Loading...
HomeMy WebLinkAbout2022-02-28-minutes-it-study-session 2022-02-28 Minutes 1 Information Technology Commissioners’ Minutes Kittitas County, Washington Commissioners’ Conference Room Regular Meeting Monday 11:00 AM February 28, 2022 Board members present: Chair Laura Osiadacz, Vice-Chair Cory Wright, Commissioner Brett Wachsmith Others present: IT Director Jim Goeben Regular Meeting Information Technology Meeting called to order at 11:03 AM. Request for Approval of Proposed Changes to Technology Policy 13.4.5 Text and Instant Messaging The board approved the changes as submitted. Request for Chair Signature on Critical Insight Services Agreement The board authorized chair signature on the agreement. Request for Chair Signature on Renewed WaTech Service Level Agreement for GIS Statewide Imagery The board authorized chair signature on the agreement and requested the county publicize COMPAS to inform the public of its availability as a free service. Request for Approval of Updates to the Incident Response Plan The board approved the changes as submitted. Lean Update Mr. Goeben informed the board he will have a status update for the board at the next IT Study Session. Meeting adjourned at 11:23 AM. Kittitas County Commissioners Information Technology Director Kittitas County, Washington _______________________________________ _______________________________________ Jim Goeben, IT Director Laura Osiadacz, Chair Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509-962-7510 | http://www.co.kittitas.wa.us MEMO To: BoCC From: Jim Goeben, IT Director Date: 2/9/2022 Subject: Proposed changes to Technology Policy 13.4.5 Text and Instant Messaging In the last few months IT has been made aware of, but has not witnessed, employee use of text and instant messaging for county business, which is not allowed except under emergency circumstances. IT believes there might be misunderstandings or confusion related to county polices about text and instant messaging and would like to ensure all users clearly understand what is expected an allowed. IT has reviewed policy 13.4.5 Text and Instant Messaging and has identified changes that would clarify the intention of the policy. On 2/8/2022 the IT Committee reviewed and approved these proposed policy updates. IT and the IT Committee recommends the board approve the following updates: 13.4.5 Text and Instant Messaging If authorized by your DH/EO, you may use text or instant messaging for communications of minimal retention value on personally-owned cell phones and County-owned cell phones; however, you must delete the transitory communication when it is no longer needed, and you will may be responsible for contacting your service provider to obtain copies of any records responsive to public records requests. Text message primary records that conduct County business (those you send, and those you receive from non-County employees) must be memorialized as they are sent or received. If you must text county business for emergency purposes, or you receive a text message conducting county business, you must memorialize and delete the message as soon as possible after it is sent/received. Transitory Records Records with Minimal Retention Value (Transitory Records) Public records that only document information of temporary, short- term value, and provided that the records are not needed as evidence of a business transaction and not covered by a more specific records series. (GS50-02-05 Rev. 12) v.31621 1 CRITICAL INSIGHT™ SERVICES AGREEMENT NOTICE TO CUSTOMER: THIS IS A LEGAL AGREEMENT BETWEEN CRITICAL INSIGHT, INC. D/B/A CRITICAL INSIGHT (“CI”) AND YOU, ON BEHALF OF YOURSELF AND AS AN AUTHORIZED REPRESENTATIVE OF YOUR EMPLOYER OR CUSTOMER ENTITY (YOU AND SUCH ENTITY, TOGETHER, “YOU”, “YOUR”, OR “CUSTOMER”). BY INSTALLING OR ACCESSING THE CI PRODUCTS, RECEIVING THE CI SERVICES, AND/OR USING THE CI PROGRAMS, YOU AGREE TO ALL THE TERMS OF THIS SERVICES AGREEMENT (THE “AGREEMENT”). AS USED IN THIS AGREEMENT, “CI PRODUCTS” MEANS COLLECTIVELY THE CRITICAL INSIGHT PROGRAMS, HARDWARE, MONITORING AND RESPONSE SERVICES, ACTION PLANS, REPORTS, GRAPHICS, PICTORAL AND FUNCTIONAL REPRESENTATIONS, SPREADSHEETS, PRESENTATIONS, ANALYSES, PROCESSES, METHODS, PROCEDURES, CONCEPTS, KNOW-HOW, TECHNIQUES, PRACTICES, ALL RELATED MANUALS AND DOCUMENTATION, AND MODIFICATIONS AND IMPROVEMENTS IN RESPECT TO ANY OF THE FOREGOING, PROVIDED, DELIVERED OR MADE AVAILABLE TO CUSTOMER BY CI OR, IF YOU PURCHASED THE CI PRODUCTS FROM A RESELLER, THE RESELLER AND MORE PARTICULARLY DESCRIBED IN MATERIALS PROVIDED BY RESELLER AND/OR ACCESSED BY LINKS INCLUDED IN SUCH MATERIALS. “CI PROGRAMS” MEANS THE CRITICAL INSIGHT MONITORING SOFTWARE PROGRAMS AND APPLICATIONS, DESIGNS, INVENTIONS, SOURCE CODE, OBJECT CODE, TOOLS, PATCHES, UPDATES AND NEW VERSIONS TO ANY OF THE FOREGOING, USER ID’S, USER INTERFACES, TOKENS, PASSWORDS AND PORTALS LICENSED TO CUSTOMER BY CI AS PART OF THE CI PRODUCTS, BUT EXCLUDES THIRD-PARTY SOFTWARE AND CUSTOM PROGRAMS, IF ANY, DEVELOPED BY CI OR RESELLER FOR CUSTOMER. “CI SERVICES” MEANS THE CONSULTING SERVICES DELIVERED TO CUSTOMER AND ANY OTHER PROFESSIONAL SERVICES THAT CI PROVIDES TO CUSTOMER AT CUSTOMER’S REQUEST. “CRITICAL INSIGHT SERVICES” MEANS THE CI PRODUCTS, THE CI PROGRAMS AND THE CI SERVICES TOGETHER. IF YOU DO NOT AGREE WITH ALL OF THESE TERMS, DO NOT USE, UNINSTALL AND PROMPTLY RETURN THE CI PRODUCTS TO CI (OR IF YOU PURCHASED SUCH PRODUCTS FROM A RESELLER, THE RESELLER FROM WHOM YOU PURCHASED THEM) AND, PROVIDED YOU HAVE NOT USED THE CI PRODUCTS OR RECEIVED ANY ELEMENT OR PART OF THE CI SERVICES, ANY FEES YOU HAVE PAID FOR THE CI PRODUCTS AND CI SERVICES WILL BE REFUNDED. Your privacy is important to CI. CI’s Privacy Policy located at https://criticalinsight.com/privacy-policy/ is hereby incorporated into this Agreement by reference. Please read our Privacy Policy carefully for information relating to CI’s collection, use, and disclosure of personal information. 1. LICENSE. Subject to your full compliance with all the terms and restrictions set forth in this Agreement and payment of all applicable fees owed to CI, CI grants to Customer a nonexclusive, non-assignable, non- sublicensable, royalty-free, worldwide limited right to access and use the CI Programs solely for Customer’s internal business operations and subject to the terms of this Agreement. Only Customer’s authorized personnel may access and use the CI Programs, and Customer is solely responsible for compliance with this Agreement by users accessing the CI Programs with Customer’s credentials. 2. EXCLUSIONS. Customer is solely responsible for any hardware, software and networking tools, devices and appliances that are not provided by CI pursuant to this Agreement. Customer’s responsibilities include, without limitation, Customer systems installation, maintenance and administrator activities, software and application licensing requirements, conditions and related financial commitments. Customer is solely responsible, at Customer’s expense, for establishing, maintaining, operating and regulating Customer’s access to the Internet, including without limitation, all computer hardware and software and properly configured and installed systems, browsers, modems, access lines and distributed networks, necessary to enable, maintain, monitor and control Customer’s Internet access. 3. OWNERSHIP. Customer retains all ownership and intellectual property rights in and to all in-bound and out- bound Internet borne data hosted on Customer’s proprietary or cloud-based servers that is accessed and monitored by the CI Programs (collectively, “Customer Data”) and, subject to payment of any applicable fees owed to CI, any reports, assessments, or contracted “deliverables”, including any recommendations or conclusions included in such deliverables, prepared by CI for Customer as part of the CI Products or CI Services (together, “Reports”). CI irrevocably assigns and transfers to Customer all of its worldwide right and title to, and interest in, the Reports, including all associated copyright, patent, trade secret, trademark and any other intellectual property or proprietary rights ("Intellectual Property Rights"). Additionally, CI grants to Customer a non-exclusive, worldwide, royalty-free, irrevocable, perpetual, non-terminable, transferable, sublicensable license to all Intellectual Property Rights used in the creation of the Reports in order for Customer to exercise its rights in the Reports as contemplated by this Agreement. Without limiting the foregoing, (i) the v.31621 2 Reports are “works made for hire” to the extent permitted by law, and (ii) CI will not assert, and otherwise waives, any “moral rights” in the Reports and CI hereby assigns all right, title and interest in such materials to Customer and agrees to reasonably assist Customer, at Customer's expense, to perfect such interest Subject to the foregoing, CI retains all ownership and Intellectual Property Rights in and to the CI Programs, CI Products and CI Services, and in furtherance thereof, Customer may not: a. Remove or modify any proprietary marking or notice of CI’s proprietary rights; b. Make any aspect of the CI Products available in any manner to any third party for commercial use by such party; c. Modify, make derivative works from, disassemble, reverse engineer or reverse compile any part of the CI Products (the foregoing prohibition includes, without limitation, review of data structures, signatures or similar materials produced by the CI Products), or access or use the CI Products or CI Services in order to build or support, and/or assist a third party in building or supporting, products or services competitive to CI; d. Except for Reports, which may be disclosed by Customer at its sole discretion, and as required by applicable law, disclose to any third party the results of any CI Products or CI Services without CI’s prior written consent; or e. License, sell, rent, lease, transfer, assign, distribute, display, host, outsource, disclose, permit timeshare or service bureau use, or otherwise commercially exploit or make the CI Products available to any third party other than as expressly authorized under this Agreement. 4. CONFIDENTIAL INFORMATION. “Confidential Information” means any and all information that is disclosed by CI to you, either directly or indirectly, in writing, orally or by inspection of tangible objects, which if disclosed in writing or tangible form is marked as “Confidential,” “Proprietary,” or with some similar designation, or if disclosed orally or by inspection or observation, is identified as being proprietary and/or confidential at the time of disclosure, or by the nature of the circumstances surrounding the disclosure should reasonably be treated as proprietary and/or confidential. Confidential Information including, without limitation, computer programs, algorithms, know-how, ideas, inventions (whether patentable or not), and other technical, business, financial, customer and product development information. By way of example, Confidential Information of CI includes information relating to the performance of the CI Products and CI Services, reliability or stability of the CI Products, operation of the CI Programs and CI Services, knowhow, techniques, processes, ideas, algorithms, and software design and architecture. As between the parties, such Confidential Information shall belong solely to CI. During and after the term of this Agreement, you shall hold in confidence and protect, and shall not use (except as expressly authorized by this Agreement) or disclose, Confidential Information to any third party. 5. DATA SECURITY. During the term of this Agreement, CI shall maintain reasonable and appropriate safeguards, security measures and protocols, which in no event shall be less effective than industry-standard safeguards, security measures and protocols, designed to: (i) reasonably protect Customer Data in CI’s possession or control from unauthorized use, alteration, access or disclosure; and (ii) detect and prevent a breach of such safeguards, security measures and protocols by any unauthorized party. CI shall promptly notify Customer upon discovery of a confirmed security breach. 6. CI PROGRAMS SERVICE LEVELS. CI will use commercially reasonable efforts to achieve the minimum availability of the CI Programs set forth in the documentation provided to Customer by CI or Reseller, as the case may be, not including Excused Downtime, and CI will monitor the availability of its systems on a 24/7 basis. “Excused Downtime” means any of the following: (i) force majeure events; (ii) data transmission failures outside the control of CI; and (iii) scheduled and emergency maintenance outages. Scheduled maintenance is generally conducted between the hours of 8 p.m. Saturday and 8 a.m. Sunday, U.S. Pacific Time. Maintenance outages include, without limitation, installation of software updates and patches, service packs and routine server and application configuration changes. CI may schedule a non-routine maintenance outage on an as needed basis in its sole discretion and, except in instances of emergency maintenance, will use commercially reasonable efforts to notify Customer forty-eight (48) hours in advance of any such outage. 7. WARRANTIES, DISCLAIMERS AND EXCLUSIVE REMEDIES. A. CI warrants (i) that the CI Products and the CI Services will be performed in all material respects in accordance with the applicable documentation provided by CI or Reseller, as the case may be, (ii) that the CI Programs shall be maintained and available at the service levels specified in Section 6 hereof, and (iii) that the CI Products and the CI Services will be performed in a good and workmanlike manner substantially in accordance with prevailing industry standards. If the CI Products or CI Services provided to Customer for any given calendar month during the term are not performed as warranted, Customer must provide written notice to CI no later than five (5) business days after the last calendar day of such month. v.31621 3 B. CI DOES NOT GUARANTEE THAT THE CRITICAL INSIGHT SERVICES WILL BE PERFORMED ERROR- FREE OR UNINTERRUPTED, OR THAT CI WILL CORRECT ALL CRITICAL INSIGHT SERVICE ERRORS, IF ANY. CUSTOMER ACKNOWLEDGES THAT CI DOES NOT CONTROL THE TRANSFER OF DATA OVER COMMUNICATIONS FACILITIES, INCLUDING WITHOUT LIMITATION, CUSTOMER’S PROPRIETARY SYSTEMS AND THE INTERNET, AND THAT THE SERVICES MAY BE SUBJECT TO THE LIMITATION, DELAYS, AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. IN ADDITION, DELIVERY OF THE CRITICAL INSIGHT SERVICES MAY BE CONTINGENT UPON THE ACCESS, SUPPORT AND COOPERATION OF CUSTOMER, WITHOUT WHICH SUCH SERVICES CANNOT BE PERFORMED. CI IS NOT RESPONSIBLE FOR, AND SPECIFICALLY DISCLAIMES LIABILITY FOR, ANY DELAYS, DELIVERY OR SERVICE FAILURES OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS AND CONDITIONS. C. FOR ANY BREACH OF THE ABOVE WARRANTIES, CI WILL REMIT A SERVICE FEE CREDIT TO CUSTOMER EQUAL TO TEN PERCENT (10%) OF (i) IF FOR CI PRODUCTS, THE NET MONTHLY FEES FOR THE APPLICABLE CI PRODUCTS FOR THE MONTH IN WHICH THE BREACH OCCURRED, AND (ii) IF FOR CI SERVICES, THE NET SERVICE FEE SET FORTH IN THE APPLICABLE STATEMENT OF SERVICE OR PURCHASE ORDER. THE CREDIT WILL BE APPLIED ONLY TOWARD ANY ACCRUED BUT UNPAID FEES OWED TO CI FOR THE RELATED CI PRODUCTS OR CI SERVICES, AND REMITTANCE OF SUCH CREDIT WILL REPRESENT CUSTOMER’S EXCLUSIVE REMEDY, AND FULL SATISFACTION OF CI’S SOLE LIABILITY, FOR ALL WARRANTIES SPECIFIED IN THIS AGREEMENT. D. EXCEPT AS SPECIFICALLY SET FORTH HEREIN, THE CRITICAL INSIGHT SERVICES, INCLUDING EACH COMPENENT PART THEREPF AND ANY REPORTS OR OTHER TANGIBLE OR INTANGIBLE SERVICES FURNISHED BY CI TO CUSTOMER, ARE PROVIDED ON AN “AS IS” BASIS WITH NO WARRANTIES OF ANY KIND. CI MAKES NO WARRANTY, EXPRESS OR IMPLIED, THAT THE CRITICAL INSIGHT SERVICES WILL RENDER CUSTOMER’S NETWORK AND SYSTEMS SAFE FROM MALICIOUS CODE, INTRUSIONS, OR OTHER SECURITY RISKS OR BREACHES OR THAT THE CRITICAL INSIGHT SERVICES WILL DETECT, REPORT OR NEUTRALIZE ALL SUCH MALICIOUS CODE, INTRUSIONS, SECURITY RISKS OR BREACHES. TO THE EXTENT NOT PROHIBITED BY LAW, THE WARRANTIES IN THIS SECTION 7 ARE EXCLUSIVE AND THERE ARE NO OTHER EXPRESS OR IMPLIED WARRANTIES OR CONDITIONS OF ANY KIND, INCLUDING FOR HARDWARE, SOFTWARE, SYSTEMS, NETWORKS, ENVIRONMENTS OR SERVICES OR FOR MERCHANTABILITY, SATISFACTORY QUALITY, NONINFRINGEMENT AND FITNESS FOR A PARTICULAR PURPOSE. 8. LIMITATION OF LIABILITY. A. IN NO EVENT WILL CI, ITS SUPPLIERS, AGENTS OR REPRESENTATIVES BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL, CONSEQUENTIAL, PUNATIVE OR EXEMPLARY DAMAGES, HOWEVER CAUSED AND WHETHER BASED IN CONTRACT, TORT (INCLUDING NEGLIGENCE), PRODUCT LIABILITY OR ANY OTHER THEORY OF LIABILITY, INCLUDING WITHOUT LIMITATION, LOST REVENUE, PROFITS, OR SAVINGS, LOSS OF BUSINESS OPPORTUNITY, COSTS OF PROCUREMENT OF SUBSTITUTE GOODS, LOSS OF GOODWILL, LOSS OF DATA OR SYSTEM USE, AND OTHER BUSINESS LOSS, EVEN IF THEY HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY. B. IN NO EVENT WILL CI’S TOTAL CUMULATIVE LIABILITY IN CONNECTION WITH THIS AGREEMENT, THE CI PRODUCTS AND THE CI SERVICES, INCLUDING WITHOUT LIMITATION, THE CI PROGRAMS, REPORTS, AND RELATED HARDWARE, FROM ALL CAUSES OF ACTION OF ANY KIND, INCLUDING BUT NOT LIMITED TO TORT, CONTRACT, NEGLIGENCE, STRICT LIABILITY AND BREACH OF WARRANTY, EXCEED THE TOTAL AMOUNT PAID BY CUSTOMER FOR ALL CI PRODUCTS AND CI SERVICES DURING THE TWELVE (12) CONSECUTIVE MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM FOR SUCH LIABILITY. ANY DAMAGE IN CUSTOMER’S FAVOR AGAINST CI SHALL BE REDUCED BY ANY REFUND OR CREDIT RECEIVED BY CUSTOMER FOR OR RELATING TO THE CI PRODUCTS OR CI SERVICES AT ISSUE AND ANY SUCH CREDIT OR REFUND SHALL APPLY TOWARD THE LIMITATION OF LIABILITY. C. The foregoing shall apply notwithstanding any failure or inability to provide the limited remedies set forth in this Agreement. 9. TERM. A. Term and Termination. The term of this Agreement shall be as specified in the purchase order or similar document between Customer and Reseller. This Agreement is effective until the effective date of expiration or termination, whichever occurs first. v.31621 4 Customer and CI may terminate this Agreement at any time by mutual written agreement. This Agreement will terminate automatically if Customer breaches any term or condition of this Agreement, including any breach of Customer’s limited license rights in and to the CI Products. B. Effect of Termination. Upon any termination, Customer shall disable all hardware and make it available for retrieval by or on behalf of CI or reseller, as the case may be, destroy all copies of any CI Products- related documentation and immediately return to CI or destroy all CI Confidential Information in its possession or control that is in tangible form. In addition, unless otherwise provided in a mutually executed document between Customer and CI, Customer prepaid amounts then held by CI, if any, shall be payable to and retained by CI as an early termination fee. 10. U.S. GOVERNMENT RESTRICTED RIGHTS. Certain elements of the CI Programs licensed under this Agreement constitutes commercial computer software as that term is described in 48 C.F.R. 252.227- 7014(a) (1). If acquired by or on behalf of a civilian agency, the U.S. Government acquires this commercial computer software and/or commercial computer software documentation subject to the terms of this Agreement as specified in 48 C.F.R. 12.212 (Computer Software) and 12.211 (Technical Data) of the Federal Acquisition Regulations (FAR) and its successors. If acquired by or on behalf of any agency within the Department of Defense (DOD), the U.S. Government acquires such commercial computer software and/or commercial computer software documentation subject to the terms of this Agreement as specified in 48 C.F.R. 227.7202-3 of the DOD FAR Supplement (DFAR) and its successors. 11. GENERAL. Customer may not assign this Agreement or any of its rights or duties, by operation of law or otherwise, without CI’s prior written consent. Any attempt to assign the Agreement without such consent will be void. This Agreement will be governed by and construed under the laws of the State of Washington, excluding its conflicts of law principals. Any action filed by either party arising or relating to this Agreement shall be brought in Seattle, Washington, and Customer irrevocably consents to and waives any objection to jurisdiction and venue in the state and federal courts located in Seattle, Washington. The prevailing party in any such dispute or action shall be entitled to an award of its reasonable attorneys’ fees and costs incurred therein. The United Nations Convention on the International Sale of Goods shall not govern this Agreement. If any provision of this Agreement is held by a court of competent jurisdiction to be invalid or unenforceable, such provision shall be changed and interpreted so as to best accomplish the objectives of the original provision to the fullest extent allowed by law and the remaining provisions of this Agreement shall remain in full force and effect. No modification, amendment or waiver of any provision of this Agreement shall be effective unless in writing and signed by Customer and a duly authorized representative of CI. No failure or delay by either party in exercising any right, power, or remedy under this Agreement, except as specifically provided herein, shall operate as a waiver of any such right, power or remedy. Customer agrees to comply fully with all applicable laws, rules, policies, directives and regulations, including the U.S. export laws and to provide CI with such documentation, assurances and access to records as may be required to obtain licenses under the U.S. export laws. Customer agrees that it will not knowingly, without prior authorization if required, export or re-export the CI Products in any medium without the appropriate United States and foreign government licenses. The parties to this Agreement are independent contractors and as such will not have any authority to bind or commit the other. Nothing in this Agreement will in any way be construed to create a joint venture, partnership or agency relationship between the parties for any purpose. CI’s failure to perform its obligations hereunder shall be excused to the extent and for the period such performance is prevented by any condition or act beyond the reasonable control of CI, including without limitation fire, flood, earthquake, acts of God, explosion, casualty of war, pandemic, epidemic, labor dispute, inability to obtain delivery of parts, failure of supplies of electrical power, violence, any governmental law, order, regulation or ordinance. If this Agreement expires or is terminated, the provisions of Sections 2 (Exclusions), 3 (Ownership), 4 (Confidential Information), 5 (Data Security), 7 (Warranties, Disclaimers and Exclusive Remedies), 8 (Limitation of Liability), 10 (U.S. Government Restricted Rights), and 11 (General) shall survive and shall continue to bind the parties. If you have any questions about the terms of this Agreement, please contact your reseller or CI at operations@ci.security. [Signature Page Follows] v.31621 5 ACCEPTED AND AGREED TO: Customer Name: Authorized Signature: Print Name: Title: Date: Kittitas County Laura Osiadacz 02/28/2022 Board of County Commissioners Chairman February 14, 2022 Quote Number 70972 Version 1 CI MDR Service 02/19/22 - 02/18/2025 Customer Ship to Bill To Prepared By Kittitas County 205 W 5th Ave STE 13 Ellensburg, WA 98926 Jim Goeben Jim.Goeben@co.kittitas.wa.us (509) 312-0213 Kittitas County 205 W 5th Ave Ellensburg, WA 98926-2890 (509) 312-0213 Kittitas County 205 W 5th Ave STE 13 Ellensburg, WA 98926 (509) 312-0213 Larry Hyndman larry@ednetics.com P (208) 262-2049 F (208) 777-4708 Pricing provided through WSIPC SECURITY CONTRACT #: 18-03 Annual MDR Costs - Year 1 Line Part Number Description Price Qty Ext. Price CI-MDR-Service Managed Detection & Response: Network (MDR) Service $12,000.00 1 $12,000.001 CI-MDR-User-Network MDR Network Seat Users - Up to 250 Network Users - Annual Price.$30,000.00 1 $30,000.002 CI-P: CI-C-1U-R010-010 -03 1U Collector, 3 disk(s), RJ45 10G connector - Annual Price.$5,076.00 1 $5,076.003 Annual MDR Costs - Year 1 Subtotal $47,076.00 Annual MDR Costs - Year 2 Line Part Number Description Price Qty Ext. Price CI-MDR-Service Managed Detection & Response: Network (MDR) Service $12,000.00 1 $12,000.004 CI-MDR-User-Network MDR Network Seat Users - Up to 250 Network Users - Annual Price.$30,000.00 1 $30,000.005 CI-P: CI-C-1U-R010-010 -03 1U Collector, 3 disk(s), RJ45 10G connector - Annual Price.$5,076.00 1 $5,076.006 Annual MDR Costs - Year 2 Subtotal $47,076.00 Annual MDR Costs - Year 3 Line Part Number Description Price Qty Ext. Price CI-MDR-Service Managed Detection & Response: Network (MDR) Service $12,000.00 1 $12,000.007 CI-MDR-User-Network MDR Network Seat Users - Up to 250 Network Users - Annual Price.$30,000.00 1 $30,000.008 CI-P: CI-C-1U-R010-010 -03 1U Collector, 3 disk(s), RJ45 10G connector - Annual Price.$5,076.00 1 $5,076.009 Annual MDR Costs - Year 3 Subtotal $47,076.00 Ednetics, Inc. | 971 South Clearwater Loop | Post Falls, ID 83854 1 February 14, 2022 Quote Number 70972 Version 1 Quote Summary Annual MDR Costs - Year 1 $47,076.00 Annual MDR Costs - Year 2 $47,076.00 Annual MDR Costs - Year 3 $47,076.00 Subtotal $141,228.00 Estimated Tax $11,721.93 Total $152,949.93 Delivery of products will be considered complete and invoiced upon delivery. Customer will be invoiced for service and installation upon completion of service unless otherwise stated. Payment terms are net 30 days unless contract terms specify otherwise. Payments that are past due may be charged the lower of 1.5% interest monthly, or the highest rate permitted by law. These prices do NOT include applicable taxes, insurance, shipping, delivery, setup fees, cabling services or material unless specifically listed above. All prices are subject to change without notice. Supply subject to availability. A payment and performance bond is not included in this quote unless specifically stated. A performance bond can be provided at an additional 1.5% of the after tax total. Please submit your PO to: orders@ednetics.com or fax to: (208) 777-4708 Ednetics, Inc. | 971 South Clearwater Loop | Post Falls, ID 83854 2 1 EXHIBIT A Description of Service Critical Insight Commercially Available Products v. December 2020 Product Release Status On-Premises MDR Generally Available Nessus, On-Premises Vulnerability Scanning Generally Available AWS MDR Generally Available Microsoft MCAS Adaptor MDR Generally Available Microsoft Azure MDR Beta Microsoft Defender for Endpoint MDR Beta Log Retention Generally Available ALL COMMERCIALLY AVAILABLE PRODUCTS OFFERED BY CRITICAL INSIGHT TO CUSTOMERS ARE DETAILED IN THIS DESCRIPTION OF SERVICES. “GENERALLY AVAILABLE” PRODUCTS ARE SUBJECT TO THE SERVICE LEVEL COMMITMENTS OR “SLA’s” SET FORTH ON PAGE 8 HEREOF. PRODUCTS LISTED AS “ALPHA” OR “BETA” ARE NOT SUBJECT TO ANY SLA’s. ALPHA/BETA PRODUCTS ARE PROVIDED ‘AS IS’ WITH NO WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. CI SHALL USE COMMERCIALLY REASONABLE EFFORTS TO SUPPORT ALPHA AND BETA PRODUCTS ONLY ON AN ‘AS AVAILABLE’ BASIS. Service Description (Service ID) Description Critical Insight Platform (CI-P) The provisioning process to set up the ingest capabilities for each platform varies depending on the monitoring platform: • On Premises Collectors: • Deliver and install or provide instruction for installation of the Critical Insight Collector (CIC) on Customer premises and verify operation • Share provisioning instructions for any other specified data sources • Cloud - AWS: • Determine from the list of CI approved sources which services Customer intends for Critical Insight (“CI”) to monitor and provide relevant provisioning instructions • Microsoft - MCAS, Defender (Azure Cloud or Endpoint): 2 • Provide relevant provisioning documentation for Graph API or MCAS Each platform has unique data streams and CI has approved specific data streams for ingest and monitoring. Data types not listed here may not yet be approved. The following list details the CI-approved data streams, which include but are not limited to (inquire for specifics as needed): • On-premises customers • Specific Intrusion-detection event streams • Specific Device, server, infrastructure, and application logs • Continuous onsite packet collection for network segments specified by Customer • CI will generate flow records from collected packets • CI ephemerally stores packets for a period limited by the storage capacity of the customer’s chosen collectors • Microsoft Defender (Azure Cloud and/or Endpoint) and MCAS Customers • Event streams, e.g. Graph API SecurityEvents or MCAS (Required) • AWS • GuardDuty Event Streams (Required) • CloudTrail Audit Logs (Required) • VPC Flow Records • WAF Logs Managed Detection and Response (CI-MDR) Activation: • On-Premises Collector Activation: • Verify acquisition of NetFlow, named log sources, packet capture • Verify network scope of packet capture • Verify transmission of event data and correct ingestion into Critical Insight analytics engine • Verify ability to perform extract of packet capture for investigation • AWS Activation: • CloudTrail • Customer verifies successful delivery of CloudTrail logs into the accessible resource determined in provisioning 3 • CI Operations verifies that CI can access Customer’s CloudTrail logs and that CI is successfully pulling data from that location • CI Operations verifies that CloudTrail information is formatted as expected • VPC Flows (via CloudWatch) • Operations verifies that Customer has granted CI access to the selected CloudWatch Streams • CI Operations verifies that CI is successfully pulling data from those streams • CI Operations verifies that CloudWatch information is formatted as expected • Security Hub – Guard Duty (GD) • CI Operations confirms that GD data is available in CloudWatch • CI and Customer execute default AWS GD “Generate Sample Findings” test • CI Operations verifies that Sample Findings generate expected alerts • AWS WAF (via Kinesis Firehose) • CI Operations verifies that Customer has granted CI access to the correct source for WAF records • CI Operations verifies that CI is successfully pulling WAF records • CI Operations verifies that WAF records are formatted and flowing as expected • Verify transmission of any Customer data into CI’s corporate analysis systems, SOC dashboards and ticketing • Azure and Microsoft Defender ATP Activation: • Graph API • Customer verifies successful delivery of data from the selected services into the Graph API • CI Operations verifies that CI can access the specified data and that CI is successfully pulling it • CI Operations verifies that incoming data is structured as expected and synthetically generated customer events are generating tickets • Verify transmission of any Customer data into CI’s analysis systems • MCAS Activation: • CI Operations ensures successful delivery of MCAS feed from Customer to CI’s analysis systems 4 CI monitors delivery of data streams on an automated basis as available, and will also perform periodic manual reviews Managed Detection and Response (CI-MDR) Monitoring: Upon successful activation of specified platforms, CI will ingest any approved data streams, specified in the ‘Platform’ section, and will elevate alerts from those streams for review, as appropriate. CI analysts review approved data streams for indicators of compromise which include but are not limited to: • Alerts linked to Poor Reputation IPs or Domains • Command and Control connections • Anomalous or suspicious alert patterns • Sudden shifts in the volume of key activities • Event correlation with regional, sector, or global campaigns Managed Detection and Response (CI-MDR) Response: • Investigation ticket created and assigned to Critical Insight Analyst with a goal to conclude the investigation within the specified SLA (see SLA agreement) • Analysts investigate and attempt to confirm an incident has occurred by analyzing relevant and available data • For on-premises customers, “relevant data” refers to the packet capture, network flows and system logs from 30 seconds prior to until 30 seconds after the suspect activity in standard investigations. When warranted, the time period may expand. • For AWS, Azure, Microsoft Defender, or MCAS customers, “relevant data” refers to any data that the customer sends CI from Customer’s native AWS, Azure, Defender, or MCAS systems • Confirmation occurs when evidence of attack or compromise is verified by a CI Analyst Tiered Response: • For all confirmed incidents, notify customer within 30 minutes of incident verification • For urgent or high severity incidents, a final Incident Action Plan will be delivered to Customer at the time that all related tickets are closed. The report will include: 5 • Summary of incident • Summary of any confirmed actions taken (by CI and/or Customer) • Final status and/or resolution Monthly Activity Report: • Published by the 15th of month • Security Events Generated • Investigations Completed • Confirmed Severe Incidents (IAPs Issued) • Security events to include: • Intrusion detection signatures • Reputation matches • Anomalous traffic identification • Threat hunting findings • Additional detail for critical assets and highest volume events Continuous Vulnerability Identification (CI-CVI) • Automatically conducts internal network vulnerability scans at Customer-defined frequencies and IP scopes(s) • Identifies insecure configurations, open ports and services, vulnerable software/service versions, and missing patches • Generates reports with steps to eliminate each vulnerability, as well as risk via CVSS scores to allow prioritization of remediation efforts • Populates a web dashboard to view statistics, visualizations, and results • Tabular Results • Graphical representation of time-based trends for newly identified vulnerabilities and for remediated vulnerabilities Log Retention (CI-LR) • CI saves logs as indicated by Customer • CI hashes and encrypts logs to enable Customer to verify that they are secure and unchanged • CI will gather and return logs according to search criteria (limited to source and date) specified by Customer, when requested 6 Incident Classification for Critical Insight MDR Incident Severity Description Urgent An urgent priority security incident is a network event or set of network events that is believed to present a serious and immediate risk to the Customer’s network environment. CI will contact the Customer (contact on file) via phone and email to attempt resolution. Examples of urgent priority security incidents include: • Suspected account compromise with account misuse observed • Customer security device has alerted CI to a likely compromise that has been verified using other MDR data/tools with no evidence the security device has mitigated the incident • Suspected malware infection with evidence of immediate business impact • Communications observed with a suspected malicious host with evidence of data exfiltration or immediate business impact • Regulated data seen unencrypted going to an external destination High A high priority security incident is a network event or set of network events that is believed to present a risk to the Client’s network environment. CI will contact the Customer (contact on file) via phone and email to attempt resolution. Examples of high priority security incidents include: • Suspected or potential account compromise with no misuse observed • Suspected malware infection with evidence of malware spreading but no evidence of immediate business impact • Suspected or potential system compromise with no evidence of misuse • Regulated data seen unencrypted between two internal hosts Medium A medium priority security incident is a network event or set of network events that may be a risk to the Client’s network environment and may inform future customer actions. CI will contact the Customer (contact on file) via email to attempt resolution. Examples of medium priority security incidents include: • Attempted account compromise with no evidence of success • Suspected malware infection with no evidence of malware spread or immediate business impact 7 Low A low priority security incident is a network event or set of network events that is not believed to represent an immediate risk to the Client’s network environment but does warrant awareness and investigation. CI will contact the Customer (contact on file) via email to attempt resolution. Examples of low priority security incidents include: • Potentially unwanted program observed • Other issue that is not an immediate security threat observed Critical Insight and the Critical Insight logo are the trademarks of Critical Insight, Inc. ©2021 Critical Insight, Inc. All rights reserved. 8 Service Level Agreement1 CI Product Description Service Level SLA Credit Critical Insight Platform (CI-P) Collect, normalize, store, transmit, and retain security event data 99.9% uptime in a given month for the Critical Insight Collector while client network is functional 2% of Monthly Fee Maintenance of Critical Insight Collector Replacement devices shipped within 3 business days of failure 2% of Monthly Fee Managed Detection and Response (CI-MDR) Evaluate security alerts and determine if they are false positives or actual incidents 99% of events escalated to analyst for review in a given month evaluated within 90 minutes 2% of Monthly Fee Incident Reporting and Remediation Follow-ups 99% of confirmed incidents in a given month reported to customer within 30 minutes of confirmation 2% of Monthly Fee Continuous Vulnerability Identification (CI-CVI) Scheduled vulnerability scanning of customer network; report upload of scan results As vulnerability scans complete, report data uploaded to customer portal or delivered to customer within 48 hours of scan completion 2% of Monthly Fee 1. Service Level Agreements only apply to products in General Availability. Alpha and Beta products are not subject to this SLA. Please see page 1 for a list of products and their commercial availability status. State of Washington Consolidated Technology Services Statewide Imagery Consortium Group Contract # 17-088 1 + SERVICE LEVEL AGREEMENT Statewide Imagery Consortium Group Kittitas County Imagery Consortium Contributing Member WaTech Service Level Agreement Number: 2022-001 WaTech Customer Service Agreement Number: 8190-0 Customer Contract Number (optional): 1. Purpose This Service Level Agreement Number 2022-001 (SLA) is executed by the Washington State C onsolidated Technology Services (CTS), hereinafter referred to as Washington Technology Solutions (WaTech) and Kittitas County hereinafter referred to as the Customer, pursuant to the terms and conditions of Customer Service Agreement Number 8190-0 (CSA). The parties acknowledge they have read and understand the terms and conditions therein and by this reference incorporate those terms in this SLA. All rights and obligations of the parties shall be subject to and governed by the terms of the CSA and the SL A. This SLA sets forth the obligations of the parties with respect to WaTech’s provision of Statewide Imagery Services to the Customer. 2. Term and Termination The term of this SLA is effective upon the date of execution by both parties and shall remain in full force and effect until April 1, 2024 unless extended upon written mutual agreement between the parties or terminated as specified below. Either party may cancel or terminate this SLA pursuant to the terms of the CSA or upon 10 business days’ written notification to the other party. In the event the CSA is terminated, this SLA shall also terminate on the CSA termination date. This SLA supersedes and replaces all prior SLAs for Statewide Imagery Consortium Group imagery services. 3. Scope of Work CTS shall furnish the access to the Web based services, and a hard copy of the applicable State/County/City specific data and otherwise do all things necessary to make access to the data and service possible as defined in the Technical Specification and Requirements (Schedule B) and subject to the End User License Agreement (EULA) included in Contract 20-077 between CTS/WaTech and Ascent GIS, references in Schedule A to contract period refer to the original contract, not this SLA (Schedule A). 4. Pricing and Service Fees The total dollar amount expended under this SLA shall not exceed $4,000.00 per year for 2 years. State of Washington Consolidated Technology Services Statewide Imagery Consortium Group Contract # 17-088 2 5. Billing and Invoices Billing and invoicing will be handled by Consolidated Technology Services and invoiced yearly using the Customers assigned Consolidated Technology Services Account Code. 6. Service Level Agreement Changes This SLA may be modified at any time upon mutual written agreement of the parties. All such modifications will be made as an amendment to the SLA and will take precedence over the original SLA. 7. Order of Precedence If there is a conflict between this SLA and the CSA, the conflict will be resolved by giving precedence first to this SLA and then to the CSA. 8. SLA Management Unless otherwise indicated, all correspondence regarding this SLA should be directed to: Primary Contact Name: Primary WaTech Contact Name: Jim Goeben Joanne Markert Title: IT Director Title: Program Manager Address: 205 W 5th Avenue, Suite 108 Address: 1500 Jefferson Street SE Ellensburg, WA 98926 Olympia, WA 98501 Phone: 509.933.8283 Phone: 360.407.8691 E-Mail: Jim.Goeben@co.kittitas.wa.us E-Mail: joanne.markert@watech.wa.gov Billing email: itbilling@co.kittitas.wa.us 12. Termination for Convenience Either CTS/WaTech or the Customer may terminate this Contract, including all Statement(s) of Work if applicable, in whole or in part, by fourteen (14) calendar days’ written notice to the other party. If this SLA is so terminated, the Customer is liable only for payments required by the terms of this SLA or any SOW for Services received and accepted prior to the effective date of termination. 13. Authorization/Acceptance This SLA and the CSA constitute the entire agreement between the parties and supersedes all other communication, written or oral, related to the subject matter of this SLA. Customer hereby authorizes CTS to perform the services described herein. The Parties hereby acknowledge and accept the terms and conditions of this SLA. State of Washington Consolidated Technology Services Statewide Imagery Consortium Group Contract # 17-088 3 IN WITNESS WHEREOF, the parties have executed this Service Level Agreement. APPROVED APPROVED State of Washington State of Washington Consolidated Technology Services/Washington Technology Services (WaTech) Signature Signature Joanne Markert Print or Type Name Print or Type Name State GIS Coordinator Board of County Commissioners Chairman Title Date Title Date Approved as to Form by the Office of the Attorney General Laura Osiadacz 02/28/2022 State of Washington Consolidated Technology Services Statewide Imagery Consortium Group Contract # 17-088 4 Schedule A End User License Agreement (EULA) END USER ACCESS AGREEMENT IMPORTANT - READ CAREFULLY BEFORE ACCESSING INFORMATION FROM THIS HEXAGON-ENABLED WEB SITE, DOWNLOADING INFORMATION OR USING SERVICES FROM HEXAGON. BY ACCESSING THIS HEXAGON -ENABLED WEB SITE OR OTHER MEANS OF ACCESSING OR DOWNLOADING INFORMATION, YOU ACCEPT THIS AGREEMENT. IF YOU DO NOT AGREE WITH THE TERMS OF THIS AGREEMENT, DO NOT ACCESS THIS INFORMATION FROM ANY HEXAGON-ENABLED WEB SITE, OR OTHER MEANS OF ACCESSING OR DOWNLOADING INFORMATION. ACCESS TO THE GEOSPATIAL DATA IS GRANTED BY HEXAGON EXCLUSIVELY ON THESE TERMS OR OTHER TERMS EXPRESSLY AGREED IN WRITING AND S IGNED BY AN AUHORIZED OFFICER OF HEXAGON. This End User Access Agreement is between you and Leica Geosystems Inc. (“Hexagon”), a Delaware corporation with a place of b usiness at 5051 Peachtree Corners Cir., Suite 250, Norcross, GA 30092, USA. Access and Rights. During the subscription period as set forth in the ordering webpage, Hexagon grants access to various physical world data including but not limited to; 1) stereo, ortho-rectified, and/or oblique aerial imagery, 2) point cloud, elevation, and/or digital surface model data, 3) various derivative natural or humanmade geographic feature data, and 4) associated metadata or attribu te information (the “Geospatial Data”) through the online services provided by Hexagon (the “Services”) to you and such othe r persons authorized by you to use the Services in accordance with the Acceptable Use Policy (you and such authorized users hereinafter being collectively referred to as the “Authorized End Users”), for which you have paid the required fees. You are resp onsible for compliance with the terms of this End User Access Agreement by the Authorized End Users you delegate or to whom you grant log-in credentials to the Services. During the subscription period set forth in the ordering webpage, and subject to payment of fees and compliance with this Agreement, Authorized End Users may (i) consume Geospatial Data through a desktop and/or web -based GIS application (to the extent compatible with the Geospatial Data), (ii) combine vector layers and other data sets with the Geospatial Data, (iii) create reports, marketing collateral, and other work product of yours (“Your Work Product”) containing the Geospatial Data (iv) print images of Geospatial Data in hardcopy. You may deliver, or give access to, Your Work Product to your customers, provided your customers are bound not to distribute, copy or publish Your Work Product containing the Geospatial Data except for internal purposes and not for further sale or distribution, unless you are using an unpaid evaluation license, in which case you may not copy, give access to, or distribute Your Work Product that contains the Geospatial Data. For purposes of this End User License Agreement “internal purposes” means use consistent with CTS’ provider status in RCW 43.105. Attribution. In Your Work Product (including work product created by you or your other Authorized End Users) that contains or reproduces the Geospatial Data, you shall give notice that the Geospatial Data is “Copyright 2019 Hexagon” or as adjusted to the then cu rrent year or such other notice as Hexagon may instruct from time to time in writing. Ownership. Geospatial Data is not sold to the Authorized End User and no ownership rights are transferred to the Authorized End User. The Geospatial Data is owned by Hexagon or its licensors. Confidentiality. “Confidential Information” means all information disclosed by Hexagon (“Disclosing Party”) to an Authorized End User (“Receiving Party”), whether orally or in writing, that is designated as confidential or that relates to the Services, including the terms of this Agreement (including pricing). Confidential Information excludes any information that: (i) is or becomes generally known to the public without breach of any obligation owed to the Disclosing Party, (ii) was known to the Receiving Party prior to its disclosure by the Disclosing Party without breach of any obligation owed to the Disclosing Party, (iii) is received from a third party w ithout breach of any obligation owed to the Disclosing Party, (iv) was independently developed by the Receiving Party, or (v) is not exempt under the Washington Public Records Act RCW 42.56. The Receiving Party will use the same degree of care that it uses to protect the confidentiality of its own confidential info rmation of like kind, but in no event less than reasonable care, to (i) not use any Confidential Information of the Disclosing Party for any purpose outside the scope State of Washington Consolidated Technology Services Statewide Imagery Consortium Group Contract # 17-088 5 of this Agreement and (ii) except as otherwise authorized by the Disclosing Party in writing, limit acc ess to Confidential Information of the Disclosing Party to those of its and its affiliates’ employees and contractors who need that access for purposes consistent with this Agreement and who are under confidentiality obligations with the Receiving Party not materially less protective than those herein. The Receiving Party shall destroy Confidential Information in its possession upon termination of this agreement. Nothing in this section grants rights to Geospatial Data greater than those set forth in section 1 of this Agreement. The Receiving Party may disclose Confidential Information of the Disclosing Party to the extent compelled by law to do so, pr ovided the Receiving Party gives the Disclosing Party prior notice of the compelled disclosure (to the extent legally permitted) and reasonable assistance, at the Disclosing Party's cost, if the Disclosing Party wishes to contest the disclosure. Fees and Taxes. The ordering web page sets forth the fees, subscription term and other terms related to access and use of the Geospatial Data, and is hereby incorporated into, and forms a part of, this Agreement. Fees are exclusive of all applicable sales, use, value added, GST, and other taxes (and all applicable tariffs, customs duties and similar charges), and you will be responsible for payment of all such taxes (other than taxes based on the net income of Hexagon), tariffs, duties and charges (and any related penalties and interest), payable in connection with this Agreement or the provision of Services hereunder . The total invoice amount for fees is subject to increase by the amount of any taxes which Hexagon is required to pay and/or which you are required to withhold, collect or pay upon the fees so that Hexagon receives the full amount of the fees invoiced. If you are claiming tax exemption status, you must provide a copy of a valid tax exemption certificate. Restrictions. The Geospatial Data and Services may only be used by the Authorized End User or by individual users authorized in writing by Hexagon, and not by any other party, whether or not affiliated with the Authorized End User. Except as otherwise expressly provided in this End User Access Agreement, no part of the Geospatial Data, the Services or products derived therefrom, or any right granted under this Agreement may be copied, sold, rented, leased, lent, sub -licensed, disclosed, or transferred to any other person or entity. The Authorized End User shall not use any part of the Geospatial Data or the Services to develop or derive any other product or service for distribution, disclosure, or commercial sale, whether by hardcopy, digital medium or web service, without a license specifically authorizing it to do so, with the understanding that no such right is granted under this Agreement exc ept in connection with Your Work, which your customers may use for internal purposes, strictly as provided in paragraph 1. You have no other rights to the Geospatial except as expressly set forth in paragraph 1 or the ordering web page. Without limiting the foregoing, you may not re-sell or re-distribute or give access to the Geospatial Data as a web service. You may not use the Geospatial Data in connection with a service bureau or for time-sharing purposes or in any other way allow third parties to exploit the Geospatial Data, except your customers as specifically authorized by this End User Access Agreement. You shall not provi de passwords or other log-in information to any third party, except as specifically authorized by this End User Access Agreement. The Authorized End User acknowledges that the Geospatial Data and Services contain and embody proprietary materials, valuable data, trade secrets, and copyrights of Hexagon and its licensors and suppliers. Unauthorized reproduction, modification, distribution, o r display of the Geospatial Data or the Services in whole or in part, and in any manner not expressly authorized in thi s Agreement, are prohibited. The Authorized End User shall keep confidential and use its best efforts to protect the Geospatial Data and the Services and prevent their unauthorized disclosure or use. The Authorized End User shall immediately notify Hexag on upon discovering evidence of a current or threatened misuse or unauthorized use or disclosure of the Geospatial Data or Services by any party. The Authorized End User may not modify, distort, disassemble, decompile or in any way attempt to reverse engi neer the Services or any software provided as part of the Geospatial Data or the Geospatial Data itself. Each Authorized End User shall comply wi th the Acceptable Use Policy. The Authorized End User may not transfer the Geospatial Data to or store the Geo spatial Data or the Services in any electronic network for use by more than the number of users authorized in writing by Hexagon, unless it obtains prior written permission from Hexago n and pays associated additional fees. If the Authorized End User is a federal, provincial, state or local government agency, the Geospatial Data is licensed solely to the particular agency and not to any other government agency unless explicit authorization has been received from Hexagon. Evaluation Access. Hexagon may grant a right to access the Services during an evaluation period. In addition to the restrictions set forth above, Authorized End Users, during an evaluation period, shall use the Services for evaluation only, and shall not use the Services for any commercial or profit-making activity, including, but not limited to, non-revenue commercial activities such as marketing, bid submission, and promotion. Upon termination of the evaluation period, the Authorized End Users shall return or destroy all Geospatial Data and any reports, documents or files incorporating the Geospatial Data. State of Washington Consolidated Technology Services Statewide Imagery Consortium Group Contract # 17-088 6 Non-Hexagon Services. Hexagon may offer certain Services, or features or functions within Services, made available by unaffiliated third parties (“Non-Hexagon Services”). Accessing such Non-Hexagon Services may cause your computer to communicate with a third- party website. Such connectivity or access to third party websites or third-party materials is governed by the terms found on such sites, and access to and use of Non-Hexagon Services may require your agreement to separate terms. Linking to or use of Non - Hexagon Services constitutes your agreement with such terms. Hexagon Group Companies are not a party to such third -party agreements and are not responsible for such Non-Hexagon Services. Hexagon may at any time, for any reason, modify or discontinue the availability of any Non-Hexagon Services. Hexagon Affiliates. You acknowledge that Hexagon has Affiliates and subcontractors worldwide. You acknowledge and agree that Hexagon affiliates and subcontractors are entitled to provide the Services to you. Warranty Disclaimer and Limit of Liability. THE GEOSPATIAL DATA AND THE SERVICES ARE PROVIDED “AS IS,” AND HEXAGON MAKES NO WARRANTY, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, UPTIME, ACCURACY, OR NON-INFRINGEMENT. IN NO EVENT WILL HEXAGON AND ITS AFFILIATES, OFFICERS, DIRECTORS OR EMPLOYEES BE LIABLE FOR ANY DIRECT, INDIRECT, SPECIAL, CONSEQUENTIAL OR OTHER SIMILAR DAMAGES, HOWEVER CAUSED, INCLUDING, BUT NOT LIMITED TO, LOST PROFITS AND LOST DATA. THE AUTHORIZED END USER ACKNOWLEDGES THAT ITS SOLE REMEDY UNDER THIS AGREEMENT IS TO REQUIRE HEXAGON TO REDELIVER THE GEOSPATIAL DATA GIVING RISE TO ANY BREACH OF THIS AGREEMENT OR BREACH OF DUTY. THE AGGREGATE LIABILITY OF HEXAGON FOR ALL OTHER LOSSES, LIABILITIES, CLAIMS, DAMAGES OR ASSESSMENTS, OF ANY KIND OR NATURE, SHALL NOT EXCEED THE LICENSE FEES PAID BY THE AUTHORIZED END USER TO HEXAGON WITH RESPECT TO THE GEOSPATIAL DATA OR THE SERVICES AT ISSUE IN ANY DISPUTE OR CLAIM. The Authorized End User agrees that the limitations of liability and disclaimers set forth herein will apply regardless of whether the Authorized End User has accepted the Geospatial Data or any other product or service delivered by Hexagon. The Authorized En d User acknowledges and agrees that Hexagon has set its prices and entered into this Agreement in reliance upon the disclaimers of warranty and the limitations of liability set forth herein, that the same reflect an allocation of risk between the parties (including the risk that a contract remedy may fail of its essential purpose and cause consequential loss), and that the same form an essential basis of the bargain between the parties. In addition, in no event shall Hexagon be liable for any third-party websites that appear in or are referenced by the Hexagon ordering web page. Acceptable Use. You shall ensure all your Authorized End Users comply with the Acceptable Use Policy (“AUP”). The latest version of AUP posted https://hxgncontent.com/global/acceptable-use-policy, is incorporated herein by reference. An Authorized End User may be prompted with review and acceptance of the AUP to gain access to the Services. Hexagon reserves the right to change the AUP at any time. Any update to the AUP may require each Authorized End User to re-accept the modified AUP. Failure to comply with the AUP may result in suspension of the Services or termination of this Agreement for material breach. During any perio d of suspension, your will still be liable for payment of the applicable fees. Term. Hexagon may terminate this End User Access Agreement, which will terminate all access to the Services and the Geospatial Data , if the Authorized End User fails to comply with any term of this Agreement. In the event of termination, the Auth orized End User must immediately return the Geospatial Data to Hexagon or destroy it and certify this destruction in writing to Hexagon. Complete Agreement. This Agreement and ordering web page set forth the complete and exclusive statement of the understanding between the Authorized End User and Hexagon with respect to the Geospatial Data and the Services and may be amended or modified only in a written instrument signed by a duly authorized representative of both parties. If any provision is determined to be invalid or unenforceable, the remaining provisions of this Agreement shall continue to be valid and enforceable. Without the prior w ritten consent of Hexagon, neither this Agreement nor any of the rights granted by it may be assigned or transferred by the Authorized End User. This restriction on assignments or transfers shall apply to assignments or transfers by operation of law, as well as by contract, merger or consolidation. State of Washington Consolidated Technology Services Statewide Imagery Consortium Group Contract # 17-088 7 Export. You acknowledge that this Agreement and the performance thereof is subject to compliance with any and all applicable Swiss, Canadian, EU and United States laws, regulations, or orders relating to export. You expressly acknowledge and agree that you will not export, re-export, transfer or release the Geospatial Data in whole or in part to (a) any EU, Swiss, Canadian and/ or U.S. embargoed country (or to a national or resident of any EU, Swiss, Canadian and/ or U.S. embar goed country); (b) any person on the U.S. Treasury Department’s list of Specially Designated Nationals; (c) any person or entity on the U.S. Commerce Departme nt’s Table of Denial Orders; or (d) any person or entity on any EU or Swiss or US Denied Parties Lists; or (e) any person or entity where such export, re-export or provision violates any EU or Swiss or Canadian or U.S. export control laws or regulations including, but not limited to, the terms of any export license or licensing provision and any amendments and supplemental additions to EU or Swiss or Canadian or U.S. export laws as they may occur from time to time. Force Majeure. Except for your payment obligations, neither party will be held liable or responsible for delay or failure to perform any of such party's obligations under this Agreement occasioned by any cause beyond its reasonable control, including but not limited to war; terrorist acts; civil disturbance; fire; flood; earthquake; acts or defaults of common carriers; governmental laws, acts, reg ulations, embargoes or orders; or any other cause, contingency or circumstance not subject to such party's reasonable control. The affected party will resume full performance of interrupted obligations as soon as practicable upon cessation of intervening causes. Notices. Notices permitted or required under this Agreement shall be in writing and delivered personally (including courier service), by certified or registered mail, return receipt requested, or by confirmed facsimile transmission. Notices shall be effective upon receipt . If notice is sent to Hexagon, it shall be directed to Attn: Legal Department. Precedence. In the event of a conflict or inconsistency in the Agreement documents, the following order of precedence shall apply: (i) the ordering webpage, (ii) the Acceptable Use Policy, and (iii) this End User Access Agreement. The English language version of this Agreement is legally binding in case of any inconsistencies between the English version and any translations. Governing Law. The interpretation, Agreement shall be governed by the following law: (a) if the Authorized End User is a government entity, the applicable laws of the Authorized End User, (b) in all other cases, the law of the state of Georgia, U.S.A., excluding its choi ce of law principles. Restricted Rights to U.S. Federal Agencies. As prescribed in FAR 27.409(f), the Geospatial Data is existing data, and is licensed to the U.S. government under clause: 52.227-18 Rights in Data-Existing Works. No Joint Venture. This Agreement shall not create any relationship between you and Hexagon as joint ventures, partners, associates, or principal and agent. Neither party is granted any right of authority and shall not create any obligation or responsibility for or on behalf of the other party. Neither party shall have the authority to bind the other party. State of Washington Consolidated Technology Services Statewide Imagery Consortium Group Contract # 17-088 8 Electronic Agreement. You expressly consent and agree that ordering webpages and related Hexagon forms may be electronically signed or acknowledged and agreed, and that such electronic signatures shall be treated, for purposes of validity, enforceability as well as admissibility, the same as written signatures. Special Terms and Conditions which are granted to Washington State with regards to the End User License Agreement. Special Terms and Conditions 1) The following entities shall be allowed unlimited access licenses; a. All State Government Agencies and Regents-level institutions b. All County-level governments c. All Municipal (city) governments d. All Public Safety Answering Points (PSAP) e. Tribes who are served and part of E911 and NG911 f. Any commercial firm or organization holding an active contract to conduct work on behalf of the entities listed above. 2) Authorized users shall be allowed to develop and publish, not for monetary gain, publicly available web applications which utilize ortho- imagery or web map service(s), in a view-only mode with no download capability. 3) Authorized users shall be allowed to print and distribute, not for monetary gain, hardcopy format maps that display the orthoimagery. 4) At the end of the contract period , all previous vintage data will enter into a perpetual license. At the end of the contract period, if not renewed, the web services will no longer be provided. However, the license allows for perpetual use of the previous vintage data for all approved users. Upon renewal of the contract or refresh of the data, the previous vintage data will be allowed in the public domain. CUSTOMER ______________________________________ Signature: _______________________________ Name: __________________________________ Title: ___________________________________ Date: ___________________________________ Kittitas County Laura Osiadacz Board of County Commissioners Chairman 02/28/2022 Schedule B Technical Specifications and Requirements Cybersecurity Incident Response Plan Kittitas County Department of Information Technology Excerpts of Plan Changes… Roles and Responsibilities Communications Director  Communicate applicable cybersecurity incidents to the public and press Definition of a cybersecurity incident Any adverse event that threatens the confidentiality, integrity, or availability of the county’s data or information resources. While this definition includes numerous types of cybersecurity incidents, the requirement for cybersecurity incident reporting, regardless of malicious or accidental origin, is limited to serious incidents. A serious incident is an incident that might pose a substantial threat to county records, resources, and/or services. An incident is designated as serious if it meets one or more of the following criteria: 1. Involves potential, accidental, or other unauthorized access or disclosure of sensitive (Category 2) or confidential information (Categories 3 and 4) 2. Involves legal issues including criminal activity, or might result in litigation or regulatory investigation 3. Might cause severe disruption to critical services 4. Involves active threats 5. Is widespread 6. Is likely to be of public interestin the public’s best interest 7. Is likely to cause reputational harm to the county Communication All communication regarding the cybersecurity incident will include only the minimum necessary information, only to those who need it. All cybersecurity incident communication from IT will be reviewed by the IT Director before dissemination. All cybersecurity incident communication with the press will be provided by the Communications Director or the BoCC or their non-IT designee; however, it is advised the communication be reviewed by the IT Director before released. Cybersecurity Incident Response Plan Kittitas County Department of Information Technology Cybersecurity Incident Response Procedure Stage 2. Respond Communication Plan If the event impacts the public, the CIR Commander will coordinate communication through the Communications Director or the BoCC.