Loading...
HomeMy WebLinkAbout2021-682-IT Dept-NWN Corporation-Varonis security software licensing and installation DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 [Departmental Use Only] TITLE NWN Varonis FY 22 NORTH CAROLINA SERVICES AGREEMENT NO RFP/RFQ ORANGE COUNTY This Services Agreement (hereinafter "Agreement"), made and entered into this loth day of December, 2021, ("Effective Date") by and between Orange County, North Carolina a political subdivision of the State of North Carolina (hereinafter, the "County") and NWN Corporation , (hereinafter, the "Provider"). WITNESSETH: That the County and Provider, for the consideration herein named, do hereby agree as follows: 1. Services a. Scope of Work. i) This Agreement is for services to be rendered by Provider to County with respect to (insert type of project): Varonis data security platform licensing and support ii) By executing this Agreement, the Provider represents and agrees that Provider is qualified to perform and fully capable of performing and providing the services required or necessary under this Agreement in a fully competent, professional and timely manner. iii) Time is of the essence with respect to this Agreement. iv) The services to be performed under this Agreement consist of Basic Services, as described and designated in Section 3 hereof. Compensation to the Provider for Basic Services under this Agreement shall be as set forth herein. 2. Responsibilities of the Provider a. Services to be provided. The Provider shall provide the County with all services required in Section 3 to satisfactorily complete the Project within the time limitations set forth herein and in accordance with the highest professional standards. b. Standard of Care. i) The Provider shall exercise reasonable care and diligence in performing services under this Agreement in accordance with the highest generally accepted standards of this type of Provider practice throughout the United States and in accordance with applicable federal, state and local laws and regulations applicable to the performance of these services. Provider is solely responsible for the professional Revised 06/21 1 DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 quality, accuracy and timely completion and submission of all work related to the Basic Services. ii) Provider shall be responsible for all errors or omissions of its agents, contractors, employees, or assigns in the performance of the Agreement. Provider shall correct any and all errors, omissions, discrepancies, ambiguities, mistakes or conflicts at no additional cost to the County. iii) The Provider shall not, except as otherwise provided for in this Agreement, subcontract the performance of any work under this Agreement without prior written permission of the County. No permission for subcontracting shall create, between the County and the subcontractor, any contract or any other relationship. iv) Provider is an independent contractor of County. Any and all employees of the Provider engaged by the Provider in the performance of any work or services required of the Provider under this Agreement, shall be considered employees or agents of the Provider only and not of the County, and any and all claims that may or might arise under any workers compensation or other law or contract on behalf of said employees while so engaged shall be the sole obligation and responsibility of the Provider. v) If activities related to the performance of this Agreement require specific licenses, certifications, or related credentials Provider represents that it or its employees, agents and subcontractors engaged in such activities possess such licenses, certifications, or credentials and that such licenses certifications, or credentials are current, active, and not in a state of suspension or revocation. vi) In determining the Basic Services to be provided, should any documents be referenced in this Agreement, the terms of this Agreement shall have priority in any conflict between the terms of referenced documents and the terms of this Agreement. vii) Should this Agreement involve project designs, the construction or creation of which is to be bid out or fulfilled by other contractors, and bidding or negotiation with contractors produce prices which, when added to the other elements of the approved total project cost, produce a cost that is in excess of the approved total project cost, the Provider shall participate with the County in negotiation and design adjustments to the extent such are necessary to obtain prices within the approved total project cost. All activity of the Provider with respect to these matters shall constitute Basic Services and shall be performed by the Provider without additional compensation. If negotiation and design adjustments fail to bring costs within the total project cost the County may reject all bids and Provider will redesign or reduce portions of the project in an effort to reduce the bid prices to within the total project cost and rebid the project. One such redesign is included within Basic Services. If this second letting for bids does not produce bids that are within the approved total project cost initially or after negotiations with the contractor the cost is not reduced to an amount within the total project cost, the Provider is not obligated to engage in further redesign. Revised 06/21 2 DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 3. Basic Services a. Basic Services. The Services to be rendered pursuant to this Agreement are as follows (fully describe services to be provided): Varonis data security as described in attached Statement of Work(see Attachment A). 4. Duration of Services a. Term. The term of this Agreement shall be from 03 January 2022 to 02 January 2023. b. Scheduling of Services. i) The Provider shall schedule and perform its activities in a timely manner. ii) Should the County determine that the Provider is behind schedule, it may require the Provider to expedite and accelerate its efforts, including providing additional resources and working overtime, as necessary, to perform its services in accordance with the approved project schedule at no additional cost to the County. iii) The Commencement Date for the Provider's Basic Services shall be 03 January 2022. 5. Compensation a. Compensation for Basic Services. Compensation for Basic Services shall include all compensation due the Provider from the County for all services satisfactorily (as determined by the County) performed pursuant to this Agreement. The maximum amount payable for Basic Services shall not exceed eighty-four-thousand-four-hundred- eleven and 73/100 Dollars ($84,411.73) (See Attachment B). Payment for satisfactorily performed Basic Services shall become due and payable within thirty (30) days of Provider properly invoicing County. Payment shall be subject to provisions of Section 5(b). b. Disputes. In the event the amount stated on an invoice is disputed by the County, the County may withhold payment of all or a portion of the amount stated on an invoice until the parties resolve the dispute. Should Provider fail to perform its duties under the terms of this Agreement, County may, without fault or penalty, withhold any payment associated with the work to be performed until such time as said work is completed. c. Additional Services. County shall not be responsible for costs related to any services in addition to the Basic Services performed by Provider unless County requests such additional services in writing and such additional services are evidenced by a written amendment to this Agreement. 6. Responsibilities of the County a. Cooperation and Coordination. The County has designated (Jim Northrup) to act as the County's representative with respect to the Project who shall have the authority to render decisions within guidelines established by the County Manager or the County Board of Revised 06/21 3 DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 Commissioners and who shall be available during working hours as often as may be reasonably required to render decisions and to furnish information. 7. Insurance a. General Requirements. Provider shall obtain, at its sole expense, Commercial General Liability Insurance, Automobile Insurance, Workers' Compensation Insurance, and any additional insurance as may be required by County's Risk Manager as such insurance requirements are described in the Orange County Risk Transfer Policy and Orange County Minimum Insurance Coverage Requirements (each document is incorporated herein by reference and may be viewed at http://www.orangecountync.gov/departments/purchasing division/contracts.php). If County's Risk Manager determines additional insurance coverage is required such additional insurance shall consist of N/A(if no additional insurance required mark N/A as being not applicable). Provider shall not commence work until such insurance is in effect and certification thereof has been received by the County's Risk Manager. 8. Indemnity a. Indemnity. To the extent authorized by North Carolina law the Provider agrees, without limitation, to defend, indemnify and hold harmless the County from all loss, liability, claims or expense, including attorney's fees, arising out of or related to the Project and arising from property damage or bodily injury including death to any person or persons caused in whole or in part by the negligence or misconduct of the Provider except to the extent same are caused by the negligence or willful misconduct of the County. It is the intent of this provision to require the Provider to indemnify the County to the fullest extent permitted under North Carolina law. 9. Amendments to the Agreement a. Changes in Basic Services. Changes in the Basic Services and entitlement to additional compensation or a change in duration of this Agreement shall be made by a written Amendment to this Agreement executed by the County and the Provider. The Provider shall proceed to perform the Services required by the Amendment only after receiving a fully executed Amendment from the County. 10. Termination a. Termination for Convenience of the County. This Agreement may be terminated without cause by the County and for its convenience upon seven (7) days' prior written notice to the Provider. b. Other Termination. The Provider may terminate this Agreement based upon the County's material breach of this Agreement; provided, the County has not taken all reasonable actions to remedy the breach. The Provider shall give the County seven(7) days'prior written notice of its intent to terminate this Agreement for cause. Either party may terminate this Agreement upon notice to the other party that obligations pursuant to this Agreement are made impractical due to declarations of emergency by Orange County or by North Carolina due to events directly impacting Orange County. Both parties shall Revised 06/21 4 DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 remain responsible for all payment and performance due up to the receipt of such notice, but shall have no further obligation or responsibility beyond that date provided the terminating party has taken all reasonable steps to complete the performance of its obligations. c. Compensation After Termination. i) In the event of termination, the Provider shall be paid that portion of the fees and expenses that it has earned to the date of termination, less any costs or expenses incurred or anticipated to be incurred by the County due to errors or omissions of the Provider. Upon request of the County, the Provider shall submit to County all relevant documentation, including but not limited to, job cost records, to support its claims for final compensation. ii) Should this Agreement be terminated, the Provider shall deliver to the County within seven (7) days, at no additional cost, all deliverables including any electronic data or files relating to the Project. d. Waiver. The payment of any sums by the County under this Agreement or the failure of the County to require compliance by the Provider with any provisions of this Agreement or the waiver by the County of any breach of this Agreement shall not constitute a waiver of any claim for damages by the County for any breach of this Agreement or a waiver of any other required compliance with this Agreement. e. Suspension. County may suspend the Basic Services and this Agreement at any time for County's convenience and without penalty to County upon three (3) days' notice to Provider. Upon any suspension by County, Provider shall discontinue work on the Basic Services and shall not resume the Basic Services until notified to proceed by County. 11. Additional Provisions a. Limitation and Assignment. The County and the Provider each bind themselves, their successors, assigns and legal representatives to the terms of this Agreement. Neither the County nor the Provider shall assign or transfer its interest in this Agreement without the written consent of the other. b. Governing Law. This Agreement and the duties, responsibilities, obligations and rights of respective parties hereunder shall be governed by the laws of the State of North Carolina. By executing this Agreement Provider affirms that Provider and any subcontractors of Provider are and shall remain in compliance with Article 2 of Chapter 64 of the North Carolina General Statutes. By executing this Agreement Provider certifies that Provider has not been identified, and has not utilized the services of any agent or subcontractor identified, on the list created by the State Treasurer pursuant to G.S. 147-86.58. By executing this Agreement Provider certifies that Provider has not been identified, and has not utilized the services of any agent or subcontractor identified, on the list created by the State Treasurer pursuant to G.S. 147-86.81. c. Non-Discrimination. Provider shall at all times remain in compliance with all applicable local, state, and federal laws, rules, and regulations including but not limited to all state Revised 06/21 5 DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 and federal non-discrimination laws, policies, rules, and regulations and the Orange County Non-Discrimination Policy and Orange County Living Wage Policy(each policy is incorporated herein by reference and may be viewed at http://www.oran eg counMc. o�partments/purchasing division/contracts.php.) Any violation of the Orange County Non-Discrimination Policy is a breach of this Agreement and County may immediately terminate this Agreement without further obligation on the part of the County. This paragraph is not intended to limit and does not limit the definition of breach to discrimination. d. Dispute Resolution. Any and all suits or actions to enforce, interpret or seek damages with respect to any provision of, or the performance or non-performance of, this Agreement shall be brought in the General Court of Justice of North Carolina sitting in Orange County, North Carolina. It is agreed by the parties that no other court shall have jurisdiction or venue with respect to such suits or actions. Binding arbitration may not be initiated by either Party, however, the Parties may agree to nonbinding mediation of any dispute prior to the bringing of such suit or action. e. Entire Agreement. This Agreement represents the entire and integrated agreement between the County and the Provider and supersedes all prior negotiations, representations or agreements, either written or oral. This Agreement may be amended only by written instrument signed by both parties. Modifications may be evidenced by facsimile signatures. f. Severability. If any provision of this Agreement is held as a matter of law to be unenforceable, the remainder of this Agreement shall be valid and binding upon the Parties. g. Ownership of Work Product. Should Provider's performance of this Agreement generate documents, items or things that are specific to this Project such documents, items or things shall become the property of the County and may be used on any other project without additional compensation to the Provider. The use of the documents, items or things by the County or by any person or entity for any purpose other than the Project as set forth in this Agreement shall be at the full risk of the County. h. Non-Appropriation. Provider acknowledges that County is a governmental entity, and the validity of this Agreement is based upon the availability of public funding under the authority of its statutory mandate. In the event that public funds are unavailable or not appropriated for the performance of County's obligations under this Agreement, then this Agreement shall automatically expire without penalty to County immediately upon written notice to Provider of the unavailability or non-appropriation of public funds. It is expressly agreed that County shall not activate this non-appropriation provision for its convenience or to circumvent the requirements of this Agreement. In the event of a change in the County's statutory authority, mandate or mandated functions, by state or federal legislative or regulatory action, which adversely affects County's authority to continue its obligations under this Agreement, then this Agreement shall automatically terminate without penalty to County upon written notice to Provider Revised 06/21 6 DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 of such limitation or change in County's legal authority. i. Signatures. This Agreement together with any amendments or modifications may be executed electronically. All electronic signatures affixed hereto evidence the consent of the Parties to utilize electronic signatures and the intent of the Parties to comply with Article 11A and Article 40 of North Carolina General Statute Chapter 66. j. Notices. Any notice required by this Agreement shall be in writing and delivered by certified or registered mail, return receipt requested to the following: Orange County Provider's Name Attention:Jim Northrup NWN Corporation P.O. Box 8181 271 Waverley Oaks Road Hillsborough,NC 27278 Waltham, MA 02452 [SIGNATURE PAGE TO FOLLOW] Revised 06/21 7 DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 IN WITNESS WHEREOF, the Parties, by and through their authorized agents, have hereunder set their hands and seal, all as of the day and year first above written. ORANGE COUNTY: PROVIDER: DocuSigned by: DocuSigned by: By. t�M"41021 By. i(,�,ad hJA SiL2/9/2021 Bonnie Hammersley, County Manager Michael Hansil, VP of Engineering Printed Name and Title Revised 06/21 8 DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 ORANGE COUNTY—DEPARTMENT USE ONLY Party/Vendor Name: NWN Corporation Party/Vendor Contact Person: Michael Hansil Contact Phone: 704-496- 6919 Party/Vendor Address: 7025 Albert Pick Road, Suite 302 City Greensboro State: NC Zip: 27409 Department: IT Amount: $84,411.73 Purpose: Varonis security software licensing and installation Budget Code(s): 61370035-897229-30007 Vendor#67127 (N/A if new vendor) Vendor is a BOCC consultant? Yes ❑ No® Contract Type: (Check one) New ® Renewal ❑ Amendment ❑ Effective Date 10 December 2021 Approved by Board Yes❑ No® Agenda Date: ---For Section XIV. c. contracts only,Approved by Board in Current FY Budget Yes❑No❑ This agreement is approved as to technical form and content and I as Department Director affirmatively state work on this project has not been initiated prior to e >d adafa iW agreement: Department Director's Signature tJ6&Vvf Date:12/9/2021 Agreements for emergency services or repair are noltg 9 ecT4Po the above affirmation. If services related to this agreement have already begun or been completed please briefly describe the nature of the emergency condition that was addressed: N/A Information Technologies (Applicable only to hardware/software purchases or related services)This agreement has been reviewed and is approved as to information technology content an om: rimP.JJR Nb 12/9/2021 Office of the Chief Information Officer Date: Risk Management This agreement is approved for sufficiency of ins ur SAtQfLVO,specifications,and requirements: Office of the Risk Management Officer Q�1Sa rbvv�.c,TTb Date: 12/9/2021 Financial Services This instrument has been pre-audited in the manner required by the Local Government Budget and Fiscal Control Act: DocuSigned by: Office of the Chief Financial Officer �O Date: 12/13/2021 ` ' 7D4E5181%CC1409... Legal Services This agreement is approved as to legal form a ^ may: ����J�LS Office of the County Attorney Date:12/13/2021 Clerk to the Board Received for record retention: All Docusign contracts must be copied to the Clerk upon completion: occlerkdocs@orangecountync.gov The following signature block is for hard copies only and is not required for Docusign contracts: Office of the Clerk to the Board Date: Revised 06/21 9 DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 Attachment A Statement of Work Varonis Data Security Services Orange County Government, Hillsborough, NC 27278 December 9, 2021 1% nwn DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 NWN-CAROUSEL-SERVICES AGREEMENT STATEMENT OF WORK Statement of Work#A-1 Orange County North Carolina 1) Services a) The Varonis resources will include a deployment engineer and project manager,as deemed necessary. b) The major tasks and estimated person days needed to complete the implementation are described below. c) The parties acknowledge and agree that the sizing requirements listed in Exhibit A attached hereto(the"Sizing Requirements")are essential for the operation of the Software and to allow Varonis to provide the services covered under this SOW. d) Services will be performed remote. Phase Tasks Project Planning and • Hold Kick Off Meeting Design o Includes:Review SOW Scope,Review Business Needs,and Confirm Resources Assigned • Deliver Standard Project Plan • Review Environment Architecture and Hardware Recommendations per Sizing Document Product Installation+ • Install all Applicable Product(s) Data Discovery . Add Resources Specified in Sizing • Perform Health Check Sessions DatAdvantage • Optimize Configuration Per Business objectives Optimization • Share Varonis Best Practices Data Classification • Add DCE to the DatAdvantage installation Engine Configuration • Apply license for DCE • Configure DCE per Licensee's definition of sensitive data • Initiate DCE Scanning • Health check to confirm that DCE scan is working Automation Engine • Identify,develop,and validate scope and priority Remediation . Configure Automation Engine to repair a pilot scope of broken ACLs • Configure Automation Engine to remove a pilot scope of global access groups • Execute the rules • Provide weekly and/or ad-hoc reports tracking progress of the cleanup. Project Closure • Perform Final Varonis System Health Check • Validate All Varonis Jobs Are Running as Expected • Present Closing Engagement Summary Total Number of Days 7 days Billing Breakdown This SOW is priced on a Time&Materials basis as specified in the"Scope of Work"above as quantified in the quote The breakdown of Business Hours is as follows: Business Hours:9:00 AM to 6:00 PM,EST Monday through Friday,excluding US Federal Holidays. After Hours:Any time other than regular business hours or Holidays 2 ©2019NWN Corporation.All rights reserved. Third-party trademarks mentioned arethe propertyoftheir respective owners DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 NWN-CAROUSEL-SERVICES AGREEMENT One(1)day is equal to eight(8)hours of work.On site work is not offered for any of the services covered under this SOW. No After-Hours work is included in this SOW. All remote work,not including phone and email communication,will be billed in 30-minute increments. Phone/email will be billed to Licensee as time is spent. All indicated engagement durations are estimates only.Regular status updates will be provided so that budgetary impacts may be monitored as work progresses. In the event that Licensee requires a change in the executed SOW for this project that would impact the necessary resources or the definition of the nature of the work commitment,the parties will negotiate and document such a change in requirement through a written,mutually executed Change Order. Rescheduling Services Upon the execution of the SOW by Licensee and NWN,a start date will be mutually agreed to by both parties.Services are expected to commence on,and continue from,that date. If Licensee wishes to reschedule Services from any date(s)set forth in the executed SOW,Licensee must provide NWN with written notice thereof no less than three(3)business days before the originally scheduled date(s). If Licensee reschedules Services with less than three(3)business days of notice,Licensee shall be charged an agreed liquidated damage in an amount equal to fee paid or payable for half the amount of time cancelled. 2) Assumptions a) Varonis personnel will perform all design, installation and configuration work at Varonis' premises when possible using remote access. b) Varonis must notify Licensee as soon as reasonably possible of any project delays. Fees&Payment Terms Services Fee: For the professional services described in the Description of Services section above, Licensee shall pay the applicable services fee. Additional Services Fee: For any additional work beyond the services described above,an additional order will be submitted by Licensee,and License shall pay the applicable services fees,plus reasonable and customary out-of-pocket expenses. Service and Training Fees shall are payable within 30 days following the issuance of an invoice by NWN. Term This SOW will commence as of December 31,2021(the"Effective Date")and will continue through June 8,2022. Services purchased by Licensee pursuant to the terms of this SOW shall be deemed provided by Varonis within six 6 months from the purchase of such Services,unless otherwise agreed in writing between the parties. 3 ©2019 NWN Corporation.All rights reserved. Third-party trademarks mentioned arethe propertyoftheir respective owners DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 NWN-CAROUSEL-SERVICES AGREEMENT Exhibit A Sizing Requirements VARONIS ORANGE COUNTY NORTH SIZING DESIGN CAROLINA December 7th 2021 I CUSTOMER DATA ProductsLicensed Users Licensed DA for Windows DatAlert Analytics 1 001 DA for Directory Services Automation Engine Data Classification Engine Policy Pack DatAlert Location File Server Quantity of • D. City,, State,, Country Type Servers # of • . Hillborough NC Windows 30 30,000 Hillborough NC Active Directory 2 0 Hillborough NC NetApp 2 70,000 HARDWARE REQUIREMENTS Varonis Server LocationQuantity DSP OS: 150GB DLS Hillborough NC 1 8 Core 32GB Data: 2,150GB OS: 150GB SQL + SSRS Hillborough NC 1 8 Core 32GB Data: 1,200GB Logs: 600GB Temp: 40OGB SOLR + Zookeeper Server Hillborough NC 1 4 Core 32GB 1,5000B Collector Hillborough NC 1 8 Core 16GB 250GB 4 ©2019NWN Corporation.All rights reserved. Third-party trademarks mentioned are the property of their respective owners DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 NWN-CAROUSEL-SERVICES AGREEMENT ........ ......... ......... ......... ......... ......... ......... ......... ......... ......... ......... Required Probe/Collector Licenses: 1 .......................................................................................................................................................................................................................................................................................................................................................................................................: Supported OS Versions SQLVersions (64-bit Standard/Enterprise) (64-bit Standard/Enterprise) Windows Server 2008 (DA 6.3 only) Microsoft SQL 2008 (DA 6.3 only) Windows Server 2008 R2 Microsoft SQL 2008 R2 (DA 6.3 only) Windows Server 2012 Microsoft SQL 2014 Windows Server 2012 R2 Microsoft SQL 2016 Windows Server 2016 Microsoft SQL 2017 (DA 7.4+ only) Windows Server 2019 Microsoft SQL 2019 (DA 8.5.30+ only) Supported OS and SQL Server Versions provided for convenience only. Refer to the"Data Security Platform Installation Prerequisites" guide for specific requirements. ORANGE COUNTY NORTH CAROLINA'S IMPORTANT NOTES The sizing provided is generated from an estimate of events and filesystem objects based on the user count and data amounts provided. Actual collected events and objects which fall significantly outside of our estimations may alter sizing requirements. This sizing is designed to support up to 10 million daily average events and 25 million total filesystem objects. Server specifications are for physical hardware. Virtual Machines may be utilized, if they can provide performance equivalent to a physica/machine of the same hardware specifications. When utilizing Virtual machines, the CPU and RAM resources must be DEDICATED to the Varonis VM servers, in the quantities provided above. CPU specifications are for physical cores not logical processors. The required Varonis components(eg: collectors, DSP) can NOT be installed on pre-existing servers that are running other applications. SQL Enterprise edition may be required when SQL hardware requirements exceed Microsoft SQL Standard edition limitations. IaaS/Cloud solutions (including but not limited to AWS,Azure, etc.) may be utilized for Varonis servers where appropriate. Servers must be dedicated virtual or bare-metal. Virtual servers must provide performance equivalent to bare-metal of equivalent specification. All IaaS servers must meet hardware, software, and connectivity prerequisites, as outlined above and in the Varonis prerequisites documentation. Disk space requirements are based upon default retention policies. Additional monitored resources not specified at the time of this sizing or atypical datasets/usage may result in additional disk requirements. Disk Allocation/Usage should be reviewed regularly and increased as necessary. SQL DB storage assumes simple recovery mode and may be allocated incrementally if desired. Varonis is unable to provide SQL log storage requirements when using full 5 ©2019NWN Corporation.AlI rights reserved. Third-partytradem arksmentioned are the property of their respective owners DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 NWN-CAROUSEL-SERVICES AGREEMENT recovery mode (including SQL AlwaysOn) as storage is determined by log backup policies. Customer must closely monitor log consumption and utilize a suitable backup schedule to keep the log growth at the desired amount. For optimal performance, SQL disk must operate within industry-standard latency guidelines. Consult with your Varonis Professional Services Engineer for further details. Except where otherwise specified, provided data amounts are for Varonis data only and do not include required storage for system, backups, or other external services. Partitions should be created in accordance with customer IT standards and/or industry best practices. Varonis recommends a separate system partition of 15OGB or greater on all servers. Monitored domain controllers in locations without local Varonis collectors require installation of one or more DC proxy services. This component will improves event collection performance and reduces the amount of network traffic sent over the WAN.The DC proxy service can be installed on the Domain Controller, standalone servers, or on an existing file/print server, and do not consume any Varonis licenses. SOLR hardware recommendation is designed to handle up to an average of 25 million events daily, with a 180-day retention period. Event loads in excess of this amount may require additional SUR hardware. Sizing is valid for a period of 3 months from the date of creation. This sizing will expire on March 07`h 2022, after this date please contact your Varonis representative. Varonis Professional Services Design ID 42680-Orange County North Carolina - 120721 /CS/ 2/AC/ N / Specification Version: 1.10 APPROVALS Orange County NWN By(authorized signature) By(authorized signature) Name(Print or Type) Name(Print or Type) Title(Print or Type) Date: Title(Print or Type) Date: 6 ©2019NWN Corporation.All rights reserved. Third-partytrademarks mentionedare the property of their respective owners DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 ```a c h m e n t B PROPOSAL QUOTE SHEET nwn i% carousel One Year Quote, Product and Varonis Services Client: Orange County Government Issue Date: 12/6/2021 Client Address 1: Information Technologies Opportunity#: OP-25861 Q-27162 v2 Client Address 2: 131 West Margaret Lane Account Exec: Ben Smith Client City,State,Zip: Hillsborough,NC 27278 bsmith@nwnit.com Attn: Jim Northrup 336.217.1341 Phone: (919)245-2276 email: I northrup(Wco.orange.nc.us Version: 2.00 Product Number Description Unit Price Extended Price **This offer is valid until 12/31/2021. Professional Services(Installation/Training)* PS-1D 7 Professional Services Engagement(1 day) 7 $1,755.00 $ 12,285.00 FIRST YEAR $0.00 $ - AE-1001-15000S Automation Engine for Windows On-prem license for 1001 1001 $11.16 $ 11,171.16 Users for 12 Months DADS-1001-15000S DatAdvantage for Directory Services On-prem licenses for 1001 $14.88 $ 14,894.88 1001 Users for 12 Months DatAdvantage for Windows On-prem licenses for 1001 DAW-1001-15000S Users for 12 Months 1001 $14.88 $ 14,894.88 DLS-1001-15000S 1001 DatAlert Suite On-prem licenses for 12 Months 1001 $14.88 $ 14,894.88 DCF-501-7500S 1001 Data Classification Framework for Windows and 1001 $10.71 $ 10,720.71 SharePoint On-prem licenses for 12 Months GDPR-1001-15000S 1001 Data Classification Policy Pack On-prem licenses 1001 $3.72 $ 3,723.72 for 12 Months CL-1-50S 1 Collector On-prem licenses for 12 Months 1 $1,826.50 $ 1,826.50 Q-258282-1 Section 1 Hardware&Software Subtotal $ 84,411.73 Subtotals Hardware and Software Subtotal: $ 84.411.73 Total Project Investment $ 84,411.73 Estimated Taxes C&7.5% $ - Estimated Shipping $ Total Project Investment Pre-Tax $ 3 Terms&Conditions Any professional services and/or training services offered under this quotation shall be deemed provided by Varonis Systems,Inc.within three(3)months as of the issuance of an invoice, unless the end user advise otherwise in writing to NWN. NWN Corporation Page 1 of 1 Confidential Proposal DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 A 11ac ment DATE(MM/DD/YYYY) A�" CERTIFICATE OF LIABILITY INSURANCE 01/08/2021 THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER.THIS CERTIFICATE DOES NOT AFFIRMATIVELY OR NEGATIVELY AMEND,EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POLICIES BELOW. THIS CERTIFICATE OF INSURANCE DOES NOT CONSTITUTE A CONTRACT BETWEEN THE ISSUING INSURER(S),AUTHORIZED REPRESENTATIVE OR PRODUCER,AND THE CERTIFICATE HOLDER. IMPORTANT: If the certificate holder is an ADDITIONAL INSURED,the policy(ies)must have ADDITIONAL INSURED provisions or be endorsed. If SUBROGATION IS WAIVED,subject to the terms and conditions of the policy,certain policies may require an endorsement. A statement on this certificate does not confer rights to the certificate holder in lieu of such endorsement(s). PRODUCER CONTACT NAME: RSC Insurance Brokerage,Inc. ,C No Ext: (212)596-3400 ac,No): (212)596-3460 160 Federal St. E-MAIL ADDRESS: 4th Floor INSURER(S)AFFORDING COVERAGE NAIC# Boston MA 02110 INSURERA: Hartford Fire Insurance Company 19682 INSURED INSURER B: Trumbull Insurance Company 27120 NWN Corporation INSURERC: Hartford Casualty Insurance Company 29424 271 Waverly Oaks Road,Ste.100 INSURER D: Twin City Fire Insurance Company 29459 INSURER E: Waltham MA 02452 INSURER F: COVERAGES CERTIFICATE NUMBER: CL20121487041 REVISION NUMBER: THIS IS TO CERTIFY THAT THE POLICIES OF INSURANCE LISTED BELOW HAVE BEEN ISSUED TO THE INSURED NAMED ABOVE FOR THE POLICY PERIOD INDICATED. NOTWITHSTANDING ANY REQUIREMENT,TERM OR CONDITION OF ANY CONTRACT OR OTHER DOCUMENT WITH RESPECT TO WHICH THIS CERTIFICATE MAY BE ISSUED OR MAY PERTAIN,THE INSURANCE AFFORDED BY THE POLICIES DESCRIBED HEREIN IS SUBJECT TO ALL THE TERMS, EXCLUSIONS AND CONDITIONS OF SUCH POLICIES.LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS. INSR TYPE OF INSURANCEADDLSUBR POLICY EFF POLICY EXP LTR INSD WVD POLICY NUMBER MM/DD/YYYY MM/DD/YYYY LIMITS X COMMERCIAL GENERAL LIABILITY EACH OCCURRENCE $ 1,000,000 CLAIMS-MADE X OCCUR PRIM SES Ea :Nru ence $ 300,000 MED EXP(Any one person) $ 10,000 A 08UUNBA6761 12/15/2020 12/15/2021 PERSONAL&ADV INJURY $ 1,000,000 GEN-LAGGREGATE LIMITAPPLIES PER: GENERAL AGGREGATE $ 2,000,000 X JECT LOC PRODUCTS-COMP/OPAGG $POLICY ❑ PRO 2,000,000 OTHER: $ AUTOMOBILE LIABILITY COMBINED SINGLE LIMIT $ 1,000,000 Ea accident X ANYAUTO BODILY INJURY(Per person) $ B OWNED SCHEDULED 08UENBA7384 12/15/2020 12/15/2021 BODILY INJURY(Per accident) $ AUTOS ONLY AUTOS HIRED NON-OWNED PROPERTY DAMAGE $ AUTOS ONLY AUTOS ONLY Per accident X UMBRELLA LIAB X OCCUR EACH OCCURRENCE $ 10,000,000 C EXCESS LAB CLAIMS-MADE 08XHUBA6901 12/15/2020 12/15/2021 AGGREGATE $ 10,000,000 DED I X1 RETENTION $ 10,000 $ WORKERS COMPENSATION X PER STATUTE ERH AND EMPLOYERS'LIABILITY Y/N 1,000,000 ANY PROPRIETOR/PARTNER/EXECUTIVE E.L.EACH ACCIDENT $ D OFFICER/MEMBER EXCLUDED? NIA 08WEAE2JVW 12/15/2020 12/15/2021 (Mandatory in NH) E.L.DISEASE-EA EMPLOYEE $ 1,000,000 If yes,describe under 1,000,000 DESCRIPTION OF OPERATIONS below E.L.DISEASE-POLICY LIMIT $ Tech E&O A 08TE034486319 12/15/2020 12/15/2021 Limit $10,000,000 DESCRIPTION OF OPERATIONS/LOCATIONS/VEHICLES (ACORD 101,Additional Remarks Schedule,may be attached if more space is required) Evidence of Insurance CERTIFICATE HOLDER CANCELLATION SHOULD ANY OF THE ABOVE DESCRIBED POLICIES BE CANCELLED BEFORE THE EXPIRATION DATE THEREOF,NOTICE WILL BE DELIVERED IN Orange County Office Building ACCORDANCE WITH THE POLICY PROVISIONS. 131 West Margaret Lane AUTHORIZED REPRESENTATIVE Hillsborough NC 27278 fYCr f ©1988-2015 ACORD CORPORATION. All rights reserved. ACORD 25(2016/03) The ACORD name and logo are registered marks of ACORD DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 DATE(MM/DD/YYYY) A�" CERTIFICATE OF LIABILITY INSURANCE 12/09/2021 THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER.THIS CERTIFICATE DOES NOT AFFIRMATIVELY OR NEGATIVELY AMEND,EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POLICIES BELOW. THIS CERTIFICATE OF INSURANCE DOES NOT CONSTITUTE A CONTRACT BETWEEN THE ISSUING INSURER(S),AUTHORIZED REPRESENTATIVE OR PRODUCER,AND THE CERTIFICATE HOLDER. IMPORTANT: If the certificate holder is an ADDITIONAL INSURED,the policy(ies)must have ADDITIONAL INSURED provisions or be endorsed. If SUBROGATION IS WAIVED,subject to the terms and conditions of the policy,certain policies may require an endorsement. A statement on this certificate does not confer rights to the certificate holder in lieu of such endorsement(s). PRODUCER CONTACT April Ruiz NAME: RSC Insurance Brokerage,Inc. PHONE FAX A/C No Ext: A/C,No): 1350 Avenue of the Americas E-MAIL aruiz@krautergroup.com ADDRESS: 18th Floor INSURER(S)AFFORDING COVERAGE NAIC# New York NY 10019 INSURERA: Hartford Fire Ins Co 19682 INSURED INSURER B: Hartford Casualty Insurance Co 29424 Carousel Industries of North America,LLC INSURER C: Hartford Ins Co of the Midwest 37478 659 South County Trail INSURER D: XL Select Insurance Company 19607 INSURER E: Exeter RI 02822 INSURER F: COVERAGES CERTIFICATE NUMBER: CL2192135086 REVISION NUMBER: THIS IS TO CERTIFY THAT THE POLICIES OF INSURANCE LISTED BELOW HAVE BEEN ISSUED TO THE INSURED NAMED ABOVE FOR THE POLICY PERIOD INDICATED. NOTWITHSTANDING ANY REQUIREMENT,TERM OR CONDITION OF ANY CONTRACT OR OTHER DOCUMENT WITH RESPECT TO WHICH THIS CERTIFICATE MAY BE ISSUED OR MAY PERTAIN,THE INSURANCE AFFORDED BY THE POLICIES DESCRIBED HEREIN IS SUBJECT TO ALL THE TERMS, EXCLUSIONS AND CONDITIONS OF SUCH POLICIES.LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS. INSR TYPE OF INSURANCEADDLSUBR POLICY EFF POLICY EXP LTR INSD WVD POLICY NUMBER MM/DD/YYYY MM/DD/YYYY LIMITS X COMMERCIAL GENERAL LIABILITY EACH OCCURRENCE $ 1,000,000 CLAIMS-MADE X OCCUR PREM SES Ea oNcE ante $ 300,000 MED EXP(Any one person) $ 10,000 A 08 UUN BB6213 05/07/2021 05/07/2022 PERSONAL&ADV INJURY $ 1,000,000 GEN-LAGGREGATE LIMITAPPLIES PER: GENERAL AGGREGATE $ 2,000,000 X JECT LOC PRODUCTS-COMP/OPAGG $POLICY ❑ PRO 2,000,000 OTHER: $ AUTOMOBILE LIABILITY COMBINED SINGLE LIMIT $ 1,000,000 Ea accident X ANYAUTO BODILY INJURY(Per person) $ B OWNED SCHEDULED 08UENBB6262 05/07/2021 05/07/2022 BODILY INJURY(Per accident) $ AUTOS ONLY AUTOS HIRED NON-OWNED PROPERTY DAMAGE $ AUTOS ONLY AUTOS ONLY Per accident X Comp$1,000 Hx Coll$1,000 $ X UMBRELLA LIAB X OCCUR EACH OCCURRENCE $ 13,000,000 B EXCESS LAB CLAIMS-MADE 08 XHU BB5564 05/07/2021 05/07/2022 AGGREGATE $ 13,000,000 DED I X1 RETENTION $ 10,000 $ WORKERS COMPENSATION X PER STATUTE ERH AND EMPLOYERS'LIABILITY Y/N 1,000,000 ANY PROPRIETOR/PARTNER/EXECUTIVE E.L.EACH ACCIDENT $ C OFFICER/MEMBER EXCLUDED? NIA 08WEAK5SHK 05/07/2021 05/07/2022 (Mandatory in NH) E.L.DISEASE-EA EMPLOYEE $ 1,000,000 If yes,describe under 1,000,000 DESCRIPTION OF OPERATIONS below E.L.DISEASE-POLICY LIMIT $ TECH E&O/CYBER D MTP904316700 05/07/2021 05/07/2022 Limit: $5,000,000 DESCRIPTION OF OPERATIONS/LOCATIONS/VEHICLES (ACORD 101,Additional Remarks Schedule,may be attached if more space is required) This certificate is issued as evidence of insurance coverage only. CERTIFICATE HOLDER CANCELLATION SHOULD ANY OF THE ABOVE DESCRIBED POLICIES BE CANCELLED BEFORE THE EXPIRATION DATE THEREOF,NOTICE WILL BE DELIVERED IN Orange County Office Building ACCORDANCE WITH THE POLICY PROVISIONS. 131 West Margaret Lane AUTHORIZED REPRESENTATIVE Hillsborough NC 27278 fYCr f ©1988-2015 ACORD CORPORATION. All rights reserved. ACORD 25(2016/03) The ACORD name and logo are registered marks of ACORD DocuSign Envelope ID:CAFE7F47-667A-4DCB-8308-4812EB80F267 AGENCY CUSTOMER ID: LOC#: ADDITIONAL REMARKS SCHEDULE Page of AGENCY NAMED INSURED RSC Insurance Brokerage,Inc. NWN Corporation POLICY NUMBER CARRIER NAIC CODE EFFECTIVE DATE: ADDITIONAL REMARKS THIS ADDITIONAL REMARKS FORM IS A SCHEDULE TO ACORD FORM, FORM NUMBER: 25 FORM TITLE: Certificate of Liability Insurance:Notes Coverage:Business Auto(MA Only) Policy#08UENBB6381 Term:5/7/2021-5/7/2022 Carrier:Hartford Casualty CSL:$1,000,000 Coverage:Excess Tech E&O/Cyber Liability Policy#652336994 Term:5/7/2021-5/7/2022 Carrier:CNA Limit:$5,000,000 Coverage:Crime Liability Policy#596748603 Term:5/7/2021-5/7/2022 Carrier:CNA Limit:$5,000,000 ACORD 101 (2008/01) © 2008 ACORD CORPORATION. All rights reserved. The ACORD name and logo are registered marks of ACORD