CITY AND COUNTY OF DENVER DENVER CITY AUDITOR S OFFICE REQUEST FOR PROPOSAL FOR PROFESSIONAL AUDITING SERVICES. February 12, 2016

Transcription

1 DENVER CITY AUDITOR S OFFICE CITY AND COUNTY OF DENVER DENVER CITY AUDITOR S OFFICE FOR PROFESSIONAL AUDITING SERVICES February 12, February 12, 2016

2 DENVER CITY AUDITOR S OFFICE SUMMARY As authorized under D.R.M.C , the Denver City Auditor s Office ( Auditor ) is promulgating this Request for Proposal ( RFP ) in order to secure professional audit services from a qualified firm(s) ( Vendor ) interested in conducting an audit of the City of Denver s ( City ) information network security including network penetration testing. This RFP details the scope of the engagement and the nature of the services required; the reports or other items to be delivered under the engagement; and the format to be used for all Proposals in response to this RFP. The Auditor reserves the right to amend this RFP by an addendum at any time prior to the date set for receipt of Proposals. The Auditor will post any addenda or amendments on the City s website as soon as available. Prospective vendors bear the responsibility of obtaining all relevant addenda or amendments. The Auditor shall follow the following schedule in selecting a Vendor: February 12, 2016 February 26, 2016 April 1, 2016 April 8, 2016 April 13-15, 2016 April 22, 2016 May 13, 2016 Distribute RFP Pre-proposal conference, 11:00 a.m., Webb Municipal Building 201 West Colfax Avenue, Room 7.F.9 Proposals must be in possession of the Auditor Finalist Vendors notified by the Auditor Auditor interviews finalist Vendors Notification of selected Vendor Vendor will begin providing services by no later than All requests for clarification or for additional information must be submitted to: Auditor Timothy M. O Brien, C.P.A. City and County of Denver 201 West Colfax Avenue, Department 705 Denver, CO Telephone: (720) Auditor@denvergov.org The Auditor will address any requests for clarification and/or additional information leading up to and during the pre-proposal conference verbally at the pre-proposal conference. Attendance at the pre-proposal conference is not mandatory; however, the Auditor will not provide 2 February 12, 2016

3 DENVER CITY AUDITOR S OFFICE additional information or clarification after the pre-proposal conference. Consequently, prospective respondents interested in submitting a Proposal are strongly encouraged to attend the pre-proposal conference. The purpose of the pre-proposal conference is to assist prospective respondents in the interpretation of this Request for Proposals, and other technical and contractual matters. All Proposals must be delivered no later than 5:00 p.m. prevailing Mountain Standard Time on April 1, 2016 to: Auditor Timothy M. O Brien, C.P.A. City and County of Denver 201 West Colfax Avenue, Department 705 Denver, CO February 12, 2016

4 DENVER CITY AUDITOR S OFFICE I. INTRODUCTION A. General Information B. Term of Engagement C. Subcontracting TABLE OF CONTENTS II. NATURE OF SERVICES REQUIRED A. General B. Scope of Work to be Performed C. Auditing Standards to be Followed D. Reports to be Issued E. Irregularities and Illegal Acts F. Reporting to the Audit Committee G. Special Considerations H. Working Paper Retention and Access to Working Papers III. DESCRIPTION OF THE GOVERNMENT A. Background Information B. Internal Audit IV. TIMELINE V. VENDOR ACCESS TO CITY ASSISTANCE A. City Staff Availability B. City Documents VI. PROPOSAL REQUIREMENTS A. Pre-proposal Conference B. Format of Proposals C. Sealed Dollar Cost Bid VII. EVALUATION PROCEDURES A. Evaluation Criteria B. Price C. Oral Presentations D. Right to Reject Proposals Appendix A Standard Contract Language 4 February 12, 2016

5 DENVER CITY AUDITOR S OFFICE I. INTRODUCTION A. General Information - The Auditor is requesting Proposals from qualified firms experienced in evaluating and auditing electronic information network security, to evaluate; test, including penetration testing; and produce reports regards the City s information network security. A pre-proposal conference for all the firms interested in submitting a Proposal will be held at 11:00 A.M. on February 26, 2016 at the Webb Municipal Building, 201 West Colfax Avenue, Room 7.F.9, to answer any prospective respondent s questions related to the engagement. The Auditor will not address inquiries concerning this RFP after the preproposal conference. The purpose of the pre-proposal conference is to provide assistance to prospective respondents in the interpretation of this Request for Proposals, and other technical and contractual matters. Attendance at the pre-proposal conference is not mandatory, but is highly recommended. To be considered, a complete copy of the respondent s Proposal must be delivered to the Auditor s Office at 201 West Colfax Avenue, Department 705, Denver, CO 80202, no later than 5:00p.m. prevailing Mountain Standard Time on or before April 1, The Auditor is not responsible for conditions that result in failed delivery of any Proposal. The Auditor reserves the right to reject any Proposal during the evaluation process for any reason and without cause. The Auditor reserves the right to request additional information, clarifications, or oral presentations from prospective Vendors. The Auditor reserves the right to permit or deny prospective Vendors to correct errors or omissions in a Proposal. The Auditor reserves the right to not exercise any condition in this RFP and not select a Vendor if the necessary conditions are not met or if any condition prevents the selection of a Vendor. This RFP is not a contract, a contractual offer, or in any way create any form of contractual duty for any party, including the Auditor. The Auditor reserves the right to amend this Request for Proposal by an addendum at any time prior to the date set for receipt of proposals. Addenda or amendments will be posted to the City s website as soon as available and it shall be the responsibility of any prospective Vendor to obtain all addenda. Submission of a Proposal indicates acceptance by the Prospective Vendor of the conditions contained in this RFP, including the Auditor s reservation of right to retain all Proposals submitted and to use any ideas in a Proposal regardless of whether that Proposal is selected. Only the Vendor selected to perform the scope of work related to this RFP will contract for and obtain payment related to this RFP. The Auditor anticipates selecting the Vendor on or before April 22, The Vendor is required to contract and initiate the proposed scope of work by May 13, February 12, 2016

6 DENVER CITY AUDITOR S OFFICE B. Term of Engagement - Pursuant to the terms of this RFP, the Vendor is required to initiate the proposed scope of work by May 13, 2016 and complete the proposed scope of work within approximately eight (8) weeks. C. Subcontracting & Minority and Woman-Owned Business Programs - The City places a priority on the participation of small and/or socially and economically disadvantaged owned businesses. The City encourages the use of qualified small businesses doing business within the City that are owned and controlled by, economically or socially disadvantaged individuals, including but not limited to, African Americans, Hispanics, Native Americans (American Indians), Asians, and/or women. The Vendor is encouraged, with respect to the goods or services to be provided under the contract, resulting from this RFP to use a process that includes small businesses, including minority and woman owned businesses, when considering and selecting any subcontractors or suppliers where necessary. II. NATURE OF SERVICES REQUIRED A. General - The Auditor is soliciting professional audit services from a qualified firm(s) interested in conducting an audit of the City s information network security, including network penetration testing. These services are to be performed in accordance with the provisions contained in this RFP; the prevailing audit practices; information technology standards; any applicable local, state, or federal laws; any modifications to any of these criteria; and any additional criteria imposed by the Auditor during the performance of the services. B. Scope of Work to be Performed - The Auditor desires the Vendor to evaluate the City s information network and information technology security. The Vendor is required to evaluate the following ( Evaluation Goals ): The City networks vulnerability to a cyber-attack or hacking, including the effectiveness of firewalls and cyber-security software; The City s vulnerability to information theft; The City s wireless network vulnerability; The City s websites security; The City s IT systems ability to detect a cyber-attack or hacking; The sufficiency of the City s IT systems to protect the City s protected information; Potential for unauthorized access to the City s information systems and storage; and The City s response to a data breach incident. The Vendor is required to identify the tasks or testing necessary to achieve this RFP s Evaluation Goals. The Vendor is required to collaborate with the Auditor and the City s Technology Services Agency and the IT organizations of other in scope agencies to ensure Vendor testing does not impair the City s network security. The Vendor is required 6 February 12, 2016

7 DENVER CITY AUDITOR S OFFICE to provide regular reports to the Auditor on the tasks or testing being performed and the results of those tasks or testing while the Vendor is performing the services. The Vendor is required to immediately report to the Auditor and the designated security officers of the in scope agencies of any material weaknesses in the City s information network security that poses an immediate or substantial threat to the City s information network security. Under no circumstances is the vendor to exfiltrate data en mass. The Vendor is required to reduce the results of its evaluation to a Confidential Written Report to the Auditor and a Public Audit Report compliant with the reporting standards prescribed in this RFP and any other standards or guidance provided by the Auditor while services are being provided. C. Auditing Standards to be Followed - To meet the requirements of this RFP, the Vendor shall perform the scope of work in accordance with the prevailing auditing standards generally accepted in the United States of America, the prevailing standards set forth in the U.S. General Accountability Office's Government Auditing Standards, and the then prevailing Single Audit requirements of U.S. Office of Management and Budget Circular A-133, Audits of States, Local Governments, and Non-Profit Organizations. D. Reports to be Issued The Vendor shall produce two written reports, (1) Confidential Report to the Auditor, and (2) Public Audit Report; and any oral presentations requested by the Auditor. The Confidential Report to the Auditor will include a comprehensive unedited summary of the Vendor s analysis of the Evaluation Goals and the basis for the Vendor s analysis. The Public Audit Report will provide a summary of the Vendor s analysis of the Evaluation Goals; however, the Public Audit Report will not include any information that could impair the City s information network security. The Vendor has the discretion to draft the Confidential Report to the Auditor in the any format that best conveys the required information. The Confidential Report shall contain sufficient detail to allow for validation of any discovered vulnerabilities. The Vendor is required to draft the Public Audit Report in compliance with the Denver City Auditor standards formatted to match the Denver City Auditor s report template. E. Irregularities and Illegal Acts Upon notice of any irregular or illegal acts, the Vendor is required to make an immediate, written report to the Auditor of all irregularities and illegal acts or indications of illegal acts related to this RFP s Scope of Work. F. Reporting to the Audit Committee - The Vendor is required to make a public oral presentation to the Denver City Audit Committee within 60 days of completion of this RFP s Scope of Work. The Auditor shall schedule and set the date of the Vendor s presentation to the Denver City Audit Committee. G. Special Considerations The Vendor is acting as a contracted employee/agent of the Auditor s Office to the limited extent the Vendor and its work papers are subject to all the same protections and limits as those afforded the Denver City Auditor s Office. For all other purposes, the Vendor is not an agent or employee for the City or the Auditor. The Vendor is precluded from making any public statement or statement to any government agency regarding any issue related, expressly stated, or contemplated in connection with 7 February 12, 2016

8 DENVER CITY AUDITOR S OFFICE this RFP or performance of any work related to this RFP at any time without the Auditor s written consent. H. Working Paper Retention and Access to Working Papers - The Vendor must retain at its own expense, all work papers and reports for a minimum of three years, unless the Auditor or City notifies the Vendor in writing the Auditor or City requires the Vendor to retain its work papers and report for a period greater than three years. The Vendor wholly bears the storage and retention costs of any documents collected or created in conjunction with work performed in response to this RFP. After completion of this RFP s scope of Work, including the Vendor s presentation to the Denver City Audit Committee, the Vendor at no additional cost shall produce original or electronic copies of all documents collected or created in conjunction with work performed in response to this RFP to the Auditor, or any successive Auditor. The Vendor is required to agree the City through the Auditor s Office owns the rights to any work papers, processes, recommendations, or intellectual property created or resulting from work performed in connection with this RFP. III. DESCRIPTION OF THE GOVERNMENT A. Background Information - The City extends an area of 155 square miles with a population of approximately 660,000. The City s information network is accessible to approximately 7,200 city employees and contractors. The City s information network includes approximately 6,300 laptop and desktop computers and 830 servers. Every City agency and enterprise, including Denver International Airport, Human Resources, Human Services, and Denver Police and Fire use the City s information network. The City s information network utilizes numerous software systems and networking packages. The City s information network includes wireless connectivity. The City s information network is remotely accessible. The City s information network safeguards a voluminous amount of legally protected, private, and confidential information, including personal identification information for both City and non-city employees; financial and banking information; medical information; information legally sealed from public inspection; and information related to at-risk and endangered populations. The City s Information Technology Services Agency works City agencies to manage and protect the City s information network. B. Internal Audit - The Audit Services Division in the Denver Auditor s Office performs audits of the City agencies, including information technology audits. IV. TIMELINE The following is the estimated schedule for completion: 1. Vendor initiates work on May 13, February 12, 2016

9 DENVER CITY AUDITOR S OFFICE 2. A draft report of the Confidential Report to the Auditor due July 12, A draft of the Public Audit Report is due July 19, A final Confidential Report to the Auditor and Public Audit Report is due July 22, Vendor presents its findings to the Denver City Audit Committee on August 18, 2016 V. VENDOR S ACCESS TO CITY ASSISTANCE A. City Staff Availability City staff shall be made available to assist the Vendor when necessary. The Vendor shall coordinate requests for City staff assistance through the Auditor s Office. B. City Documents - The City shall provide the Vendor with City documents and policies when necessary. The Vendor shall coordinate requests for City documentation through the Auditor s Office. VI. PROPOSAL REQUIREMENTS A. Pre-proposal Conference - The purpose of the pre-proposal conference is to provide assistance to prospective respondents in the interpretation of the Request for Proposals, and other technical and contractual matters. Attendance at the pre-proposal conference is not mandatory, but is recommended. Any requests for clarification or additional information leading up to and during the pre-proposal conference will be addressed verbally at the preproposal conference. The pre-proposal conference will be held on February 26, at 11:00 a.m., at the Webb Municipal Building, 201 West Colfax Avenue, Room 7.F.9. Both verbal and written questions will be accepted during the conference. B. Format of Proposals - Minimum contents: Proposals must include the following elements, provided in the following sequence: 1. Title Page - Title page showing the RFP subject, the prospective Vendor s name, addresses and telephone numbers of a contact person and an alternate, and the date of the Proposal; 2. Transmittal Letter - A signed letter of transmittal that briefly states the prospective Vendor s understanding of the work to be done; the commitment to perform the work within the timeline; a statement of the prospective Vendor s experience and qualifications (a corporate resume or description may be attached and cited by reference); and a statement that the Proposal is a firm and irrevocable offer for 180 days; 9 February 12, 2016

10 DENVER CITY AUDITOR S OFFICE 3. Detailed Proposal - A purpose of the Proposal is to demonstrate the qualifications, competence, and capacity of the prospective Vendors seeking to perform the scope of work described in this RFP. The Proposal should identify and explain the tasks or testing required to achieve this RFP s Evaluation Goals and demonstrate the qualifications of the prospective Vendor s organization and staff to achieve the Evaluation Goals. The Proposal should address all the points outlined in this RFP. The Proposal should be prepared simply and economically, providing a straightforward, concise manner. Prospective Vendors may elect to organize the Detailed Proposal in the following sections: Proposal Overview Corporate or Firm Overview Methodology and Tools Statement of Work Assumptions and Audit/ Evaluation Limits Communication Schedule and Project Milestones In addition to all other pertinent information the prospective Vendor elects to include, the Detailed Proposal must address the following items (a) through (f): a. Independence - The prospective Vendor should provide an affirmative statement that it is independent of the City as defined by the Government Auditing Standards. The prospective Vendor should also provide an affirmative statement that it is independent of all of the component units of the City as defined by those same standards. b. License to Practice in Colorado - An affirmative statement should be included that the prospective Vendor and the staff that will be assigned to perform the work prescribed in this RFP are properly licensed to practice in Colorado. c. Vendor Qualifications and Experience - The proposer should state the size of the Vendor organization, the location of the office from which the work will be performed, and the number and nature of the professional staff to be employed on a full-time or part-time basis to complete this RFP s prescribed Scope of Work. If the prospective Vendor is a joint venture or consortium, the qualifications of each organization comprising the joint venture or consortium should be separately identified and the principal organization should be identified. The prospective Vendor should identify any work performed for any federal or state agency or organization in the past three years. In addition, the prospective Vendor shall provide information on the circumstances 10 February 12, 2016

11 DENVER CITY AUDITOR S OFFICE and status of any disciplinary action, including unresolved or known pending disciplinary action taken against the prospective Vender in past three years by any regulatory bodies or professional organizations. d. Partner, Supervisory and Staff Qualifications and Experience - Identify the principal supervisory and management staff, including engagement partners, managers, other supervisors and specialists who would be assigned to the perform or supervise work under this RFP. If practical and relevant, provide information on the government auditing experience of each person, including information on relevant continuing professional education for the past three years and membership in professional organizations relevant to the performance of this audit. Provide as much information as possible regarding the number, qualifications, experience and training, including relevant continuing professional education, of the specific staff to be assigned to perform work under this RFP. Indicate how the quality of staff over the term of the agreement will be assured. Provide a partner rotation schedule. e. Specific Audit Approach - The Proposal should set forth a detailed and chronological work plan, including an explanation of methodology to achieve this RFP s Evaluation Goals. Beyond the day-to-day resources expected to be assigned to the Auditor, what other resources will be available to the Auditor and what value will the Auditor receive from such resources? Describe what resources are available from a national office, if any? f. Contract Provisions - Appendix A to this RFP contains the standard City contract provisions with respect to insurance, confidentiality, and indemnification. The Auditor expects those provisions to become part of the contract with the selected Vendor. The response to this RFP must include an acknowledgement of your familiarity with an agreement to these provisions and all conditions prescribed in this RFP. C. Sealed Dollar-Cost Bid 1. Total All-Inclusive Maximum Price All Proposals must include a sealed total dollar cost bid, including all pricing information related to performing the services described in this RFP; all direct and indirect costs, including all out-of-pocket expenses; and the total hours and hourly rate distinguished by staff classification. The Auditor is not be responsible for any expenses incurred in preparing and submitting any Proposal. Such costs should not be included in the Proposal. 11 February 12, 2016

12 DENVER CITY AUDITOR S OFFICE VII. EVALUATION PROCEDURES A. Evaluation - Proposals will be evaluated using the conditions and criteria discussed in this RFP. The Auditor will have the sole discretion to select the Vendor based on the Vendor s ability to effectively and timely achieve this RFP s Evaluation Goals. B. Price - Cost will be considered, although it is not the sole determining factor in the selection of the Vendor. Evaluating the quality and quantity of services relative to cost, in effect determining the most responsive Proposal offering the greatest value is expected to be a driving consideration. C. Oral Presentations - During the evaluation process, the Auditor may request an oral presentation any one or all firms. Not all prospective Vendors will be asked to make such oral presentations. D. Right to Reject Proposals - Submission of a Proposal indicates acceptance by the prospective Vendor of the conditions contained in this RFP unless clearly and specifically noted in the Proposal submitted and confirmed in the contract between the Auditor and the firm selected. The Auditor reserves the right without prejudice to reject any or all Proposals. 12 February 12, 2016

13 Appendix A Standard Contract Language THIS AGREEMENT is made between the CITY AND COUNTY OF DENVER, a municipal corporation of the State of Colorado (the City ) and, a (the Contractor ), jointly the parties. The parties agree as follows: 1. COORDINATION AND LIAISON: The Contractor shall fully coordinate all services under the Agreement with the Auditor, ( Auditor ) or, the Auditor s Designee. 2. SERVICES TO BE PERFORMED: a. As the Auditor directs, the shall diligently undertake, perform, and complete all of the services and produce all the deliverables set forth on Exhibit A, the Scope of Work, to the City s satisfaction. b. The Contractor is ready, willing, and able to provide the services required by this Agreement. c. The Contractor shall faithfully perform the services in accordance with the standards of care, skill, training, diligence, and judgment provided by highly competent individuals performing services of a similar nature to those described in the Agreement and in accordance with the terms of the Agreement. 3. TERM: 4. COMPENSATION AND PAYMENT: a. b. Reimbursable Expenses: c. Invoicing: Contractor shall provide the City with a monthly invoice in a format and with a level of detail acceptable to the City including all supporting documentation required by the City. The City s Prompt Payment Ordinance, to , D.R.M.C., applies to invoicing and payment under this Agreement. d. Maximum Contract Amount:

14 (1) Notwithstanding any other provision of the Agreement, the City s maximum payment obligation will not exceed ($ ) (the Maximum Contract Amount ). The City is not obligated to execute an Agreement or any amendments for any further services, including any services performed by Contractor beyond that specifically described in Exhibit A. Any services performed beyond those in Exhibit A are performed at Contractor s risk and without authorization under the Agreement. (2) The City s payment obligation, whether direct or contingent, extends only to funds appropriated annually by the Denver City Council, paid into the Treasury of the City, and encumbered for the purpose of the Agreement. The City does not by this Agreement irrevocably pledge present cash reserves for payment or performance in future fiscal years. The Agreement does not and is not intended to create a multiple-fiscal year direct or indirect debt or financial obligation of the City. 5. STATUS OF CONSULTANT: The Contractor is an independent contractor retained to perform professional or technical services for limited periods of time. Neither the Contractor nor any of its employees are employees or officers of the City under Chapter 18 of the Denver Revised Municipal Code, or for any purpose whatsoever. 6. TERMINATION: a. The City has the right to terminate the Agreement with cause upon written notice effective immediately, and without cause upon ( ) days prior written notice to the Contractor. However, nothing gives the Contractor the right to perform services under the Agreement beyond the time when its services become unsatisfactory to the Auditor. b. Notwithstanding the preceding paragraph, the City may terminate the Agreement if the Contractor or any of its officers or employees are convicted, plead nolo contendere, enter into a formal agreement in which they admit guilt, enter a plea of guilty or otherwise admit culpability to criminal offenses of bribery, kickbacks, collusive bidding, bidrigging, antitrust, fraud, undue influence, theft, racketeering, extortion or any offense of a similar nature in connection with Contractor s business. Termination for the reasons stated in this paragraph is effective upon receipt of notice.

15 c. Upon termination of the Agreement, with or without cause, the Contractor shall have no claim against the City by reason of, or arising out of, incidental or relating to termination, except for compensation for work duly requested and satisfactorily performed as described in the Agreement. d. If the Agreement is terminated, the City is entitled to and will take possession of all materials, equipment, tools and facilities it owns that are in the Contractor s possession, custody, or control by whatever method the City deems expedient. The Contractor shall deliver all documents in any form that were prepared under the Agreement and all other items, materials and documents that have been paid for by the City to the City. These documents and materials are the property of the City. The Contractor shall mark all copies of work product that are incomplete at the time of termination DRAFT-INCOMPLETE. 7. EXAMINATION OF RECORDS: Any authorized agent of the City, including the City Auditor or his or her representative, has the right to access and the right to examine any pertinent books, documents, papers and records of the Contractor involving transactions related to the Agreement until the latter of three (3) years after the final payment under the Agreement or expiration of the applicable statute of limitations. 8. WHEN RIGHTS AND REMEDIES NOT WAIVED: In no event will any payment or other action by the City constitute or be construed to be a waiver by the City of any breach of covenant or default that may then exist on the part of the Contractor. No payment, other action, or inaction by the City when any breach or default exists will impair or prejudice any right or remedy available to it with respect to any breach or default. No assent, expressed or implied, to any breach of any term of the Agreement constitutes a waiver of any other breach. 9. INSURANCE: a. General Conditions: Contractor agrees to secure, at or before the time of execution of this Agreement, the following insurance covering all operations, goods or services provided pursuant to this Agreement. Contractor shall keep the required insurance coverage in force at all times during the term of the Agreement, or any extension thereof, during any warranty period, and for three (3) years after termination of the Agreement. The required insurance shall be underwritten by an insurer licensed or authorized to do business in Colorado and rated by A.M. Best Company as A- VIII or better. Each policy shall contain a valid

16 provision or endorsement requiring notification to the City in the event any of the abovedescribed policies are canceled or non-renewed before the expiration date thereof. Such written notice shall be sent to the parties identified in the Notices section of this Agreement. Such notice shall reference the City contract number listed on the signature page of this Agreement. Said notice shall be sent thirty (30) days prior to such cancellation or non-renewal unless due to nonpayment of premiums for which notice shall be sent ten (10) days prior. If such written notice is unavailable from the insurer, Contractor shall provide written notice of cancellation, non-renewal and any reduction in coverage to the parties identified in the Notices section by certified mail, return receipt requested within three (3) business days of such notice by its insurer(s) and referencing the City s contract number. If any policy is in excess of a deductible or self-insured retention, the City must be notified by the Contractor. Contractor shall be responsible for the payment of any deductible or self-insured retention. The insurance coverages specified in this Agreement are the minimum requirements, and these requirements do not lessen or limit the liability of the Contractor. The Contractor shall maintain, at its own expense, any additional kinds or amounts of insurance that it may deem necessary to cover its obligations and liabilities under this Agreement. b. Proof of Insurance: Contractor shall provide a copy of this Agreement to its insurance agent or broker. Contractor may not commence services or work relating to the Agreement prior to placement of coverages required under this Agreement. Contractor certifies that the certificate of insurance attached as Exhibit, preferably an ACORD certificate, complies with all insurance requirements of this Agreement. The City requests that the City s contract number be referenced on the Certificate. The City s acceptance of a certificate of insurance or other proof of insurance that does not comply with all insurance requirements set forth in this Agreement shall not act as a waiver of Contractor s breach of this Agreement or of any of the City s rights or remedies under this Agreement. The City s Risk Management Office may require additional proof of insurance, including but not limited to policies and endorsements. c. Additional Insureds: For Commercial General Liability, Auto Liability Professional Liability, and Excess Liability/Umbrella (if required) Contractor and subcontractor s insurer(s) shall include the City and County of Denver, its elected and appointed officials, employees and volunteers as additional insured.

17 d. Waiver of Subrogation: For all coverages required under this Agreement, Contractor s insurer shall waive subrogation rights against the City. e. Subcontractors and Subconsultants: All subcontractors and subconsultants (including independent contractors, suppliers or other entities providing goods or services required by this Agreement) shall be subject to all of the requirements herein and shall procure and maintain the same coverages required of the Contractor shall include all such subcontractors as additional insured under its policies (with the exception of Workers Compensation) or shall ensure that all such subcontractors and subconsultants maintain the required coverages. Contractor agrees to provide proof of insurance for all such subcontractors and subconsultants upon request by the City. f. Workers Compensation/Employer s Liability Insurance: Contractor shall maintain the coverage as required by statute for each work location and shall maintain Employer s Liability insurance with limits of $100,000 per occurrence for each bodily injury claim, $100,000 per occurrence for each bodily injury caused by disease claim, and $500,000 aggregate for all bodily injuries caused by disease claims. Contractor expressly represents to the City, as a material representation upon which the City is relying in entering into this Agreement, that none of the Contractor s officers or employees who may be eligible under any statute or law to reject Workers Compensation Insurance shall effect such rejection during any part of the term of this Agreement, and that any such rejections previously effected, have been revoked as of the date Contractor executes this Agreement. g. h. Additional Provisions: (i) following: For Commercial General Liability, the policy must provide the

18 policy; (a) (b) That this Agreement is an Insured Contract under the Defense costs are outside the limits of liability; (c) A severability of interests, separation of insureds provision (no insured vs. insured exclusion); and (d) A provision that coverage is primary and non-contributory with other coverage or self-insurance maintained by the City. (ii) For claims-made coverage: (a) The retroactive date must be on or before the contract date or the first date when any goods or services were provided to the City, whichever is earlier. (b) shall advise the City in the event any general aggregate or other aggregate limits are reduced below the required per occurrence limits. At their own expense, and where such general aggregate or other aggregate limits have been reduced below the required per occurrence limit, the (c) will procure such per occurrence limits and furnish a new certificate of insurance showing such coverage is in force. 10. DEFENSE AND INDEMNIFICATION a. Contractor agrees to defend, indemnify, reimburse and hold harmless City, its appointed and elected officials, agents and employees for, from and against all liabilities, claims, judgments, suits or demands for damages to persons or property arising out of, resulting from, or relating to the work performed under this Agreement ( Claims ), unless such Claims have been specifically determined by the trier of fact to be the sole negligence or willful misconduct of the City. This indemnity shall be interpreted in the broadest possible manner to indemnify City for any acts or omissions of Contractor or its subcontractors either passive or active, irrespective of fault, including City s concurrent negligence whether active or passive, except for the sole negligence or willful misconduct of City.

19 b. Contractor s duty to defend and indemnify City shall arise at the time written notice of the Claim is first provided to City regardless of whether Claimant has filed suit on the Claim. Contractor s duty to defend and indemnify City shall arise even if City is the only party sued by claimant and/or claimant alleges that City s negligence or willful misconduct was the sole cause of claimant s damages. c. Contractor shall defend any and all Claims which may be brought or threatened against City and shall pay on behalf of City any expenses incurred by reason of such Claims including, but not limited to, court costs and attorney fees incurred in defending and investigating such Claims or seeking to enforce this indemnity obligation. Such payments on behalf of City will be in addition to any other legal remedies available to City and will not be the City s exclusive remedy. d. Insurance coverage requirements specified in this Agreement in no way lessen or limit the liability of the Contractor under the terms of this indemnification obligation. The Contractor is responsible to obtain, at its own expense, any additional insurance that it deems necessary for the City s protection. e. This defense and indemnification obligation shall survive the expiration or termination of this Agreement. 11. TAXES, CHARGES AND PENALTIES: The City is not liable for the payment of taxes, late charges or penalties of any nature, except for any additional amounts that the City may be required to pay under the City s prompt payment ordinance D.R.M.C , et seq. The Contractor shall promptly pay when due, all taxes, bills, debts and obligations it incurs performing the services under the Agreement and shall not allow any lien, mortgage, judgment or execution to be filed against City property. 12. ASSIGNMENT; SUBCONTRACTING: The Contractor shall not voluntarily or involuntarily assign any of its rights or obligations, or subcontract performance obligations, under this Agreement without obtaining the Auditor s prior written consent. Any assignment or subcontracting without such consent will be ineffective and void, and will be cause for termination of this Agreement by the City. The Auditor has sole and absolute discretion whether to consent to any assignment or subcontracting, or to terminate the Agreement because of unauthorized assignment or subcontracting. In the event of any subcontracting or unauthorized

20 assignment: (i) the Contractor shall remain responsible to the City; and (ii) no contractual relationship shall be created between the City and any sub-consultant, subcontractor or assign. 13. INUREMENT: The rights and obligations of the parties to the Agreement inure to the benefit of and shall be binding upon the parties and their respective successors and assigns, provided assignments are consented to in accordance with the terms of the Agreement. 14. NO THIRD PARTY BENEFICIARY: Enforcement of the terms of the Agreement and all rights of action relating to enforcement are strictly reserved to the parties. Nothing contained in the Agreement gives or allows any claim or right of action to any third person or entity. Any person or entity other than the City or the Contractor receiving services or benefits pursuant to the Agreement is an incidental beneficiary only. 15. NO AUTHORITY TO BIND CITY TO CONTRACTS: The Contractor lacks any authority to bind the City on any contractual matters. Final approval of all contractual matters that purport to obligate the City must be executed by the City in accordance with the City s Charter and the Denver Revised Municipal Code. 16. SEVERABILITY: Except for the provisions of the Agreement requiring appropriation of funds and limiting the total amount payable by the City, if a court of competent jurisdiction finds any provision of the Agreement or any portion of it to be invalid, illegal, or unenforceable, the validity of the remaining portions or provisions will not be affected, if the intent of the parties can be fulfilled. 17. CONFLICT OF INTEREST: a. No employee of the City shall have any personal or beneficial interest in the services or property described in the Agreement. The Contractor shall not hire, or contract for services with, any employee or officer of the City that would be in violation of the City s Code of Ethics, D.R.M.C. 2-51, et seq. or the Charter 1.2.8, 1.2.9, and b. The Contractor shall not engage in any transaction, activity or conduct that would result in a conflict of interest under the Agreement. The Contractor represents that it has disclosed any and all current or potential conflicts of interest. A conflict of interest shall include transactions, activities or conduct that would affect the judgment, actions or work of the Contractor by placing the Contractor s own interests, or the interests of any party with whom the Contractor has a contractual arrangement, in conflict with those of the City. The City, in its sole discretion,

21 will determine the existence of a conflict of interest and may terminate the Agreement if it determines a conflict exists, after it has given the Contractor written notice describing the conflict. 18. NOTICES: All notices required by the terms of the Agreement must be hand delivered, sent by overnight courier service, mailed by certified mail, return receipt requested, or mailed via United States mail, postage prepaid, if to Contractor at the address first above written, and if to the City at: Denver Auditor or Designee 201 W. Colfax Ave., Dept. 705 Denver, CO Notices hand delivered or sent by overnight courier are effective upon delivery. Notices sent by certified mail are effective upon receipt. Notices sent by mail are effective upon deposit with the U.S. Postal Service. The parties may designate substitute addresses where or persons to whom notices are to be mailed or delivered. However, these substitutions will not become effective until actual receipt of written notification. 19. NO EMPLOYMENT OF ILLEGAL ALIENS TO PERFORM WORK UNDER THE AGREEMENT: a. This Agreement is subject to Division 5 of Article IV of Chapter 20 of the Denver Revised Municipal Code, and any amendments (the Certification Ordinance ). b. The Contractor certifies that: (1) At the time of its execution of this Agreement, it does not knowingly employ or contract with an illegal alien who will perform work under this Agreement. (2) It will participate in the E-Verify Program, as defined in (3.7), C.R.S., to confirm the employment eligibility of all employees who are newly hired for employment to perform work under this Agreement. c. The Contractor also agrees and represents that: (1) It shall not knowingly employ or contract with an illegal alien to perform work under the Agreement.

22 (2) It shall not enter into a contract with a subconsultant or subcontractor that fails to certify to the Contractor that it shall not knowingly employ or contract with an illegal alien to perform work under the Agreement. (3) It has confirmed the employment eligibility of all employees who are newly hired for employment to perform work under this Agreement, through participation in either the E-Verify Program. (4) It is prohibited from using either the E-Verify Program procedures to undertake pre-employment screening of job applicants while performing its obligations under the Agreement, and it is required to comply with any and all federal requirements related to use of the E-Verify Program including, by way of example, all program requirements related to employee notification and preservation of employee rights. (5) If it obtains actual knowledge that a subconsultant or subcontractor performing work under the Agreement knowingly employs or contracts with an illegal alien, it will notify such subconsultant or subcontractor and the City within three (3) days. The Contractor shall also terminate such subconsultant or subcontractor if within three (3) days after such notice the subconsultant or subcontractor does not stop employing or contracting with the illegal alien, unless during such three-day period the subconsultant or subcontractor provides information to establish that the subconsultant or subcontractor has not knowingly employed or contracted with an illegal alien. (6) It will comply with any reasonable request made in the course of an investigation by the Colorado Department of Labor and Employment under authority of (5), C.R.S., or the City Auditor, under authority of D.R.M.C d. The Contractor is liable for any violations as provided in the Certification Ordinance. If Contractor violates any provision of this section or the Certification Ordinance, the City may terminate this Agreement for a breach of the Agreement. If the Agreement is so terminated, the Contractor shall be liable for actual and consequential damages to the City. Any such termination of a contract due to a violation of this section or the Certification Ordinance

23 may also, at the discretion of the City, constitute grounds for disqualifying Contractor from submitting bids or proposals for future contracts with the City. 20. DISPUTES: All disputes between the City and Contractor arising out of or regarding the Agreement will be resolved by administrative hearing pursuant to the procedure established by D.R.M.C (b)-(f). For the purposes of that administrative procedure, the City official rendering a final determination shall be the Auditor. 21. GOVERNING LAW; VENUE: The Agreement will be construed and enforced in accordance with applicable federal law, the laws of the State of Colorado, and the Charter, Revised Municipal Code, ordinances, regulations and Executive Orders of the City and County of Denver, which are expressly incorporated into the Agreement. Unless otherwise specified, any reference to statutes, laws, regulations, charter or code provisions, ordinances, executive orders, or related memoranda, includes amendments or supplements to same. Venue for any legal action relating to the Agreement will be in the District Court of the State of Colorado, Second Judicial District (Denver District Court). 22. NO DISCRIMINATION IN EMPLOYMENT: In connection with the performance of work under the Agreement, the Contractor may not refuse to hire, discharge, promote or demote, or discriminate in matters of compensation against any person otherwise qualified, solely because of race, color, religion, national origin, gender, age, military status, sexual orientation, gender variance, marital status, or physical or mental disability. The Contractor shall insert the foregoing provision in all subcontracts. 23. COMPLIANCE WITH ALL LAWS: Contractor shall perform or cause to be performed all services in full compliance with all applicable laws, rules, regulations and codes of the United States, the State of Colorado; and with the Charter, ordinances, rules, regulations and Executive Orders of the City and County of Denver. 24. LEGAL AUTHORITY: Contractor represents and warrants that it possesses the legal authority, pursuant to any proper, appropriate and official motion, resolution or action passed or taken, to enter into the Agreement. Each person signing and executing the Agreement on behalf of Contractor represents and warrants that he has been fully authorized by Contractor to execute the Agreement on behalf of Contractor and to validly and legally bind Contractor to all the terms, performances and provisions of the Agreement. The City shall have the right, in its

24 sole discretion, to either temporarily suspend or permanently terminate the Agreement if there is a dispute as to the legal authority of either Contractor or the person signing the Agreement to enter into the Agreement. 25. NO CONSTRUCTION AGAINST DRAFTING PARTY: The parties and their respective counsel have had the opportunity to review the Agreement, and the Agreement will not be construed against any party merely because any provisions of the Agreement were prepared by a particular party. 26. ORDER OF PRECEDENCE: In the event of any conflicts between the language of the Agreement and the exhibits, the language of the Agreement controls. 27. INTELLECTUAL PROPERTY RIGHTS: 28. SURVIVAL OF CERTAIN PROVISIONS: The terms of the Agreement and any exhibits and attachments that by reasonable implication contemplate continued performance, rights, or compliance beyond expiration or termination of the Agreement survive the Agreement and will continue to be enforceable. Without limiting the generality of this provision, the Contractor s obligations to provide insurance and to indemnify the City will survive for a period equal to any and all relevant statutes of limitation, plus the time necessary to fully resolve any claims, matters, or actions begun within that period. 29. ADVERTISING AND PUBLIC DISCLOSURE: The Contractor shall not include any reference to the Agreement or to services performed pursuant to the Agreement in any of the Contractor s advertising or public relations materials without first obtaining the written approval of the Auditor. Any oral presentation or written materials related to services performed under the Agreement will be limited to services that have been accepted by the City. The Contractor shall notify the Auditor in advance of the date and time of any presentation. Nothing in this provision precludes the transmittal of any information to City officials. 30. CONFIDENTIAL INFORMATION: a. City Information: Contractor acknowledges and accepts, in performance of all work under the terms of this Agreement, Contractor may have access to Proprietary Data or confidential information that may be owned or controlled by the City, and that the disclosure of such Proprietary Data or information may be damaging to the City or third parties. Contractor agrees that