Loading...
HomeMy WebLinkAboutContracts & Agreements_97-2016 AGREEMENT TO PERFORM PROFESSIONAL SERVICES This agreement for the provision of information technology disaster recovery planning services for the Department of Innovation and Technology ("Agreement") is made and entered into this 17th day of May, 2016 ("Effective Date"), by and between the City of Redlands, a municipal corporation ("City)" and Moss-Adams LLP ("Consultant"). City and Consultant are sometimes individually referred to herein as a "Party" and, together, as the "Parties." In consideration of the mutual promises contained herein, City and Consultant agree as follows: ARTICLE 1 —ENGAGEMENT OF CONSULTANT 1.1 City hereby engages Consultant to provide professional services associated with information technology disaster recovery planning services for the City's Department of Innovation and Technology (the "Services"). 1.2 The Services shall be performed by Consultant in a professional manner, and Consultant represents that it has the skill and the professional expertise necessary to provide the Services to City at a level of competency presently maintained by other practicing professional consultants in the industry providing like and similar types of Services. ARTICLE 2--SERVICES OF CONSULTANT 2.1 The Services that Consultant shall perform are more particularly described in Exhibit "A," entitled "Scope of Services," which is attached hereto and incorporated herein by reference. 2.2 Consultant shall comply with applicable federal, state and local laws and regulations in the performance of this Agreement including, but not limited to, State prevailing wage laws. ARTICLE 3—RESPONSIBILITIES OF CITY 3.1 City shall make available to Consultant information in its possession that may assist Consultant in performing the Services. 3.2 City designates Danielle Garcia, Chief Innovation Officer, as City's representative with respect to performance of the Services, and such person shall have the authority to transmit instructions, receive information, interpret and define City's policies and decisions with respect to performance of the Services. ARTICLE 4—PERFORMANCE OF SERVICES 4.1 Consultant shall perform and complete the Services in a prompt and diligent manner in accordance with the schedule set forth in Exhibit "B," entitled "Project Schedule," which is attached hereto and incorporated herein by reference, The Services shall commence within ten(10)days of the Effective Date of this Agreement. 1 1 IcagrnlAgtecments%Moss Adams Disaster Recovery Planning 5 17.16.doc 4.2 At any time during the Term of this Agreement, City may request that Consultant perform Extra Services. As used herein, "Extra Services" means any work which is determined necessary by City for the proper completion of the project or work for which the Services are being performed, but which the Parties did not reasonably anticipate would be necessary at the time of execution of this Agreement. Provided the Extra Work does not exceed twenty percent (20%) of the compensation to be paid by City to Consultant for the Services, such Extra Work may be agreed to by the Parties, by written amendment to this Agreement, executed by the City Manager. Consultant shall not perform, nor be compensated for, Extra Work without such written authorization from City. 4.3 If Consultant's Services include deliverable electronic visual presentation materials, such materials shall be delivered in a form, and made available to the City, consistent with City Council adopted policy for the same. It shall be the obligation of Consultant to obtain a copy of such policy from City staff. ARTICLE 5—PAYMENTS TO CONSULTANT 5.1 The total compensation for Consultant's performance of the Services shall not exceed the amount Seventy Three Thousand Two Hundred and Fifty Dollars ($73,250). City shall pay Consultant on a time and materials basis up to the not to exceed amount, in accordance with Exhibit "C" entitled "Project Costs and Hourly Rates." Exhibit "C" is attached hereto and incorporated herein by this reference. 5.2 Consultant shall submit monthly invoices to City describing the Services performed during the preceding month. Consultant's invoices shall include a brief description of the Services performed,the dates the Services were performed, the number of hours spent and by whom, and a description of reimbursable expenses, if any. City shall pay Consultant no later than thirty(30)days after receipt and approval by City of Consultant's invoice. 5.3 Any notice or other communication required, or which may be given, pursuant to this Agreement, shall be in writing. Any such notice shall be deemed delivered (i)on the date of delivery in person; (ii) Eve (5) days after deposit in first class registered mail, with return receipt requested; (iii) on the actual delivery date if deposited with an overnight courier; or (iv) on the date sent by facsimile, if confirmed with a copy sent contemporaneously by first class, certified, registered or express mail; in each case properly posted and fully prepaid to the appropriate address set forth below, or such other address as a Party may provide notice in accordance with this section: City Consultant Danielle Garcia,CIO Kevin Villanueva,Senior Manager City of Redlands Attn: Sandy Lewis,Moss-Adams LP 35 Cajon Street, Suite 222 999 Third Street, Suite 2800 Redlands,CA 92373 Seattle,WA 98104 2 1\ca\djm\AgrccmcrosWoss Adams Disaster Recovery Planning 5 17.16 doe ARTICLE 6—INSURANCE AND INDEMNIFICATION 6.1 Insurance required by this Agreement shall be maintained by Consultant for the duration of its performance of the Services. Consultant shall not perform any Services unless and until the required insurance listed below is obtained by Consultant. Consultant shall provide City with certificates of insurance and endorsements evidencing such insurance prior to commencement of the Services. Insurance policies shall include a provision prohibiting cancellation or modification of the policy except upon thirty (30) days prior written notice to City. 6.2 Workers' Compensation and Employer's Liability insurance in the amount that meets statutory requirements with an insurance carrier acceptable to City, or certification to City that Consultant is self-insured or exempt from the workers' compensation laws of the State of California. Consultant shall provide City with Exhibit "D," entitled "Workers' Compensation Insurance Certification," which is attached hereto and incorporated herein by this reference prior to commencement of the Services. 6.3 Consultant shall secure and maintain comprehensive general liability insurance with carriers acceptable to City. Minimum coverage of One Million Dollars ($1,000,000) per occurrence and Two Million Dollars ($2,000,000) aggregate for public liability, property damage and personal injury is required. City shall be named as an additional insured and such insurance shall be primary and non-contributing to any insurance or self-insurance maintained by City. 6.4 Consultant shall secure and maintain professional liability insurance throughout the term of this Agreement in the amount of One Million Dollars($1,000,000)per claim made. 6.5 Consultant shall have business auto liability coverage, with minimum limits of One Million Dollars ($1,000,000)per occurrence,combined single limit bodily injury liability and property damage liability.This coverage shall include all Consultant owned vehicles used in connection with Consultant's provision of the Services, hired and non-owned vehicles, and employee non-ownership vehicles. City shall be named as an additional insured and such insurance shall be primary and non-contributing to any insurance or self insurance maintained by City. 6.6 Consultant shall defend, indemnify and hold harmless City and its elected officials, employees and agents from and against any and all claims, losses or liability, including attorneys' fees, arising from injury or death to persons or damage to property occasioned by any negligent act or omission by, or the willful misconduct of, Consultant, or its officers,employees and agents in performing the Services. 3 1:1caldjmlAgreementsWoss Adams Disaster Recovery Planning 5.17.16.doc ARTICLE 7 —CONFLICTS OF INTEREST 7.1 Consultant covenants and represents that it does not have any investment or interest in any real property that may be the subject of this Agreement or any other source of income, interest in real property or investment that would be affected in any manner or degree by the performance of Consultant's Services. Consultant further covenants and represents that in the performance of its duties hereunder, no person having any such interest shall perform any Services under this Agreement. 7.2 Consultant agrees it is not a designated employee within the meaning of the Political Reform Act because Consultant: A. Does not make a governmental decision whether to: (i) approve a rate, rule or regulation, or adopt or enforce a City law; (ii) issue, deny, suspend or revoke any City permit, license, application, certification, approval,order or similar authorization or entitlement; (iii) authorize the City to enter into, modify or renew a contract; (iv) grant City approval to a contract that requires City approval and to which City is a party,or to the specifications for such a contract; (v) grant City approval to a plan, design, report, study or similar item; (vi) adopt or grant City approval of, policies, standards or guidelines for City or for any subdivision thereof. B. Does not serve in a staff capacity with City and in that capacity, participate in making a governmental decision or otherwise perform the same or substantially the same duties for City that would otherwise be performed by an individual holding a position specified in City's Conflict of Interest Code under Government Code section 87302. 7.3 In the event City officially determines that Consultant must disclose its financial interests, Consultant shall complete and file a Fair Political Practices Commission Form 700,Statement of Economic Interests, with the City Clerk's office pursuant to the written instructions provided by the City Clerk. ARTICLE 8—GENERAL CONSIDERATIONS 8.1 In the event any action is commenced to enforce or interpret any of the terms or conditions of this Agreement the prevailing Party shall, in addition to any costs and other relief, be entitled to the recovery of its reasonable attorneys' fees, including fees for the use of in-house counsel by a Party. 8.2 Consultant shall not assign any of the Services, except with the prior written approval of City and in strict compliance with the terms and conditions of this Agreement. 4 11cMdjm\ASmcments%Moss Adams Disasicr Recovery Planning 5-17.16 doc 8.3 Records, drawings, designs, cost estimates, electronic data files, databases and any other documents developed by Consultant in connection with its performance of the Services, and any copyright interest in such documents, shall become the property of City and shall be delivered to City upon completion of the Services, or upon the request of City. Any reuse of such documents, and any use of incomplete documents, shall be at City's sole risk. 8.4 Consultant is for all purposes under this Agreement an independent contractor and shall perform the Services as an independent contractor. Neither City nor its agents shall have control over the conduct of Consultant or Consultant's employees, except as herein set forth. Consultant shall supply all necessary tools and instrumentalities required to perform the Services. Assigned personnel employed by Consultant are for its account only, and in no event shall Consultant or personnel retained by it be deemed to have been employed by City or engaged by City for the account of, or on behalf of City. Consultant shall have no authority, express or implied, to act on behalf of City in any capacity whatsoever as an agent, nor shall Consultant have any authority, express or implied, to bind City to any obligation. 8.5 Unless earlier terminated as provided for below, this Agreement shall terminate on January 18, 2017. This Agreement may be terminated by City, in its sole discretion, by providing not less than five (5) days prior written notice to Consultant of City's intent to terminate. If this Agreement is terminated by City, an adjustment to Consultant's compensation shall be made, but (1) no amount shall be allowed for anticipated profit or unperformed Services, and (2) any payment due Consultant at the time of termination may be adjusted to the extent of any additional costs to City occasioned by any default by Consultant. Upon receipt of a termination notice, Consultant shall immediately discontinue its provision of the Services and, within five (5) days of the date of the termination notice, deliver or otherwise make available to City, copies (in both hard copy and electronic form, where applicable) of project related data, design calculations, drawings, specifications, reports, estimates, summaries and such other information and materials as may have been accumulated by Consultant in performing the Services. Consultant shall be compensated on a pro-rata basis for Services completed up to the date of termination. 8.6 Consultant shall maintain books, ledgers, invoices, accounts and other records and documents evidencing costs and expenses related to the Services for a period of three (3) years, or for any longer period required by law, from the date of final payment to Consultant pursuant to this Agreement. Such books shall be available at reasonable times for examination by City at the office of Consultant. 8.7 This Agreement, including the Exhibits incorporated herein by reference, represents the entire agreement and understanding between the Parties as to the matters contained herein, and any prior negotiations,written proposals or verbal agreements relating to such matters are superseded by this Agreement. Except as otherwise provided for herein, any amendment to this Agreement shall be in writing, approved by City and signed by City and Consultant. 5 IlcaWjm%AZ=mcntsWoss Adams Disaster Reeavrry Plowing 5.17A&doc 8.8 This Agreement shall be governed by and construed in accordance with the laws of the State of California. 8.9 If one or more of the sentences, clauses, paragraphs or sections contained in this Agreement is declared invalid, void or unenforceable by a court of competent jurisdiction, the same shall be deemed severable from the remainder of this Agreement and shall not affect, impair or invalidate the remaining sentences, clauses, paragraphs or sections contained herein, unless to do so would deprive a Party of a material benefit of its bargain under this Agreement. 6 1-%caWjmlAgrcementsWoss Adams Disastcr Rrcomy Planning 5.17.16.doc IN WITNESS WHEREOF, duly a,uthorized representatives of City and Consultant have signed in confirmation of this Agreement. CITY OF REDLANDS MOSS-ADAMS LLP Pau . Foster, Mayor Kevin Villanueva, Senior Manager Attest. Sara it n, ty^ Clerk 7 1 V-.a%djnAAgrecnwrfl5AMoss Adarns Dismier Recovery Planning 5.17.16hoL EXHIBIT ' A" SCOPE OF SERVICE F1r,1C)� GT The City seeks external consulting expertise and assistance in,developing a business continuity/disaster recovery plan (13C/DRP) that can help facilitate the timely recovery of the City's 11" systems and networks following an emergency or disastrous event.Specifically,the City is seeking a vendor to define and author a RC/DRP in two phases.Phase I will be when the business impact analysis(BBA) Is created, and Phase 2 will be when the BC/DRP will be created. The following describes Moss Adams approach and work plan for assisting the City with these two important components of the overall disaster recovery strategy. B, MOSS ADAMS APPROACI-1 Development of a BC/DRP is a multi-phase project with various separate components.The project will begin by quickly orienting our staff to the existing technology environment at the C'4. We will accomplish this through documentation reviews, Interviews with IT staff and business units, and waikthroughs of the technology environment and operations. Throughout data gathering activities we will determine stakeholder needs, perceived priority of services and system recovery,and gaps in the City's current disaster recovery infrastructure and capabilities. We will develop a business impact analysis (131A) matrix during Phase I in order to understand the desired recovery time objectives (RTOs), recovery point objectives (RP s)!, and maximum tolerable downtimes (MTDs)., This understanding will allow Moss Adamsto develop a draft disaster recovery plan in Phase 2, which will represent the "ideal," scalable process for critical system and data recovery. A draft BC/DRP will be developed and reviewed with the City's Project Director and major stakeholders who will have the opportunity to provide feedback and input on plan content and layout. Any input and modification requests will be considered and incorporated into the final BC/DRP. With this overall approach In mind, we will proceed with the project as described below, the City Project Director and key City stakeholders involved and informed of the project progress. CP1!3C')JECP`T­W0RK PLAN The project work plan below outlines four tasks essential for completing the two phases of the C/DRP development. In order to be more efficient in our work for the City of Redlands, Moss Adams will conduct essential groundwork and lay the foundation for both Phase I and Phase 2 during Tasks I and 2,. Task 3 will then focus on the steps necessary to complete Phase 1,while Task 4 will: be centered an Phase 2. as I w F'roject hill tion and Management 1.1 Schedule and hold kick-off meeting To ensure that we meet the objectives for the project, we will meet with the Project Director and stakeholder team during, a formal project kick-off meeting to confirm the scope of the project and project schedule. We will discuss the risks and implications associated with the disaster recovery 8 T\caWjnAAgmca,wntsWoss.Admis Disaster RmuvcryPlanniq 5 17116doc planning process, In addition, administrative matters related to communications protocols, status reporting, deliverable formats, work space, interviewee lists, and file sharing will be discussed and confirmed.The kick-off meeting is essential for ensuring expectations are aligned between all involved parties. 1.2 Conduct regular status reporting To provide visibility into the progress of the project, regular status reporting will occur between the City's Project Director and the Moss Adams Project Manager. The status reports will be either regular phone calls,e-mails,or another agreed upon format.We anticipate that status reports will occur weekly and include detailed communication about tasks completed since the last status update, next action steps,project issues and challenges faced,scheduling impacts,and deliverables progress. 1.3 Perform quality assurance (QA) reviews Quality assurance reviews occur for every major deliverable produced by the Moss Adams team.The purpose of the reviews is to ensure that all deliverables to clients meet the firm's high standards of quality and the deliverables are viewed from a business manager's perspective,Kevin Villanueva,Senior Manager,will serve as the project`s QA Reviewer. Task 2: Data Gathering 2.1 Request and review relevant documentation To quickly orient the Moss Adams team to the City's technology environment and disaster recovery infrastructure, we will develop and disseminate a documentation request list. The documentation request list will include requests for existing disaster recovery documentation, network diagrams, system descriptions, service level agreements, and lists of applications and hardware, among other items, to help the Moss Adams team understand the critical business systems and functions at the City. Once received, the Moss Adams team will review the documentation prior to on-site fieldwork so that we can "hit the ground running" during our walkthrough and interviews with minimal background information. 2.2 Perform an on-site walkthrough of the network, systems, and 1T operations We will perform the walkthrough of the network,systems,and IT operations with a specific focus on the disaster recovery preparedness infrastructure, Facility, and equipment. The walkthrough will help to identify the capabilities within the current technology environment to respond to disaster scenarios in a timely manner and any gaps that might adversely impact or delay the recovery efforts. 2.3 Evaluate the security and control of the City's off-site facilities With the City contemplating a move to a new data center as well as having physical servers dispersed to two additional sites across the wide area network,and since backup media is stored at these facilities, physical security and environmental controls need to be reviewed and assessed for their sufficiency and effectiveness. During this task, the Moss Adams team will review such controls around physical access, access logging, alarm monitoring„ HVAC controls, backup power, surveillance cameras, and fire suppression,among other areas.A weakness in any of these areas could result in an adverse impact on the high availability of the City's systems. If warranted, alternative backup strategies will be 9 11cMdjm\AgmcmcntsWnss Adams Disaster Recovery Planning S.17.16 doc communicated to the City if it is determined that the current backup strategy and media locations are insufficient. 2.4 Conduct on-site interviews with select personnel and technical staff The interview process constitutes the crux of our data gathering activities.It is during this task that the Moss Adams team will meet with select members of the disaster recovery team from the IT Department, management, and others jointly determined by the City and Moss Adams project teams.The interview process is crucial to gaining an understanding of the disaster recovery needs of the City and the disaster recovery planning process the City has adopted. 2.5 Interview department managers and staff about their operations and critical functions One-on-one or group interviews will be facilitated to drill down and obtain further detail on the City's critical business processes and operations.It Is expected that,at a minimum,department managers will be interviewed. During the interview process,we will gather information on critical systems used, the data that is acquired and processed,location and storage of data,dependent systems,business partners, external connections, manual processes available, and potential makeshift emergency operational procedures. The ultimate goal of the interviews with the department managers and staff is to identify three essential disaster recovery system prioritization components: recovery time objectives (RTOs), recovery point objectives (RPOs), and maximum tolerable downtime (MTD). These prioritization components will constitute a large part of the business impact analysis. 2.8 Identify operational dependencies for each essential service In some service areas, the City's departments may rely on processes performed or data obtained from other business units and systems creating a dependency situation.The City may also rely on external business partners.As a result,services may not be able to be completed or accomplished without the assistance of another department, division, or business partner. We find this to often be the case with geographic information systems(GIS) functions that the City is dependent on for County-level mapping. In addition, there could he other data dependencies at the State or Federal level upon which City systems rely. During this task, the project team will identify these dependencies and determine the feasibility of maintaining service levels in spite of the dependencies. 2.7 Identify vital records used at the City Through our interviews and documentation reviews,Moss Adams will identify the vital records used at the City. On the surface, the City's vital records could be numerous. There is customer payment information, employee personally identifiable information (PII), salary data, financial information, and other critical information assets that are administered and maintained by the City. This task involves identifying the vital record types, where they are processed, how they are stored, and if any backup media is used to preserve them in the event of an emergency or disaster. 2.8 Identify hot-site options It may be determined that the existing disaster recovery infrastructure and capabilities may not be sufficient to meet the RTOs, RPOs, and MTDs required by the business units. Some systems may be deemed to require real-time replication and no downtime. As such, hot-site options may need to be considered. This task will take into account the system uptime needs of the City's critical enterprise systems and determine which require constant uptime. We will then identify hot-site options that are 10 1:1caldjm\Ag=mentsWoss Adams Disaster Recovery Planning 5.17.16.doe well suited based on the system hardware needs,replication needs,and software compatibility.The hot- site option stemming from this task will be included in the approach taken in the BC/DRP. Task Conduct a BUSniess kn�:)ad Anatyso-s (Ptmse 1) 3.1 Identify potential threats and hazards to the availability of City services Threats and hazards to the City's business are varied and many, They can come in the form of natural disasters, technological disasters, and man-made disasters, This task will identify potential threats and hazards and the probability of their occurrence. This exercise will help to, determine if there is an ongoing and persistent threat to, the City's facilities and if alternate disaster, recovery operations facilities warrant serious consideration, 3.2 Determine recovery time objectives (RTOs)and recovery point objective$ (RPOS)for critical business systems Operational procedures that are heavily reliant upon the City's technology systems and applications will be analyzed for what is feasible from an RTO perspective and the MTD time that is driving the RTO. During this task, Moss Adams will also determine RPOs or the point in time from which the City will need to recover its system data sets. 3.3 Determine maximum tolerable downtimes (MTDs) for critical business systems Maximum, tolerable downtime(MTD) is the maximum length of time a business function/service can be, '"down" and unavailable without causing irreparable harm to the business. For municipalities like the City of Redlands, this could refer to adverse system issues that may impact the City's ability to accept payments for utility billing or the ability for citizens to register for classes through the Parks & Recreation Department.This task will identify how long the City can operate without the availability of critical systems before experiencing irreparable harm to the City's reputation among its citizens and to its ability to operate as a fully functioning City. 3.4 Identify workarounds for obstacles and/or dependencies to achieving RTOs Some RTOs may be difficult to,achieve depending on the circumstances and dependencies.The City may be dependent on how quickly new equipment can be procured,which may result in additional downtime for critical systems.Therefore,alternate processes or workarounds need to be identified and considered, in lieu of an automated system. 3,6 Analyze options for preserving vital records, Vital personnel records may be at risk of irreparable damage depending an their current storage medium. We will analyze options fair ensuring the continued safe-keeping and storage of vital records during this task. 3.6 Prepare Business Impact Analysis (BIA) summary Once the analysis has been performed, the business Impact analysis summary can be developed that takes operational impacts from a quantitative standpoint into consideration,The RI will also take into account R'TOls, RPOs, and MTDs for the critical systems and processes to determine recovery priority., This information will be used in the development of the disaster recovery plan. The BIA summary document is typically presented in a matrix format. li I\ca\djnAAgr=nenL%\Mo%s Adams Disastcr Rccovery Ptanning 5 17 16 doic "I'ask 4.� Develop [�-ie Disaster 11acovery Rian (Phasie 2) 4.1 Review existing backup process, During this task, the Moss Adams team will review the City's existing backup strategy and approach to ensure that data can be recovered in a timely manner.We will ascertain how the backup process meets the requirements, including the data RPOs of City business units. We will also review existing backup systems and tools currently used to support recovery efforts, 4.2 Identify missing software, hardware, peripherals, and documentation As the Moss Adams team processes the data collected during Task 3, there may be deficiencies in the software, hardware, peripherals, and standard operating procedures/documentation needed to implement the BC/DiRP. This task will identify the deficiencies in each of these areas and will group them from most crucial to less important needs, The most crucial needs will be those that are Instrumental to meeting the RTOs, RP s, and M'TDs that were established through the RIA.A situation where these needs continue to not be met may result in a plan that is insufficient for the City, 4.3 Review the, Business Impact Analysis ('BIA,) to determine the order of service priority With the BIA completed and the feedback received from the City leadership team,the project team will determine the order of priority for services to be reestablished,systems to be recovered,and data to be restored. This review process will help to determine which services are top priorities based on the prioritization components obtained from the BBA process, 4.4 Identify key staff roles and authority Key staff will need to be assigned roles and responsibilities during an emergency or disaster recovery effort. This task will seek to identify employees who would fit roles such as Continuity Coordinator, Equipment Salvage Team, Recovery Team,and Procurement Lead.Authority would need to be assigned to an Individual or individuals so that there is a central point of contact for major decision-making. 4.5 Establish orders of succession Backup personnel may be needed should the principal individual be unavailable or unreachable during the emergency or disaster recovery effort.Therefore,It is important that secondary staff are available to assume the principal's role if need be. For key positions, the project team will help to, establish the hierarchy of principal and backup personnel for critical roles, 4.6 Identity communications alternatives Depending on the reach of the emergency or disaster, critical communications infrastructure may be offline.This task will attempt to identify alternative communications channels that may be available to the City as It works through the service recovery effort. Telephony and data communications options will be analyzed for immediacy of service and ease of in Options could include personal cell phones, Internet telephones, cloud-based communications (e.g., Skype for Business), rerouting of existing phone lines, and walkie-talkies, among others. We will examine the most reasonable options for,the City to consider. 12 1\caVJjn:AAgrcconcntsWoss Adains Disaster Recovery Planning 5.17.r6 due 4.7 Identify alternate operations and processing facilities During an emergency or disastrous event,the City offices may not be available for an extended period of time until the emergency has abated or until the recovery effort has been completed. Consequently, consideration for alternate work locations will need to be considered. Alternate work locations may include a co-location facility for the City's systems,hosting providers,hotel conference rooms,and event centers, among others. This task entails reviewing options for makeshift operations centers and data centers. 4.8 Identify remote access capabilities for employees Provided the City has sufficient network connectivity for remote access purposes, some means of remote access should be considered for employees who have the ability to work from home to conduct City business. This task will identify possible alternatives for remote access including providing recommendations for a network infrastructure that could support remote access in an emergency or disaster recovery scenario. This task will also consider cloud-based communications services such as Skype,Viber,and Tango. 4.9 Identify business partners for notification The City's business partners will need to be notified if there is an emergency that results in an extended service outage. The task will entail collecting this information from the BIA to identify the critical business partners who need to be contacted about the reduced service capacity. 4.10 Review/Document recovery steps for critical systems and connectivity Critical systems at the City should have recovery steps available for rebuilding the system and restoring the database or files to the server.If available,the project team will collect the recovery documentation for critical systems and incorporate them into the disaster recovery plan.if no recovery steps have been developed, Moss Adams will assist the City in documenting key recovery steps for the critical systems identified. In addition, connectivity to the Internet may need to be restored as well as connectivity to other departments and sites. This task entails reviewing/developing documentation related to recovering these important IT components. 4.11 Develop draft disaster recovery plan Once our analysis has been completed,a draft disaster recovery plan for the City will be developed and submitted to the City for input and feedback. The draft plan will include incorporating the data and insight gained from our analysis activities.At a minimum, the following standard planning components will be included; e Purpose,scope,and objectives Authority Situation and assumptions Functional roles and responsibilities for internal departments and positions Recoverysteps • Concept of operations • Process flow diagram that depicts the overall BC/DRP 13 1AcaWjm\Ajp=mentslMoss Adams Disaster Recovery Planning 5.17,16.doc a Plan maintenance, which includes procedures for annual testing and After Action Report (AAR) analysis a Plan appendices(call trees,equipment lists,vendor contact information,etc.) The disaster recovery plan will be developed in such a way that several different disaster scenarios will be considered and the plan will be scaled for each. 4.12 Incorporate input from the City Input from the City's project team will be received and considered for inclusion and incorporation into the plan prior to plan finalization. 4.13 Finalize the disaster recovery plan and submit to the City Once the plan has been modified to include input and feedback from the City's project team,the plan will be finalized and sent to City management as the final deliverable. 14 i tcaWjm\Agmcments\Moss Adams Disaster Recovery Planning S.17.16 doe EXHIBIT 101111 PROJECT SCHEDULE We anticipate the project will take up to four months to complete.This is an aggressive schedule that is mostly independent from the business continuity planning project. The project will start in April and will go through July.A project timeline is presented below. Maski —P r IMEMMEW I oJect Initiation and Management 1.1 Schedule and'hold kick-off meeting ............... 1.2 Conduct regular status reporting, — — --- — — — — — — — .................. 1.3 Perform quality assurance(QA)reviews - - - - - - Task 2—Date Gathering 2,11 Request and review relevant documentation 2.2 Perform anon-site walkth rough of the network, systems, and IT operations -—---------- 2.3 Evaluate the security and control of the City's off-site facilities 2.4 Conduct on-site interviews with select personnel and technical staff 2.5 Interview department managers and staff about their operations and critical functions ...................................................... 2.6 Identify operational dependencies for each essential service ............ 2.7 Identify vital records used at the City ................ 2.8 Identify hot-site options Task 3—Conduct a Business Impact Analysis(Phase 1) 3.1 Identify potentlai threats and hazards to the availability of City services 3,2 Determine recovery time objectives (RTOs)and recovery point objectives (RPOs)for critical business systems .......... 15 6 kaWjm%Agmcments\Moss Adarm Disaster Recomy Planning 5 17,16,4oc ro mew OW M� 3.3 Determine maximum tolerable downtimes( Ds)for critical business systems .._n_._ __.....__.M......_.. .,. ._ ..m. ... _..__w..._ ,,, m .4 Identify workarounds for obstacles and/dr dependencies to achieving RTOs ,_ ._...._w_._._.... .__ .w___..... ....� .... _ .6 Analyze options for preserving vital records w--- � 3.6 Prepare Business Impact Analysis(Bi ) summary Task 4—Develop the Disaster Recovery Plan(Phase 2) 4.1 Rsview existing backup process 4.2 identify missing software, hardware, peripherals® and documentation 4.3 Review,the Business Impact Analysis(RIA,)to determine! the order of service priority 4.4 Identify key staff roles and authority 4.5 Establish orders of succession 4.6 Identify communications alternatives 4.7 Identify alternate operations and processing facilities 4.6 Identify remote access capabilities for employees 4.9 IdlentKy business partners for notification 4.10 Review/Document recovery steps for critical systems and connectivity _. .. _... .. .,,..,.,., ... 4.11 Develop draft disaster recovery plan 4.12 Incorporate input from the City 4.13 Finall a the disaster recovery plan and submit to the City 16 T\caVJjn0LA e1=ftts' aaS,%Ad mmes Oiswwr Recovery Planning 5.17.16 doc EXHIBIT as of PROJECT COSTS A HOURLY RATES breakdown of the fees associated with this engagement has been provided below. Phase 1:Business impact Analysis 125 ° $29,300 Phase 2�Disaster Recovery pian 158 $43,950 To,tal Fees and xpenses $73,2150" "The total fee for this proposal includes all out-of-pocket expenses, such as word processing, photocopying,telephone,postage,travel,airfare,mileage,accommodations,rental cars,meals,etc. [to ur'ly Rates breakdown of hourly rates by position for staff assigned to this engagement is included below. I rentor�dianager $255 anagen $220 w __.... . ._....... _._ _.__... �......w....._ ...._..w.. Supervisor $200 Senior Consultant $175 l OcaWjart Agmert ems oss Adams Master Recd ^ry Planning 5.P 16.doc EXHIBIT 111)" WORKERS" COMPENSATION INSURANCE CERTIFICATION City of Redlands Services for Information Technoloy Disaster Recovery Planning Every employer, except the State, shall secure the payment of compensation in one or more of the following ways® (a) By in insured against liability to pay compensation by, one or more insurers duly authorized to write compensation insurance in this State. (b) By securing from the Director of Industrial Relations, a certificate of consent to self-insure, either as an individual employer, or as one employer in a group of employers, which may be given upon furnishing proof satin facrory to the Director of Industrial Relations of ability to self-insure and to pay any compensation that may become due to his or her employees. CHECK 9NE —1 am aware of the: provisions of Section 3700 of the Labor Code which requires every employer to be insured against liability for Workers' Compensation or to undertake self- insurance in accordance with the provisions of that Code, and I will comply with such provisions before commencing the performance of the work and activities required or permitted under this Agreement. (Labor Code §1851),. affirm that at all times, in performing the work and, activities required or permitted under this Agreement, I shall not employ any person in any manner such that I become subject to the workers' compensation, laws of California. However, at any time, if I employ any person such that I become subject to the workers' compensation laws of California, immediately I shall provide the City with a certificate of consent to self-insure, or a certification of workers' compensation insurance. I certify under penalty, of perjury under the laws of the State of California that the information and representations made in this certificate are true and correa Moss-Adams LLP Date: By:—_ Kevin Villanueva, Senior Manager 18 1%4a'V1jnA.Agrcc1nCM5WG3S Adams Mailer Recovery PlarwingS,17,16,doc ATTACHMENT "'B"' High Level Network Diagram with Background Information High-Level Network Diagram and Backaround Information The City of Redlands Department of Innovation and Technology utilizes a wide variety of hardware and software,including an IBM server and an environment of Windows servers,both virtualized and physical;SQL and Oracle database servers,-400 desktop computers.various mobile and smartphone devices and enterprise systems for permitting and land management,financial accounting and utility billing. rfOC7�6pt lacus RryUWle�a� Vt"W/ �{. WAN h r`�1GbW P1kfld$e(ytf3 Too Savers pryHaM/JciiittSenrerRaem Sher "MOft cam [kjrd rt[�rls Most servers are housed at City Hall In a server room,.The server room has an independent AC unit for environmental control. Additionally a UPS is In place which currently provides-40 minutes of uptime for the servers,SAN,and cora network components. Due to the age of the facilities and building,the server room experiences periodic power outages as well as overheating Issues when the AC unit goes out. There are occasions where power andfor HVAC cannot be restared within the UPS uptime and therefore critical systems go oHlina. The City would Eke to start utilizing the new data center for backups,de-duplication,and disaster recovery for all vital systems. The new data center has state of the art UPS equipment,an independent HVAC system,as well as a backup generator which can power the data center for as long as needed. It is also desired to have a backup Internet connection at the data center in the event that City Hall loses the current Internet connection in a disaster scenario. Certain hardware and software systems are considered critical to the City's operations,if a disaster disables the facilities In which care systems are housed,the operation of the mission-crilicat systems would have to be recovered within a relatively short period of time to ensure restoration of essential services.