Loading...
15 - Agreement with SpearTip's Shadow Spear PlatformItem No. 15 TO: Mayor Mayor Pro Tem City Council FROM: Celso Arrieta, IT Manager SUBJECT: Agreement with SpearTip's ShadowSpear Platform DATE: November 13, 2023 BACKGROUND: When the City of Paris experienced a cyber -attack in 2021, Texas Municipal League recommended SpearTip's ShadowSpear Platform to provide cybersecurity. In the fall of 2022, the City entered into a one-year agreement with this organization, which concludes November 2023. STATUS OF ISSUE: SpearTip's ShadowSpear Platform is an unparalleled resource that protects against cyber threats and attacks impacting our network. The SaaS (Software as a Service) architecture Platform optimizes visibility without intensive and overbearing resource requirements. With the one-year agreement ending in November of 2023, the City has the option of auto - renewing for one year at the price of $2,700 per month, entering into a two-year agreement for $2,500 per month, or a three-year agreement for $2,375 per month. This service is working very well and is providing the appropriate added protection as expected and staff has no expectation to seek a different vendor for the same or similar service. The specifics for the one, two and three-year agreement are outlined in the following table: 1 year _ $ _._. 2,700.00 —......A $ 32,400.00 ,, ,. $ - _........ 2 year $ 2,500.00 $ 30,000 00 $ 2,400 00 3 year $ 2,375.00 $ 28,500.00 $ 3,900.00 BUDGET: As noted in the table above, depending on the time length attached to the agreement, this item will have an annual cost of $32,400 for a one-year contract, $30,000 for a two-year contract, or $28,500 for a three-year contract. This is a budgeted expense. RECOMMENDATION: Staff recommends Council approves the 3 -year agreement with Shadow Spear and authorize the City Manager to sign the appropriate documents. i iiia i , 111111 111111 1714 Deer Tracks Trail Ste. 130 Saint Louis, MO 63131 800-236-6550 accounting@speartip.com �PV4 11:� �ID Lr` A, 'r� T I � 11, CYBER COUNTERINTELLIGENCE ShadowSpear SOW Prepared o City of Paris Texas Celso Arrieta - IT Manager 135 St. 1 st Paris, Texas 75460 (903) 782-6969 Carrietta@paristexas.gov This Statement Of Work ("SOW') is governed by the terms and conditions of the Master Services Agreement ("Agreement") entered into between the parties effective 2023-11-06 C! 24 -Month ShadowSpear SOC -as -a- $10,00 250 $2,500.00 Service « 24/7/365 SeCLUity Operations Center Support « Managed Detection and Response (IE DR, STEM, Next. -Gen AV) « Uoud Monitoring - 0365, GoogUe Suite, SaNesforce « Log Storage •- 7 Days Hot, 30 Days Cold « Dark Welb Monitoring « MordWy Reporting •-'T'eclhnica! and i Executive « Quarterly lBusiness Reviews « 3 vCIISO hour; monthly « T'errm-12.7.23-12.5,25 -� ___ p 36 -Month Shadows ear SOC -as -a- $9.50 50 � $2,375.00 Service « 24/71365 Security Operations Center Support « Managed Detection and IResponse � (EDR, Si IVI, Next -Gen AV) ® Cloud Monitoring - 0365, Google Suite, Salesforce i « dog Storage ..- 7 Days Hot, 30 Days J Cold « IDark Web IMonitoring « Monthly Reporting - T'echnicae and Executive « Quarterly Business Review « 3 vCiSO hours irmonthly « T'enrm-12.7.2312.7.26 Monthly Total $0.00 Name: Accepted By: ------------- Title: Company: Date Please Complete This Accounts Payable Form For SpearTip's Accounting Department Statement of Risk During the course of the engagement, there may be several procedural points that the City of Paris Texas must be aware of, including: 1. During the course of the engagement, there may be findings and recommendations documented and relayed to City of Paris Texas. Due to the pervasiveness of zero -day malware and the inability to create a guaranteed and impenetrable protective barrier, SpearTip, L.L.C. cannot be held liable for an intrusion or breach within City of Paris Texas's environment. The nature of all SpearTip, L.L.C. findings and recommendations may or may not have a direct or immediate impact on City of Paris Texas; therefore, SpearTip, L.L.C. cannot be held liable for any action related to findings or recommendations identified during the course of this engagement. 2. SpearTip, L.L.C. follows industry best practice and, based on significant experience, makes every effort to reduce the chance of service disruption while conducting security activity. As a result of the security activity and depending on several factors, including the age of the equipment or outdated software, the possibility exists that service disruptions could occur. If detectable and the activity appears or is reported to be causing a real or suspected disruption to City of Paris Texas's activities, operations, or production systems, SpearTip, L.L.C. will immediately halt the activity and notify City of Paris Texas. Due to the critical nature of this scope of work, it is imperative that City of Paris Texas understands and accepts the associated risks. 3. SpearTip's ability to monitor City of Paris Texas's environment depends in large part on software sensors. During this engagement, City of Paris Texas will be responsible for installing software sensors and resolving sensor health issues. SpearTip will report any detectable sensor health issues to City of Paris Texas within the Monthly Report. Further, SpearTip has low visibility on devices that do not have a sensor installed. No City of Paris Texas node, host, or endpoint should be left out of the deployment. Doing so could create a "blind spot" within City of Paris Texas's network and prevent SpearTip from effectively detecting and responding to malicious activity. SpearTip is not responsible for devices or software not monitored by a software sensor deployed within the environment. Affirmation of Understanding City of Paris Texas understands that SpearTip has agreed not to divulge any information regarding the details of the engagement or evidence collected to any third party not covered by a Partner Non -Disclosure Agreement without the explicit written authorization of the designated primary contact and authorizing agent or chief officer of the Partner's organization. SpearTip agrees to provide full and complete disclosure of all information gathered during the course of the engagement, including copies of raw data, and will keep the organization informed of all activities, operations, and proceedings of the engagement. City of Paris Texas agrees to provide open avenues for communication and timely response to communications during the engagement. City of Paris Texas grants SpearTip permission to perform research, make recommendations, follow the course of action within the scope of work. City of Paris Texas understands and agrees to the Statement of Risk and Project Terms as contained in this document. The below parties have reviewed the attached document (including the incorporated terms and conditions) and agree to the stated scope and price of work and associated terms and assumptions. Name: Initials: General Terms Project Initiation: Upon execution of this SOW. Period of Performance: 12 -Months, 24 -Months, or 36 -Months Project Terms: (1) Initial payment (first month) will be invoiced upon execution of this SOW. All following monthly payments will be invoiced on the first business day of each subsequent month (Payment is due upon receipt. Please accept a 3% charge for all credit card payments (except where prohibited by law). (2) This SOW will automatically renew for an additional 12,24, or 36 Months at the conclusion of the project term. Should City of Paris Texas wish not to renew the SOW, SpearTip will require written documentation detailing this request at least 30 days in advance. On each renewal pricing will increase by up to 10% for a 36 -month SOW, up to 15% for a 24 -month SOW, or up to 25% for a 12 month SOW. (3) The hours allotted within this engagement may be used throughout a given month at the discretion of SpearTip engineers or based on a request from the Partner but will expire on the last day of each month. In the event a partner exceeds the allotted hours, SpearTip will notify the Partner of the overage and solicit approval. (4) This engagement is not designed for and will not cover the scope of responding to a "full-blown" Incident Response investigation. Rather, the goal of the ShadowSpear@ Protection Services is to detect and identify active malware threats. Should a network breach or other cyber -related incident occur at any point during the duration of this engagement, which meets the following two conditions City of Paris Texas wishes to have SpearTip investigate the issue at hand, and SpearTip estimates the investigation, in its entirety, will exceed available monthly hours. SpearTip will require a separate engagement/proposal/statement of work to be approved by the Partner with the scope, objectives, and hourly rates defined. The above circumstances will not affect the terms of this SOW. (5) This engagement provides several options to the Partner. The Partner should carefully consider the option selected. The engagement is designed to address specific cybersecurity threats and may not include monitoring of all the Partner's I.T. systems. SpearTip is not responsible for systems or cybersecurity threats that fall outside the scope of this engagement. (6) In the event the scope of this engagement is exceeded by a margin greater than 5% of the total specified scope, SpearTip will notify the Partner of the overage and the increase will be included on any remaining invoices. (7) SpearTip will maintain all updates and patches on the technology installed by SpearTip on an ongoing basis throughout this engagement. City of Paris Texas is responsible for assisting SpearTip in the deployment of security technology and ensuring all scoped City of Paris Texas assets are covered by the security technology deployment. Certain data collection depends on third parties, for example, office 365 audit logs. SpearTip is unable to control the timing and delivery of these logs and is not responsible for delays due to third parry data delivery. (8) SpearTip may need to conduct investigations and validation within City of Paris Texas's I.T. environment during this engagement. City of Paris Texas is responsible for providing SpearTip administrative access to City of Paris Texas's environment. City of Paris Texas's I.T. support may be required at various points during the engagement. SpearTip is not responsible for consequences resulting from City of Paris Texas's I.T. actions or failure to collaborate with SpearTip. (9) Service Suspension, a delay or interruption of SpearTip's services at City of Paris Texas request, may temporarily impair City of Paris Texas's network security and ability to respond to a security incident. Additionally, Service Suspension requested by City of Paris Texas may require SpearTip to remove installed technologies. SpearTip is not responsible for consequences stemming from a partner's requested service suspension. (10) Failure to follow SpearTip's guidance during an investigation could result in the destruction of vital forensic artifacts necessary to investigate an incident. SpearTip is not responsible should the Partner fail to take guidance and advice from SpearTip personnel. (11) During onboarding, SpearTip will require a single P.O.C. (Point of Contact) within the environment to serve as the primary point of communication from SpearTip to the Partner. This can be changed via written request to SpearTip via the Dashboard. In addition, SpearTip will require an approved contact list from the Partner. Only individuals from the Partner identified on the approved contact list will be allowed to interact with SpearTip. The P.O.C. is responsible for all changes to the approved contact list. (12) T&E invoiced separately as incurred (for work required outside of the Metro St. Louis area). SpearTip will bill the client for one-way travel at a rate of %2 per hour, the normal rate. (13) Should City of Paris Texas fail to pay invoices within a 60 day timeframe or City of Paris Texas fails to fulfill contractual obligations, SpearTip reserves the right to terminate services outlined in the Statement of Work. Service Level Agreement SpearTip will extend to the Partner the following Service Level Agreement (S. L.A.) terms and conditions. The intention of the S.L.A. is to provide service levels commensurate to the reasonable expectations of the Partner and to provide a reasonable remedy to the Partner if the S.L.A. is breached. The S.L.A.'s are not intended to cover extraordinary or unreasonable circumstances. S.L.A. breaches and credits will be determined solely by SpearTip, L.L.C. within its reasonable commercial judgment. Responsibilities of the Partner During the course of the engagement, SpearTip will require earnest and responsive coordination and communication with the Partner. A breach of an S.L.A. caused by the actions or inaction of a partner will not be eligible for remedies. The Partner is responsible for being aware of established communication procedures and any changes that may occur to the procedures throughout the course of an engagement. Service Fee Remedy In the event of an S.L.A. breach, a service fee credit will be issued to the Partner. This credit will be applied against the Partner's fee for current or future services. The credit is nonrefundable and will appear on an invoice statement to the Partner. The service fee credit will expire within 12 months of issuance. The credit can be used for any SpearTip engagements. A service fee credit is calculated based on the total value of the signed engagement. Third -Party Service Level Agreements SpearTip, L.L.C. leverages Third -Parties Service Providers for the purposes of providing Protection Services described within this engagement. All Third -Party Service Level Agreements and applicable remedies will be provided as a pass-through by SpearTip, L.L.C. to the Partner upon request, as permitted by such third -party service level agreements, in the form of a credit against the Partner's fee for current or future services. Time to Identify, Investigate, and Resolve If SpearTip, L.L.C. determines in its reasonable commercial judgment that a failure to meet one of the following S.L.A. metrics has occurred caused solely by events, circumstances, and responsibilities within SpearTip, L.L.C.'s control, the S.L.A. breach will be used to calculate breach severity for the remedies provided below: • Identify — Low —1 Hours, Medium — 30 Minutes, High — 15 minutes, Critical — 5 Minutes • Notify — Medium — 4 Hours, High —1 Hour, Critical — 30 Minutes • Resolve - Low —16h, Medium — 8h, High — 2h, Critical —1 h S.L.A. — Remedies • Breached — 5% of Service Fee Credit • A breached severity occurs when an S.L.A. is exceeded by 20% or less • Significant Breach — 10% of Service Fee Credit • A significant breach occurs when an S.L.A. is exceeded by 20 — 50% • Excessive Breach — 15% of Service Fee Credit • An excessive breach occurs when an S. L.A. is exceeded by 51 % or more ShadowSpear Platform Availability S.L.A. If SpearTip, L.L.C. determines in its reasonable commercial judgment that a Partner's services are unavailable due to an outage caused solely by infrastructure, equipment, and virtual components owned and operated by SpearTip, L.L.C., the outage will be used to calculate Service Unavailability or Service Degradation for the remedies provided below. • Infrastructure, Networking Equipment, and Virtual Components - 99.9% S.L.A. • If a Partner experiences a Service Unviability due to failure of Infrastructure, Networking Equipment, And Virtual Components, SpearTip, L.L.C. will credit the Partner with 5% service fee credit after the initial minutes of Service Unavailability allowable by the S.L.A. within a given month. • No credit will be issued during a Service Degradation of Infrastructure, Networking Equipment, and Virtual Components. Credit Limitations The credits provided will not exceed twenty percent (20%) of the Customer's monthly base in any billing period. To receive credits, the Partner must open a credit request through the Dashboard within five (5) calendar days of the applicable incident. The Partner will not receive credits for unaffected Services. Definitions • Service Unavailability — the number of minutes that SpearTip Managed Detection and Response Infrastructure, Equipment, Or Virtual Components are affected by a total outage, and the service solution is unable to render objectives described in the Statement of Work. • Example: The Security Operations Center has lost power and internet connectivity, and backup systems have failed to engage. The Security Operations Center is unable to monitor Partner networks or respond to security events. • Service Degradation — the number of minutes that SpearTip Managed Detection and Response infrastructure, Equipment, or Virtual Components are affected by the partial outage, but the service solution is still able to render objectives described in the Statement of Work. • Example: A Partner dashboard is temporarily unavailable due to a configuration issue. The Security Operations Center is unaffected by the configuration issue. • Infrastructure - power systems and physical servers owned and operated by SpearTip, L.L.C. • Networking equipment - switching, routing, and firewall devices owned and operated by SpearTip, L.L.C. that provide connectivity to the local network (LAN) and internet (WAN). • Virtual Components - private cloud infrastructure hosted on SpearTip, L.L.C. infrastructure. • Security Event - an event involving intentional malicious activity occurring inside a Partner network or on a Partner endpoint. MSA 2021 This Master Services Agreement (the "Agreement') is made and entered into as of November 6, 2023 (the "Effective Date"), by and between City of Paris Texas, a corporation formed in the state of Texas, with its principal offices at 135 St.1 st, Paris, TX 75460, and its subsidiaries ("Client') and SpearTip, LLC ("SpearTip"), a Missouri limited liability company with its principal offices at 1714 Deer Tracks Trail Suite 150, Saint Louis, MO 63131-1847. 1. SERVICES SpearTip agrees to provide all services necessary to perform the work ("Services") as described in a statement of work or proposal (the "SOW/Proposal") as may be entered into between the parties from time to time for the compensation set forth therein. Each SOW/Proposal will incorporate the terms and conditions of this Agreement by reference and together will constitute the entire Agreement between the parties. 2. INDEPENDENT CONTRACTOR Each party, in all matters relating to this Agreement, will act as an independent contractor. Neither party will have authority nor will either party represent that it has any authority to assume or create any obligation, express or implied, on behalf of the other, or to represent the other as an agent, employee or in any other capacity. Neither execution nor performance of this Agreement will be construed to have established any agency, joint venture or partnership. Neither party will make any warranties or representations on behalf of the other party. 3. COMPENSATION 3.1 Professional Service Fees. Client agrees to pay SpearTip the rates set forth in each SOW/Proposal for the Services described therein. 3.2 Expenses. Client will pay SpearTip travel and expenses reasonably incurred in performing its obligations under the Agreement, including meals, rental car, travel, lodging, miscellaneous incidental expenses, and expenses for any non -routine supplies and equipment expressly called for in a SOW/Proposal or approved by Client. In each applicable SOW/Proposal, Client and SpearTip will make reasonable expense plans covering the pre -approval of travel related expenses generally for that SOW/Proposal, including use of Client to book lodging or airline flights. 3.3 Invoices. SpearTip will submit invoices to the individual at the Client address designated in the SOW/Proposal or electronically via instructions provided by Client. Sales taxes, if any, imposed on the Services, will be itemized on the invoice and shall be paid to SpearTip. Unless the SOW/Proposal provides otherwise, upon a fully executed SOW/Proposal, SpearTip will invoice Client for the first and MSA 2021 last two months of the term of the Agreement. Thereafter, Client will be invoiced as set forth in the SOW/Proposal. All other expenses and non -service deliverables will be submitted to Client every two weeks. All invoices are due and payable upon receipt. 3.4 Payment Terms. Client will pay fees, charges, and expenses to SpearTip in United States Dollars, by wire transfer of funds to an account designated by SpearTip or by check sent to SpearTip at an address to be designated by SpearTip. If there are any good faith disputes related to an invoice, Client will immediately pay the undisputed portion of the invoice and notify SpearTip in writing of Client's basis for withholding payment of the disputed amount. Disputes with respect to invoiced amounts will be deemed waived if not raised in writing. Upon receipt of Client's dispute notice, SpearTip and Client will work together in good faith to resolve such dispute in a prompt and mutually acceptable manner. If the dispute is not resolved within 30 days after receipt of Client's dispute notice, the parties will resolve the issue pursuant to the provisions of Section 15. Client will pay any disputed amounts within five calendar days after applicable disputed matters have been resolved. 3.5 Late Payment Interest; Convenience Fee. If Client does not pay an invoice within 20 calendar days after receipt, SpearTip may add an interest charge of one and one-half percent (1-1/2%) per month, or the maximum rate allowed by law if less; this interest will begin to accrue on the 21th day after Client's receipt of SpearTip's invoice and will accumulate on the outstanding balance on a daily basis until paid in full. Payments of invoices made by credit card will incur a convenience fee of 2.5% of the invoice amount, or the amount charged to SpearTip for processing; whichever is less. 4. CLIENT RESPONSIBILITIES 4.1 Client Personnel, Facilities and Resources. Client will provide SpearTip with timely access to appropriate Client personnel and will arrange for SpearTip personnel to have suitable and safe access to Client's facilities and systems. Client will also provide suitable office space and associated resources for SpearTip personnel working on-site, including all necessary computing and office support resources, and will undertake any other responsibilities described in the applicable SOW/Proposal. 4.2 Approvals and Information. Client will respond promptly to any SpearTip request to provide information, approvals, or authorizations that are reasonably necessary for SpearTip to perform the Services in accordance with the requirements of the SOW/Proposal. In addition, SpearTip may request instructions, directions or decisions from Client. SpearTip will document the requests and may present a default instruction, direction or decision. If the SOW/Proposal does not specify a period for Client's response, the time period will be seven (7) calendar days. If Client does not respond within the specified time period, SpearTip will be entitled to proceed on the basis of the default instruction, direction or decision, or in its reasonable discretion. 4.3 Sensor Issues. Client is responsible for resolving all sensor health issues. SpearTip may identify any sensor health issues to Client as part of its Deliverables. Client is responsible for investigating sensor issues including the deployment of appropriate sensors on all nodes, hosts or endpoints. SpearTip is not responsible for detecting and responding to malicious threats as result of blind spots in Client's network from the failure Client's failure to install appropriate sensors. 5. SPEARTIP RESPONSIBILITIES MSA 2021 SpearTip's specific responsibilities in performing the Services including any service level agreements will be set out in the applicable SOW/Proposal. SpearTip's employees, consultants and agents will use reasonable business practices while performing the Services and will, as much as possible given the nature of the Services, observe the working hours, working rules, and policies of Client while working on Client's premises, including but not limited to compliance with Client's technology security handbook or Client's information technology policies. 6. CHANGE ORDERS 6.1 Changes to Statements of Work. Either party may propose changes to the scope, nature or time schedule of the Services being performed under an applicable SOW/Proposal. Requests for changes will be submitted to the other party in writing for consideration of feasibility and likely effect on the cost and schedule for performance of Services. The parties will mutually agree to any proposed changes, including resulting equitable adjustments to costs and schedules for the performance of Services. Proposed changes will be affected through written amendments to the affected SOW/Proposal, signed by both parties (referred to as "Change Orders"). SpearTip may proceed with performing changed work following receipt of an oral instruction to proceed by Client's Project Manager, as designated in the SOW/Proposal, or another authorized representative provided that SpearTip sends a written confirmation of such instruction to the Client Project Manager. 6.2 Effect on Prices. Amounts payable pursuant to Change Orders will be in addition to any compensation or expenses specified in the SOW/Proposal. If a Change Order will have the effect of delaying the expected completion date of any milestones under a SOW/Proposal, the amounts payable under the Change Order will include a reasonable carrying charge reflecting SpearTip's cost of funds for the rescheduled milestone(s). 7. ACCEPTANCE As part of the Services, SpearTip will provide Client with the Deliverables identified in the SOW/Proposal. SpearTip's conformity to the specifications and service levels set forth in the SOW/Proposal will solely determine Client's right to reject the Deliverables. Client shall report any deficiencies in the Deliverables in writing within ten (10) days of receipt specifying in detail the deficiencies. If Client does not report any deficiencies within the ten (10) day period, the Deliverables will be deemed accepted. SpearTip will correct the deficiencies within a reasonable time period. Client acknowledges that SpearTip's ability to correct any defects in the Deliverables is dependent upon and may be delayed due to third -party vendors or licensors. 8. NOT AN EXCLUSIVE AGREEMENT It is expressly understood and agreed that this Agreement does not grant to SpearTip any exclusive rights to do business with Client and that Client may contract with other suppliers for the procurement of comparable services. Client makes no guarantee or commitment for any minimum or maximum amount of Services to be purchased under this Agreement. Nothing in this Agreement will prevent SpearTip from marketing, developing, using and performing services or delivering products similar to or competitive with the Services furnished under the Agreement. MSA 2021 9. PROPRIETARY RIGHTS 9.1 Work Product. Except for SpearTip Pre -Existing IP (as defined below), any material or data generated, designed or developed while performing the Services, including any intellectual property rights and the intellectual property rights therein (collectively the "Work Product") and all rights, title and interest in and to the Work Product shall belong to Client. SpearTip assigns all intellectual property rights in the Work Product to Client. 9.2 Preexisting SpearTip Materials. SpearTip retains all right, title and interest in and to SpearTip Pre -Existing IP. "SpearTip Pre -Existing IP" shall mean all pre-existing information, data, software, tools and other materials developed by or for SpearTip prior to commencement of the Services or developed by or for SpearTip independently outside the scope of the Services. All improvements, add-ons or modifications to SpearTip Pre -Existing IP shall be the exclusive property of SpearTip. SpearTip grants to Client a perpetual, paid-up, non-exclusive, non -transferable license to use the SpearTip Pre -Existing IP for Client's internal business purposes, any SpearTip Pre -Existing IP which are incorporated in a Deliverable or necessary for Client to use as a Deliverable. 9.3 Reservation of Rights. Neither party will be prevented from using ideas, concepts, expressions, techniques, know-how, skills and experience possessed by it prior to, or developed or learned by it in the course of, performance of its obligations under the Agreement. 10. CONFIDENTIALITY/NONDISCLOSURE 10.1 Confidential Information, Standard of Care. In the performance of or otherwise in connection with this Agreement, one party ("Disclosing Party") may disclose to the other party ("Recipient") certain Confidential Information of the Disclosing Party. "Confidential Information" will mean any information, technical data, or know-how (including, but not limited to, information relating to research, products, software, services, development, inventions, processes, engineering, marketing, techniques, clients, customers, insureds, policyholders, claimants, Client's sales agents, pricing, internal procedures, business and marketing plans or strategies, finances, employees and business opportunities) disclosed by the Disclosing Party to Recipient either directly or indirectly in any form whatsoever (including, but not limited to, in writing, in machine readable or other tangible form, orally or visually): (i) that has been marked as confidential; (ii) whose confidential nature has been made known by Disclosing Party, orally or in writing, to Recipient; or (iii) that due to its character and nature, a reasonable person under like circumstances would treat as confidential. The Recipient will treat such Confidential Information as confidential and proprietary to the Disclosing Party and Recipient will not be deemed by virtue of the Agreement or any access to the Disclosing Party's Confidential Information to have acquired any right or interest in or to any such Confidential Information. During the Term of this Agreement and for a period of two (2) years thereafter Recipient will: (a) use the Confidential Information of the Disclosing Party solely for the purposes set forth in this Agreement; (b) take suitable precautions and measures to maintain the confidentiality of the Confidential Information of the Disclosing Party; (c) afford Disclosing Party's Confidential Information at least the same level of protection against unauthorized disclosure or use as Recipient normally uses to protect its own information of a similar character, but in no event less than reasonable care; (d) not disclose or otherwise furnish the Confidential Information of the Disclosing Party to any third party other than employees or independent contractors of the Recipient who have a need to MSA 2021 know the Confidential Information to perform its obligations under this Agreement, provided such employees or independent contractors are obligated to maintain the confidentiality of the Confidential Information; and (e) to notify the furnishing party promptly of any unauthorized use or disclosure of Disclosing Party's Confidential Information and cooperate with and assist Disclosing Party in every reasonable way to stop or minimize such unauthorized use or disclosure at receiving party's cost. 10.2 Exclusions, Relief. The obligations under this section will not apply to any: (a) approved use or approved disclosure of any information pursuant to the exercise of the Disclosing Party's rights under this Agreement; (b) information that is now or hereafter becomes generally known or available to the public other than through a violation of this Agreement; (c) information that is obtained by the Recipient from a third party (other than in connection with this Agreement) who was not under any obligation of secrecy or confidentiality with respect to such information; (d) information that is independently developed by the Recipient without reference to any Confidential Information; and (e) any disclosure made with the explicit consent of the Disclosing Party. Any disclosure required by a validly issued administrative or judicial process or subpoena will not violate this section, provided that the Recipient uses reasonable efforts to give advance notice to and cooperate with the Disclosing Party in connection with any such disclosure and, provided further, the Recipient limits such disclosure to only that information that is required to be disclosed. In the event a court determines that the Recipient has breached, attempted or threatened to breach, any of its confidentiality obligations to the Disclosing Party or the Disclosing Party's proprietary rights, the parties agree that the Disclosing Party will be entitled to obtain appropriate injunctive relief and other measures restraining further, attempted or threatened breaches of such obligations. 10.3 Return or Destruction of Confidential Information. Upon written request, or in any event, upon any termination or expiration of the Agreement and any applicable SOW/Proposals, the Recipient will do one of the following with all copies of any Confidential Information of the Disclosing Party in its possession or control to which the receiving party does not possess under a valid license: (i) promptly return all such items to the Disclosing Party; or (ii) destroy all such items and provide written confirmation of such destruction by a duly authorized officer who supervised the destruction. Provided that SpearTip may retain one (1) copy of all of its work products (including working papers) produced under the Agreement for archival purposes for a period not to exceed five years from the date of termination or expiration of the Agreement. 10.4 Retained Rights. Each party is free to develop products independently without the use of the other's Confidential Information. Except for limitations set forth in a SOW/Proposal, neither party is obligated to restrict the future work assignments of a party's employees, contractors or representatives who have had access to Confidential Information. In addition, except for limitations on the parties set forth in a SOW/Proposal, the parties and their respective employees, agents and representatives are free to use the information retained in their unaided memories without reference to or use of a party's Confidential Information , including ideas, concepts, know-how or techniques, without the duty to account to the other, so long as such party or their employee, agent or representative does not use and does not disclose the other party's Confidential Information in violation of this Section 10. Nothing contained herein shall be construed to grant either party any rights to or under the other party's Confidential Information, including without limitation any copyrights, trademarks, patents, trade secrets, licenses or MSA 2021 ability to grant licenses except as may be specifically set forth in a SOW/Proposal. All improvements, add-ons or modifications to any party's Confidential Information shall remain the exclusive property of the party who owns or has rights to such Confidential Information. 11. INSURANCE SpearTip will maintain the following policies of insurance covering all Services furnished by SpearTip to Client during the Term of this Agreement. 11.1 General Liability (Bodily Injury, Property Damage, Personal and Advertising) insurance, in an amount not less than One Million Dollars ($1,000,000) per occurrence with an annual aggregate of not less than Two Million Dollars ($2,000,000); 11.2 Network Security insurance in an amount not less than Five Million Dollars ($5,000,000) per occurrence. 11.3 Technology Errors and Omissions insurance in an amount not less than Five Million Dollars ($5,000,000) per occurrence. 11.4 Automobile liability insurance (covering hired and non -owned vehicles) in a combined single limit of not less than One Million Dollars ($1,000,000); 11.5 Excess Liability insurance in an amount not less than Four Million Dollars ($4,000,000) per occurrence with an annual aggregate of not less than Four Million Dollars ($4,000,000); 11.6 Employee Dishonesty (Theft) in the amount of not less than One Million Dollars ($1,000,000) per claim; 11.7 Workers Compensation and Employees Liability Insurance as prescribed by law. Upon request, SpearTip will provide certificates of insurance for the coverages specified above. 12. WARRANTIES AND REMEDIES FOR BREACH OF WARRANTY 12.1 Quality of Services. SpearTip warrants that the Services will be performed in a workmanlike manner with the same degree of professionalism, skill, and care consistent with industry standards reasonably applicable to the performance of such Services. 12.2 Place of Correction. SpearTip may perform the investigation and correction services pursuant to this section at SpearTip's offices to the extent possible. If Client requires SpearTip to travel to Client's place of business, Client will reimburse SpearTip for the reasonable travel time and expenses of SpearTip's personnel. If a reported breach of warranty is attributable to a cause other than the SpearTip Services, then SpearTip will be entitled to payment for its investigation and correction efforts on a time and materials basis at the rates applicable to the SOW/Proposal. 12.3 Compliance with Laws; Background Checks. In performing the Services, SpearTip shall comply with all federal, state and local laws and regulations. SpearTip represents and warrants that all of its employees and contractors that perform any type of Service for Client, or has access to Client's Confidential Information, have undergone a comprehensive criminal history records check and passed same without exception and with satisfactory results 12.4 Exclusions. 12.4.1 SpearTip shall have no liability pertaining to any software or hardware deficiencies and Client's remedy for such deficiencies shall be solely against the software vendor or hardware manufacturer. 12.4.2 e a,Tip does not warrant that the operation of hardware,equipment,or of any other software will be uninterrupted or r Client acknowledges that one is responsibleo results of using the software, hardware and equipment used in its business operations, including without limitation the completeness, accuracya.nd content of such rnacknowledges that responsible for dn verification d testing o, any such results prior 12.4.3 During the course of providing the Services, SpearTip may provide findings and recommendations toi a is notM viruses, worms and/or othero, eenvironment.a^ p makes no warranty of a guaranteed protective barrier. SpearTip disclaims all liability for any of its findings or recommendations it makes to Client during the term (and any renewal term) of this Agreement. 12.5 Disclaimer. THE FOREGOING WARRANTIES ARE IN LIEU OF ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON INFRINGEMENT, AND ANY L WARRANTIES ARISING COURSE A" ,. PERFORMANCE •, a D ; 13.1 SpearTip. If Client's shareholders, or subsidiaries (the "Customer Indemnitees")subject to third party legal claims ,an . ; ^'.� w+say � ��� ,��, � �� �, � ��►a��;' i• ', ^�� �' � ��` t� n , MSA 2021 failure to use any new or corrected versions of the item made available by SpearTip; (d) SpearTip's adherence to Client's specifications or instructions; or (e) any third party software, e.g., software licensed by Oracle Corporation or hardware. Other than for the remedies for alleged infringement, SpearTip's indemnification obligations hereunder shall be subject to the limits of its insurance policies specified in Section 11 above. 13.2 Client. Without limiting SpearTip's liability to Client for non-performance under the Agreement, each of the parties acknowledges and agrees that by entering into and performing its obligations under the Agreement, SpearTip will not assume and should not be exposed to the business and operational risks associated with Client's business. Therefore, except for claims covered by Section 13.1, Client will, at its own expense, indemnify, settle or defend SpearTip in all claims or actions by third parties arising out of or relating to the conduct of Client's business, including without limitation, the acquisition or use by Client of any Deliverable or Services to be provided by SpearTip under the Agreement, any claims for infringement or misappropriation of a third -party's intellectual property rights attributable to Client's products and/or services and rights to third party products provided by Client to SpearTip for use in the Services and claim of personal injury or property damage caused or alleged to be caused by Client or Client's employees; and Client will pay all settlements, costs, damages and legal fees and expenses finally awarded provided that SpearTip promptly notifies Client in writing of the proceeding, provides Client a copy of all information received by SpearTip with respect to the proceeding, cooperates with Client in defending or settling the proceeding, and allows Client to control the defense and settlement of the proceeding, including the selection of attorneys. SpearTip may, at its option, observe the proceeding and confer with Client at its own expense. If, because of Client's negligence, SpearTip or SpearTip's employees, subcontractors, or agents suffer personal injury or damage to tangible property, Client will reimburse SpearTip for that portion of any claims SpearTip pays for which Client is legally liable, plus any reasonable legal fees and court costs incurred by SpearTip. 14. TERM AND TERMINATION 14.1 Term. This Agreement will be for a period of three (3) years ("Term") commencing on the Effective Date. This Agreement will automatically be renewed for successive three-year periods, unless a party provides the other with written notice at least 45 calendar days prior to its next scheduled expiration stating that it does not wish for this Agreement to be renewed. If this Agreement expires, its terms and conditions will continue to apply to any SOW/Proposal then in effect until the SOW/Proposal expires or terminates. 14.2 Termination of a Statement of Work/Proposal for Convenience. Either party may terminate any outstanding SOW/Proposal, or any portion of a SOW/Proposal, for convenience upon at least 60 calendar days' prior written notice to the other party. Upon receipt of such notice, SpearTip will take steps to wind down work in progress in an orderly fashion during the notice period. At the end of the notice period and upon payment by Client as outlined below, SpearTip will deliver to Client whatever Deliverables, completed or in -progress, that then exist. 14.3 Termination of a Statement of Work for Cause. If either party believes that the other party has failed to perform an obligation a party is obliged to perform under a SOW/Proposal that is so fundamental that the failure to perform the obligation defeats the essential purpose of the SOW/Proposal MSA 2021 (a "Breach"), then that party may provide written notice directed to the breaching party's Project Manager for the applicable SOW/Proposal describing the alleged Breach in reasonable detail. If the breaching party does not, within 30 calendar days (15 days for payment defaults) after receiving such written notice, either cure the Breach or develop a plan to cure the Breach (if the Breach is not one that can reasonably be cured within 30 calendar days) and diligently proceed according to the plan until the Breach has been cured, then the breaching party may terminate the affected SOW/Proposal, in whole or in part, for cause by written notice to the applicable Project Manager of the breaching party. Prior to termination of a SOW/Proposal for cause, the party receiving the initial notice under the preceding sentence will be afforded an opportunity to meet with a senior management representative of the breaching party to explain its position. The termination of any particular SOW/Proposal will not affect the parties' respective rights, duties and obligations under any other SOW/Proposal then in effect. 14.4 Termination Due to Insolvency. Either party may terminate this Agreement or an SOW/Proposal immediately if the other party (a) becomes or is declared insolvent or bankrupt; (b) is the subject of any proceeding relating to its liquidation or insolvency; (c) makes an assignment for the benefit of its creditors; or (d) enters into an agreement for the composition, extension or readjustment of all or substantially all of its assets. 14.5 Payment upon Termination. SpearTip will be paid for all Services performed through the effective date of termination, plus associated expenses and termination costs as follows: 14.5.1 SpearTip will be paid all fees for Services actually performed through the effective date of termination; 14.5.2 SpearTip will be paid for expenses incurred through the effective date of termination, plus costs and expenses reasonably incurred by SpearTip to terminate its performance of the Services earlier than anticipated, including without limitation costs to relocate any SpearTip personnel from Client's site, and costs to terminate any special contracts or leases entered into for the purpose of performing the terminated Services. SpearTip will use commercially reasonable efforts to minimize Client's termination costs under this section; and, 14.5.3 If Client terminates this Agreement for Convenience, in addition to the amount Client owes SpearTip pursuant to Sections 14.5.1 and 14.5.2, Client will owe SpearTip early termination fees as follows: (i) If the SOW/Proposal is terminated during the first year of the term or any renewal, term, fifty percent (50%) of the total fees that would have been earned during the balance of the term or renewal term; (ii) If the SOW/Proposal is terminated during the second year of the term or any renewal term, forty percent (40%) of the total fees that would have been earned during the balance of the term or renewal term; (iii) If the SOW/Proposal is terminated during the third year of the term or any renewal, term, thirty percent (30%) of the total fees that would have been earned during the balance of the term or renewal term. Any early termination fees will be due on the effective date of termination 15. LAW AND DISPUTES MSA 2021 15.1 Dispute Resolution. The parties agree to mediate all disputes arising under the Agreement until either the designated representatives conducting the mediation conclude that resolution through continued negotiation does not appear likely or thirty (30) calendar days have passed since the initial request to negotiate the dispute was made; provided, however, that a party may file earlier to avoid the expiration of any applicable limitations period, to preserve a superior position with respect to other creditors, or to apply for interim or equitable relief. Such mediation will be conducted by each party designating a duly authorized officer or other representative to represent the party, with authority to bind the party, and the parties agree to exchange all non -privileged information with respect to the dispute that the parties believe to be appropriate and germane. 15.2 Governing Law. The Agreement will be governed by the laws of the State of Missouri, without regard to conflict of laws principles. In the event the parties are unable to mediate their dispute to a satisfactory resolution, the parties agree to the exclusive personal and subject matter jurisdiction and venue of the courts located in St. Louis County, Missouri or the United States District Court for the Eastern District of Missouri for any claim or action under the Agreement. 15.3 Export Control. Both SpearTip and Client agree to comply fully with all relevant export laws and regulations of the United States to ensure that no information or technical data provided pursuant to the Agreement is exported or re-exported directly or indirectly in violation of law. 15.4 Limitation of Actions. No proceeding, regardless of form, arising out of or related to the Agreement may be brought by either party more than two years after the accrual of the cause of action, except that proceedings related to violation of a party's proprietary rights or any duty to protect Confidential Information may be brought at any time within the applicable statute of limitations, and proceedings for non-payment may be brought up to four years after the date the last payment was due. 15.5 Attorneys' Fees. In the event of any litigation between the parties with respect to this Agreement, the prevailing party (the party entitled to recover costs of suit, at such time as all appeal rights have expired or the time for taking such appeals has expired) will be entitled to recover reasonable attorneys' fees, including fees incurred at the appellate level, in addition to such other relief as a court of competent jurisdiction may award. 16. LIMITATION OF LIABILITY AND REMEDIES 16.1 Limitations. IF CLIENT SHOULD BECOME ENTITLED TO CLAIM DAMAGES FROM SPEARTIP (INCLUDING WITHOUT LIMITATION, FOR BREACH OF CONTRACT, BREACH OF WARRANTY, NEGLIGENCE OR OTHER TORT CLAIM), SPEARTIP WILL BE LIABLE ONLY FOR THE AMOUNT OF CLIENT'S ACTUAL DIRECT DAMAGES UP TO THE LESSER OF AMOUNT THAT CLIENT PAID SPEARTIP FOR THE ITEMS OR SERVICES THAT ARE THE SUBJECT OF THE CLAIM OR THE AMOUNT OF THE FEES PAID TO SPEARTIP DURING THE SIX (6) MONTHS PRECEEDING THE DATE OF THE EVENT GIVING RISE TO THE CLAIM. THESE LIMITS ALSO APPLY TO SPEARTIP'S SUBCONTRACTORS. 16.2 No Liability for Certain Damages. IN NO EVENT WILL EITHER PARTY OR ANY PERSON OR ENTITY INVOLVED IN THE CREATION, MANUFACTURE OR DISTRIBUTION OF ANY SOFTWARE, SERVICES OR OTHER MATERIALS PROVIDED UNDER THE AGREEMENT BE LIABLE FOR: (1) ANY DAMAGES CAUSED BY THE FAILURE OF THE OTHER PARTY OR THE OTHER PARTY'S MSA 2021 SUPPLIERS TO PERFORM THEIR RESPONSIBILITIES; (2) ANY CLAIMS OR DEMANDS OF THIRD PARTIES (OTHER THAN THOSE THIRD PARTY CLAIMS COVERED BY SECTION 13); OR (3) ANY LOST PROFITS, LOSS OF BUSINESS, LOSS OF USE, LOST SAVINGS OR OTHER CONSEQUENTIAL, SPECIAL, INCIDENTAL, INDIRECT, EXEMPLARY OR PUNITIVE DAMAGES, EVEN IF THAT PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. NEITHER PARTY WILL BE HELD RESPONSIBLE, OR TO HAVE FAILED TO MEET ITS OBLIGATIONS UNDER THE AGREEMENT, IF IT EITHER DELAYS PERFORMANCE OR FAILS TO PERFORM AS A RESULT OF ANY CAUSE BEYOND ITS REASONABLE CONTROL. 16.3 Exclusions from Limitation; Survival. The foregoing limitations do not apply to the payment of settlements, costs, damages and legal fees under Section 13 (Indemnification) or for breach of confidentiality under Section 10. The limitations of liability set forth in this Section 16 will survive and apply notwithstanding the failure of any limited or exclusive remedy, any breach of the Agreement, or any other reason. The parties agree that the foregoing limitations will not be deemed to limit any liability to an extent that would not be permitted under applicable law. 17. GENERAL 17.1 Notices. All notices required to be given under this Agreement must be given in writing. Either party may change its address for notice under this Agreement by giving advance written notice to the other party as provided herein. Such notices will be deemed to have been given: (a) when delivered in person; (b) five (5) business days after being sent by certified mail, return receipt requested, postage pre -paid; (c) when transmitted if sent by facsimile, provided a confirmation of transmission is produced by the sending machine and a copy of such facsimile is promptly sent by another means specified herein; or (d) upon delivery by reputable overnight courier, all delivery charges pre -paid, and addressed as follows: MSA 2021 In the case of Client: with a copy to the following, which will not constitute notice: SpearTip, LLC SpearTip, LLC c/o Zurich Attn: Joe Hoosech, Vice President Attn: Corporate Law 1714 Deer Tracks Trail Ste. 130 1299 Zurich Way Saint Louis, MO 63131-1847 Schaumburg, Illinois 60196 jhoosech@speartip.com 17.2 Reasonable Behavior. Each party will act in good faith in the performance of its respective responsibilities under the Agreement and will not unreasonably delay, condition or withhold the giving of any consent, decision or approval that is either requested or reasonably required by the other party in order to perform its responsibilities under the Agreement. 17.3 Assignment. Neither party may assign or otherwise transfer the Agreement or any of the rights that they grant without the prior written consent of the other party. Any purported assignment in violation of the preceding sentence will be void and of no effect. The Agreement will be binding upon the parties' respective successors and permitted assigns. 17.4 Severability. Any term or provision of this Agreement that is invalid or unenforceable in any jurisdiction will be ineffective only to the extent of such invalidity or unenforceability and only as to such jurisdiction without rendering invalid or unenforceable the remaining terms and provisions of this Agreement or affecting the validity or enforceability of any of these terms or provisions in any other jurisdiction. Additionally, if any provision of the Agreement is declared to be unenforceable, the parties will substitute an enforceable provision that, to the maximum extent possible in accordance with applicable law, preserves the original intentions and economic positions of the parties. 17.6 Order of Precedence. In the event of any conflict between or among the provisions contained in the Agreement, the following order of precedence will govern: (a) this Agreement, exclusive of its exhibits; (b) exhibits to this Agreement; and (c) a SOW/Proposal (except as to terms specifically identified in a particular SOW/Proposal as modifying or amending terms of this Agreement, which terms will control over the Agreement for that SOW/Proposal only). 17.6 Publicity. Both parties agree that neither party will issue any press release or make any other public statement about the other party, the Agreement or the Services without the other party's prior written consent. Notwithstanding the preceding, SpearTip may include Client's name on SpearTip's Client list/website and may describe briefly, and in general terms, the nature of the work performed by SpearTip for Client. 17.7 No Waiver. No failure or delay by either party in exercising any right, power or remedy will operate as a waiver of such right, power or remedy, and no waiver will be effective unless it is in writing and signed by the waiving party. The waiver by either party of a breach or a default of any provision of this Agreement by the other party will not be construed as a waiver of any succeeding breach of the same or any other provision. 17.8 oDuring Agreement i) months after laterof the a.iration or termination,, :* successors and assigns. 17.11 .,", �" � �., ,� � tom" � ,�,. � �:. ,, +► � ;.. ; "r" .sem , Counterparts r Agreement ^" s in multiple counterparts and a each of deemed o be an original,all of which together constitutewill r Agreement by electronic or facsimile transmission be re a r by the parties as if an original had been delivered. 17.12 Entire Agreement and Amendment. This Agreement, and attachments, constitutes the entire agreement between the parties with respect to the subject matter hereof. This Agreement supersedes, and the terms of this Agreement govern, any prior agreements with This Agreement may only be changed by mutual agreement of authorized representatives of the parties 1 ea' by e+ by an authorized principal both parties. EachPa;s, e ; under this Agreement will incorporate4 will constitute separate contract between the parties. A SOW/Proposal may amend the terms and conditions of this Agreement as they apply to that particular SOW/Proposal, but only if the SOW/Proposal expressly identifies the section(s) that are being amended. 17.13 Force Majeure. SpearTip shall not be liable or deemed to be in default for any delay or failure in performance of the Services hereto to the extent such delay or failure is caused by fire, flood, explosion, war, embargo, government requirement, , regulatory or legislative intervention or other similar causes beyond its control and anticipation or foreseeability. In any such event, SpearTip will be excused from the performance of such obligation affected by such event for so long as such circumstances prevail, provided that SpearTip uses and continues to use commercially reasonable efforts to utilize alternative resources to recommence and/or maintain , performance without further delay MSA 2021 Each party has caused its authorized representative to execute this Agreement as of the Effective Date.