The URL can be used to link to this page

Home My WebLink About2020-011-E IT - Xentegra DUO authentication implementationRevised 11/19 1 [Departmental Use Only] TITLE DUO IMPLEMENTATION FY 20 NORTH CAROLINA SERVICES AGREEMENT NO RFP/RFQ ORANGE COUNTY This Services Agreement (hereinafter “Agreement”), made and entered into this 13th day of December, 2019, (“Effective Date”) by and between Orange County, North Carolina a political subdivision of the State of North Carolina (hereinafter, the "County") and XenTegra, LLC, (hereinafter, the "Provider"). WITNESSETH: That the County and Provider, for the consideration herein named, do hereby agree as follows: 1. Services a. Scope of Work. i) This Agreement is for services to be rendered by Provider to County with respect to (insert type of project): DUO Dual Factor Authentication Implementation ii) By executing this Agreement, the Provider represents and agrees that Provider is qualified to perform and fully capable of performing and providing the services required or necessary under this Agreement in a fully competent, professional and timely manner. iii) Time is of the essence with respect to this Agreement. iv) The services to be performed under this Agreement consist of Basic Services, as described and designated in Section 3 hereof. Compensation to the Provider for Basic Services under this Agreement shall be as set forth herein. 2. Responsibilities of the Provider a. Services to be provided. The Provider shall provide the County with all services required in Section 3 to satisfactorily complete the Project within the time limitations set forth herein and in accordance with the highest professional standards. b. Standard of Care. i) The Provider shall exercise reasonable care and diligence in performing services under this Agreement in accordance with the highest generally accepted standards of this type of Provider practice throughout the United States and in accordance with applicable federal, state and local laws and regulations applicable to the performance of these services. Provider is solely responsible for the professional DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 Revised 11/19 2 quality, accuracy and timely completion and/or submission of all work related to the Basic Services. ii) Provider shall be responsible for all errors or omissions of its agents, contractors, employees, or assigns in the performance of the Agreement. Provider shall correct any and all errors, omissions, discrepancies, ambiguities, mistakes or conflicts at no additional cost to the County. iii) The Provider shall not, except as otherwise provided for in this Agreement, subcontract the performance of any work under this Agreement without prior written permission of the County. No permission for subcontracting shall create, between the County and the subcontractor, any contract or any other relationship. iv) Provider is an independent contractor of County. Any and all employees of the Provider engaged by the Provider in the performance of any work or services required of the Provider under this Agreement, shall be considered employees or agents of the Provider only and not of the County, and any and all claims that may or might arise under any workers compensation or other law or contract on behalf of said employees while so engaged shall be the sole obligation and responsibility of the Provider. v) If activities related to the performance of this Agreement require specific licenses, certifications, or related credentials Provider represents that it and/or its employees, agents and subcontractors engaged in such activities possess such licenses, certifications, or credentials and that such licenses certifications, or credentials are current, active, and not in a state of suspension or revocation. vi) In determining the basic services to be provided, should any documents be referenced in this Agreement, the terms of this Agreement shall have priority in any conflict between the terms of referenced documents and the terms of this Agreement. 3. Basic Services a. Basic Services. The Services to be rendered pursuant to this Agreement are as follows (fully describe services to be provided): See Exhibit A (Statement of Work) and Exhibit B (Void Prior Document) 4. Duration of Services a. Term. The term of this Agreement shall be from December 13th 2019 to June 30th, 2020. b. Scheduling of Services. i) The Provider shall schedule and perform its activities in a timely manner. ii) Should the County determine that the Provider is behind schedule, it may require the Provider to expedite and accelerate its efforts, including providing additional resources and working overtime, as necessary, to perform its services in DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 Revised 11/19 3 accordance with the approved project schedule at no additional cost to the County. iii) The Commencement Date for the Provider's Basic Services shall be December 13th 2019. 5. Compensation a. Compensation for Basic Services. Compensation for Basic Services shall include all compensation due the Provider from the County for all services satisfactorily (as determined by the County) performed pursuant to this Agreement. The maximum amount payable for Basic Services shall not exceed Twelve Thousand One Hundered Fifty-Five Dollars ($12,155.00). Payment for satisfactorily performed Basic Services shall become due and payable within thirty (30) days of Provider properly invoicing County. Payment shall be subject to provisions of Section 5(b). b. Disputes. In the event the amount stated on an invoice is disputed by the County, the County may withhold payment of all or a portion of the amount stated on an invoice until the parties resolve the dispute. Should Provider fail to perform its duties under the terms of this Agreement, County may, without fault or penalty, withhold any payment associated with the work to be performed until such time as said work is completed. c. Additional Services. County shall not be responsible for costs related to any services in addition to the Basic Services performed by Provider unless County requests such additional services in writing and such additional services are evidenced by a written amendment to this Agreement. 6. Responsibilities of the County a. Cooperation and Coordination. The County has designated (Jim Northrup) to act as the County's representative with respect to the Project and shall have the authority to render decisions within guidelines established by the County Manager and/or the County Board of Commissioners and shall be available during working hours as often as may be reasonably required to render decisions and to furnish information. 7. Insurance a. General Requirements. Provider shall obtain, at its sole expense, Commercial General Liability Insurance, Automobile Insurance, Workers’ Compensation Insurance, and any additional insurance as may be required by County’s Risk Manager as such insurance requirements are described in the Orange County Risk Transfer Policy and Orange County Minimum Insurance Coverage Requirements (each document is incorporated herein by reference and may be viewed at http://www.orangecountync.gov/departments/purchasing_division/contracts.php). If County’s Risk Manager determines additional insurance coverage is required such additional insurance shall consist of N/A (if no additional insurance required mark N/A as being not applicable). Provider shall not commence work until such insurance is in effect and certification thereof has been received by the County's Risk Manager. DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 Revised 11/19 4 8. Indemnity a. Indemnity. To the extent authorized by North Carolina law the Provider agrees, without limitation, to defend, indemnify and hold harmless the County from all loss, liability, claims or expense, including attorney's fees, arising out of or related to the Project and arising from property damage or bodily injury including death to any person or persons caused in whole or in part by the negligence or misconduct of the Provider except to the extent same are caused by the negligence or willful misconduct of the County. It is the intent of this provision to require the Provider to indemnify the County to the fullest extent permitted under North Carolina law. 9. Amendments to the Agreement a. Changes in Basic Services. Changes in the Basic Services and entitlement to additional compensation or a change in duration of this Agreement shall be made by a written Amendment to this Agreement executed by the County and the Provider. The Provider shall proceed to perform the Services required by the Amendment only after receiving a fully executed Amendment from the County. 10. Termination a. Termination for Convenience of the County. This Agreement may be terminated without cause by the County and for its convenience upon seven (7) days’ prior written notice to the Provider. b. Other Termination. The Provider may terminate this Agreement based upon the County's material breach of this Agreement; provided, the County has not taken all reasonable actions to remedy the breach. The Provider shall give the County seven (7) days' prior written notice of its intent to terminate this Agreement for cause. c. Compensation After Termination. i) In the event of termination, the Provider shall be paid that portion of the fees and expenses that it has earned to the date of termination, less any costs or expenses incurred or anticipated to be incurred by the County due to errors or omissions of the Provider. ii) Should this Agreement be terminated, the Provider shall deliver to the County within seven (7) days, at no additional cost, all deliverables including any electronic data or files relating to the Project. d. Waiver. The payment of any sums by the County under this Agreement or the failure of the County to require compliance by the Provider with any provisions of this Agreement or the waiver by the County of any breach of this Agreement shall not constitute a waiver of any claim for damages by the County for any breach of this Agreement or a waiver of any other required compliance with this Agreement. e. Suspension. County may suspend the Basic Services and this Agreement at any time for County’s convenience and without penalty to County upon three (3) days’ notice to DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 Revised 11/19 5 Provider. Upon any suspension by County, Provider shall discontinue work on the Basic Services and shall not resume the Basic Services until notified to proceed by County. 11. Additional Provisions a. Limitation and Assignment. The County and the Provider each bind themselves, their successors, assigns and legal representatives to the terms of this Agreement. Neither the County nor the Provider shall assign or transfer its interest in this Agreement without the written consent of the other. b. Governing Law. This Agreement and the duties, responsibilities, obligations and rights of respective parties hereunder shall be governed by the laws of the State of North Carolina. By executing this Agreement Provider affirms that Provider and any subcontractors of Provider are and shall remain in compliance with Article 2 of Chapter 64 of the North Carolina General Statutes. By executing this Agreement Provider certifies that Provider has not been identified, and has not utilized the services of any agent or subcontractor identified, on the list created by the State Treasurer pursuant to G.S. 147-86.58. By executing this Agreement Provider certifies that Provider has not been identified, and has not utilized the services of any agent or subcontractor identified, on the list created by the State Treasurer pursuant to G.S. 147-86.81. c. Non-Discrimination. Provider shall at all times remain in compliance with all applicable local, state, and federal laws, rules, and regulations including but not limited to all state and federal non-discrimination laws, policies, rules, and regulations and the Orange County Non-Discrimination Policy and Orange County Living Wage Policy (each policy is incorporated herein by reference and may be viewed at http://www.orangecountync.gov/departments/purchasing_division/contracts.php.) Any violation of the Orange County Non-Discrimination Policy is a breach of this Agreement and County may immediately terminate this Agreement without further obligation on the part of the County. This paragraph is not intended to limit and does not limit the definition of breach to discrimination. d. Dispute Resolution. Any and all suits or actions to enforce, interpret or seek damages with respect to any provision of, or the performance or non-performance of, this Agreement shall be brought in the General Court of Justice of North Carolina sitting in Orange County, North Carolina. It is agreed by the parties that no other court shall have jurisdiction or venue with respect to such suits or actions. Binding arbitration may not be initiated by either Party, however, the Parties may agree to nonbinding mediation of any dispute prior to the bringing of such suit or action. e. Entire Agreement. This Agreement represents the entire and integrated agreement between the County and the Provider and supersedes all prior negotiations, representations or agreements, either written or oral. This Agreement may be amended only by written instrument signed by both parties. Modifications may be evidenced by facsimile signatures. f. Severability. If any provision of this Agreement is held as a matter of law to be unenforceable, the remainder of this Agreement shall be valid and binding upon the Parties. DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 Revised 11/19 6 g. Ownership of Work Product. Should Provider’s performance of this Agreement generate documents, items or things that are specific to this Project such documents, items or things shall become the property of the County and may be used on any other project without additional compensation to the Provider. The use of the documents, items or things by the County or by any person or entity for any purpose other than the Project as set forth in this Agreement shall be at the full risk of the County. h. Non-Appropriation. Provider acknowledges that County is a governmental entity, and the validity of this Agreement is based upon the availability of public funding under the authority of its statutory mandate. In the event that public funds are unavailable and not appropriated for the performance of County’s obligations under this Agreement, then this Agreement shall automatically expire without penalty to County immediately upon written notice to Provider of the unavailability and non-appropriation of public funds. It is expressly agreed that County shall not activate this non-appropriation provision for its convenience or to circumvent the requirements of this Agreement, but only as an emergency fiscal measure during a substantial fiscal crisis. In the event of a change in the County’s statutory authority, mandate and/or mandated functions, by state and/or federal legislative or regulatory action, which adversely affects County’s authority to continue its obligations under this Agreement, then this Agreement shall automatically terminate without penalty to County upon written notice to Provider of such limitation or change in County’s legal authority. i. Signatures. This Agreement together with any amendments or modifications may be executed electronically. All electronic signatures affixed hereto evidence the consent of the Parties to utilize electronic signatures and the intent of the Parties to comply with Article 11A and Article 40 of North Carolina General Statute Chapter 66. j. Notices. Any notice required by this Agreement shall be in writing and delivered by certified or registered mail, return receipt requested to the following: Orange County Provider’s Name Attention:Jim Northrup Andy Whiteside P.O. Box 8181 XenTegra Hillsborough, NC 27278 704-975-2459 [SIGNATURE PAGE TO FOLLOW] DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 Revised 11/19 7 IN WITNESS WHEREOF, the Parties, by and through their authorized agents, have hereunder set their hands and seal, all as of the day and year first above written. ORANGE COUNTY: PROVIDER: By: _________________________________ Bonnie Hammersley By: __________________________________ Bill Sutton, Director of Consulting Services Printed Name and Title DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 Exhibit B – Void Prior Document A document had previously been routed for signature with substantially similar form, dated the 25th day of November, 2019 with signatories as Jason Hendren and Bill Sutton, and specifically labeled with DocuSign Envelope ID: 2AC74859-8A1F-4E34-A0C4-B7D02E957FA2, (“Prior Document”). Prior Document was voided while still in process due to the lack of signing authority. Parties hereby agree that the Prior Document is null and was void ab initio. Both Parties release and forgive all mutual claims, agreements, actions, and liabilities that parties might have against one another resulting from Prior Document. DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 Ǧ Created by Randy Price Orange County Government 10/29/201910/8/2019 DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 2 XenTegra’s Partners DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 3 TABLE OF CONTENTS PROJECT OVERVIEW ...........................................................................................................................4 PROJECT COORDINATION ................................................................................................................................ 6 CLIENT PROJECT SPONSORS ............................................................................................................................. 6 XENTEGRA PROJECT TEAM .............................................................................................................................. 6 PROJECT TARGET USER GROUPS ....................................................................................................................... 6 2.0 SCOPE ..........................................................................................................................................7 SERVICES ...................................................................................................................................................... 7 Discovery Phase ..................................................................................................................................... 7 Design Phase .......................................................................................................................................... 7 Implementation Phase ........................................................................................................................... 8 Readiness Phase..................................................................................................................................... 9 Rollout Phase ......................................................................................................................................... 9 TASKS OUT OF SCOPE ...................................................................................................................................... 9 PLACE OF PERFORMANCE .............................................................................................................................. 10 PREREQUISITES ............................................................................................................................................ 10 3.0 CUSTOMER RESPONSIBILITIES/ASSUMPTIONS ............................................................................ 11 GENERAL RESPONSIBILITIES ........................................................................................................................... 11 PROJECT SPECIFIC CUSTOMER RESPONSIBILITIES................................................................................................ 11 GENERAL ASSUMPTIONS ............................................................................................................................... 11 4.0 PERIOD OF PERFORMANCE ......................................................................................................... 12 ESTIMATED TIMELINE ................................................................................................................................... 12 CANCELLATIONS ........................................................................................................................................... 12 CHANGE MANAGEMENT PROCESS .................................................................................................................. 12 5.0 PRICING AND PAYMENT TERMS .................................................................................................. 13 PROFESSIONAL SERVICES ............................................................................................................................... 13 PAYMENT TERMS & CONDITIONS ................................................................................................................... 14 EXPENSES ................................................................................................................................................... 14 SERVICES PROVIDED AFTER-HOURS .................................................................................................................. 14 SOW COMPLETION CRITERIA ......................................................................................................................... 15 WARRANTY & LIMITATIONS ........................................................................................................................... 15 6.0 SOW ACCEPTANCE ...................................................................................................................... 16 DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 4 PROJECT OVERVIEW SOW to perform consulting services for Orange County Government (“OG”) Date Services Performed By: Services Performed For: October 29, 2019October 8, 2019 XenTegra, LLC PO Box 1954 Huntersville, NC 28078 Orange County Government 131 W. Margaret Lane Hillsborough, NC 27613 XenTegra, LLC. is pleased to present this Statement of Work to Orange County Government to provide professional services for the implementation of a multi-factor authentication “MFA” solution, utilizing Duo. XenTegra will perform the following tasks during the proposed project: x Deploy a Duo multi-factor authentication solution for the following use cases: o Citrix Application Delivery Controller “ADC” o Microsoft Office 365 “O365” /Active Directory Federation Services “ADFS” o Virtual Private Network “VPN” o Windows Logon and Remote Desktop Protocol “RDP” XenTegra considers this project engagement to be a production rollout and recommends a phased approach that includes industry recommended practices including high availability. The phases should include a discovery phase, design phase, implementation phase, readiness phase and rollout phase. It is the goal of XenTegra that each part of the project will provide OG’s staff with informal training. It is the responsibility of the OG’s staff to be available to receive the informal training and to assist with the project. DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 5 ABOUT XENTEGRA, LLC. At XenTegra, we are fueled by a passion for end users and known for a deep history with Citrix and complementary technologies. Living at the intersection of innovation and experience, we enable customers to deliver the productive, efficient and secure endpoint computing environments users need to work anytime, from anywhere, on any device. XenTegra focuses primarily on three areas: x Solutions: From secure virtual application delivery to high-performance virtual desktops and enterprise mobility management, XenTegra powers today's digital workspaces so that the client can achieve the transformational agility required. o Platinum Citrix Partner o Microsoft Gold Partner o IGEL Platinum Partner x Services: XenTegra specializes in IT managed services and consulting, focusing on the security, performance, and agility of Citrix workspaces, on premises, and in the cloud. x Events & Training: Learn how to do more with Citrix at XenTegra’s lunch & learns, seminars, or more extensive 2-day boot camps. x Awards o IGEL 2018 Marketing Partner of the Year o 2019 Citrix Innovation Award Finalist - Americas o 2019 Winner – Citrix Worldwide Partner of the Year (Americas) DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 6 PROJECT COORDINATION XenTegra will develop a project plan that details each step of the project’s execution and establishes its operational framework. XenTegra’s project coordinator will use this plan to define work elements, identify resources required for accomplishing the project tasks, and assign responsibility for deliverables. This schedule will provide the project coordinator with a baseline for managing and controlling the project objectives and resource utilization. Changes to the plan will be coordinated with OG’s staff and made upon mutual agreement. CLIENT PROJECT SPONSORS XENTEGRA PROJECT TEAM Role Name Phone Email Project Lead Lead Consultant Secondary Consultant Business Development Manager PROJECT TARGET USER GROUPS Group Name Number of End-Users Number of Applications Role Name Title Email Executive Sponsor Project Lead Technical Lead Technical Team Technical Team DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 7 2.0 SCOPE SERVICES All professional services shall be performed remotely unless specified below. The services that XenTegra shall provide will include: DISCOVERY PHASE XenTegra will meet with the various team members to collect all the necessary data as outlined in the task list below. The following tasks will be performed during this phase: x Meet with Project Sponsor/Stakeholders x Meet with the various IT groups x Define Business Requirements x Define Business Goals x Define Success Criteria x Document project details and goals x Review Datacenter environment x Review Monitoring requirements x Review Security requirements x Review Duo requirements x Review Remote access requirements o Citrix ADC – Citrix Gateway DESIGN PHASE XenTegra will develop a design based on the requirements gathered during the Discovery phase. The following topics will be included: x Define Duo MFA Requirements o Define Citrix ADC Requirements Duo Authentication Proxy requirements Citrix ADC Policies and Profiles for Duo o Define O365/ADFS Requirements Duo MFA ADFS Adapter O365 Federation Authentication Policy o Define VPN Requirements o Define Windows Logon and RDP Requirements Define Duo Authentication for Windows agent Installer GPO settings Define Client recommended settings for Windows Logon and RDP The next phase will begin when any prerequisites identified during this phase have been completed. DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 8 IMPLEMENTATION PHASE During this phase, XenTegra will implement a functioning solution meeting the design requirements gathered during the Discovery and Design Phases. Prior to beginning this phase, OG shall complete any prerequisites identified in the Design Phase. Industry recommended practices will be implemented as part of this project including high availability for the infrastructure components. The following tasks will be performed: Duo Multi-Factor Authentication use case: x Deploy a Duo multi-factor authentication solution for the following use cases: o Citrix Application Delivery Controller “ADC” o Microsoft Office 365 “O365” /Active Directory Federation Services “ADFS” o Virtual Private Network “VPN” o Windows Logon and Remote Desktop Protocol “RDP” Configuration Tasks x Deploy a Duo multi-factor authentication solution o Create Duo MFA Managed Service Provider “MSP” Account o Scope Duo MFA to Domain Admins AD group o Create Duo MFA “Applications” for the following use cases: Citrix Application Delivery Controller “ADC” x Configure Duo for Citrix Gateway x Install and configure two (2) Duo Authentication Proxies to be load balanced by Citrix ADC x Configure Citrix Gateway to utilize Duo MFA, without extra password field, allowing password resets Office 365/ADFS x Configure Duo for Microsoft Office 365 “O365”/Active Directory Federation Services “ADFS” x Install Duo MFA ADFS Adapter x Edit O365 federation authentication policy to utilize Duo Virtual Private Network “VPN” x Configure Duo for VPN x Integrate existing VPN with Duo Authentication Proxies or ADFS depending on vendor Windows Logon and Remote Desktop Protocol “RDP” x Configure Duo for local Windows logons x Create Duo Authentication for Windows agent Installer GPO x Identify/Review recommended settings for Client DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 9 READINESS PHASE XenTegra will provide support for OG’s IT staff to test the solution to verify solution functionality before rollout to end users. This phase includes the following tasks: x Instruct pilot users on how to access environment for testing and validating solution functionality x Conduct interviews with pilot users and document responses x Document pilot testing results x Rollout any additional servers in accordance with the installation policies and procedures defined and documented in the previous phases ROLLOUT PHASE During this phase, the solution will be rolled out to the pilot end users and XenTegra will provide support to assist with changes to the implementation as identified during the Rollout Phase. This phase includes the following tasks: x Assist OG with any issues associated with rolling out the final pilot users associated with the project x Create as-built documentation delivered as a PDF document that details the configuration of the solution TASKS OUT OF SCOPE The following tasks are considered to be out of scope for this project: x Network changes (Router, Switch) x Server infrastructure moves, adds, changes x Troubleshooting configurations for systems that are assumed to be in place and functioning prior to the start of the project. These systems include but are not limited to, Active Directory, Group Policy, DNS, DHCP, Authentication solutions, server, network, and storage infrastructure. x Troubleshooting of user workstations or configurations outside of what is required for solution testing x Installation of applications beyond those identified in this Statement of Work x Backup of Customer systems, data, or configurations prior to upgrade or installation x Configuration or troubleshooting of an existing environment x Creation or execution of any test plans, formal or informal x Providing formal system training x Any task that is not explicitly defined in this Statement of Work DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 10 PLACE OF PERFORMANCE Unless otherwise specified in this Statement of Work, all services will be performed remotely. Any requested on- site services will be performed at OG’s location designated here: Orange County Government 131 W. Margaret Lane Hillsborough, NC 27613 PREREQUISITES The following items are assumed to be in place prior to XenTegra resources scheduled start date: x All software media and associated licenses have been obtained x Microsoft Office 365 with ADFS 3.0 or higher deployed x Existing VPN to be secured via RADIUS/SAML/LDAPS x Existing Citrix ADC deployment configured as a high availability pair “HA” x Two (2) Windows Virtual Machines deployed (1vCPU/4GB RAM) to serve as Duo Access Proxies x Citrix Gateway is not configured with RfWebUI based theme x Client devices receiving Duo for Windows are fully patched x Branding Logo requirements: Logo image must be in PNG format and not exceed 500 by 500 pixels and 200 KB. Recommendation is a 304 x 304 pixel logo image with a transparent background. x Additional pre-requisites may be identified during the Discovery and Design Phases. Any additional pre- requisites should be in place prior to XenTegra resources beginning the Implementation Phase. DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 3.0 CUSTOMER RESPONSIBILITIES/ASSUMPTIONS GENERAL RESPONSIBILITIES During this project, XenTegra will require the support of OG’s staff and computing resources. If the required OG resources cannot be made available, the scope of the Services and estimated schedule may be affected. OG agrees to provide the following: x OG will grant the appropriate credentials for the consultant to implement the solution x OG will grant remote access to the consulting resource x OG will supply the network resources need to complete the project x OG will provide additional IP addresses and DNS names if requested x OG will assist as necessary with project tasks x OG will provide all software and operating system licensing to meet the project needs x OG will perform any backup system and system changes when appropriate Downtime of production systems will be avoided when possible but may be required PROJECT SPECIFIC CUSTOMER RESPONSIBILITIES x OG will have all supporting systems and infrastructure in place and ready for this project x OG will be responsible for all network changes needed that are associated with this project x A single point of contact will be provided who is familiar with the environment and requirements to work with the XenTegra resource throughout the project acting as a liaison between XenTegra and OG x OG is responsible for the physical setup of any hardware required for the solution unless otherwise specified in this Statement of Work x Calls and meetings will be scheduled at a mutually agreeable time between XenTegra and OG GENERAL ASSUMPTIONS This Statement of Work and associated services are based upon the following assumptions: x Upon the conclusion of this engagement, it will be expected that OG will use vendor technical support or purchase optional XenTegra Success Desk Support to resolve any ongoing technical issues x Project estimates assume that once the project has started it will continue without interruption (excluding Holidays) unless agreed upon by both XenTegra and OG x All Services will be provided during Normal business hours unless otherwise stated in this Statement of Work or arranged during the Project Kick-Off Call. Normal business hours are Monday-Friday, 9:00am- 5pm local time. x If the project is not executed within sixty (60) days of the Statement of Work being signed there is no guarantee that the required resources will be available to complete the project work. x If the project is not completed within sixty (60) days of the execution of the Statement of Work, (1) both parties agree to make commercially reasonable efforts to allocate the resources necessary to complete the project in accordance with a mutually agreed revised schedule or (2) OG may terminate the SOW and pay those fees due to XenTegra up to the date of termination x XenTegra resources will have access to the keyboard to perform the work DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 4.0 PERIOD OF PERFORMANCE ESTIMATED TIMELINE The estimated timeline for the Services will begin within sixty (60) days after execution of this Statement of Work and continue for not more than six (6) months. If Services have not been scheduled at the execution of this Statement of Work, a timeline will be developed mutually by the Parties and agreed to before each Phase of the Services begins. The actual start date will depend on the following considerations: x Scheduled availability of a Systems Engineer x Receipt of Product(s) and necessary equipment x Receipt of the signed Statement of Work from OG prior to the proposed start date x Receipt of a purchase order from OG CANCELLATIONS XenTegra will work with OG to assign resources based on the mutually agreed timeline and schedule for the project. Because XenTegra will commit consulting resources based on the established schedule, OG is required to provide at (3 business days’ notice) for any unplanned changes or cancellations to the schedule. Should OG fail to provide such notice, XenTegra reserves the right to bill for 4 hours (1/2 Day) at the established hourly rate and for any non-refundable expenses incurred in preparation for such canceled services. All scheduled days will bill at 80% of the hours scheduled for the day. CHANGE MANAGEMENT PROCESS If items requiring a scope change are identified during the project phases, the following are the high-level steps that XenTegra will follow to discuss these with OG’s management: x Discuss and confirm the need for additional scope change x Identify additional tasks and deliverables associated with the scope change x Estimate the work effort associated with the additional tasks and deliverables x Based on the work effort estimate, determine the impact on schedule and budget x Draft a new Statement of Work if the estimate: o Requires additional resources o Affects the project timeline or budget DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 5.0 PRICING AND PAYMENT TERMS PROFESSIONAL SERVICES Pricing and terms valid for thirty (30) days. Hours in this Statement of Work will be invoiced as they are consumed and are billed on a weekly basis. Phase Estimated Hours Discovery Phase 4 Design Phase 8 Implementation Phase 28 Readiness Phase 4 Rollout Phase 4 Total Estimated Engineering Hours 48 Standard Engineering Hourly Rate $275 Project Coordination Hours (Billed @ $125/hr) 7 Estimated Project Total (Including Project Coordination) $14,075.00 Discounted Engineering Hourly Rate $235 Discounted Estimated Project Total Before Expenses (Including Project Coordination) $12,155.00 DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 14 PAYMENT TERMS & CONDITIONS Payment terms are net 30 days from invoice date unless custom net terms are provided by XenTegra in this Statement of Work. Client agrees to pay on time unless prior arrangement has been made in writing with XenTegra. XenTegra may suspend future obligations until payment has been made on prior invoices. Overdue accounts are subject to interest and service charges of 1.5% per month plus collection fees. All charges and fees to be paid by Client are exclusive of any applicable sales, use, excise or services taxes (“Taxes”) that may be assessed on the provision of the services or selling goods. All discrepancies regarding pricing shown on invoices shall be brought to XenTegra’s attention within 15 days of invoice date. Invoice amount shown shall be accepted and paid in full by Client if not disputed within 15 days. Discrepancies arising after 15 days of invoice date shall not affect past invoices. All payments which are returned or dishonored will be subject to a $40 fee. In the event that the Client terminates its relationship with XenTegra for any or no reason prior to the agreed upon term set forth in the Quote, the Client shall promptly pay to XenTegra an amount equal to (a) any unpaid fees attributable to the period up to and including the date of termination, and (b) the aggregate of the fees that would have been payable from the date of termination until the date that XenTegra was no longer obligated to perform the services or provide the goods were it not for such termination. The amount due to XenTegra shall be paid by the Client within ten (10) days after the date of termination. The client agrees to reimburse XenTegra for any expenses XenTegra may incur, including reasonable attorneys’ fees, associated with collecting amounts owed hereunder. XenTegra may refuse to provide services or goods to the client due to delinquent payment or any other reason. EXPENSES It is expected that services to be performed remotely for this engagement, however, should travel be required it will be confirmed via change order prior to scheduling. Travel expenses will be submitted to the client for reimbursement (including copies of receipts) using standard IRS guidelines for expenses. XenTegra will endeavor to select reasonably priced airlines, hotels, meals, and other expenses. It is expected that Orange County Government will provide travel expenses during the project for those XenTegra team members traveling out of their domiciled area, between sites or over long sequences. These expenses include the following: x Airfare necessary to location(s) x Meals x Parking, ground transportation, tolls, and Lodging SERVICES PROVIDED AFTER-HOURS XenTegra does not anticipate the need for professional services to be provided outside of normal business hours defined in this Statement of Work. If during the project, it is determined that after-hours work is required to complete the deliverables, XenTegra will charge one and a half times (1.5x) the normal rate for any after-hours work. DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 Page 15 of 16 SOW COMPLETION CRITERIA XenTegra shall have fulfilled its obligations when any one of the following first occurs: XenTegra accomplishes the activities described within this SOW, including delivery to OG of the materials listed in this SOW, as determined by XenTegra in its reasonable discretion and so notifies OG in writing. Orange County Government has five (5) working days from the completion accept the SOW as being complete. In order to refuse acceptance of the SOW as being complete, Orange County Government must provide XenTegra with reasonable details that show that Services do not conform to those defined in the SOW. OG cancels services or deliverables not yet provided with 10 business days’ advance written notice to XenTegra and pay those fees due to XenTegra up to the date of the termination. WARRANTY & LIMITATIONS EXCEPT AS PROVIDED HEREIN, XENTEGRA MAKES NO WARRANTIES, EITHER EXPRESS OR IMPLIED. XENTEGRA EXPRESSLY DISCLAIMS ANY IMPLIED WARRANTIES OR ANY WARRANTY OF MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR USE OR PURPOSE AND EXPRESSLY DISCLAIMS ANY WARRANTY AS TO PERFORMANCE OF ANY SERVICES OR ANY GOODS SOLD. XENTEGRA SHALL NOT BE LIABLE FOR ANY CONSEQUENTIAL, SPECIAL OR INDIRECT DAMAGES OR FOR LOSS OR DAMAGE DIRECTLY OR INDIRECTLY ARISING FROM THE SERVICES PROVIDED OR GOODS SOLD BY XENTEGRA. IN ANY CASE AND WITHOUT LIMITING THE FOREGOING, THE ENTIRE LIABILITY OF XENTEGRA FOR ALL DAMAGES OF EVERY KIND AND TYPE (WHETHER SUCH DAMAGES ARISE IN CONTRACT, TORT (INCLUDING NEGLIGENCE) OR OTHERWISE) SHALL BE LIMITED TO THE FEES PAID BY THE CLIENT TO XENTEGRA IN THE 12 CALENDAR MONTHS IMMEDIATELY PRIOR TO THE DAMAGES ARISING. MISCELLANEOUS The Client warrant that the information provided to XenTegra is accurate and complete. XenTegra may discontinue, suspend or modify its services, any feature included in its services, or the availability of its services at any time and without notice to the Client. Except as expressly set forth herein, this Statement of Work does not grant the Client any intellectual property rights in XenTegra’s services or property or XenTegra’s trademarks and brand features or in the material and images contained on XenTegra’s websites. This writing constitutes the full, complete and final statement of XenTegra’s obligations. All prior oral and written correspondence regarding the services or goods offered by XenTegra are merged in this writing and extinguished by it. XenTegra’s failure at any time to enforce any of the terms and conditions stated herein shall not constitute a waiver of any of the provisions herein. XenTegra's headquarters is in North Carolina, and consequently, this Statement of Work shall be governed by and construed in accordance with the laws of the State of North Carolina. The Client shall not assign this Statement of Work. Further, if any portion of this Statement of Work shall be invalid it shall not have the effect of invalidating any other portion of this Statement of Work. ANY CONTROVERSY OR CLAIM ARISING OUT OF OR RELATING TO THIS STATEMENT OF WORK, OR A BREACH HEREOF, SHALL BE SETTLED BY ARBITRATION ACCORDING TO THE COMMERCIAL ARBITRATION RULES OF THE AMERICAN ARBITRATION ASSOCIATION TO BE HEARD BY ONE ARBITRATOR IN MECKLENBURG COUNTY, NORTH CAROLINA. Judgment upon the arbitrator's award may be entered in any court having jurisdiction thereof. DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 Page 16 of 16 6.0 SOW ACCEPTANCE This Statement of Work “SOW” is governed by the terms and conditions of the Master Services Agreement “MSA” between XenTegra, LLC and Orange County Government (the “Agreement”). Any conflict between the Agreement and this SOW will be resolved in favor of this SOW. This Statement of Work, upon being executed by both XenTegra and the Client, constitutes the entire contract between the parties hereto with respect to price, work, material, goods, and Services specified herein. Verbal instructions or agreements relative to or altering this Statement of Work (and the resulting Contract) in any way, will not be recognized, and no changes shall be made except in writing, signed and dated by both XenTegra and its Client. IN WITNESS WHEREOF, the parties hereto have caused this SOW to be effective as of the day, month and year first written above. Accepted By: XenTegra, LLC Accepted By: Orange County Government Signature Signature Printed Name Printed Name Title Title Date Date DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 WLTR005 THE HARTFORD BUSINESS SERVICE CENTER 3600 WISEMAN BLVD SAN ANTONIO TX 78251 December 17, 2019 Orange County Local Government North Carolina 405 Meadowlands Drive Hillsborough NC 27278 Account Information: Policy Holder Details :XENTEGRA, LLC Contact Us Business Service Center Business Hours: Monday - Friday (7AM - 7PM Central Standard Time) Phone:(866) 467-8730 Fax:(888) 443-6112 Email:agency.services@thehartford.com Website:https://business.thehartford.com Enclosed please find a Certificate Of Insurance for the above referenced Policyholder. Please contact us if you have any questions or concerns. Sincerely, Your Hartford Service Team DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85 CERTIFICATE OF LIABILITY INSURANCE DATE (MM/DD/YYYY) 12/17/2019 THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER. THIS CERTIFICATE DOES NOT AFFIRMATIVELY OR NEGATIVELY AMEND, EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POLICIES BELOW. THIS CERTIFICATE OF INSURANCE DOES NOT CONSTITUTE A CONTRACT BETWEEN THE ISSUING INSURER(S), AUTHORIZED REPRESENTATIVE OR PRODUCER, AND THE CERTIFICATE HOLDER. IMPORTANT: If the certificate holder is an ADDITIONAL INSURED, the policy(ies) must be endorsed. If SUBROGATIONIS WAIVED, subject to the terms and conditions of the policy, certain policies may require an endorsement. A statement on this certificate does not confer rights to the certificate holder in lieu of such endorsement(s). PRODUCER USI INSURANCE SERVICES LLC/PHS 22273082 The Hartford Business Service Center 3600 Wiseman Blvd San Antonio, TX 78251 CONTACT NAME: PHONE (A/C, No, Ext): (866) 467-8730 FAX (A/C, No): (888) 443-6112 E-MAIL ADDRESS: INSURER(S) AFFORDING COVERAGE NAIC# INSURED XENTEGRA, LLC PO BOX 1954 HUNTERSVILLE NC 28070-1954 INSURER A :Sentinel Insurance Company Ltd. 11000 INSURER B :Hartford Fire and Its P&C Affiliates 00914 INSURER C : INSURER D : INSURER E : INSURER F : COVERAGES CERTIFICATE NUMBER: REVISION NUMBER: THIS IS TO CERTIFY THAT THE POLICIES OF INSURANCE LISTED BELOW HAVE BEEN ISSUED TO THE INSURED NAMED ABOVE FOR THE POLICY PERIOD INDICATED.NOTWITHSTANDING ANY REQUIREMENT, TERM OR CONDITION OF ANY CONTRACT OR OTHER DOCUMENT WITH RESPECT TO WHICH THIS CERTIFICATE MAY BE ISSUED OR MAY PERTAIN, THE INSURANCE AFFORDED BY THE POLICIES DESCRIBED HEREIN IS SUBJECT TO ALL THE TERMS, EXCLUSIONS AND CONDITIONS OF SUCH POLICIES. LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS. INSR LTR TYPE OF INSURANCE ADDL INSR SUBR WVD POLICY NUMBER POLICY EFF (MM/DD/YYYY) POLICY EXP (MM/DD/Y YYY)LIMITS A COMMERCIAL GENERAL LIABILITY 22 SBA VW1344 11/15/2019 11/15/2020 EACH OCCURRENCE $2,000,000 CLAIMS-MADE X OCCUR DAMAGE TO RENTED PREMISES (Ea occurrence)$1,000,000 X General Liability MED EXP (Any one person)$10,000 PERSONAL & ADV INJURY $2,000,000 GEN'L AGGREGATE LIMIT APPLIES PER:GENERAL AGGREGATE $4,000,000 POLICY PRO- JECT X LOC PRODUCTS - COMP/OP AGG $4,000,000 OTHER: A AUTOMOBILE LIABILITY 22 SBA VW1344 11/15/2019 11/15/2020 COMBINED SINGLE LIMIT (Ea accident)$2,000,000 ANY AUTO BODILY INJURY (Per person) ALL OWNED AUTOS SCHEDULED AUTOS BODILY INJURY (Per accident) X HIRED AUTOS X NON-OWNED AUTOS PROPERTY DAMAGE (Per accident) A X UMBRELLA LIAB EXCESS LIAB X OCCUR CLAIMS- MADE 22 SBA VW1344 11/15/2019 11/15/2020 EACH OCCURRENCE $2,000,000 AGGREGATE $2,000,000 DED X RETENTION $ 10,000 B WORKERS COMPENSATION AND EMPLOYERS' LIABILITY ANY PROPRIETOR/PARTNER/EXECUTIVE OFFICER/MEMBER EXCLUDED? (Mandatory in NH) If yes, describe under DESCRIPTION OF OPERATIONS below N/ A 22 WBC EM0165 11/15/2019 11/15/2020 PER STATUTE X OTH- ER Y/N E.L. EACH ACCIDENT $500,000 E.L. DISEASE -EA EMPLOYEE $500,000 E.L. DISEASE - POLICY LIMIT $500,000 A EMPLOYMENT PRACTICES LIABILITY 22 SBA VW1344 11/15/2019 11/15/2020 Each Claim Limit Aggregate Limit $10,000 $10,000 DESCRIPTION OF OPERATIONS / LOCATIONS / VEHICLES (ACORD 101, Additional Remarks Schedule, may be attached if more space is required) Those usual to the Insured's Operations. CERTIFICATE HOLDER CANCELLATION Orange County Local Government North Carolina 405 Meadowlands Drive Hillsborough NC 27278 SHOULD ANY OF THE ABOVE DESCRIBED POLICIES BE CANCELLED BEFORE THE EXPIRATION DATE THEREOF, NOTICE WILL BE DELIVERED IN ACCORDANCE WITH THE POLICY PROVISIONS. AUTHORIZED REPRESENTATIVE © 1988-2015 ACORD CORPORATION. All rights reserved. ACORD 25 (2016/03) The ACORD name and logo are registered marks of ACORD DocuSign Envelope ID: D75DC1A2-5BE1-4C99-A19E-1D924AA1CD85