Loading...
The URL can be used to link to this page
Your browser does not support the video tag.
Home
My WebLink
About
2021-332-IT-NWN Corporation-DUO Deployment
Revised 07/20 1 [Departmental Use Only] TITLE NWN DUO FY 21 NORTH CAROLINA SERVICES AGREEMENT NO RFP/RFQ ORANGE COUNTY This Services Agreement (hereinafter “Agreement”), made and entered into this 23rd day of June, 2021, (“Effective Date”) by and between Orange County, North Carolina a political subdivision of the State of North Carolina (hereinafter, the "County") and NWN Corporation, (hereinafter, the "Provider"). WITNESSETH: That the County and Provider, for the consideration herein named, do hereby agree as follows: 1. Services a. Scope of Work. i) This Agreement is for services to be rendered by Provider to County with respect to (insert type of project): NWN will implement the infrastructure components for Duo as well as a successful group of pilot users/computers, and the Customer’s team will plan to handle the deployment of agents and Duo user enrollments to the larger employee population. ii) By executing this Agreement, the Provider represents and agrees that Provider is qualified to perform and fully capable of performing and providing the services required or necessary under this Agreement in a fully competent, professional and timely manner. iii) Time is of the essence with respect to this Agreement. iv) The services to be performed under this Agreement consist of Basic Services, as described and designated in Section 3 hereof. Compensation to the Provider for Basic Services under this Agreement shall be as set forth herein. 2. Responsibilities of the Provider a. Services to be provided. The Provider shall provide the County with all services required in Section 3 to satisfactorily complete the Project within the time limitations set forth herein and in accordance with the highest professional standards. b. Standard of Care. i) The Provider shall exercise reasonable care and diligence in performing services under this Agreement in accordance with the highest generally accepted standards of this type of Provider practice throughout the United States and in accordance DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E Revised 07/20 2 with applicable federal, state and local laws and regulations applicable to the performance of these services. Provider is solely responsible for the professional quality, accuracy and timely completion and submission of all work related to the Basic Services. ii) Provider shall be responsible for all errors or omissions of its agents, contractors, employees, or assigns in the performance of the Agreement. Provider shall correct any and all errors, omissions, discrepancies, ambiguities, mistakes or conflicts at no additional cost to the County. iii) The Provider shall not, except as otherwise provided for in this Agreement, subcontract the performance of any work under this Agreement without prior written permission of the County. No permission for subcontracting shall create, between the County and the subcontractor, any contract or any other relationship. iv) Provider is an independent contractor of County. Any and all employees of the Provider engaged by the Provider in the performance of any work or services required of the Provider under this Agreement, shall be considered employees or agents of the Provider only and not of the County, and any and all claims that may or might arise under any workers compensation or other law or contract on behalf of said employees while so engaged shall be the sole obligation and responsibility of the Provider. v) If activities related to the performance of this Agreement require specific licenses, certifications, or related credentials Provider represents that it or its employees, agents and subcontractors engaged in such activities possess such licenses, certifications, or credentials and that such licenses certifications, or credentials are current, active, and not in a state of suspension or revocation. vi) In determining the Basic Services to be provided, should any documents be referenced in this Agreement, the terms of this Agreement shall have priority in any conflict between the terms of referenced documents and the terms of this Agreement. vii) Should this Agreement involve project designs, the construction or creation of which is to be bid out or fulfilled by other contractors, and bidding or negotiation with contractors produce prices which, when added to the other elements of the approved total project cost, produce a cost that is in excess of the approved total project cost, the Provider shall participate with the County in negotiation and design adjustments to the extent such are necessary to obtain prices within the approved total project cost. All activity of the Provider with respect to these matters shall constitute Basic Services and shall be performed by the Provider without additional compensation. If negotiation and design adjustments fail to bring costs within the total project cost the County may reject all bids and Provider will redesign or reduce portions of the project in an effort to reduce the bid prices to within the total project cost and rebid the project. One such redesign is included within Basic Services. If this second letting for bids does not produce bids that are within the approved total project cost initially or after negotiations DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E Revised 07/20 3 with the contractor the cost is not reduced to an amount within the total project cost, the Provider is not obligated to engage in further redesign. 3. Basic Services a. Basic Services. The Services to be rendered pursuant to this Agreement are as follows (fully describe services to be provided): Deliverables: Kick off meetings and follow up communications; Project plan package, Project work schedule and related meetings (design, discovery, status), Knowledge transfer sessions + corresponding design documentation, Maintenance contract activation and related documents, Project closure meeting; Installation and configuration of Cloud Portal, Authentication proxy (if required) and up to 3 administrator accounts, Single session of up to (2) hours Knowledge Transfer for up to (5) participants; Standalone Secure Access Gateway (DAG) is installed and tested to meet best practice guidelines with Single session of up to (2) hours Knowledge Transfer for up to (5) participants; Configure (1) policy for RDP configured in Secure Access cloud portal; Secure Access MFA Integration with up to (2) Remote Access VPN profile; Configure (1) policy to integrate Secure Access with Office 365 for MFA per standard; Configure (1) granular Advanced or Custom policy, Single session of (1) hour Knowledge Transfer for up to (5) participants (See Attachment A.) 4. Duration of Services a. Term. The term of this Agreement shall be from 23June2021 to 22June2022. b. Scheduling of Services. i) The Provider shall schedule and perform its activities in a timely manner. ii) Should the County determine that the Provider is behind schedule, it may require the Provider to expedite and accelerate its efforts, including providing additional resources and working overtime, as necessary, to perform its services in accordance with the approved project schedule at no additional cost to the County. iii) The Commencement Date for the Provider's Basic Services shall be 23June2021. 5. Compensation a. Compensation for Basic Services. Compensation for Basic Services shall include all compensation due the Provider from the County for all services satisfactorily (as determined by the County) performed pursuant to this Agreement. The maximum amount payable for Basic Services shall not exceed twenty-six-thousand-two-hundred- thirty-three and 41/100 Dollars ($26,233.41) (See Attachment A). Payment for satisfactorily performed Basic Services shall become due and payable within thirty (30) days of Provider properly invoicing County. Payment shall be subject to provisions of Section 5(b). b. Disputes. In the event the amount stated on an invoice is disputed by the County, the County may withhold payment of all or a portion of the amount stated on an invoice DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E Revised 07/20 4 until the parties resolve the dispute. Should Provider fail to perform its duties under the terms of this Agreement, County may, without fault or penalty, withhold any payment associated with the work to be performed until such time as said work is completed. c. Additional Services. County shall not be responsible for costs related to any services in addition to the Basic Services performed by Provider unless County requests such additional services in writing and such additional services are evidenced by a written amendment to this Agreement. 6. Responsibilities of the County a. Cooperation and Coordination. The County has designated (Jim Northrup) to act as the County's representative with respect to the Project who shall have the authority to render decisions within guidelines established by the County Manager or the County Board of Commissioners and who shall be available during working hours as often as may be reasonably required to render decisions and to furnish information. 7. Insurance a. General Requirements. Provider shall obtain, at its sole expense, Commercial General Liability Insurance, Automobile Insurance, Workers’ Compensation Insurance, and any additional insurance as may be required by County’s Risk Manager as such insurance requirements are described in the Orange County Risk Transfer Policy and Orange County Minimum Insurance Coverage Requirements (each document is incorporated herein by reference and may be viewed at http://www.orangecountync.gov/departments/purchasing_division/contracts.php). If County’s Risk Manager determines additional insurance coverage is required such additional insurance shall consist of N/A (if no additional insurance required mark N/A as being not applicable). Provider shall not commence work until such insurance is in effect and certification thereof has been received by the County's Risk Manager. 8. Indemnity a. Indemnity. To the extent authorized by North Carolina law the Provider agrees, without limitation, to defend, indemnify and hold harmless the County from all loss, liability, claims or expense, including attorney's fees, arising out of or related to the Project and arising from property damage or bodily injury including death to any person or persons caused in whole or in part by the negligence or misconduct of the Provider except to the extent same are caused by the negligence or willful misconduct of the County. It is the intent of this provision to require the Provider to indemnify the County to the fullest extent permitted under North Carolina law. 9. Amendments to the Agreement a. Changes in Basic Services. Changes in the Basic Services and entitlement to additional compensation or a change in duration of this Agreement shall be made by a written Amendment to this Agreement executed by the County and the Provider. The Provider shall proceed to perform the Services required by the Amendment only after receiving a fully executed Amendment from the County. DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E Revised 07/20 5 10. Termination a. Termination for Convenience of the County. This Agreement may be terminated without cause by the County and for its convenience upon seven (7) days’ prior written notice to the Provider. b. Other Termination. The Provider may terminate this Agreement based upon the County's material breach of this Agreement; provided, the County has not taken all reasonable actions to remedy the breach. The Provider shall give the County seven (7) days' prior written notice of its intent to terminate this Agreement for cause. Either party may terminate this Agreement upon notice to the other party that obligations pursuant to this Agreement are made impractical due to declarations of emergency by Orange County or by North Carolina due to events directly impacting Orange County. Both parties shall remain responsible for all payment and performance due up to the receipt of such notice, but shall have no further obligation or responsibility beyond that date provided the terminating party has taken all reasonable steps to complete the performance of its obligations. c. Compensation After Termination. i) In the event of termination, the Provider shall be paid that portion of the fees and expenses that it has earned to the date of termination, less any costs or expenses incurred or anticipated to be incurred by the County due to errors or omissions of the Provider. Upon request of the County, the Provider shall submit to County all relevant documentation, including but not limited to, job cost records, to support its claims for final compensation. ii) Should this Agreement be terminated, the Provider shall deliver to the County within seven (7) days, at no additional cost, all deliverables including any electronic data or files relating to the Project. d. Waiver. The payment of any sums by the County under this Agreement or the failure of the County to require compliance by the Provider with any provisions of this Agreement or the waiver by the County of any breach of this Agreement shall not constitute a waiver of any claim for damages by the County for any breach of this Agreement or a waiver of any other required compliance with this Agreement. e. Suspension. County may suspend the Basic Services and this Agreement at any time for County’s convenience and without penalty to County upon three (3) days’ notice to Provider. Upon any suspension by County, Provider shall discontinue work on the Basic Services and shall not resume the Basic Services until notified to proceed by County. 11. Additional Provisions a. Limitation and Assignment. The County and the Provider each bind themselves, their successors, assigns and legal representatives to the terms of this Agreement. Neither the County nor the Provider shall assign or transfer its interest in this Agreement without the written consent of the other. DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E Revised 07/20 6 b. Governing Law. This Agreement and the duties, responsibilities, obligations and rights of respective parties hereunder shall be governed by the laws of the State of North Carolina. By executing this Agreement Provider affirms that Provider and any subcontractors of Provider are and shall remain in compliance with Article 2 of Chapter 64 of the North Carolina General Statutes. By executing this Agreement Provider certifies that Provider has not been identified, and has not utilized the services of any agent or subcontractor identified, on the list created by the State Treasurer pursuant to G.S. 147-86.58. By executing this Agreement Provider certifies that Provider has not been identified, and has not utilized the services of any agent or subcontractor identified, on the list created by the State Treasurer pursuant to G.S. 147-86.81. c. Non-Discrimination. Provider shall at all times remain in compliance with all applicable local, state, and federal laws, rules, and regulations including but not limited to all state and federal non-discrimination laws, policies, rules, and regulations and the Orange County Non-Discrimination Policy and Orange County Living Wage Policy (each policy is incorporated herein by reference and may be viewed at http://www.orangecountync.gov/departments/purchasing_division/contracts.php.) Any violation of the Orange County Non-Discrimination Policy is a breach of this Agreement and County may immediately terminate this Agreement without further obligation on the part of the County. This paragraph is not intended to limit and does not limit the definition of breach to discrimination. d. Dispute Resolution. Any and all suits or actions to enforce, interpret or seek damages with respect to any provision of, or the performance or non-performance of, this Agreement shall be brought in the General Court of Justice of North Carolina sitting in Orange County, North Carolina. It is agreed by the parties that no other court shall have jurisdiction or venue with respect to such suits or actions. Binding arbitration may not be initiated by either Party, however, the Parties may agree to nonbinding mediation of any dispute prior to the bringing of such suit or action. e. Entire Agreement. This Agreement represents the entire and integrated agreement between the County and the Provider and supersedes all prior negotiations, representations or agreements, either written or oral. This Agreement may be amended only by written instrument signed by both parties. Modifications may be evidenced by facsimile signatures. f. Severability. If any provision of this Agreement is held as a matter of law to be unenforceable, the remainder of this Agreement shall be valid and binding upon the Parties. g. Ownership of Work Product. Should Provider’s performance of this Agreement generate documents, items or things that are specific to this Project such documents, items or things shall become the property of the County and may be used on any other project without additional compensation to the Provider. The use of the documents, items or things by the County or by any person or entity for any purpose other than the Project as set forth in this Agreement shall be at the full risk of the County. DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E Revised 07/20 7 h. Non-Appropriation. Provider acknowledges that County is a governmental entity, and the validity of this Agreement is based upon the availability of public funding under the authority of its statutory mandate. In the event that public funds are unavailable and not appropriated for the performance of County’s obligations under this Agreement, then this Agreement shall automatically expire without penalty to County immediately upon written notice to Provider of the unavailability and non-appropriation of public funds. It is expressly agreed that County shall not activate this non-appropriation provision for its convenience or to circumvent the requirements of this Agreement, but only as an emergency fiscal measure during a substantial fiscal crisis. In the event of a change in the County’s statutory authority, mandate or mandated functions, by state or federal legislative or regulatory action, which adversely affects County’s authority to continue its obligations under this Agreement, then this Agreement shall automatically terminate without penalty to County upon written notice to Provider of such limitation or change in County’s legal authority. i. Signatures. This Agreement together with any amendments or modifications may be executed electronically. All electronic signatures affixed hereto evidence the consent of the Parties to utilize electronic signatures and the intent of the Parties to comply with Article 11A and Article 40 of North Carolina General Statute Chapter 66. j. Notices. Any notice required by this Agreement shall be in writing and delivered by certified or registered mail, return receipt requested to the following: Orange County Provider’s Name Attention:Jim Northrup NWN Corporation P.O. Box 8181 271 Waverley Oaks Road Hillsborough, NC 27278 Waltham, MA 02452 [SIGNATURE PAGE TO FOLLOW] DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E Revised 07/20 8 IN WITNESS WHEREOF, the Parties, by and through their authorized agents, have hereunder set their hands and seal, all as of the day and year first above written. ORANGE COUNTY: PROVIDER: By: _________________________________ Bonnie Hammersley, County Manager By: __________________________________ Jack Lodge, Executive Vice President of Customer Success, NWN Corporation Printed Name and Title DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E 6/23/20216/29/2021 Revised 07/20 9 ORANGE COUNTY—DEPARTMENT USE ONLY ______________________________________________________________________________ Party/Vendor Name: NWN Corporation Party/Vendor Contact Person: Jack Lodge Contact Phone: 781-788-4475 Party/Vendor Address: 271 Waverley Oaks Road City Waltham State: MA Zip: 02452 Department: IT Amount: $26,233.41 Purpose: DUO Deployment Budget Code(s): 61370035-897229-30007 Vendor # 67127 (N/A if new vendor) Vendor is a BOCC consultant? Yes No Contract Type: (Check one) New Renewal Amendment Effective Date 23June2021 Approved by Board Yes No Agenda Date: This agreement is approved as to technical form and content and I as Department Director affirmatively state work on this project has not been initiated prior to execution of the agreement: Department Director’s Signature ________________________________________ Date: ________ Agreements for emergency services or repair are not subject to the above affirmation. If services related to this agreement have already begun or been completed please briefly describe the nature of the emergency condition that was addressed: Information Technologies (Applicable only to hardware/software purchases or related services) This agreement has been reviewed and is approved as to information technology content and specifications: Office of the Chief Information Officer___________________________________ Date: ________ Risk Management This agreement is approved for sufficiency of insurance standards, specifications, and requirements: Office of the Risk Management Officer___________________________________ Date: _________ Financial Services This instrument has been pre-audited in the manner required by the Local Government Budget and Fiscal Control Act: Office of the Chief Financial Officer ____________________________________ Date: _________ Legal Services This agreement is approved as to legal form and sufficiency: Office of the County Attorney __________________________________________Date: ________ Clerk to the Board Received for record retention: All Docusign contracts must be copied to the Clerk upon completion: occlerkdocs@orangecountync.gov The following signature block is for hard copies only and is not required for Docusign contracts: Office of the Clerk to the Board __________________________________________Date:_________ DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E 6/28/2021 6/28/2021 6/28/2021 6/29/2021 6/29/2021 Orange County Government OP-19451 1 Orange County Government June 15, 2021 Orange County Government Security Services to Deploy DUO Statement of Work Prepared for: Prepared by: Jim Northrup Ben Smith Chief Information Officer Senior Account Manager 208 S Cameron St 7025 Albert Pick Rd, Suite 302 Hillsborough, NC Greensboro NC, Attachment ADocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E Orange County Government 2 Q-20526 June 15, 2021 Executive Summary Orange County Government ("Customer") requires assistance with implementation of multi-factor authentication (MFA) to protect VPN, OWA, Windows workstations/servers, and additional cloud and on-prem applications. Duo Access Gateway will be utilized for SSO for cloud applications while the majority of other on- prem, AD-native systems will utilize AD integration and Duo Authentication Proxy to add MFA to the authentication process. NWN will implement the infrastructure components for Duo as well as a successful group of pilot users/computers, and the Customer’s team will plan to handle the deployment of agents and Duo user enrollments to the larger employee population. Customer will be responsible for configuration and software installations on the Microsoft Exchange platform. Project Scope and Related Materials Project Scope NWN will provide the engineering expertise to complete the following tasks: Security Project – Kickoff and Closure Meetings Part Number Description SEC-PRO-PROJ-KO Customer Kickoff and Project Closure Kickoff Meetings Kickoff meetings are essential in any project to ensure a successful introduction of all stakeholders involved in the project. The security Kickoff meetings are held between the NWN and customer teams and will involve all customer IT staff and leadership, NWN engineering and project management, and customer project management teams. Internal kickoff meeting – this meeting involves the NWN Sales Team and the NWN Implementation Team. At this meeting, the entire NWN team is made aware of Customer’s expectations that were set during the Sales process to ensure all communication is translated to the Implementation Team for the on-site work effort. During this process the NWN Solution Architects and the NWN Professional Services engineering team will meet to discuss the details of the project and communicate the requirements for the project as agreed upon with Customer during the presales process. External kickoff meeting – this meeting involves the NWN Team and Customer’s Team and usually takes place at Customer’s site. During this meeting, all aspects of the project will be reviewed and established. This includes, but is not limited to: logistics management, roles and responsibilities of all project team members, draft schedule, task plan and work breakdown structure (WBS), communications plan and design and implementation approaches. Customer will also have the opportunity to meet the services engineering team members who will be responsible for delivery of the installation components of the project. Scheduling for Design Meeting – Initial timeline will be set for overall project. NWN and Customer will work together to identify resources for project and coordinate schedules to complete the Design Phase. DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E Orange County Government 3 Q-20526 June 15, 2021 Create project plan package – the NWN Project Manager will work with the overall team to create a project plan package, schedule, communications plan, project documents and protocols. Project Closure Meetings Project Closure meetings occur at the end of the project when all the installation and configuration deliverables have been completed. During this final stage of the project, final documentation and knowledge transfer is performed as well as any handoffs to the customer’s operations team or NWN’s managed services team if required and part of the project scope. Knowledge Transfer – NWN’s technical team on the project will conduct a solution orientation session and knowledge transfer with Customer’s designated staff. This does not replace manufacturer specific technical training on the specific equipment, but provides a solid overview of how NWN has integrated the solution into Customer’s environment. Details of this session are: o 1 x 2 Hour session(s) with up to four (4) Customer technical staff members at Customer’s site o Deployment documentation Maintenance contract activation – NWN will review any manufacture’s maintenance contracts purchased as part of this project and ensure those contracts are properly activated. Transfer to Customer support – NWN will provide final AS Built documentation to Customer on the solution implementation and transition the project to Customer’s technical support staff. Project closure meeting – NWN will conduct a project review, acceptance and closure meeting to close out the project. This will include a review of the scope for completion, BOM deliverables, final documents and Customer acceptance and survey documents. Deliverables: Kick off meetings and follow up communications Project plan package Project work schedule and related meetings (design, discovery, status) Knowledge transfer sessions, corresponding design documentation Maintenance contract activation and related documents Project closure meeting Security Project – Cutover Window Part Number Description SEC-PRO-PROJ-CUT Standard Cutover Window (Overtime) Cutover Window – NWN will work with the customer to deploy the solution into production during the pre- determined cutover window. During this time all system functionality will be verified and validated to ensure that all systems are providing the appropriate capability as deemed required from the design requirements documentation and that all outcomes are achieved. If issues are found during this window that require a rollback, this decision will be made jointly between the customer and NWN and rollback procedures will be executed to return the solution to the pre-cutover state. Test and Acceptance – During the final stage of the cutover window the customer and NWN engineering team will ensure that all testing procedures have been completed successfully and that any outstanding issues have been addressed before considering the cutover successful. Security Project – Next Day Support Part Number Description SEC-PRO-PROJ-NEXTDAY Standard Next Day Support DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E Orange County Government 4 Q-20526 June 15, 2021 Day 2 Support – NWN will remain on site for help address and diagnose any problems that arise due to the migration to the new equipment. NWN will be able to troubleshoot any installation related issues and the Customer needs to provide a resource with troubleshooting knowledge for Customer’s software applications and end user devices. Once the new solution configurations agreed to be stable by NWN and Customer IT Staff, NWN will start to finalize the documentation for the project. Zero Trust Secure Access Cloud Portal Provisioning Part Number Description SEC-PRO-MFA-BSE Configuration and Installation Services for Base Setup of MFA Portal and up to (3) Administrator accounts NWN professional services engineer will perform the following Installation and Configuration tasks: Cloud portal provisioning with configuration of up to 3 administrator accounts Configure (1) standard Directory Integration with on premise AD or Azure AD and (1) Directory sync Deliverables: Installation and Configuration of Cloud Portal, Authentication proxy (if required) and up to 3 administrator accounts Single session of up to (2) hours Knowledge Transfer for up to (5) participants Zero Trust Secure Access Standalone Gateway for SSO Part Number Description SEC-PRO-MFA-DAG Install and Configure on premise Secure Access Standalone Gateway (DAG) for SSO Protected cloud applications will redirect users to the Secure Access Gateway server in Customer’s network. NWN professional services engineer will perform the following tasks: Deploy on premise Standalone Secure Access Gateway (DAG) on Customer provided Windows server to function as IdP Deploy DAG on DMZ server Complete configuration to integrate with on premise AD server Assumptions: Customer’s IdP must meet DAG prerequisites Customer will be responsible for any additional components or configuration changes required for DAG Requires Secure Access portal provisioning (SEC-PRO-MFA-BSE) is completed Customer will be responsible for all timely internal communications to meet project timelines. Customer will be responsible for Firewall, DNS, IIS changes that may be required and providing certificate for DAG. HA for DAG is out of scope Deliverables: Standalone Secure Access Gateway (DAG) is installed and tested to meet best practice guidelines Single session of up to (2) hours Knowledge Transfer for up to (5) participants DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E Orange County Government 5 Q-20526 June 15, 2021 Zero Trust Secure Access Basic Application Policy Part Number Description SEC-PRO-MFA-POLICY Configuration of (1) Basic Policy for Trusted User, Device Health use case Configure Secure Access two-factor authentication (2FA) solution to verify the identity of your users and protect against breaches. NWN professional services engineers will perform the following tasks: Configure Basic Control Policy for (1) Application for trusted user, device health Test Basic Policy and make necessary changes Assumptions: Requires Secure Access portal provisioning (SEC-PRO-MFA-BSE) is completed Requires SSO integration (SEC-PRO-MFA-SSO or SEC-PRO-MFA-DAG) is completed Pilot group of up to (25) users will be enrolled Customer will be responsible for all timely internal communications to meet project timelines 2FA methods will be Push, Tokens, Passcodes, Call Me or SMS Customer will be responsible for Call Me and SMS charges. Custom Web applications & Integrations are not included Deliverables: Single session of (1) hour Knowledge Transfer for up to (5) participants Zero Trust Secure Access RDP and Windows Logon Part Number Description SEC-PRO-MFA-RDP Configuration and Installation of Secure Access RDP Feature Add two-factor authentication to Remote Desktop and local logons and credentialed User Access Control (UAC) elevation prompts of server or workstations within the customer’s AD environment. NWN professional services engineers will perform the following tasks: Configure (1) RDP policy to provide integration of MFA with Remote Desktop services. Test Secure Access authentication for Windows app on up to 3 workstations or servers (OFF HOURS) Assumptions: Requires Secure Access portal provisioning (SEC-PRO-MFA-BSE) is completed Customer is responsible for Secure Access authentication installer on all other workstations or servers Deliverables: Configure (1) policy for RDP configured in Secure Access cloud portal Zero Trust Secure Access MFA for Remote Access VPN Part Number Description SEC-PRO-MFA-RAVPN Configuration services for Secure Access MFA with Remote Access VPN Configure two-factor authentication (2FA) to verify the identities of your users and check the security health of their devices before granting them access to your applications via the VPN firewall. NWN professional services engineers will perform the following tasks: Configure (1) policy to provide for VPN client to integrate with up to (2) Remote access VPN profiles Configure and test up to (2) VPN Remote Access profiles (OFF HOURS) DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E Orange County Government 6 Q-20526 June 15, 2021 Assumptions: Requires authentication proxy as part of Secure Access portal provisioning (SEC-PRO-MFA-BSE) is completed The customer is responsible for configuring the firewalls based on documentation that will be provided by NWN engineer to support this integration. Firewall software version must meet prerequisites to integrate with authentication proxy. Requires Customer to have a functioning remote access VPN configuration Deliverables: Secure Access MFA Integration with up to (2) Remote Access VPN profile Zero Trust Secure Access Policy for Outlook Web Access (OWA) Part Number Description SEC-PRO-MFA-O365 Configuration and Installation of Secure Outlook Web Access (OWA) for Exchange Server 2013/2016 on Server 2012; or Exchange 2019 on Server 2019 Add two-factor authentication and flexible security policy to Office 365 logins. NWN professional services engineers will perform the following tasks: Discovery session up to (2) hours of customer’s existing O365 environment Configure (1) policy to provide OWA integration of MFA according to best practice (OFF HOURS) Testing of policy and integration for OWA (OFF HOURS) Assumptions: Requires Secure Access portal provisioning (SEC-PRO-MFA-BSE) is completed Requires MFA Policy for Trusted User (SEC-PRO-MFA-POLICY) is completed Pilot group of up to (25) Endpoints/Users will be enrolled Customer will be responsible for all configuration changes and support of the Microsoft Exchange platform. Customer will be responsible for all timely internal communications to meet project timelines. 2FA methods will be Push, Tokens, Passcodes, Call Me or SMS Customer will be responsible for Call Me and SMS charges. Deliverables: Configure (1) policy to integrate Secure Access with Office 365 for MFA per standard Zero Trust Secure Access Advanced or Custom Policy Part Number Description SEC-PRO-MFA-POLICYADV Configuration of (1) granular Advanced or Custom Policy Configure Secure Access two-factor authentication (2FA) solution to reduce risk by configuring precise policies and controls to enforce rules on specific user groups access application. NWN professional services engineers will perform the following tasks: Configure Advanced or Custom policy to gain granular control to differentiate between corporate and BYOD devices Test Advanced policy and make necessary changes Assumptions: DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E Orange County Government 7 Q-20526 June 15, 2021 Requires Secure Access portal provisioning (SEC-PRO-MFA-BSE) is completed Requires SSO integration (SEC-PRO-MFA-SSO or SEC-PRO-MFA-DAG) is completed Requires DNG deployment (SEC-PRO-MFA-DNG) is completed (if applicable) Pilot group of up to (25) users will be enrolled Customer will be responsible for all timely internal communications to meet project timelines 2FA methods will be Push, Tokens, Passcodes, Call Me or SMS Customer will be responsible for Call Me and SMS charges. Custom Web applications & Integrations are not included Deliverables: Configure (1) granular Advanced or Custom policy Single session of (1) hour Knowledge Transfer for up to (5) participants Services Pricing # PART DESCRIPTION QTY UNIT PRICE EXT. TOTAL 1. SEC-BUN-CORE Security Services - Core bundle 1 2. SEC-PRO-PROJ-KO Customer Kickoff and Project Closure 1 $2,281.12 $2,281.12 3. SEC-PRO-PROJ-CUT Standard Cutover Window (After Hours) 1 $1,537.06 $1,537.06 4. SEC-PRO-PROJ-NEXTDAY Standard Next Day Support 1 $1,223.78 $1,223.78 5. SEC-PRO-MFA-BSE Configuration and Installation Services for Basic Setup of MFA Portal and Administration 1 $2,642.64 $2,642.64 6. SEC-PRO-MFA-POLICY Configuration services for (1) Application & Basic Policy 8 $1,151.92 $9,215.36 7. SEC-PRO-MFA-RAVPN Configuration services for Secure Access MFA for up to (2) Remote Access VPN profiles 1 $2,860.70 $2,860.70 8. SEC-PRO-MFA-RDP Configuration and Installation of Secure Access RDP Feature 1 $1,977.36 $1,977.36 9. SEC-PRO-MFA-DAG Install and Configure on premise Standalone Secure Access Gateway (DAG) for SSO 1 $2,642.64 $2,642.64 10. SEC-PRO-MFA-O365 Configuration and Installation of Secure Outlook Web Access (OWA) for Exchange Server 2013/2016 on Server 2012; or Exchange 2019 on Server 2019 1 $1,852.75 $1,852.75 Total: $26,233.41 Total One-Time Charge: $26,233.41 Scope Assumptions Customer is responsible for providing access to all systems requested by NWN for completion of the project. Customer is responsible for providing all hardware, software, maintenance and other resources required for the successful completion of the project. Customer will provide a primary point of contact for the NWN Project Coordinator. DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E Orange County Government 8 Q-20526 June 15, 2021 Customer will be responsible to have complete backups of any data prior to commencement of our services. NWN assumes no responsibility for lost data. NWN Standard Business Hours are Monday thru Friday, 8am to 5pm. All work effort noted above is estimated to be completed during this timeframe, and NWN will bill actual hours as incurred with a 4-hour minimum charge for all onsite work effort. If after-hours work is required, then a change order will be required. NWN will provide knowledge transfer to Customer staff throughout the engagement. Knowledge transfer is not intended to replace formal technical training and certification. Customer must have ACTIVE manufacturer support contracts on any existing equipment that NWN will be performing work on during this work effort. Terms and Conditions Customer shall be billed in accordance with the Billing and Subscription Terms set forth herein for the terms beginning on the Subscription Start Date. The Subscription Start Date shall begin on the SOW Effective Date and for the length set forth in the Subscription Term. Unless Customer notifies NWN in writing at least ninety (90) days prior to the Subscription Renewal Date, Customer’s Subscription Term will automatically renew on annual terms. The Payment Frequency set forth in the table above details the timing and amount of the charges due under this SOW. Customer shall be billed the Non-recurring Charge and the Subscription Charge on the SOW Effective Date and in accordance with the Payment Frequency set forth in the Billing and Subscription Terms table set forth above. For example, a Payment Frequency of “Full Term” shall mean that the Customer is agreeing to pay for the entire Subscription Term’s Non-recurring Charges and Recurring Charges upfront and such payment shall be invoiced as of the SOW Effective Date. This SOW and any applicable Products or Services purchased hereunder are subject to either (i) the applicable mutually executed Master Products and Services Agreement or Master Services Agreement that authorizes the purchase(s) herein between NWN and Customer; or (ii) where NWN and Customer have not executed such an agreement, the terms and conditions set forth at https://www.nwnit.com/service-description/ shall apply (the online terms and conditions and the applicable agreement shall each be deemed the “Agreement”). For the avoidance of doubt, in the event of any conflict between the terms of this SOW and the Agreement, the terms of this SOW shall prevail. To the extent the name of the Agreement does not correspond with those referenced above but authorize Customer to purchase Products or Services from NWN, those agreements shall additionally be deemed Agreements for the purposes of this SOW. Any terms not defined in this SOW shall be set forth in the Agreement. The pricing contained in this SOW is valid for thirty (30) days from date of issue. Applicable shipping charges, taxes, and if applicable, telecommunications surcharges and fees, will be billed by NWN and itemized on a separate line item(s) on NWN’s invoice. In the event Customer does not execute this SOW and only places a Purchase Order, such Purchase Order is deemed acceptance of the terms of this SOW and any additional or different terms in such Purchase Order will not bind NWN without its written consent to amend the terms of the SOW. Provided no additional or different terms are contained in a Purchase Order, NWN may reject a Purchase Order in its sole discretion within two (2) business days from its receipt and after which time such Purchase Order is deemed accepted (an “Accepted Purchase Order”). In the event Customer chooses to place a Purchase Order rather than signing this SOW, the date of the Accepted Purchase Order shall be considered the SOW Effective Date. DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E Orange County Government 9 Q-20526 June 15, 2021 Statement of Confidentiality This Statement of Work (“SOW”) has been developed by NWN and is NWN’s proprietary trade secret and business confidential information. This SOW may not be released to another vendor, business partner or contractor without prior written consent from NWN. Accepted and Agreed by: Orange County Government NWN Corporation, Inc. Signature Signature Name Name Title Title Date Date DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E 01/08/2021 RSC Insurance Brokerage, Inc. 160 Federal St. 4th Floor Boston MA 02110 (212) 596-3400 (212) 596-3460 NWN Corporation 271 Waverly Oaks Road, Ste. 100 Waltham MA 02452 Hartford Fire Insurance Company 19682 Trumbull Insurance Company 27120 Hartford Casualty Insurance Company 29424 Twin City Fire Insurance Company 29459 CL20121487041 A 08UUNBA6761 12/15/2020 12/15/2021 1,000,000 300,000 10,000 1,000,000 2,000,000 2,000,000 B 08UENBA7384 12/15/2020 12/15/2021 1,000,000 C 10,000 08XHUBA6901 12/15/2020 12/15/2021 10,000,000 10,000,000 D N 08WEAE2JVW 12/15/2020 12/15/2021 1,000,000 1,000,000 1,000,000 A Tech E&O 08TE034486319 12/15/2020 12/15/2021 Limit $10,000,000 ~ Evidence of Insurance Orange County Office Building 131 West Margaret Lane Hillsborough NC 27278 SHOULD ANY OF THE ABOVE DESCRIBED POLICIES BE CANCELLED BEFORE THE EXPIRATION DATE THEREOF, NOTICE WILL BE DELIVERED IN ACCORDANCE WITH THE POLICY PROVISIONS. INSURER(S) AFFORDING COVERAGE INSURER F : INSURER E : INSURER D : INSURER C : INSURER B : INSURER A : NAIC # NAME:CONTACT (A/C, No):FAX E-MAILADDRESS: PRODUCER (A/C, No, Ext):PHONE INSURED REVISION NUMBER:CERTIFICATE NUMBER:COVERAGES IMPORTANT: If the certificate holder is an ADDITIONAL INSURED, the policy(ies) must have ADDITIONAL INSURED provisions or be endorsed. If SUBROGATION IS WAIVED, subject to the terms and conditions of the policy, certain policies may require an endorsement. A statement on this certificate does not confer rights to the certificate holder in lieu of such endorsement(s). THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER. THIS CERTIFICATE DOES NOT AFFIRMATIVELY OR NEGATIVELY AMEND, EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POLICIES BELOW. THIS CERTIFICATE OF INSURANCE DOES NOT CONSTITUTE A CONTRACT BETWEEN THE ISSUING INSURER(S), AUTHORIZED REPRESENTATIVE OR PRODUCER, AND THE CERTIFICATE HOLDER. OTHER: (Per accident) (Ea accident) $ $ N / A SUBR WVD ADDL INSD THIS IS TO CERTIFY THAT THE POLICIES OF INSURANCE LISTED BELOW HAVE BEEN ISSUED TO THE INSURED NAMED ABOVE FOR THE POLICY PERIOD INDICATED. NOTWITHSTANDING ANY REQUIREMENT, TERM OR CONDITION OF ANY CONTRACT OR OTHER DOCUMENT WITH RESPECT TO WHICH THIS CERTIFICATE MAY BE ISSUED OR MAY PERTAIN, THE INSURANCE AFFORDED BY THE POLICIES DESCRIBED HEREIN IS SUBJECT TO ALL THE TERMS, EXCLUSIONS AND CONDITIONS OF SUCH POLICIES. LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS. $ $ $ $PROPERTY DAMAGE BODILY INJURY (Per accident) BODILY INJURY (Per person) COMBINED SINGLE LIMIT AUTOS ONLY AUTOSAUTOS ONLY NON-OWNED SCHEDULEDOWNED ANY AUTO AUTOMOBILE LIABILITY Y / N WORKERS COMPENSATION AND EMPLOYERS' LIABILITY OFFICER/MEMBER EXCLUDED? (Mandatory in NH) DESCRIPTION OF OPERATIONS below If yes, describe under ANY PROPRIETOR/PARTNER/EXECUTIVE $ $ $ E.L. DISEASE - POLICY LIMIT E.L. DISEASE - EA EMPLOYEE E.L. EACH ACCIDENT EROTH-STATUTEPER LIMITS(MM/DD/YYYY)POLICY EXP(MM/DD/YYYY)POLICY EFFPOLICY NUMBERTYPE OF INSURANCELTRINSR DESCRIPTION OF OPERATIONS / LOCATIONS / VEHICLES (ACORD 101, Additional Remarks Schedule, may be attached if more space is required) EXCESS LIAB UMBRELLA LIAB $EACH OCCURRENCE $AGGREGATE $ OCCUR CLAIMS-MADE DED RETENTION $ $PRODUCTS - COMP/OP AGG $GENERAL AGGREGATE $PERSONAL & ADV INJURY $MED EXP (Any one person) $EACH OCCURRENCE DAMAGE TO RENTED $PREMISES (Ea occurrence) COMMERCIAL GENERAL LIABILITY CLAIMS-MADE OCCUR GEN'L AGGREGATE LIMIT APPLIES PER: POLICY PRO-JECT LOC CERTIFICATE OF LIABILITY INSURANCE DATE (MM/DD/YYYY) CANCELLATION AUTHORIZED REPRESENTATIVE ACORD 25 (2016/03) © 1988-2015 ACORD CORPORATION. All rights reserved. CERTIFICATE HOLDER The ACORD name and logo are registered marks of ACORD HIRED AUTOS ONLY DocuSign Envelope ID: D5E822B6-CEA5-42BA-9CEC-DFE6C888D91E