HomeMy WebLinkAbout2017-212-E CJRM - Automon LLC for Criminal Justice Resource Management (CJRM) Case Management Software DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
[Departmental Use Only]
TITLE CJRM Software
FY 2016-2017
ORANGE COUNTY
CONTRACT UNDER $15,000.00
NORTH CAROLINA
THIS AGREEMENT,made and entered into this 22rd day of May, 2017, ("Effective Date")by and
between Orange County, North Carolina, a political subdivision of the State of North Carolina, (the
"County"),party of the first part; and Automon,LLC(the "Provider"),party of the second part;
WITNESSETH:
For the purpose and subject to the terms and conditions hereinafter set forth, the County hereby
contracts for the services of the Provider, and the Provider agrees to provide the following services to the
County in accordance with the terms of this Agreement, time being of the essence:
The services and/or materials (hereinafter referred to collectively as "Services") to be furnished
under this Agreement are as follows: annual subscriptions to Ce Pretrial software as well as one-time service
for configuration, training and data conversion as described in the Purchased Services (Attachment A),
Description of Services (Attachment B), Project RolloutPlan (Attachment C), and Service Level Agreement
(Attachment D). Also, attached are the Cyber Liability Insurance Certificate (Attachment E) and the
completed Orange County NC Cloud Service Questionnaire with Answers from AutoMon(Attachment F).
The term of this agreement rendered shall be from 2017 to 2020.
Provider represents and agrees that Provider is qualified to perform and fully capable of performing and
providing the services required or necessary under this Agreement in a fully competent, professional and
timely manner to the satisfaction of the County. Provider shall be responsible for all errors or omissions, in
the performance of the Agreement. Provider shall correct any and all errors, omissions, discrepancies,
ambiguities, mistakes or conflicts at no additional cost to the County. Provider agrees that Provider shall not
sub-contract any of the services to be provided in this Agreement, nor shall Provider assign any right or
responsibility granted or required by this Agreement,without the prior written approval of the County.
SPECIFIC TERMS
1. Payment: The County agrees to pay at the rates specified for Services satisfactorily
performed in accord with this Agreement. The amount to be paid by the County shall not exceed three
thousand nine hundred dollars ($3,900) for implementation as a one-time cost and four thousand four
hundred dollars ($4,400) per year for subscription costs for a total not to exceed ten thousand five hundred
dollars, ($10,500). Payment shall be made within thirty (30) days of an invoice properly submitted to
County. Should Provider fail to perform its duties under the terms of this Agreement, County may, without
fault or penalty,withhold any payment associated with the work to be performed until such time as said work
is completed.
2. Non—waiver: Failure by County at any time to require the performance by Provider of any
of the provisions hereof shall in no way waive or affect the County's right hereunder to enforce the same, nor
shall any waiver by the County of any breach be held to be a waiver of any succeeding breach or a waiver of
this Non-Waiver Clause.
3. Independent Contractor: The Provider shall operate as an independent contractor and the
County shall not be responsible for any of the Provider's acts or omissions. The Provider shall not be treated
as an employee with respect to the Services performed hereunder for federal or state tax, unemployment or
Revised 2/17 1
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
workers' compensation purposes. The Provider understands that neither federal, nor state, nor payroll tax of
any kind shall be withheld or paid by the County on behalf of the Provider or the employees of the Provider.
4. Insurance: Provider shall obtain, at its sole expense, Commercial General Liability
Insurance, Automobile Insurance, Workers' Compensation Insurance, and any additional insurance as may
be required by County's Risk Manager as such insurance requirements are described in the Orange County
Risk Transfer Policy and Orange County Minimum Insurance Coverage Requirements (each document is
incorporated herein by reference and may be viewed at
http://www.orangecountync.gov/departments/purchasing division/contracts.php). If County's Risk
Manager determines additional insurance coverage is required such additional insurance shall consist of
Cyber Liability (if no additional insurance required mark N/A as being not applicable). Provider shall not
commence work until such insurance is in effect and certification thereof has been received by the County's
Risk Manager.
5. Indemnity: The Provider shall be fully liable for the actions of its agents, employees,
partners or subcontractors and shall fully indemnify and save harmless the County and Authorized Users
from suits, actions, damages and costs of every name and description (including reasonable attorney's fees)
relating to personal injury and damage to real or personal tangible property caused by an intentional act or
negligence of Provider, its agents, employees, partners or subcontractors, without limitation that relate to
Provider's obligations under this Agreement; provided, however, that the Provider shall not indemnify the
County or Authorized Users for that portion of any claim, loss or damage arising hereunder due to the
negligent act,failure to act or intentional act of the County of the Authorized Users.
6. Termination: This Agreement may be terminated at any time by mutual written agreement of
the parties or by the County upon written notice to the Provider. County may suspend this Agreement upon
reasonable notice to the Provider.
7. Entire Agreement and Signatures: The parties have read this Agreement and agree to be
bound by all of its terms, and further agree that it constitutes the complete and exclusive statement of the
Agreement between the parties unless and until modified in writing and signed by the parties. This
Agreement together with any amendments or modifications may be executed electronically. All electronic
signatures affixed hereto evidence the consent of the Parties to utilize electronic signatures and the intent of
the Parties to comply with Article 11A and Article 40 of North Carolina General Statute Chapter 66.
8. Priority: In determining the basic services to be provided, should any documents be
referenced in or attached to this Agreement, the terms of this Agreement shall have priority in any conflict
between the terms of referenced documents and the terms of this Agreement.
9. Governing Law: Both parties agree that this Agreement shall be governed by the laws of the
State of North Carolina. Provider shall at all times remain in compliance with all applicable local, state, and
federal laws, rules, and regulations including but not limited to all state and federal anti-discrimination laws,
policies,rules, and regulations and the Orange County Non-Discrimination Policy and Orange County Living
Wage Policy (each policy is incorporated herein by reference and may be viewed at
http://www.orangecountync.gov/departments/purchasing_division/contracts.php.). Any violation of this
requirement is a breach of this Agreement and County may immediately terminate this Agreement without
further obligation on the part of the County. This paragraph is not intended to limit and does not limit the
definition of breach to discrimination. By executing this Agreement Provider affirms that Provider is and
shall remain in compliance with Article 2 of Chapter 64 of the North Carolina General Statutes. By
executing this Agreement Provider certifies that Provider has not been identified, and has not utilized the
services of any agent or subcontractor, on the list created by the State Treasurer pursuant to G.S. 147-86.58.
Revised 2/17 2
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
10. Dispute Resolution: Any and all suits or actions to enforce, interpret, or seek damages with
respect to any provision of, or the performance or non-performance of, this Agreement shall be brought in
the General Court of Justice of North Carolina sitting in Orange County, North Carolina. It is agreed by the
parties that no other court shall have jurisdiction or venue with respect to such suits or actions. Binding
arbitration may not be initiated by either Party, however, the Parties may agree to nonbinding mediation of
any dispute prior to the bringing of such suit or action.
11. Non Appropriation: Provider acknowledges that County is a governmental entity, and the
validity of this Agreement is based upon the availability of public funding under the authority of its statutory
mandate. In the event that public funds are unavailable and not appropriated for the performance of County's
obligations under this Agreement, then this Agreement shall automatically expire without penalty to County
immediately upon written notice to Provider of the unavailability and non-appropriation of public funds.
[SIGNATURE PAGE TO FOLLOW]
Revised 2/17 3
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
IN WITNESS WHEREOF, County and the Provider have signed this Agreement, effective as of
the day first written above.
ORANGE COUNTY PROVIDER
DocuSigned by:
1 DocuSigned by:
By cjb1A,bt,lt, �GUMwtt,V'St,t,i 6/9/2017 By Sc6f QS 5/25/2017
Bon>icirYt1 € ley, County Manager Tltl A544FF98C55A4N ice president
200 S. Cameron St. Scot Asher,Vice President,Automon LLC
P.O. Box 8181 6621 N. Scottsdale Road
Hillsborough,NC 27278 Scottsdale,AZ 85250
Revised 2/17 4
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
Attachment A
Purchased Services—Annual Subscription Fees
Product(s) Year 1 per User # Annual Line Amount
Charge Users Subscription
Term/Notes
Ce Pretrial— $1,100.00 4 Annual $4,400.00
Subscription Subscription dates
(12 month duration,
dates TBD).
Limited for use by
Orange County
(NC) Pretrial
Services.
Subscription
includes unlimited
read-only licenses.
A) Purchased Services Sub-Total (annual) $4,400.00
One Time Additional Costs— Training and Implementation Services
Item Description Hours Hourly Rate Line Amount
End-User Training Web-based Training and N/A $2,000.00
& Configuration Electronic Training Manual;
Tenant Set-up and
configuration of Ce Pretrial for
Orange County Pretrial.
Data Conversion Data Mapping, testing& 10 $190.00 $1,900.00
verification
B) Additional Costs Sub-Total(one-time) $3,900.00
$8,300.00
(A +B) 4 Total Purchased Services &Additional Costs
1.1. Term of Purchased User Subscriptions. User subscriptions purchased by County
commence on the go-live date and continue for 12 month durations. All User
subscriptions shall automatically renew for up to 1 annual term under the same terms,
subject to an annual 3% annual price escalation, unless either party gives the other
notice of non-renewal at least 30 days before the end of the relevant subscription term.
1.2. Refund upon Termination. Upon any termination for cause by County, Provider shall
refund County any prepaid fees covering the remainder of the term of all
subscriptions after the effective date of termination.
1.3. Return of County Data. Upon request by County made within 30 days after the
effective date of termination of a Purchased Services subscription, Provider will make
available to County for download a file of County Data in comma separated value
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
Attachment A
(.csv) format along with attachments in their native format. After such 30-day period,
Provider shall have no obligation to maintain or provide any County Data and shall
thereafter, unless legally prohibited, delete all of County Data in Provider's systems or
otherwise in Provider possession or under Provider control.
1.4. Additional Services: Additional mutually-agreed-to Professional Services and/or
additional Projects (i.e., Data Conversion, Interfaces with 3rd party systems) may be
offered under a separate billable Work Order at a Time and Materials rate of$190/hour
(2017 pricing).
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
ATTACHMENT B
DESCRIPTION OF SERVICES
Orange County Criminal Justice Resource Management seeks to implement an automated
Pretrial Case Management System to assist in the management of Pretrial tasks and cases and in
providing a continuum of evaluation and supervision for defendants as they interact with
functions throughout Pretrial Services. The Pretrial CMS (Ce Pretrial) shall be placed into
production for agency use.
The services outlined are designed to orient AutoMon and Orange County Criminal Justice
Resource Management to one another, align and define expectations for implementation, and
develop mutually agreed upon timelines and deliverables.
Annual Subscription shall include all software licenses,hosting services, updates, upgrades,
maintenance and support. Additional users may be added at the Annual per User Charge defined
in Appendix A: Purchased Services and Costs.
Additional mutually-agreed-to Professional Services and/or additional Projects (i.e., Data
Conversion, Interfaces with 3rd party systems) may be offered under a separate billable Work
Order at a Time and Materials rate of$190/hour.
Additional Modules and Services may become available in future product development releases
and may incur additional Subscription licenses and Training/Implementation costs.
Purchased Services are subject to annual price escalation equal to 3%.
Provision of Purchased Services. Provider shall make the Purchased Services available to
County pursuant to this Agreement and the relevant Order Forms during a subscription term.
County agrees that County purchases hereunder are neither contingent on the delivery of any
future additional functionality or features nor dependent on any oral or written public comments
made by Provider regarding future functionality or features.
User Subscriptions. Unless otherwise specified in the applicable Order Form, (i) Services are
purchased as User subscriptions and may be accessed by no more than the specified number of
Users or if County is a government or corporate entity, the employees who are employed by
County or persons under County direct control who provide technical or research services to
County, (ii) additional User subscriptions may be added during the applicable subscription term
at the same pricing as that for the pre-existing subscriptions thereunder,prorated for the
remainder of the subscription term in effect at the time the additional User subscriptions are
added or if County are a government or corporate entity,based on pricing negotiated with
Provider and reflected in an additional Order Form, and (iii)the added User subscriptions shall
terminate on the same date as the pre-existing subscriptions. Unless otherwise specified in the
Order Form,User subscriptions are for designated Users only and cannot be shared or used by
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
more than one User but may be reassigned to new Users replacing former Users who no longer
require ongoing use of the Services.
1. USE OF THE SERVICES
1.1. Our Responsibilities. Provider shall: (i) provide Our basic support for the Purchased
Services to County, (ii) use commercially reasonable efforts to make the Purchased
Services available 24 hours a day, 7 days a week, except for: (a) planned downtime of
which Provider shall give at least one day prior notice via the Purchased Services and
which Provider shall schedule during standard non-business hours, or (b) any
unavailability caused by circumstances beyond Our reasonable control, including
without limitation, acts of God, acts of government, floods, fires, earthquakes, civil
unrest, acts of terror, strikes or other labor problems (other than those involving Our
employees), Internet service provider failures or delays, or denial of service attacks,
and (iii) provide the Purchased Services only in accordance with applicable laws and
government regulations.
1.2. Our Protection of County Data. Provider shall maintain, or cause to be maintained,
appropriate administrative, physical, and technical safeguards for protection of the
security, confidentiality and integrity of County Data that operate on the servers
maintained by Provider hosting vendor. Provider shall not
(a)modify County Data, (b) disclose County Data except as compelled by law or as
expressly permitted in writing by County, or (c) access County Data except to provide
the Services and prevent or address service or technical problems, or at County
request in connection with customer support matters.
1.3. County's Responsibilities. County shall (i) be responsible for Users' compliance with
this Agreement, (ii) be responsible for the accuracy, quality and legality of County
Data and of the means by which County acquired County Data, (iii) use commercially
reasonable efforts to prevent unauthorized access to or use of the Services, and notify
Provider promptly of any such unauthorized access or use, and (iv) use the Services
only in accordance with the User Guide and applicable laws and government
regulations, (v) provide the servers and system and third party software for Purchased
Services that run on County servers, (vi) desktop computers and related software to
operate the Purchased Services. County shall not (a) make the Services available to
anyone other than Users, (b) sell, resell, rent or lease the Services, (c) use the Services
to store or transmit infringing, libelous, or otherwise unlawful or tortious material, or to
store or transmit material in violation of third-party privacy rights, (d) use the Services
to store or transmit Malicious Code, (e) interfere with or disrupt the integrity or
performance of the Services or third-party data contained therein, or (f) attempt to gain
unauthorized access to the Services or their related systems or networks.
1.4. Usage Limitations. Services may be subject to other limitations or additional charges,
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
such as, for example, on the calls County are permitted to make against Our application
programming interface and similar limitations. Any such limitations or charges are
specified in the Purchased Services (Attachment A).
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
Attachment C
PROJECT ROLLOUT PLAN
I. GOALS
• Provide Orange County Criminal Justice Resource Management department with an
automated Pretrial Case Management System (CMS), Ce Pretrial, that is configured
using Orange County data and work flow along with industry best practices and
standards.
• Clearly define all in-scope and out-of-scope parameters associated with the project.
• At the first project kick-off meeting clearly define:
o Project end result, vendor and Orange County expectations, vendor and Orange
County roles/responsibilities and Stakeholders for all efforts
o All the project phases and with milestones.
o All roles and responsibilities.
o Escalation paths for AutoMon and Orange County.
o Primary point of contacts within AutoMon and Orange County.
o Clearly define all 3rd party applications/services used by the Ce Pretrial software.
II. PHASE 1: CONFIGURATION
A. Tenant Setup Form Completion
AutoMon utilizes a detailed spreadsheet to capture all of the configuration considerations for a
customer to go-live with Ce Pretrial. During this phase of the project, a Project Manager will
work with a resource at Orange County to get the form completed in its entirety and answer any
questions the County may have regarding configuration.
B. DevOps Configuration of Ce Pretrial
AutoMon's DevOps team will utilize the completed Tenant Setup Form to configure the
application based on the information provided. The Project Manager assigned to Orange
County's implementation will then verify that the configuration is complete before Training is
scheduled.
III. PHASE 2: TRAINING
Task 1: Schedule Training Session
Upon completion of the tenant set-up process, the AutoMon Project Manager will work with our
Training Staff and Orange County to agree on a mutually convenient time to conduct a training
session. The training session will be in a webinar format and recorded for the County to use in
the future should they hire new employees or need refresher training. The Project Manager will
send the Orange County resource all necessary training documentation in a Google Doc to ensure
the County has continued access to the most current versions.
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
Attachment C
Task 2: Conduct Training Session
AutoMon's training staff will conduct a two-hour training session that will cover all of Ce
Pretrial's functionality. The Project Manager will be present during this training session to
answer additional questions Orange County may have during this phase of the project.
IV. PHASE 3: PAYMENT
Task 1: Invoice and Process Payment
As set forth in the Order Form,payment is due upon completion of configuration and end-user
training, prior to go-live and upon signature by County of Final Acceptance Form, which shall
not be unreasonably withheld. There are no milestones associated with this project that require
partial payment. Should the County require an invoice prior to configuration and training, please
request as soon as possible.
V. PHASE 4: GO-LIVE
Task 1: Provide Orange County with Ce Pretrial Logins
AutoMon's Support Team will send the users an invitation to set up their Ce Connect logins.
Once this is complete, the County will have full access to Ce Pretrial.
Task 2: Provide Orange County with TeamSupport Logins
Once the County is live with Ce Pretrial, AutoMon's Support Team will create accounts for
them in TeamSupport, our customer support portal. Although we encourage customers to go
through TeamSupport for all support-related issues, the Project Manager will act as a support
resource during the first few weeks of stabilization and beyond if necessary.
Task 3: Continued Assistance, Post Go-Live
The Project Manager will actively monitor any issues or questions after go-live. Once Orange
County is comfortable using the product and is confident that they can mitigate minor issues or
questions on their own, the Project Manager will formally hand off the responsibility to our
Support Team.
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
Attachment D
Service Level Agreement/Escalation Path /Issue Response Time:
Service requests for AutoMon software may be submitted by your designated representative online via
AutoMon's web-based customer support system, TeamSupport, or by telephone. The Service Level shall
be determined based on the severity definitions specified below.
Severity Response
Level Description Timer Temporary Resolution Resolution
1 Your production use of Best effort until fixed or a 2 business days
the software is stopped 2 Hours suitable workaround
or severely impacted provided.
such that you cannot
continue to work. The
operation is mission
critical to the business
and no Circumvention
Procedures are available.
2 You experience a severe 1 Fix or suitable 5 business days
loss of service where business workaround provided
essential functionality is day3 within 5 business days.
unavailable; however,
operations can continue
in a restricted fashion or
by use of a
Circumvention
Procedure.
3 You experience a loss of 2 Fix or suitable 25 business days
service where non- business workaround provided
essential functionality is within 25 business days.
Response Time—Acknowledge receipt of a request for support.
2
Response Time — Customer must call this in to 480-368-8555 Option 2. If they get voice mail
they should try Ext 135, 113,118 if still no answer they should call 480 231 8288 - In the event
that this procedure is not followed then the response time shall be 4 hours. Alternatively, AutoMon
Connect can be accessed via the AutoMon website Support page at:
https://portaLteamsupport,com/AutoMonLLC
3 Response Time — Customer must call this in to 480-368-8555 Option 2. If they get voice mail
they should try Ext 135, 113,118 if still no answer they should call 480 231 8288 - In the event
that this procedure is not followed then the response time shall be 4 hours. Alternatively, AutoMon
Connect can be accessed via the AutoMon website Support page at:
https://portaLteamsupport,com/AutoMonLLC
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
Attachment D
unavailable and a days
workaround is not
available to restore
functionality.
4 You experience a loss of 2 Within next two
service where non- business version releases.
essential functionality is days
unavailable. The impact
is an inconvenience or a
Circumvention
Procedure is available.
5 A cosmetic or minor 2 Customer will be notified Issue may be
issue that does not in advance when a fix will resolved at
impact the operation of a business be available. AutoMon's
days
software. discretion at a
future date
6 All Enhancement 4 These requests
requests,usage business are outside the
questions, or requests for days scope of our
maintenance
training. Also reported
obligations
problems that are caused
by customer computers,
local environments,
networks or third party
software.
Definitions
a. "Circumvention" or "Circumvention Procedures" shall mean, as applied to a Documented
Defect, a change in operating procedures whereby the Customer can reasonably avoid any deleterious
effects of such Documented Defect.
b. "Documented Defect" means a failure of the Licensed Software to properly perform any of its
intended functions. The Customer must use reasonable effort to document a Documented Defect with
sufficient information to recreate the defect,including,but not limited to, the operating environment, data
set, and user, and the Customer must deliver such information to AutoMon concurrently with its
notification to AutoMon of such defect. The Customer shall use all reasonable efforts to eliminate any
non-application related issues prior to its notification to AutoMon of such defect, including, but not
limited to, issues related to the network, user training and data problems not caused by the Licensed
Software. Any technical or other issue for which the Customer requests services, but which is not a
Documented Defect, shall be treated as a request for additional services requiring a Change Order.
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
Attachment D
c. "Documentation" means the training materials, user's manuals and other materials in any form
or medium provided by AutoMon to the users of the Licensed Software regarding the use or maintenance
of Licensed Software.
d. "Enhancement." Any modification or addition that, when made or added to the Licensed
Program, changes its utility, efficiency, functional capability, or application, but that does not constitute
an Error Correction.
e. "Error." Any failure of the Licensed Program to materially conform to its functional
specifications as agreement in writing with the Customer or Documentation as published from time to
time by AutoMon. Any nonconformity resulting from Customer's misuse, improper use, alteration, or
damage of the Licensed Program shall not be considered an Error.
f. "Error Correction." Either a modification or an addition that, when made or added to the
Licensed Program, establishes material conformity of the Licensed Program to the Documentation, or a
procedure or routine that,when observed in the regular operation of the Licensed Program, eliminates the
practical adverse effect on Customer of such nonconformity.
g. Licensed Software includes any and all software and Documentation to which Customer obtains
or is granted any rights under a License Agreement with AutoMon.
h. Third Party Software means software licensed by a party other than AutoMon.
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
1 AUTOM-1 OP ID: DO
,4CORC,w CERTIFICATE OF LIABILITY INSURANCE DATE(M
o2r2s/2017 2o17
THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER. THIS
CERTIFICATE DOES NOT AFFIRMATIVELY OR NEGATIVELY AMEND, EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POLICIES
BELOW. THIS CERTIFICATE OF INSURANCE DOES NOT CONSTITUTE A CONTRACT BETWEEN THE ISSUING INSURER(S), AUTHORIZED
REPRESENTATIVE OR PRODUCER,AND THE CERTIFICATE HOLDER.
IMPORTANT: If the certificate holder is an ADDITIONAL INSURED, the policy(ies) must be endorsed. If SUBROGATION IS WAIVED, subject to
the terms and conditions of the policy, certain policies may require an endorsement. A statement on this certificate does not confer rights to the
certificate holder in lieu of such endorsement(s).
PRODUCER NAMEACT Deb Olander CIC, CISR
Low&Johnson, Inc. PHONE FAX
PMB 618 A/C No Ext:480-706-7055 (AIC,No): 480-948-1707
10645 N. Tatum Blvd, Suite 200 ADDRESS:dolandert lowjohnson.com
Phoenix, AZ 85028-3053
Jamie S. Low,CPCU,CIC INSURER(S)AFFORDING COVERAGE NAIC#
INSURERA:Travelers Property&Casualty 25674
INSURED AutoMon LLC INSURER B:
Penny Alvarez
6621 N Scottsdale Road INSURER C:
Scottsdale,AZ 85250 INSURERD:
INSURER E:
INSURER F:
COVERAGES CERTIFICATE NUMBER: REVISION NUMBER:
THIS IS TO CERTIFY THAT THE POLICIES OF INSURANCE LISTED BELOW HAVE BEEN ISSUED TO THE INSURED NAMED ABOVE FOR THE POLICY PERIOD
INDICATED. NOTWITHSTANDING ANY REQUIREMENT, TERM OR CONDITION OF ANY CONTRACT OR OTHER DOCUMENT WITH RESPECT TO WHICH THIS
CERTIFICATE MAY BE ISSUED OR MAY PERTAIN, THE INSURANCE AFFORDED BY THE POLICIES DESCRIBED HEREIN IS SUBJECT TO ALL THE TERMS,
EXCLUSIONS AND CONDITIONS OF SUCH POLICIES. LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS.
INSR RODE SUBR POLICY EFF POLICY EXP
LTR TYPE OF INSURANCE INSD WVD POLICY NUMBER (MM1DDIYYYY) (MM1DDIVYYY) LIMITS
COMMERCIAL GENERAL LIABILITY EACH OCCURRENCE $
DAMAGE._.. RENTED
.. ....
TO R
CLAIMS-MADE OCCUR PREMISES(En occurrence) $
MED EXP(Any one person) $
PERSONAL&ADO INJURY $
GEN'L AGGREGATE LIMIT APPLIES PER. GENERAL AGGREGATE $
PRO-
POLICY JECT LOC PRODUCT`;-COMPIOP ASS $
$
OTHER.
COMBINED SINGLE LIMIT
AUTOMOBILE LIABILITY (Ea accident)
ANY AUTO
BODILY INJURY(Per person) $
ALL OWNED SCHEDULED
BODILY INJURY(Per accident) $
AUTOS AUTOS
NON-OWNED PROPERTY DAMAGE
HIRED AUTOS _ AUTOS (Per accident)
UMBRELLA LIAB OCCUR EACH OCCURRENCE $
EXCESSLIAB CLAIMS-MADE AGGREGATE $
DED RETENTION $ $
WORKERS COMPENSATION PEP OTH-
AND EMPLOYERS'LIABILITY Y f N STATUTE ER .
ANY PROPRIETORJPARTNERfEXECUTIVE E.L.EACH ACCIDENT $
OFFICERfMEMBER EXCLUDED? N f A
(Mandatory in NH) E L DISEASE-EA EMPLOYEE $
It yes,'describe under
DESCRIPTION OF OPERATIONS below E L DISEASE-POLICY LIMIT $
A PROFESSIONAL ZPL15P22159 06/24/2016 06/24/2017 Eact Act 2,000,000
COVERAGE RETRO DATE 11/13/2001 Aggregate 2,000,000
DESCRIPTION OF OPERATIONS!LOCATIONS/VEHICLES (ACORD 101,Additional Remarks Schedule,may be attached if more space is required)
Professional Coverage includes Technology Errors &Omissions Liability, and
Network& Information Security Liability (Cyber Liability)
CERTIFICATE HOLDER CANCELLATION
ORANG-1
SHOULD ANY OF THE ABOVE DESCRIBED POLICIES BE CANCELLED BEFORE
THE EXPIRATION DATE THEREOF, NOTICE WILL BE DELIVERED IN
Orange County(NC) ACCORDANCE WITH THE POLICY PROVISIONS.
Pretrial Services
100 N Churton St.#207 AUTHORIZED REPRESENTATIVE
Hillsborough, NC 27278-2534 Q
@ 1988-2014 ACORD CORPORATION. All rights reserved.
ACORD 25(2014/01) The ACORD name and logo are registered marks of ACORD
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
00:"1-1-5°1/ Cloud Service Questionnaire
mil This questionnaire is to be used to assess security and legal issues
114 1 52 surrounding cloud services under consideration for Orange County. For this
Nki� questionnaire, cloud services are any services requiring storage of County
data outside the County network or provision of computing resources outside
of the County network.
Vendor under consideration: AutoMon, LLC
Solution under consideration: Ce Pretrial
Department(s) served: Pretrial Services
1. Who owns the data created by County personnel using this service?
The County retains data ownership of all data in Ce Pretrial. See Master Subscription
Agreement language to this effect.
2. Does the Cloud contractually allow the County to access and retrieve its data at the
County's discretion?
Yes. The County has the ability to retrieve its data through the data Analysis feature and
various reports and dashboards. From certain parts of the application, data may be
exported into a Microsoft Excel worksheet for further use and analysis. Some customers
wish to conduct more extensive research on their data. For these customers, we export a
copy of their data into a database file for download. This can be a one-time process or a
routine that is run on a schedule. There is a charge for this service.
If No, Explain: II a 1 tfi if.1,2 A Vt
3. Is the Cloud provider contractually obligated to dispose,return or retrieve data in the
event of contract termination?
Yes. The customer must request the data from AutoMon. See Master Subscription
Agreement language to this effect.
If No, Explain: ill II a V, :u n f ;�f;.
4. Upon such provision of data, is the Cloud provider obligated to specify data format and
all information necessary for data extraction?
If No, Explain: No. AutoMon handles the data extraction.
5. Is the Cloud provider obligated to destroy all copies of County data, at the County's
request?
Yes. See Master Subscription Agreement language to this effect.
If No, Explain: II fill II u f. if c
6. What are the Cloud provider's obligation to the County in the event of confirmed or
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
suspected data breaches?
AutoMon is obligated to notify the County in the event of a data breach. The Cloud
Provider, Microsoft Government Azure, is obligated to notify AutoMon. In addition, both
AutoMon and Microsoft are required to comply with applicable law.
7. Is the Cloud provider obligated to inform the County of all locations in which the data is
stored (including backups) and to continually keep the County informed of any changes
to those locations?
If No, Explain: AutoMon runs Ce Pretrial on Microsoft Government Azure. Under the
terms and conditions of its operating agreement with its US Federal, State and Local
customers, data is stored in data centers within the United States only. Movement of data
storage within its US based data centers is handled by Microsoft and reflects operating
exigencies required to efficiently serve its customers.
8. What are the Cloud provider's contractual obligations with respect to litigation holds on
County data?
Microsoft is subject to the jurisdiction of the courts of the United States and is obligated
to comply with judicial orders.
9. What are the Cloud provider's contractual prohibitions on disclosing data to individuals,
groups or organizations making record requests, unless so directed by an authorized
County official?
See Master Subscription Agreement for language describing confidentiality of the
customers' data. Microsoft is subject to the jurisdiction of the courts of the United States
and is obligated to comply with judicial orders.
10. Does the contract obligate the Cloud provider to allow third-party audits and/or
certifications related to infrastructure and security, including penetration testing and
vulnerability assessment, as requested by the County?
If No, Explain: Microsoft performs third party audits and obtains certifications,both of
which are publicly available upon request.
11. Does the contract obligate the Cloud provider to allow third party onsite inspections of
the Cloud provider's infrastructure and security practices on a specified basis?
(1101o, 1H .l.m..
If No, Explain: See answer to Question 10.
12. Does the contract obligate the Cloud provider to provide security documentation upon
request by the County?
Yes. Microsoft's security documentation is generally publicly available and may be
requested by AutoMon on behalf of the County.
If No, Explain: a' II u l 11c.n V V .t
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
13. Does the contract obligate the Cloud provider to supply the County with the provider's
performance records, including access to daily and weekly service quality statistics?
i uu p ru uuu
If No, Explain: Performance records are not generally available to the County or
AutoMon. If the County has a specific concern regarding performance, the issue should
be raised with AutoMon who can coordination a conversation with Microsoft is needed.
14. Explain the contractually obligated service level parameters, minimum levels, specific
remedies and penalties for non-compliance for:
1) Uptime AutoMon has not experienced any significant degradation of performance
when the Azure platform is operating properly. Therefore, our service level standards are
tied to a subset of the Windows Azure SLA, which reports a greater than 99.5%uptime.
2)Performance and response time: AutoMon leverages the elastic database features of
Microsoft Government Azure to save costs and hold costs down for its customers.
Accordingly, performance will vary depending on the function being performed within
the application and the time of day the function is initiated. The goal is sub 2 second
response times for all page loads, however, reports and dashboards sometimes take longer
if the application has been idle for some time or if the query is particularly complex.
3) Error correction time: The Master Subscription Agreement signed by the customer
contains detailed obligations for remedying errors related to the application licensed by
the customer. Also see AutoMon's Software Maintenance Handbook for further
explanation.
4) Infrastructure and security: As a standard part of the development process, AutoMon
performs code reviews, unit tests and other Q/A processes, and integrations tests to
ensure the integrity of our applications including as it pertains to data security and
operational integrity. Since customer data is stored in Microsoft Azure Government data
centers, and those data centers are certified under many federal and state data security
certifications, including CJIS compliance, security and integrity of data is subject to the
continuing obligations required to maintain those certifications.
15. Does the contractually defined Service Level Agreement define pertinent terms such as
downtime, scheduled downtime, etc...?
Yes. The terms of the Microsoft Azure Government operating agreement contains
detailed definitions relating to operating tasks and performance. Further, the Master
Subscription Agreement signed by the customer with AutoMon outlines the process for
upgrades,backups and service level definitions in the event of an error.
If No, Explain: 01 A
16. Does the contract specify minimum disaster recovery and business continuity
requirements, including penalties for non-compliance, as discovered through onsite
inspections, audits or actual disasters?
Yes. Ce Pretrial relies on the capabilities of SQL Azure operating on Microsoft's Azure
Government platform. The standard arrangement is to provide point-in-time recovery of
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
data for 14 days. After 14 days the backups are erased.
If No, Explain: II a U 0��w V.��w
17. Does the contract require the cloud vendor to notify the County of any outsourced
functionality and its provider?
11H�t','�'.
If No, Explain: AutoMon outsources all cloud platform services to Microsoft Azure
Government. Microsoft is constrained by the operating agreements it publishes relating
to the operation of this platform, and further constrained by the security certifications it
maintains for the benefit of its government customers. So long as Microsoft operates in a
manner consistent with those agreements and certifications, we are not notified.
18. What are the contractually required notification period for the County or the cloud vendor
for termination of the cloud services?
The Master Subscription Agreement with County signs with AutoMon contains language
governing the County's termination of services.
19. Describe how the County's data will be stored, managed and archived.
Ce Pretrial relies on the capabilities of Microsoft's Azure Government platform, and in
particular, SQL Azure operating on that platform. AutoMon makes use of many tools and
features such as point-in-time recovery for 14 days, easy one-click export to Azure Blob
storage, direct connection to the database using SQL Management Studio, and others.
AutoMon relies on Microsoft Azure Government's 14-day point-in-time recovery
guarantee for data archival and retention.
20. Will the County's data be stored and managed on a storage system with other data?
No. Customer data is stored in an isolated database containing only the County's data.
If Yes, Explain: 0 lick. u , 11 °; y�.il...
21. At what architectural point in the provider's cloud facility will the County's data be
physically connected to networking equipment with non-County data?
While, the County's data is stored in an isolated database file, that database file is stored
on a server that also stores other customers' database files.
22. What are the cloud provider's information security policies?
Microsoft Azure Government's information security policies are required to be compliant
with Federal and State laws where it operates. Further, the certifications it maintains (e.g.
Fed Ramp, DOD and CJIS) impose in some cases more stringent policies. The
information security policies are updated from time to time as laws change and best
practices evolve.
23. What are the cloud provider's incident management and reporting policies?
Microsoft Azure Government's incident management and reporting policies are required
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
to be compliant with Federal and State laws where it operates. Further, the certifications
it maintains (e.g. Fed Ramp, DOD and CJIS) impose in some cases more stringent
policies. The incident management and reporting are updated from time to time as laws
change and best practices evolve.
24. What is the process by which the cloud provider updates policies and informs customers?
Microsoft publishes on its website the policies. As those policies change, the website is
updated to reflect those changes.
25. What is the basic architecture of the cloud provider's network security? (overall design,
zones, filters, firewalls, VLANs,protocols, standards)
Microsoft Azure Government maintains state of the art architecture for network security.
A basic outline of that architecture is available online,but some, if much of about its
architecture, it internal features, redundancy and operations remains confidential and
propriety.
26. What security measures does the cloud provider use in data storage, transit and use?
Ce Pretrial makes use of TLS for all data in transit, including data in transit between the
client browser and web servers, and as well as for data in transit between the web servers
and database servers. The backend web servers, SQL Azure and Azure blob storage
operate with TDE (SQL's Transparent Data Encryption) turned on to protect data at rest.
All customer data is stored on Microsoft Azure Government platform.
27. What encryption technologies does the cloud provider use in data management?
See answer to Question 26. Ce Pretrial uses TLS for data in transit and TDE for data at
rest.
28. How are access rights managed by the cloud provider for their employees, contractors
and other persons?
Microsoft Azure Government publishes the conditions for employment and the access
rights of classes of persons who have access to a customer database servers.
29. What methods does the cloud provider use to destroy information, when so authorized?
Microsoft Azure Government publishes here a description of the process it uses for data
cleaning and leakage: https://blogs.msdn.microsoft.com/walterm/2014/09/04/microsoft-
azure-data-security-data-cleansing-and-leakage/
30. What is the cloud provider's patch management policy/methods?
See Master Subscription Agreement and AutoMon's Software maintenance Handbook.
Patches and updates are typically perform after and before business hours to minimize
potential downtime. In emergency situations, updates, restores and error corrections may
be performed during normal business hours. When such an emergency occurs, AutoMon
attempts to provide prior notice to the customer and consult with the customer regarding
the schedule. AutoMon funnels communication through the customer designated
representative, who communicates with customer staff.
DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9
31. How does the cloud provider defend against malware, including but not limited to
viruses, bots, spyware, spam, phishing and pharming?
Microsoft Azure Government published a blog regarding its threat management practices.
An example of a recent entry can be found here: https://www.microsoft.com/en-
us/TrustCenter/Security/ThreatManagement
32. What system hardening strategies are employed by the cloud provider?
Microsoft Azure Government published on its website blog and white papers regarding
its some of its strategies threat management practices. Other strategies are kept
confidential and are proprietary to protect its customers.
33. How does the cloud provider perform security testing, including logging, correlation,
intrusion detection, intrusion prevention, file integrity monitoring, time synchronization,
security assessments, penetration testing?
Microsoft Azure Government publishes a blog regarding its security testing. An example
of a recent entries can be found here: https://docs.microsoft.com/en-us/azure/security/
and here: https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-security. A
search of Microsoft's website contains many more entries which will be of interest to our
customers.
34. What technologies and methods does the cloud vendor provide for strong authentication?
Ce Pretrial leverages Active Directory polices enforced by our customers to log on to the
application. Forms based authentication is also used for customers who do not use
Active Directory. Password complexity and frequency of password changes reflect
customer policies.
35. Provide any other comments and explanations:
u Aida rc w u