F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D Products and Pricing Proposal Product Offering SYNNEX Corporation offers the following Palo Alto Networks products and services at a fixed discount percentage off the commercial published pricelist(MSRP). A full listing of current products is provided on the included Excel file "SYNNEX-OMNIA Partners Price List July 2020". Category Subcategory Discount% Hardware and On-Premise Software Cloud Security 20% Hard Disk Drives 20% Input Device Accessories 20% Network Accessories 20% Network Adapters/Cables 20% Network Devices 20% Network Storages 20% Power Accessories,Adapters, &Supplies 20% Rack System &Accessories 20% RAM Modules 20% Repeaters/Transceivers 20% Security Hardware&Software 20% Solid State Drives(SSD) 20% Storage Controllers 20% Cloud Services Cloud Security 15% Internet/Communication Applications 15% Security Service/Support 15% Security Software 15% Service Packages 4-Hour Premium &Platinum Renewal 10% 4-Hour Premium &Platinum Support 10% On-Site Spares 10% Premium& Platinum Support 10% Premium& Platinum Support Renewal 10% Standard Support 10% Standard Support Renewal 10% Demisto and Prisma Public Cloud Demisto and Prisma Cloud 5% All Others All Others 5% Non-Discounted Products Non-Discounted Products 0% DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D Additional Services: In addition to the Palo Alto Networks branded services priced in the categories above, additional Professional Services may be provided by SYNNEX Authorized Service Providers at 4% off MSRP. Services are often opportunity specific and MSRP pricing will be provided to the requesting Agency within a Statement of Work. Additional Product Offering: SYNNEX is providing a specific percentage discount off MSRP for all Palo Alto Networks products and services. Additionally, SYNNEX is offering OMNIA Partners Contract pricing for the more than 1400 IT manufacturers and Authorized Service Providers that SYNNEX carries on our linecard.This offering is fully described and priced under the SYNNEX Value Add portion in Tab Five (5). Describe any shipping charges. All deliveries under this contract shall be FOB Destination. Additional freight costs may apply for white glove, special and expedited delivery requirements when requested by the ordering agency. Provide pricing for warranties on all products and services. Warranties will be priced according to the categories listed above. Describe any return and restocking fees. Product Return Guidelines DOA/Defective Credit • Product must be returned in the original packaging. • Please ensure that all original components are shipped with the defective item (includes manuals, software, cables, etc.). • Please remove all add-ins (not originally sold with the product), as these items will not be returned to you (i.e., memory, sound cards, modems, etc.). • Please follow the return shipping instruction provided with your RMA. Advance Swap • SYNNEX cross-ships a replacement product to you before it receives the product you are returning. • Advance Swaps are subject to SYNNEX credit department approval. • Replacement shipment will be billed when shipped and credit issued once the return is received for credit. • Please follow the return shipping instruction provided with your RMA. Damaged Shipments • Shipment should be refused and SYNNEX Customer Service contacted within 48 hours of the refusal. • All damages must be reported within 48 hours of receipt of product for all courier shipments. DocuSign Envelope ID: 1 F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D ®TD SYNNEX OMNIA neap Swam. 1 FARTMERS Reseller Name Full Name Email Address Diversity Status Phone Number Address City State Zip Code RATION Sanjay Shirude MO@accelbl.com Ace Solutions a rora@acesolutionsus.com MOSS,WOSB 2406033514 12000 B.CKBERRY TERRACE NORTH ACS International Resources Inc. Amit Rao procurement@acsintl.com 1330 Baltimore Pike Chadds Ford PA 90505 Advanced Network Management(ANM) ler@anm.com E Albuquerque NM Advantage Technology,LLC Michael Ferrari aMI@advantage.tech (304)342-0796 950 Kanawha Blvd East Charleston NN Advantage Technology,LLC Michael Ferrari m ari@advantage.tech (304)34 on NN e mley@advizex.com 190 Independence OH Agio�sWorld Wide,Inc. ah@agiosww.com DBE,WOBE 103 AIP US,LLC MIN WANG ANG@AIPUS.COM MBE 703O616427 27 Bleeker Alchemy Technology Group,LLC Travis Graham ravis@alchemytechgroup.com 11 Greenway Plaza,Suite 2600 Houston TX 19073 All Covered,a Division of Konica Minolta Business Solutions USA,Inc.formerly Compuquip Adam Goebel agoebel@allcovered.com 1704)972 3300 2101 Rexford Rd 416O Charlotte NC 7875O Alpha Data Tech Gino Valconi oni@alphadatatech.com SB,Minority Owned,DV,Hubzone 213 2974419 American Prison Data Systems Segun Olowofela era@apdscorporate.com 601 West 26th Street Suite 325 New York NY 34120 AMI Strategies,Inc. Jon Dezelsky JdezelskY@amistrategies.com [e 125 Livonia MI 90703 Anuvision Technologies Summer ne@anuvlslontech.com ANVIL WORKS,LLC Sara Nerenberg ara@anvilworks.com SBA,WO,VO,SDVBE,DBE ree Ranch Rd Scottsdale AZ 379, Applied Video Technology Ashley Buettner ley@applledvideo.com ArchAngel Education Technology Frandia Garcon con@arch-te.com 323 1,21 West Dixie Highway Unit11 North MiamiBeac Atrium Advisory Services Inc. Mikki Pierce info@atriumadvise.com WOSB,MBE Suite2OO Deerfield IL 12866 Attronica Don Bright onb@attronica.com (004)270 3200 11547 Nuckols Rd Glen Allen VA 11232 STEMS CONSULTING INCDBA AURORA ENTERPRISE Philip De Souza uza@aurorait.com (000)202-0696 Avexon Kern Glynn ynn@avexon.com WOSB 5048133053 141 Robert E Lee Blvd42O6 New Orleans LA 13202 Avixum,Inc. Chris McDaniel niel@Avixum.com WO 407-868-6183 3033 Winkler Ave. Ft.Myers FL 19348 AVVID IT Barry Beitz ei[z@ovitlltcom WOSB ar war@axelliant.comTorrance CA 10019 Barcodes,Inc. Carrie Woodson son@barcodesinc.com 312-5824862 200 W.Monroe Street,STE 2300 Chicago IL 28211 BEAR Cloud Technologies df@bearcloudtech.com SBFrancisco CA 33511 Bets Group Hernan Cortes rtes@betis.com 30 McLean VA 46250 ComputerBeyond Services,LLC Ervin Hughes III eahughes@beyondpcservices.com Small Business,Minority OwnedVictoria TX 20020 BIT Direct Inc Duane Turner duane@bltdirect.com 0135413571 22O2 N.West Shore Blvd,STE 2O0 Tampa FL 95045 PaganoBlackHawk Data LLC Maryann no@blackhawkll.com WBE Woman Business Enterprise 646..39061 03 New York NY 85251 Blackwood Associates Tim Hall im.hall@blackwood.alDRIVE Blue Plains Technology Steve Meany smeanY@blueplainstech.com Minority owned (3.)462-1.5 PO Box.0111 Pike Road AL 11580 Blue Plains Technology Steve Meany smeanY@blueplainstech.com Minority owned (3.)462-1.5 PO Box.0111 Pike Road AL 11727 JepsonBlueAlly,LLC Hope son@blueally.com 9192491500 1225 Crescent Green,Suite 115 3 BorderLAN Inc. Diane Rogers lane@borderlan.com tlr 0 950 Boardwalk,STE 300 San Marcos CA 60606 Brandywine Technology Group Michael McNeill mmcneill@brandywinetechnology.group 480.80,586 106 OSBORNE CIRCLE KENNETT SQUARE PA 145. BrightCentra Inc Frederick Wick frederick.wick@brightcentra.com co CA 10016 Btek Holdings LLC Bruce Banko uce@btekholdings.com Petersburg C&G Technologies Consulting itaV@CGTechnologiesconsul[ing.biz Small Business,Woman-Owned aven Drive Homosassa FL 20878 CAF TE.INC Jesse Wallace sse@caltechinc.com SB,Micro Business 40237 California Integrated Solutions,Inc. Jay Kishor lkishor@CISpc.com 90986.333 23342 Golden Springs Dr,Suite 102 Diamond Bar CA Call One Dawn Mays ays@email.calloneonllne.com al FL 40139 Can-Am Wireless Johan Rahardjo tllo@canamwireless.com MBE 5124134741 302 New Hope Or Ste 103 Cedar Park TX 3801 Can-Am Wireless,LC lo.n Rahardjo frahardjo@canamwireless.com MBE 5124134741 302 New Hope Or Ste 103 Cedar Park CARLNTECH LLC Carl Neidhardt arin@carintech.com VOSB Carpe Diem Technology Solutions LLC Kyle Lyon klyon@cdtsusa.com 216 063 6256 Raton FL 10005 CB Technologies,Inc. Rachel Nelson rachel.nelson@cbtechinc.com WOSB,WBE 770 T.City Dr S Suite 53OO Orange CA 92123 .20 Tom Frances, ski@c62O.com 518469-1281 11 Federal Street Saratoga NY 7645 .TS Technology Solutions Steve artl s ev artl@cbts.com CCT Technologies,Inc.dbaComputerLand of Silicon V y Cathy Souza uza@cland.com WO,Minority Owned STREET„SUITE 2O San Jose CA 953, COCE,Inc Brian Solomon bsolomon@cdce.com 714-282-8881 22641 Old Canal Road ',or.Linda CA 94111 COW Government LLC Anup Sreedharan ree@cdw.comAve Vernon Hills IL 77063 Challenge Innovation Technology,Inc. Kenneth Wells ells@challengetechinc.com 94591 7965 Charter Technology Solutions LLC Krone one@charterts.com Minority Owned Chi Corporation ...Thome ttme@chlcorporatlon.comPARKWAY Cincinnati Bell Technology Solutions Steve Lankard steve.lankard@cbts.com TechnologiesClear Inc Phil Godwin win@cleartechnologles.ne[ WBE,WOSB,HUB uie3OO Addison TX 7041 Clearwinds Craig Davenport ort@clearwinds.net CD,PSA 2054138323 13001 Liberty Parkway Vestavia Hills AL 90503 Cloud Revolution LLC Adam Ball adam@cloudrevolutlon.com 720.612.3454 277O Arapahoe Rd,41321O63 Lafayette CO 4116 NMSDC MBE,Arizona DBE,NYC Clutch SolLtions LLC Damien Norwood ood@clutchsolutlons.com NYS MBE Bldg.1,Suite 1O2 Mesa AZ 91789 Coast to Coast Computer Products,Inc. Melissa Servatdfoo melissa@coastcoast.com SB y CA 27608 Code 3 Technology LLC Jim Boubelik lim@code3technology.com Code 3 Technology,LLC Jim Boubelik rim@code3technology.com 0002 Mesa AZ 77099 CollabNow David Lemperle dlemperle@collabnow.biz NA 646 522 7910 370.W 22Oth Street St Polo MO 90104 Woman-Owned,Minority Owned, Commonwealth Trading Company,Inc.DBA Commonwealth Computer C p y Nikole Vaughn uhn@commonwealthcomputer.com Small Business sse@compWlnk.com (212)69 Compu-Link Denise a mile@compu-Ilnk.com MOSS (212)695-5466 261 West 39 Street,Suite 3O2 New York NY 92887 Computer Drive Amin Ismail amin@computerdrive.com Comsourcecia@comsourceny.com Comsource Inc. Adam is cia@comsourceny.com 00 Connect.Corporation Joel Raiber her@connectuscorp.com SB Continental ces,Inc.ConReS Louis Novakis Inovakis@conres.com 508-280-6465 ,5 Middlesex Turnpike Bedford MA 11961 61 Inc. her@convergeone.com (212) 3 1055 10900 NesbittAvenue S Bloomington MN 11961 Core BTS,Inc. Benjamin Golden benjamin.golden@corebts.com Parkway North Drive,Suite 32O s IN 100. Countertrade Products,Inc. m a mm@ccounntertrade.com CPAC Inc. Ace Garin arin@cpacinc.com Small Business,Woman Owned 714692-5044 4749 E.Wesley OR Anaheim CA 95635 Critical n ver@cri[icallnsight.com Crossconnect Engineering,Inc Jeff Kronlage age@crossconnect.com (719)559-5559 1155 Kelly Johnson Blvd Suite 460 Colorado Springs CO 8090 CSG Connected Solutions Group,LLC Regina Hawkins kns@thlslscsg.com SB 004 203 0605 8529 MeadowbridgeRoad Suite 300 Mechanicsville VA 13057 TELECOMMUNICATIONS NTRA CfORS INC Michael Bolling mbolling@cIcitechnology.com 152 Huron Ave Clifton NJ 7054 CTS obility°BA Complete Tablet Solutions L. tre)o@ctsmoblllry.com MBE,State of Texas HUBDrive,Ste.125 Austin TX 40114 CVE Technologies John Lee .lee@we.com (801)602-1T96 1338 Gustin Road Salt Lake dry UT 19317 CWPA Office Supplies&Services Michelle Kalkholl ring@cwpa.com WOSB 2812519814 PO Box 11309 Spring TX 83702 CWPA Office Supplies&Services Michelle Kalk holt marketing@cwpa.com WOSB 2812519814 PO Box 11309 Spring TX 98516 CyberNorth Jeremy Lombardo rdo@rybernorth.com 15 Cottage Road Unit 2433 South Portland ME 11001 Data Center Warehouse C mer@4dcw.com (949)32004509 23041 Avenida De La Carlota., Laguna Hills CA 14079 DataCom Solutions,Inc. Jerry Brooks oks)@tlatacomusa.net SB,SOB,MOSS,Hubzone Circle Huntsville AL 22003 DataPath Inc. Brian Jump mp@mytlatapath.com 209 312 9000 14151 St. Modesto CA 27514 Datel Systems Incorporated Kat Bell KBell@datelsys.com 4393 Viewridge Ave,STE C San Diego CA 22101 GroupDavenport Paul Cummings Paul.cummings@davenportgroup.com DBISP LLC Sara Vaughn sarah.vaughn@dbisplIc.com SB,MO,Ba D Indianapolis IN 66215 Derive Technologies, Martinez nez@tlerivetech.com HFLOOR New York NY 77046 Security sal@dgxsecurity.com SBE MBE DBE 2013704761 840 Bergern Ave Jersey Cry NJ 33027 Digital Scepter Jon Robinson Jon@digldlscepter.com (951)600 5000 29970 Technology Drive Ste 122B DiPersia Technology Solutions LLC Pat DIP ersia pat@dipersiatech.com e,42O6 Newton Square PA 60101 DISTINCTIVE TE.LLC Santiago Rodriguez sago@distinctivetechla.comWalnut Distributed Technology Group(DTG) Boson mark@dtg.com SDVOSB 501 Syracuse NY 55340 DITTA ENTERPRISES C Raj DrIta rogerditta@gmaLc°. 510-776-5219 235 Emerald Way Hercules CA 85262 DOF Creations,LLC Saeed el Gordon don@dofcreations.com 865.236.0498 12604 River Birch OR Riverview FL 92614 Dreadnoughtndeavors Inc Rowan Edge redge@dreadnoughtendeavors.comCalabasas CA 95126 DTG Gary Barker ker@dtgweb.com SB 8138890660 9051 Florida Mining Blvd Suite 103 Tampa FL 91381 DynTek Services,Inc. Darlene Pricher her@dyntek.com e CA 90275 EKC Enterprises,Inc Chris Shafer tee@ekccorp.com Enabling Tech Corp/Enabling Technologies Melissa Dean mtlean@enablingtechcorp.com 4436255130 20065 Corkscrew shores Blvd Estero FL 91302 Small Business, Enchanted Technology Solutions,LLC eRg@ets.us.com Minority-Owned Owned, Ownetl cost@envlsionsuccess.net 1.1)26 Envision Tech Advisors Karen iconi ePlus Technology,Inc. Amy Knower wer@eplus.com 919.010.2311 13595 Dulles Technology Drive Herndon VA 92127 HarterEsport Supply,LLC Derrek rrek@esportsupply.com O 11 Park KS 33216 Evolving Solutions Inc org@evolvingsol.com County Road 116 Hamel MN 85258 ee nga@temdel.com 240432-1422 400 E.Pratt St.,8th Floor Baltimore MD 926. TechnologiesFlagler LLC Tom Gregor om@orbcomm.com WO 5 61 229 1601 Rd Suite 2O1 on FL 94,7 Focus TS! Chris Capri° elo@roc Forward Edge(TO) Chip Logan clogan@forwartd-edge.net 2724 E Kemper Rd Sharonville OH 94566 Frontier Technology,LLC°BA MicroAge Larry Fulop lop@microage.com 480-366-2143 8160 S.Hardy Drive Tempe AZ 78759 FSR Consulting LLC e nes@clnusrystemsus.com (4O0)21 ba 4-6534 eat41O Suite2Lansdale PA 93101 Garden State Micro,In c Educate-me.net) e a ells@educate-me.ne[ GHA Technologies,Inc. Laurie Coon a oon@gha-associates.comSB 4809516865 8998 E.Raintree Drive Scottsdale AZ 98124 Global RNSC Technologies Ranult Ross _oss@globalmsc.com MBE,SDVOSB Parkway,Building 100,STE 5OO Atlanta GA 13104 Golden Gate Systems LLC Larry Suezaki Isuezaki@goldengatesystems.com 400 9464746 320 Spence Avenue Milpitas CA Small Business,Woman Owned, Golden Star Technology, c.DBA GST Dennis Wang dpwang@gstes.com Minority Owned 5623450111 C. Eric Young Brit@googoz.com 1255 Treat Blvd.,Suite 300 Walnut Creek CA 15668 GovOiirect,Inc. left Blair jblair@govtllrectcom (888)O6O4431 600 Cleveland Street,Suite 1O0 Clearwater FL 04107 Granite Financial Solutions dba Granite Data Solutions Brigg Goodwin gg@grani[edata.com Disabled Veteran Owned Company 5321 Luce Ave McClellan CA 87109 Holman's Inc Phil Abeyta yta@holmans.com 800-545-0932 ...Jefferson St Albuquerque NM 85260 HYPERTEC USA INC. Angela ino Ino@hypertec.com 95035 Copy Inc.DBA IBE DigitalSloan Varing Sloan@Ibedigl[al.com 562 921 0202 11266 Monarch St suite B Garden Grove CA Woman-Owned,Texas HUB,WBE, iBridgeGroup,Inc. Jennifer Cumpian jennifer.cumpian@ibridgegroup.com WOSB,SBE 512)031-3399 88.Business Park Dr.,STE 1OO Austin TX 9,92 ICP INC Anthony co aantico@icpcorp.com WBE 210 556 6952 20 Clifton Ave Staten Isla. NY 91502 imageOne Jason lnker floker@imageoneway.com 13201 CapitalS[ Oak Park MI 89123 DocuSign Envelope ID: 1F3FDOC3-6EC2-4B3A-B64D-990FE5349F2D SB 33755 55437 Pipd:a „44.4m ,dd Ellicott Cs. MD 11307 !ShiftRC Mark G.gins nec.girS@bhfft net Snell Sminess 430477-5C50 7014ECa melba..,Suite1452 Scottsdale AZ Kane Communicatbrs Paul Wan Paul Nobn@larecomm.com €02-536330 572 Whftehad Rced,Mg 2 Trenton f, 77391 SB SB Link HO T.hmkgies Inc Victor Liu victor@linkhth.com MBE (973) re6643 36364 Lucinda rr Ben Groff bgroff@lucif iait.com WOO,WBE 317-E2-7E0 Sr5Allimn Pointe T.Sufte 150 irdbrepolb IN Lynim,LLC KO Lyon m.m SB Mark ill Systems Inc Slan,A,yscai sten”scai@nerldisys.com Women Owned 713664-9350 3600buthGessner RJ,Ste 170 1,,Lston n SDK.,MOT DBE/SSE,C5E, Mk roStraregies Inc Milestone Cornputer m��.. ,tec.mm Sneimam.awene.o..m MinkblMbrs Inc Bill kgers billr@mink[orn 0511452-2022 1403 NMI..Dr Saint Paul MN s DIRECT 36 amp i ,31m NetvorkintegrationCornparry Partners,Inc dba MCFertners Sean Whfte swhfte@nicpartnersinc.com 11931 lick Ben,DhreSufte103 fenchDCucarronga CA SB SB NuWareCornmuntatiors Inc. a�� Pacack Data Services ht,„erd Adler hn-e@pacac Ida.... SOCEMRALAVE,SUITEICO HOWTIORNE f, Patrt ki Be nnettGroup Inc DBA PSG Netvorl. Scott Muse. scott.bromseau@pbgnet...corn WEIE-Won-en Sminess Enrerprbe 7 Lerepe Trail Wenmah NU com i�adad4.6a.4 MOSS am3® PC Uniiersfty ntributors,Inc Sandy Fe., sardy@pcuniiersfty.com Md.a oom.00.,i Manage o32-4646, ialCOM 33163 SB P ft Bull Secure dm�..,Inc 36 PP/MG LOSAL Ana Pow, Santa Barbara CA 33607 �"iM:3 ooa4dmmm4.aenter M4�is .< n p&hmm ces..mm ,�ss353 .6=>0 War. HY MA Mc F..Pyramid BobAsh M4 M SnellcebM`v Won-en o..a a PPOS/S INFORMATON,STEMS MalvinaSerge„.< neliire seree„hik@cornpulacenter corn 631-7E-3553 1797 Vetere rs A.m.!!Hth„e”ufte 10 War. HY RCN PresdioNetmrlad Solutims Group,LLC I..Arnett Ornett@presdb.com 312342E3S 3161.ple Lawn Slid,Suite150 Fuk,n MD tfl maaCoM OMQM.an Redline Netmrk,LP Nor Fbnnery aaountire@red linen.... 972-677-3.0 2:131Hutton Dn.,STE 303 Omit, n SAFARIMCF0 INC mile Cey mile day@safahrnim[orn 431,53662E 935 W Pecos Poi STE 9 [hand, AZ 3530 Seneca BbTek Inc Cht Peed chnsGsenecabbrekgorn veteran owned snell bmines 7164533301 297 f DM Ave nue Salamanca HY SS, way aan�Veu, Tempe AZ 75006 ao4�mm .4 SimpleCorn-Simple m.asmadia mm=® 33619 S,Degrees aSirimCornputerblMiors Michelle ope�30 .34 Spera Partners e*. 4m " tanax@tanthes.com 6o66s66.M66.M36 291-3262437 a„�� .Vela o-m» mC5 Incdms,.4mm..od4m�. SS,wo.w.MO M34ss d.re Tampa Seattle WA .015 3 Urten ,CoMTSA,Inc/Technical&Scientific Applicatim Inc Jeffrey Lore Off lore@ta Korn WOO,MSEI,40SEI 2:15-49-4932 1355 Ca DriieStel0 liDoier AL .015 SS,WO,Mo.w wMs Ve,� USAT,LLC Sales Group saksgre,up@makorp[orn Chapel HD NC 37091 aManLLCdMVIM Vardis ss�� ' w-2m m �s� m4