V(F) Approval and Authorization of the Vulnerability Assessment Services to Hartman & Associates, Inc.; and Authorization for Mayor and City Clerk to Execute the Consulting Agreement for the Vulnerability Assessment Services Agenda 04-06-2004
Item V F
Mayor center of Good Lia Commissioners
S. Scott Vandergrift Danny Howell, District 1
Scott Anderson, District 2
City Manager - — _ _ Rusty Johnson, District 3
Gene Williford Nancy J. Parker, District 4
STAFF REPORT
TO: The Honorable Mayor and City Commissioners
FROM: David A. Wheeler,P.E.
Director of Public Works
DATE: March 28, 2004
RE: Award of Consulting Agreement to Hartman &Associates,Inc.
For
Vulnerability Assessment Services
ISSUE
Should the City Commission award the Consulting Agreement to Hartman & Associates, Inc.
(HAI) to perform the Vulnerability Assessment Services as required by the Environmental
Protection Agency.
BACKGROUND/DISCUSSION
At the March le City Commission meeting, staff presented the review Request for
Qualification performed by the selection committee for the Vulnerability Assessment Services.
That staff report•listed Hartman & Associates, Inc. as the highest ranked firm and the firm with
which staff should negotiate a more defined scope of services and cost for those services.
The attached agreement includes the detailed scope of services to be provided for this important
project. HAI has estimated that the water treatment system vulnerability assessment will cost
$24,500 and will be completed no later than June 30, 2004. This estimated cost is within the
budgeted amount projected in this fiscal year's budget.
RECOMMENDATION
Staff recommends that the City Commission approve the award of the Vulnerability Assessment
Services to Hartman & Associates, Inc. and authorize the Mayor and City Clerk to execute the
Consulting Agreement for Vulnerability Assessment Services between the City of Ocoee and
Hartman&Associates, Inc. in the amount of$24,500.
CONSULTING AGREEMENT FOR VULNERABILITY ASSESSMENT
SERVICES
THIS AGREEMENT is made and entered into this day of , 20_, by
and between the CITY of OCOEE, Florida, a municipal corporation existing under the laws of the
State of Florida(CITY), and Hartman & Associates, Inc a Florida corporation(CONSULTANT).
WHEREAS, the CITY shall use the CONSULTANT'S services (Services), as further described
below, for completing a Security Vulnerability Assessment Study ("Project") for the City's
water/wastewater facilities pursuant to task orders issued as provided herein; and
WHEREAS, the CONSULTANT is willing and able to perform the Services for the CITY on
the terms and conditions hereinafter set forth;
NOW, THEREFORE, in consideration of the premises and mutual covenants given one to the
other,the receipt and sufficiency of which is hereby acknowledged,the parties hereby agree as follows:
SECTION 1
BASIC SERVICES OF CONSULTANT
1.1 General
1.1.1 The CONSULTANT shall provide SERVICES for the CITY in all phases of the Project to which
this Agreement applies as hereinafter provided. The United States Environmental Protection Agency
("EPA") has developed specific requirements for water districts to prepare a Security VA Certification,
due to be provided to the EPA by June 30, 2004. The Consultant will need to comply with these
requirements.
The Scope of Work may consist of, but will not necessarily be limited to completing a Security VA
(SVA study) for the City of Ocoee water/wastewater facilities using an established methodology such as
RAM-W, V-SAT, CARVER, or other sound methodology, which satisfies the requirements of the
Public Health Security and Bioterrorism Preparedness and Response Act of 2002. Tasks include:
• Characterization of the system,including its mission and objectives.
• Independent review of the entire system for its security, including water sources, treatment plant
and suppliers, storage, distribution system, personnel, information system/ computers/ controls/
maps, and public relations.
• Determination of critical assets that might be subject to malevolent acts that could result in
undesired consequences.
• Identification and prioritization of adverse consequences to avoid.
• Assessment of the likelihood(qualitative probability) of such malevolent acts from adversaries.
• Evaluation of existing countermeasures.
• Analysis of current risk and development of a prioritized plan for risk reduction.
• Certify and submit a copy of the final Security Vulnerability Assessment Report to the EPA
Administrator,and notify appropriate agencies.
2
• Certify and submit a copy of the final Security Vulnerability Assessment Report to the EPA
Administrator, and notify appropriate agencies.
The SVA must be summarized in the format required by EPA. The preparation of the Emergency
Response Plan(ERP) and possible VA for the wastewater plant are future tasks to be included under this
Agreement. The ERP will be tasked when the EPA guidelines are published later this year. The
wastewater plant VA will be tasked upon funding availability and/or mandate from the Federal
government.
1.1.2 The CITY shall, from time to time at its sole discretion, authorize the CONSULTANT in writing
to provide Services by means of a Services Authorization under the terms of this Agreement. A Services
Authorization shall, by mutual agreement of the parties, set forth, (1) the Scope of Services, (2) the time
for performance, (3) method and amount of compensation, (4) the provisions of Sections 1 and 2 of this
Agreement which are applicable, (5) the Deliverables, if any (which are the items to be provided to the
CITY as a result of the Services), and (6) the services, information and data that can be provided by the
CITY to the CONSULTANT.
1.1.3 The CITY does not guarantee, warrant, or represent that any number or any particular type of
Services Authorization will be assigned to the CONSULTANT under the terms of this Agreement.
Furthermore, the purpose of this Agreement is not to authorize a specific Project, but to set forth certain
duties, obligations, rights, and responsibilities that may be incorporated by reference into any Services
Authorization that may be mutually agreed to by the parties. The CITY shall have the sole discretion to
select the Project(s), if any,that may be given to the CONSULTANT.
SECTION 2
ADDITIONAL SERVICES OF CONSULTANT
2.1 General
The CITY may, at its sole discretion, provide the CONSULTANT with a Services Authorization to
furnish or obtain (from others) Additional Services of the following types which are not considered
normal or customary Basic Services, as described above. These additional services may include, but are
not limited to,the following:
2.1.1 Preparation of applications and supporting documents (in addition to those furnished under Basic
Services) for private or governmental grants, loans or advances in connection with the Project;
preparation or review of environmental assessments and impact statements; and assistance in obtaining
approvals of authorities having jurisdiction over the anticipated environmental impact of the Project.
2.1.2 Services resulting from significant changes in the previously approved extent of the Project.
2.1.3 Providing measured drawings,renderings or models for use by the CITY or the CONSULTANT.
2.1.4 Furnishing services of independent professional associates and consultants for other than Basic
Services.
3
2.1.5 Providing any type of field surveys for design purposes and engineering surveys and staking to
enable other Contractor(s) or Consultants to proceed with their work; and providing other special field
surveys.
2.1.6 Preparing to serve (or serving) as a consultant or witness for the CITY in any litigation,
arbitration or other legal or administrative proceeding involving the Project
2.1.7 Assistance in the preparation of ordinances.
2.1.8 Assistance in the preparation of agreements between the CITY and others (including, but not
limited to, other units of government, developers, districts, and authorities).
SECTION 3
CITY'S RESPONSIBILITIES
3.1 Requirements for the Project
The CITY shall provide all criteria and full information as to the CITY's requirements for the Project in
a timely manner.
3.2 Information Pertinent to the Project
The CITY shall assist the CONSULTANT by placing at the CONSULTANT's disposal all available
information pertinent to the Project (including previous reports and any other data relative to design or
construction of the Project). The CONSULTANT is ultimately responsible for satisfying itself as to
accuracy of any information provided, and, furthermore, the CONSULTANT is responsible for bringing
to the CITY's attention, for the CITY's resolution, any material inconsistencies or errors in such
information that come to the CONSULTANT's attention.
3.3 Access to Property
The CITY shall arrange for access to and make provisions for the CONSULTANT to enter upon public
and private property as required for the CONSULTANT to perform its Services.
3.4 Approvals and Permits
The CITY shall obtain approvals and permits, if any, with the active assistance of the CONSULTANT
(and as budgeted in the applicable Services Authorization), from all governmental authorities having
jurisdiction over the Project, and such approvals and consents from others as may be necessary for
successful completion of the Project.
4
SECTION 4
PERIOD OF SERVICE
4.1 Time
This Agreement shall continue in full force for a period of two (2)years from the date first written above
or until terminated in accordance with SECTION 8. The CITY shall have the option of extending the
term an additional one (1) year. The above time periods may be extended to complete services being
rendered under any Services Authorization issued hereunder that are in progress at the end of the term.
4.2 Services Authorization
Each Services Authorization shall specify the Period of Service agreed to by the CITY and the
CONSULTANT for services to be rendered under that Services Authorization. The Consultant shall
complete all services necessary to allow the City to timely submit the required vulnerability assessment.
SECTION 5
PAYMENTS TO CONSULTANT
5.1 General
5.1.1 The CITY will pay the CONSULTANT for the Services as detailed in each of the
CONSULTANT's narrative monthly invoices (Invoices), and in accordance with the schedule of Fees
and reimbursable expenses as provided in each Services Authorization. The invoices shall be in a format
approved by the City.
5.1.2 The CONSULTANT fully acknowledges and agrees that if at any time it performs Services on a
Project contemplated by the parties, such Services which have not been, a) fully negotiated, reduced to
writing, and formally executed by both the CITY and CONSULTANT; b) or reduced to writing by the
CITY and signed by the CITY; then the CONSULTANT shall perform such Services without liability to
the CITY, and at the CONSULTANT's own risk.
5.1.3 For other than lump-sum contracts, the CITY shall only be obligated to pay for those Services
that the CONSULTANT can demonstrate are reasonable, provable, and within the Scope of Services of
any Services Authorization.
5.1.4 The CITY has established a maximum multiplier of to be applicable to the Wage Cost
Multiplier method of compensation,as set forth below.
5.2 Methods of Compensation
Within the Services Authorization associated with each Project, the CITY and the CONSULTANT may
agree on, but not be limited to, one of the methods of compensation outlined in Subsections 5.2.1,et seq.
If a different method of compensation is to be used, the Services Authorization will set forth the basis
for such compensation.
5
5.2.1 Wage Cost Multiplier
5.2.1.1 General. One method of compensation shall be calculated by a wage or salary cost times
(multiplied by) an actual audited overhead factor (Wage Cost Multiplier); provided, however, that in no
instance shall the factor exceed (Multiplier). Reimbursable expenses shall be compensation times
a factor of 1.0, and Subconsultants times a factor of up to 1.1. Reimbursable expenses include the
pass-through costs incurred by the CONSULTANT. After application of the Multiplier, the personnel
costs shall include:
a) Salary
b) Social Security
c) Federal and State Unemployment Taxes
d) Worker's Compensation Insurance
e) Sick Leave
f) Vacation and Holiday Pay
g) Retirement and Medical Insurance Benefits
h) General and Administrative Overhead Costs
i) Quality Control (to ensure normal standard of care)
j) Profit
k) Incidental Reproduction and Secretarial (not attributable to a specific Project)
1) Office Support Costs (including accounting work necessary for the maintenance of
Project billings)
5.2.1.2 Wage Cost Multiplier for Construction Phase Services on Major Projects. (This
Subsection shall apply to assignments which require one or more full-time field personnel assigned to a
Project.) The CITY shall pay the CONSULTANT an amount based on the direct salaries and wages of
office and field personnel times (multiplied by) the applicable factor as set forth below, for Services
rendered by officers, principals, and employees assigned to the Project; plus reimbursable expenses
times a factor 1.0; plus the cost of Subconsultants times a factor of up to 1.1. The factors to be applied
to direct salaries and wages are as follows:
Factor
Office Services,defined as personnel assigned to and based in the
CONSULTANT's regular places of business max
Field Services, defined as personnel assigned to and based in a
furnished field office which is provided by, 1)the construction
Contractor, 2)the CITY, or 3)by the CONSULTANT as a
reimbursable expense. max
Reimbursable expenses shall be as defined in Subsection 5.3, with the following additions and
clarifications:
1. The cost of communications services and equipment for Field Personnel, including but not
limited to pagers,mobile radios,base station radios, and field office telephones.
6
2. The cost of transportation equipment for field personnel based on the cost to lease the vehicle(s),
plus the estimated cost of insurance, fuel, and maintenance. The CONSULTANT shall submit a
Transportation Equipment Schedule showing the number, types, and monthly cost of vehicles to
be assigned to the Project as a part of the CONSULTANT's cost proposal. The CONSULTANT
shall invoice the CITY monthly for the cost of transportation equipment in accordance with the
Transportation Equipment Schedule, which shall be part of the Services Authorization for the
Project.
5.2.2 Lump Sum
For Services rendered, the CITY shall pay the CONSULTANT a lump-sum fee, including or excluding
reimbursable expenses as mutually agreed upon and set forth in the Services Authorization. The
CONSULTANT will invoice the CITY monthly, based upon the CONSULTANT's estimate of the
portion of the total Services actually completed at the time of billing.
5.3 Reimhiirsahle Rxpenses
"Reimbursable Expenses" means the actual, necessary and reasonable expenses incurred directly or
indirectly in connection with the Project for: transportation and subsistence incidental thereto for travel
outside Orange Lake, and Seminole Counties; furnishing and maintaining field office facilities; toll
telephone calls and telegrams; reproduction of reports, and similar Project-related items; as provided in
the CITY's Policy and Procedure Manual.
5.4 Payments by Owner
5.4.1 All Services' payment (Payment) shall be made by the City to the CONSULTANT within thirty
(30) calendar days of the City's invoice receipt thereof (Payment Period), unless, within the Payment
Period, the CITY, 1) notifies the CONSULTANT of an objection to the Payment amount, and 2) either
provides the CONSULTANT with a determination of the proper Payment, or 3) requests further
information from the CONSULTANT so that a proper Payment can be derived and agreed upon by the
parties.
5.4.2 The CITY's objection to the Payment amount shall be accompanied by the CITY's remittance of
any undisputed portion of the Payment. If the objection is resolved in favor of the CONSULTANT,then
the CITY shall pay the CONSULTANT the amount [beginning from the Payment Period,plus interest at
the Florida statutory legal rate for prejudgment interest, minus any Payment amount previously paid to
the CONSULTANT with respect to the objection. If it is determined that the CITY has overpaid the
CONSULTANT, then the CONSULTANT shall, within thirty (30) calendar days, refund to the CITY
the overpayment amount, and interest, at the Florida statutory legal rate for prejudgment interest, and the
CONSULTANT shall not be held to be in breach of this Agreement thereby.
5.5 Records
The CONSULTANT also agrees to maintain, and to cause each Subconsultant to maintain, complete and
accurate books and records (Books) in accordance with sound accounting principles and standards, and
relating to all Services and the Project, and the related costs and expenditures to the CITY that have been
contracted for and paid during the life of any Services Authorization. The Books shall identify the
7
Services rendered during each month of the Services Authorization, the date that each Project expense
was incurred, and whether the expense was Service or reimbursable-related. These Books shall be
maintained for five (5) years following Final Payment; or five (5) years following termination of any
Services Authorization; whichever is the longer of these times.
5.6 Scope, Cost and Fee Adjustment
5.6.1 General. The CONSULTANT or the CITY may at any time notify the other of requested
changes to the Scope of Services as set forth in a Services Authorization. The notification shall state the
Scope modification and an adjustment of the cost estimate and fee specified in the subject Services
Authorization to reflect such modification. The cost and fee adjustment due to modification in the
Scope of Services may be calculated utilizing the same method of compensation applicable to the
Services Authorization prior to the Scope modification. The CONSULTANT and the CITY understand
that, unless the cost and fee adjustment is within a previously approved budget, any change to the Scope
of Services must be approved or authorized by the Ocoee City Commission. If the cost and fee
adjustment is within a previously approved budget for changes to the Scope of Services for the overall
Project,the change may be approved by the CITY.
5.6.2 Scope Reduction. The CITY shall have the sole right to reduce (or eliminate, in whole or in part)
the Scope of any Project at any time and for any reason, upon written notice to the CONSULTANT
specifying the nature and extent of the reduction. In such event the CONSULTANT shall be fully
compensated for the Services already performed, including payment as defined in Section 5 of all
Project-specific fee amounts due and payable prior to the effective date stated in the CITY's notification
of the reduction and for a maximum of five (5) days' demobilization costs. The CONSULTANT shall
also be compensated for the Services remaining to be done and not reduced or eliminated on the Project.
5.6.3 Scope Suspension. The CITY may, at any time and for any reason, direct the CONSULTANT to
suspend work (in whole or in part) under this Agreement. Such direction shall be in writing, and shall
specify the period during which Services shall be stopped. The CONSULTANT shall resume its
Services upon the date specified, or upon such other date as the CITY may thereafter specify in writing.
The period during which the Services are stopped by the CITY shall be added to the applicable Services
Authorization term; provided, however, that any work stoppage not approved or caused by the actions or
inactions of the CITY shall not give rise to any claim against the CITY by the CONSULTANT. The
CITY agrees to compensate the CONSULTANT for its reasonable and provable actual costs attributable
to any delay or suspension approved or caused by the actions or inactions of the CITY.
5.7 Payment Withheld
When the CITY has reasonable grounds for belief, or information to believe that, 1)the CONSULTANT
will be unable to perform the Services under any Services Authorization within the related Project Term;
or 2) a meritorious claim exists against the CONSULTANT or the CITY arising out of the
CONSULTANT's negligence or the CONSULTANT's breach of any provision of this Agreement or any
Services Authorization; then the CITY may withhold a Payment otherwise due and payable to the
CONSULTANT; provided, however, that the CITY shall not unreasonably withhold other Services
Authorization payments that may not otherwise be in dispute. Any Payment so withheld may be retained
by the CITY for such period as it deems advisable to protect the CITY against any loss or deprivation
that the CITY may incur pursuant to this Subsection, or as may be determined by a court of competent
8
jurisdiction. This provision is intended solely for the benefit of the CITY, and no person shall have any
right against any employee or agent of the CITY or claim against the CITY by reason of the City's
failure or refusal to withhold a Payment.
5.8 Termination
Upon the termination of this Agreement, the CONSULTANT shall prepare a final and complete
Payment Statement for all Services and reimbursable expenses incurred since the posting of the last
Payment Statement, and through the date of termination. The final Payment Statement shall be subject
to all of the provisions described in Section 5.
5.9 Final Payment
The acceptance by the CONSULTANT, its successors, or assigns, of any final Payment due upon the
termination of this Agreement or any Services Authorization, shall constitute a full and complete release
of the CITY from any and all claims or demands regarding further compensation for authorized Services
rendered prior to such Final Payment that the CONSULTANT, its successors, or assigns have or may
have against the CITY under the provisions of this Agreement, unless otherwise previously and properly
filed pursuant to the provisions of this Agreement, or in a court of competent jurisdiction. This
Subsection does not affect any other portion of this Agreement that extends obligations of the parties
beyond Final Payment.
SECTION 6
DISPUTE RESOLUTION
As a condition precedent to the filing of any suit or other legal proceeding, the parties shall endeavor to
resolve claims, disputes or other matters in question by mediation. Any party shall initiate mediation by
serving a written request for mediation on the other party. The parties shall, by mutual agreement, select
a mediator within fifteen(15) days of the date of the request for mediation. If the parties cannot agree on
the selection of a mediator, then the CITY shall select the mediator who, if selected solely by the CITY
shall be a mediator certified by the Supreme Court of Florida. No suit or other legal proceeding shall be
filed until the mediator declares an impasse, which declaration, in any event, shall be issued by the
mediator not later than sixty(60)days after the initial mediation conference.
SECTION 7
VENUE SELECTION AND GOVERNING LAW
The parties agree that this Agreement was entered into in Orange County, Florida, and that the
performance of the parties under this Agreement shall be deemed to be accomplished in Orange County,
Florida, and that payment is due in Orange County, Florida, and that the venue for any mediation,
collection or enforcement action under this Agreement shall be in Orange County, Florida. The
exclusive venue of any litigation or other judicial proceeding between the parties shall be the Circuit
Court of the Ninth Judicial Circuit in and for Orange County, Florida. The laws of the State of Florida
shall govern the validity, construction and performance of this Agreement without reference to its
conflict of laws provisions.
9
SECTION 8
TERMINATION
8.1 General
This Agreement may be terminated, 1) by the CITY, following fifteen (15) days prior written notice to
the CONSULTANT, as stated below, 2) by the CONSULTANT, following fifteen (15) days prior
written notice to the CITY, as stated below, and 3) by the mutual agreement of the parties. In the event
of the termination of this Agreement, any liability of one party to the other arising out of any Services
rendered, or any act or event occurring prior to the termination, shall not be terminated or released.
8.2 Failure to Perform
In addition to any other termination provisions that may be provided in this Agreement, the CITY may
terminate this Agreement in whole or in part if the CONSULTANT makes a willfully false Payment
Statement or substantially fails to perform any obligation under this Agreement and does not remedy the
failure within fifteen (15) calendar days after receipt by the CONSULTANT of written demand from the
CITY to do so, unless, however, the nature of the failure is such that it cannot, in the exercise of
reasonable diligence, be remedied within fifteen (15) calendar days, in which case the CONSULTANT
shall have such time as is reasonably necessary to remedy the failure, provided the CONSULTANT
promptly takes and diligently pursues such actions as are necessary therefor. The CONSULTANT may
terminate this Agreement if the CITY substantially fails to perform any obligation under this Agreement,
and does not remedy the failure within fifteen (15) calendar days after receipt by the CITY of written
demand from the CONSULTANT to do so, unless, however, the nature of the failure is such that it
cannot, in the exercise of reasonable diligence, be remedied within fifteen (15) calendar days, in which
case the CITY shall have such time as is reasonably necessary to remedy the failure, provided it
promptly takes and diligently pursues such actions as are necessary therefor.
8.3 Termination for Convenience
The CITY may, without prejudice to any other rights or remedies, terminate this Agreement in whole or
in part at any time for its convenience by giving the CONSULTANT fifteen (15) days written notice.
The CONSULTANT shall be paid for Services completed prior to receipt of the termination notice and
for reasonable termination settlement costs relating to commitments which had become firm prior to the
termination; however, payment to the CONSULTANT will exclude any and all anticipated supplemental
costs,administrative expenses, overhead and profit on uncompleted Services.
8.4 Payment Upon Termination
Upon termination of this Agreement, the CITY shall pay the CONSULTANT for those Services actually
rendered and contracted for under a Services Authorization, and those reasonable and provable expenses
required by any Services Authorization and actually incurred by the CONSULTANT for Services prior
to the effective date of termination. Such payments,however, shall be, 1) reduced by an amount equal to
any additional costs incurred by the CITY as a result of the termination (if the Agreement is terminated
for cause by the CITY), or 2) increased by an amount equal to the reasonable and provable expenses
incurred by the CONSULTANT (to close out its Services) that are directly attributable to the
10
termination, and for which the CONSULTANT is not otherwise compensated (if the Agreement is
terminated for the convenience of the CITY).
8.5 Delivery of Materials I Iron Termination
In the event of termination of this Agreement (or any Services Authorization) by the CITY, prior to the
CONSULTANT's satisfactory completion of all the Services described or alluded to herein, the
CONSULTANT shall promptly furnish the CITY, at no additional cost or expense, with one (1) copy of
the following items (Documents), any or all of which may have been produced prior to and including the
date of termination: data, specifications, calculations, estimates, plans, photographs, summaries,reports,
memoranda; and any and all other documents, instruments, information, and materials (whether or not
completed) generated or prepared by the CONSULTANT, or by any Subconsultant, whether in hard
copy or digital form, in rendering the Services described herein, and not previously furnished to the
CITY by the CONSULTANT pursuant to this Agreement, or any Services Authorization. The
Documents shall be the sole property of the CITY, and the CITY shall be vested with all rights provided
therein of whatever kind and however created. The CONSULTANT shall also require that all such
Subconsultants agree in writing to be bound by the provisions of this Subsection.
SECTION 9
NOTICES
All notices denominated as such by this Agreement, or the City Code, or Florida law, required to be
given to the CONSULTANT hereunder shall be in writing, and shall be given by hand-delivery or
United States mail,postage prepaid, addressed to:
All notices required to be given to the CITY shall be in writing, and shall be given by hand-delivery or
United States mail,postage prepaid,to the City Manager and City Clerk, separately,at:
CITY OF OCOEE
150 North Lakeshore Drive
Ocoee, Florida 34761
Either party may change its address, for the purposes of this Subsection, by written notice to the other
party given in accordance with the provisions of this Subsection.
SECTION 10
CONFLICTS OF INTEREST
The CONSULTANT represents and warrants unto the CITY that no officer, employee, or agent of the
CITY has any interest, either directly or indirectly, in the business of the CONSULTANT to be
conducted hereunder. The CONSULTANT further represents and warrants to the CITY that it has not
employed or retained any company or person, other than a bona fide employee working solely for the
CONSULTANT, to solicit or secure this Agreement, and that it has not paid, or agreed to pay, or given
or offered any fee, commission, percentage, gift, loan, or anything of value (Value) to any person,
company, corporation, individual, or firm, other than bona fide Personnel working solely for the
11
CONSULTANT, in consideration for or contingent upon, or resulting from the award or making of this
Agreement. Further, the CONSULTANT also acknowledges that it has not agreed, as an expressed or
implied condition for obtaining this Agreement,to employ or retain the services of any person, company,
individual or firm in connection with carrying out this Agreement. It is absolutely understood and
agreed by the CONSULTANT that, for the breach or violation of this Subsection, the CITY shall have
the right to terminate this Agreement without liability and at its sole discretion, and to deduct from any
amounts owed, or to otherwise recover, the full amount of any Value paid by the CONSULTANT.
SECTION 11
WAIVER OF CLAIMS
The CONSULTANT and the CITY hereby mutually waive any claim against each other, their elected or
appointed officials, agents, and employees, for any loss of anticipated profits caused by any suit or
proceedings brought by any third party directly or indirectly attacking the validity of this Agreement or
any part thereof, or by any judgment or award in any suit or proceeding declaring this Agreement null,
void, or voidable, or delaying the same, or any part thereof, from being carried out.
SECTION 12
INDEMNIFICATION AND INSURANCE
12.1 Indemnification and Repair of Damao
12.1.1 CONSULTANT's Indemnification of City. The CONSULTANT shall indemnify, hold harmless,
and defend the CITY, its representatives, employees, and elected and appointed officials, from and
against all claims, damages, losses, and expenses of any sort, including reasonable attorney's fees and
costs, and reasonable attorney's fees and costs on appeal, arising out of or resulting from any Services as
may be described or provided in this Agreement, any Services Authorization, or in any of the Project
documents, caused by any intentional misconduct or negligent act or omission of the CONSULTANT,
any of its agents, employees or Subconsultants, or anyone for whose act or acts any of them may be
liable. For purposes of compliance with Florida law, CONSULTANT acknowledges that this provision
shall be deemed a part of the project specifications or the bid documents.
12.2 insnrance
12.2.1 General. The CONSULTANT shall purchase, maintain, and keep in full force, effect, and good
standing, such insurance that is further described below, and any other insurance necessary to fully
protect it from claims of the nature that are detailed below, that may arise out of, or result from, the
CONSULTANT's operations, performance, or Services, or all of these things, or any of these things in
combination (CONSULTANT's Operations), whether the CONSULTANT's Operations are by the
CONSULTANT, any of its agents or Subconsultants, or anyone for whose act or acts it may be liable.
The CONSULTANT'S insurance carrier shall be licensed to do business in the State of Florida and shall
have an A.M. Best Rating of A- VI or better.
1. Claims under Worker's Compensation, disability benefit, or other (similar) employee benefit
acts; and
12
2. Claims for damages because of bodily injury, sickness or disease, or death of any person other
than its employees; and
3. Claims for damages for personal injury; and
4. Claims for damages because of injury to or destruction of tangible property, including the loss of
property use resulting therefrom.
12.2.2 Limits of Liability. The insurance required by this Subsection shall be written for not less than
the limits of liability specified below, or required by law, whichever is greater, and shall include
contractual liability insurance as applicable to the CONSULTANT's obligation under Subsection 16.2,
above:
1. Worker's Compensation and (present Florida
Employer's Liability statutory limit)
2. Comprehensive General Liability
Bodily Injury $2,000,000
Property Damage $2,000,000
3. Business Automobile $2,000,000
Liability per occurrence
12.2.3 Consultant's Errors and Omissions Policy. The CONSULTANT shall also purchase, maintain,
and keep in full force, effect, and good standing, a professional liability/errors and omissions insurance
policy having minimum limits of $1,000,000.00, with a maximum deductible of $100,000.00 or, the
CONSULTANT shall provide the CITY with policy coverage wherein the insurer agrees to pay claims
(up to the limits of coverage), and will thereafter recover the deductible from the
insured-CONSULTANT. The errors and omissions policy shall be in effect and shall insure the
CONSULTANT's performance on CITY projects.
12.2.4 Insurance Administration. Insurance Certificates, evidencing all insurance coverages referred to
in this Subsection, shall be filed (or be on file) with the CITY at least ten (10) calendar days before the
final execution of this Agreement. The Insurance Certificates shall be fully acceptable to the CITY in
both form and content, and shall provide and specify that the related insurance coverage shall not be
canceled (Coverage Change) without at least thirty (30) calendar days prior written notice having been
given to the CITY. The CONSULTANT further agrees that no material modification or reduction shall
be made to any insurance policy coverage referred to in this Agreement, unless the CONSULTANT
gives written notice to the CITY [within seven (7) calendar days of the CONSULTANT's having been
given notice by the insurer] of such material modification or reduction. "Material modification" shall
mean but not be limited to, reduction in the limit of liability by endorsement to the policy during the
policy period, change and types of claims payable, or any other change that significantly reduces the
coverage originally provided in the policy's terms. The CONSULTANT shall have thirty (30) calendar
days following such Coverage Change to file an Insurance Certificate with the CITY, demonstrating that
the particular has either been reinstated, or has been provided through another insurer(s) that is(are)
acceptable to the CITY. Failure of the CONSULTANT to obtain the CITY's approval, or to satisfy the
13
CITY in this matter of Insurance Certificates, shall be grounds for termination of the Agreement as
specified in Section 8. It is also understood and agreed that it is the CONSULTANT'S sole burden and
responsibility to coordinate activities between itself, the CITY, and the CONSULTANT'S insurer(s) so
that the Insurance Certificates are acceptable to and accepted by the CITY within the time limits
described in this Subsection.
12.2.5 City As Additional Insured. The CITY shall be listed as an additional insured on all insurance
coverage required by this Agreement, except Worker's Compensation and Professional Liability errors
and omissions insurance. Furthermore, all other insurance policies pertaining to the Services to be
performed under this Agreement shall memorialize that the CONSULTANT's, or the CONSULTANT's
Subconsultant's, or all of these entities' (Primary Insureds) insurance, shall apply on a primary basis, and
that any other insurance maintained by the CITY shall be in excess of and shall not contribute to or be
commingled with the Primary Insured's insurance.
12.2.6 CITY's Right to Inspect Policies. The CONSULTANT shall, upon thirty (30) days' written
request from the CITY, deliver copies to the CITY of any or all insurance policies that are required in
this Agreement.
SECTION 13
MISCELLANEOUS PROVISIONS
13.1 Nnn-Exclusive Cnntrart
This Agreement is non-exclusive, and may be terminated at the CITY's convenience with the proper
notice having been given to the CONSULTANT pursuant to Section 8, above. It is understood and
acknowledged that the rights granted herein to the CONSULTANT are non-exclusive, and the CITY
shall have the right, at any time, to enter into similar agreements with other consultants to perform such
services as the CITY may desire.
13.2 Local, State and Federal Obligations
13.2.1 Discrimination. The CONSULTANT, for itself, its delegates, successors-in-interest, and its
assigns, and as a part of the consideration hereof, does hereby covenant and agree that, 1) in the
furnishing of Services to the CITY hereunder, no person shall be excluded from participation in, denied
the benefits of, or otherwise subjected to discrimination in regard to this Agreement on the grounds of
such person's race, color, creed, national origin, disability, marital status, religion or sex; and 2) the
CONSULTANT shall comply with all existing requirements concerning discrimination imposed by any
and all applicable local, state, and federal rules, regulations, or guidelines, and as such rules, regulations,
or guidelines may be from time to time amended. In the event of a breach of any of the
nondiscrimination covenants described in this Subsection, the CITY shall have the right to terminate this
Agreement, with cause,as described above.
13.2.2 Compliance with Law. The CONSULTANT and its employees shall promptly observe, comply
with, and execute the provision of any and all present and future federal, state, and local laws, rules,
regulations, requirements, ordinances, and orders which may pertain or apply to the Services that may be
rendered hereto, or to the wages paid by the CONSULTANT to its employees. The CONSULTANT
14
shall also require, by contract, that all Subconsultants shall comply with the provisions of this
Subsection.
13.2.3 Licenses. The CONSULTANT shall, during the life of this Agreement, procure and keep in full
force, effect, and good standing all necessary licenses, registrations, certificates, permits, and other
authorizations as are required by local, state, or federal law, in order for the CONSULTANT to render its
Services or Work as described herein. The CONSULTANT shall also require all Subconsultants to
comply by contract with the provisions of this Subsection.
13.2.4 Compliance With New Regulations. The CONSULTANT agrees that at such time as the local,
state, or federal agencies modify their grant procedures in order for the CITY or the CONSULTANT to
qualify for local, state, or federal funding for the Services to the rendered by the CONSULTANT, then
the CONSULTANT shall consent to and make such modifications or amendments in a timely manner.
If the CONSULTANT is unable to comply with applicable local, state, or federal laws and regulations
governing the grant of such funds for Services to be rendered herein, then the CITY shall have the right,
by written notice to the CONSULTANT, to terminate this Agreement for convenience. Furthermore, if
the CONSULTANT's compliance with such laws, regulations, rules, or procedures causes a material
change to a term or condition of this Agreement, or to any Services Authorization, then the CITY agrees,
upon sufficient proof of material changes as may be presented to it by the CONSULTANT, to amend all
related CITY/CONSULTANT contractual obligations, and to revise such Project budgets accordingly.
13.2.5 License Fee and Royalties. The CONSULTANT agrees that any invention, design, process,
product, device, proprietary system, or proprietary process for which an approval (of any type) may be
necessary, shall be paid for by the CITY, but shall be secured by the CONSULTANT (or, at the
CONSULTANT's direction, by the Contractor during the CONSULTANT's construction phase services
as may be memorialized in a Services Authorization) before the completion of any Services
Authorization.
13.3 Consultant Not Agent of City
The CONSULTANT is not authorized to act as the CITY's agent hereunder and shall have no authority,
expressed or implied, to act for or bind the CITY hereunder, either in CONSULTANT's relations with
Subconsultants, or in any other manner whatsoever except as otherwise stated in a Services
Authorization.
13.4 Suhennsultants
13.4.1 General. The CONSULTANT shall have the right, conditioned upon the CITY's prior consent
(which shall not be unreasonably withheld), to employ other firms, consultants, Contractors,
subconsultants, and so forth (Subconsultants); provided, however, that the CONSULTANT shall, 1)
inform the CITY as to what particular Services the Subconsultants shall be employed to do; 2) inform
the CITY as to what extent (what percentage) of the total Project Services each Subconsultant shall be
employed to do; 3) be solely responsible for the performance of all of its Subconsultants, including but
not limited to their maintenance of schedules, correlation of Services, or both of these things, and the
resolution of all differences between them; 4) promptly terminate the use and services of any
Subconsultants upon written request from the CITY (which may be made for the CITY's convenience);
5) promptly replace each such terminated Subconsultant with a Subconsultant of comparable experience
15
and expertise; 6) cause a Subconsultant to remove any employee(s) from a Project as the CITY shall
request (again for the CITY's convenience); and 7) assure that such employee(s) shall be promptly
replaced by other employee(s) of comparable experience and expertise and who are otherwise acceptable
to the CITY. After the Subconsultant has received notice of the termination, or two (2) business days
after the CITY has notified the CONSULTANT in writing of the required termination of the
Subconsultant or the Subconsultant's employee, whichever shall occur first, the CITY shall have no
obligation to reimburse the CONSULTANT for the Services subsequent to the notice of termination of
any Subconsultant or employee who may be terminated pursuant to the provision of this Subsection;
provided, however, that the CITY shall reimburse the CONSULTANT for the CONSULTANT's
reasonable and provable Subconsultant demobilization or remobilization costs, as defined in Subsection
5.8.3 ("Suspension"), and reasonable and provable additional fees charged by the new Subconsultant, if
any, if the CITY terminates a Subconsultant for convenience; and provided, further, that the
CONSULTANT shall receive no reimbursement for demobilization or remobilization costs or any
additional fees or costs, if a Subconsultant is terminated for cause. It is also understood that the CITY
does not, by accepting a Subconsultant, warrant or guarantee the reliability or effectiveness of that
entity's Services.
13.4.2 Work Outside Scope and Time of Payment. The CITY shall have no obligation to reimburse the
CONSULTANT for the services of any Subconsultant that may be in addition to the Basic Services, or
for those Subconsultant Services not previously made known to the CITY, or that are otherwise outside
of the Scope of any particular Project Services Authorization, unless and until the CITY has given
written approval of such reimbursement. The CONSULTANT agrees to pay all such Subconsultants for
their Project-related Services no later than thirty(30)calendar days after the CONSULTANT's receipt of
payment from the CITY for work performed by the Subconsultants, unless such payment is disputed by
the CONSULTANT, and the CITY receives written notice thereof.
13.4.3 Subconsultant Contracts. The CONSULTANT shall provide a copy of all relevant provisions of
this Agreement to all Subconsultants hired by it, or for which it may have management responsibilities
as described in a Services Authorization and shall inform all Subconsultants that all Services performed
hereunder shall strictly comply with the Agreement terms and provisions. The CONSULTANT shall
also furnish the CITY, upon demand,with a copy of all CONSULTANT-Subconsultant contracts.
13.5 Assignment and Delegation
The CITY and the CONSULTANT bind themselves and their partners, successors, executors,
administrators, and assigns, to the other party of this Agreement in respect to all duties, rights,
responsibilities, obligations, provisions, conditions, and covenants of this Agreement; except that the
CONSULTANT shall not assign, transfer, or delegate its rights or duties, or both of these things, in this
Agreement without the prior written consent of the CITY. The CITY has the absolute right to withhold
such consent at its convenience, and, furthermore, if the CONSULTANT attempts to assign, transfer, or
delegate its rights or duties in violation of these provisions without the CITY's consent, then the CITY
may terminate this Agreement as a breach of contract by the CONSULTANT and a failure by the
CONSULTANT to substantially perform its obligations hereunder, and any such assignment shall be
null, void, and of no legal effect. The CITY shall have the right to assign its rights (or any part of them)
or to delegate its duties and obligations (or any part of them) to another entity that shall be bound by all
applicable terms and conditions as provided in this Agreement.
16
13.6 Audits
13.6.1 Periodic Auditing of Consultant's Books. The CITY shall have the right, at any reasonable time
and through any of its designated agents or representatives, to inspect and audit the Books for the
purpose of verifying the accuracy of any Payment Statement or Completion Report. In addition to the
above and upon request of the CITY, the CONSULTANT shall prepare an audit (for the most recent
fiscal year) for the CITY, which shall include the CONSULTANT's paid salary, fringe benefits, general
and administrative overhead costs, profit and the total amount of money paid by the CITY to the
CONSULTANT. The Fiscal Report shall be certified as true and correct by, and shall bear the signature
of,the CONSULTANT's chief financial officer or its certified public accountant.
13.6.2 Overcharge. If it is established by the audit, or by any other means, that the CONSULTANT has
over-billed or overstated its costs, fees, or reimbursable expenses (Overcharge) to the City, then the
amount of any Overcharge shall be refunded by the CONSULTANT, together with interest at the rate of
one percent (1%) per month and the CITY's reasonable and provable costs (including the auditing
expenses)in discovering the Overcharge and effecting its repayment.
13.7 Truth in Negotiations
The CONSULTANT shall execute a Truth-in-Negotiation Certificate in the form attached hereto and
made a part hereof, by reference, as Exhibit I. It is agreed by the CONSULTANT that any Project or
Services Authorization price, and any additions thereto, shall be adjusted to exclude any significant sums
[plus interest at twelve percent (12%) per annum simple interest on the sums, from the date of payment
by the CITY] by which the CITY determines that the price was increased due to inaccurate, incomplete,
or non-current wage rates and other factual unit costs.
13.8 Entire Agreement
This Agreement, including the Exhibits hereto, constitutes the entire Agreement between the parties, and
shall supersede and replace all prior agreements or understandings, written or oral,relating to the matters
set forth therein, and that specifically related to the execution of this particular document.
13.9 Amendment
This Agreement may be amended or modified only by a Services Authorization, or an Amendment, and
as duly authorized and executed by the parties.
13.10 Validity
The validity, interpretation, construction, and effect of this Agreement shall be in accordance with and
governed by the laws of the State of Florida, only. In the event any provision hereof is determined to be
unenforceable or invalid, such unenforceability or invalidity shall not affect the remaining provisions of
this Agreement, which shall remain in full force and effect. To that extent, this Agreement is deemed
severable.
17
13.11 Headings
The headings of the Sections or Subsections of this Agreement are for the purpose of convenience only,
and shall not be deemed to expand, limit, or modify the provisions contained in such Sections or
Subsections.
13.12 Timeliness
The City and the CONSULTANT acknowledge and understand that time is of the essence in this
Agreement, and that the Services shall be performed in as expeditious a manner as may be in accord
with the nature of each Project.
13.13 Public Entity Crime,
Any Person or affiliate, as defined in 287.133 of the Florida Statutes, shall not be allowed to contract
with the CITY, nor be allowed to enter into a subcontract for work on this AGREEMENT, if such a
person or affiliate has been convicted of a public entity crime within three (3) years of the date this
AGREEMENT was advertised for proposals, or if such person or affiliate was listed on the State's
convicted vendor list within three (3) years of the date this AGREEMENT was advertised, whichever
time period is greater. A public entity crime means a violation of any state or federal law with respect to
and directly related to the transaction of business with any public entity or agency (federal, state or
local), involving antitrust, fraud, theft, bribery, collusion, racketeering, conspiracy, forgery, falsification
of records, receiving stolen property or material misrepresentation. Any AGREEMENT with the CITY
obtained in violation of this Section shall be subject to termination for cause. A Subconsultant who
obtains a subcontract in violation of this Section shall be removed from the Project and promptly
replaced by a Subconsultant acceptable to the City.
13.14 Force Majeure
The parties acknowledge that adverse weather conditions, acts of God, or other unforeseen
circumstances of a similar nature, may necessitate modifications to a Services Authorization, such
modifications to include, but not limited to the particular Services Authorization's Scope, Term, and Fee.
If such conditions and circumstances do in fact occur, then the CITY and CONSULTANT shall
mutually agree, in writing,to the modifications to be made to any Services Authorization.
IN WITNESS WHEREOF, this Agreement has been fully executed on behalf of the parties hereto
and by its duly authorized representatives, as of the date first written above.
18
ACCEPTED:
ATTEST:
/ /
, , cs. /
4.9
Name: C Name:`vr a
Y Harold F. Schmidt, Jr, P F. DEE
Title: Vice President
(SEAL)
APPROVED:
CITY OF OCOEE,FLORIDA
ATTEST:
Jean Grafton, City Clerk S. Scott Vandergrift, Mayor
(SEAL)
FOR USE AND RELIANCE ONLY BY APPROVED BY THE OCOEE CITY
THE CITY OF OCOEE,FLORIDA COMMISSION AT A MEETING
APPROVED AS TO FORM AND LEGALITY HELD ON ,2004
this day of , 2004 . UNDER AGENDA ITEM NO.
FOLEY&LARDNER
By:
City Attorney
19
TRUTH-IN-NEGOTIATION CERTIFICATE
The CONSULTANT hereby certifies that all wage rates, and any and all other unit costs
supporting the compensation to be paid to the CONSULTANT pursuant to a Services Authorization for
the Services as set forth therein, will be accurate, complete, and current at the date of the Services
Authorization's execution.
WITNESS:
BY: 1)1141 / 1/a? "� rr:,
� BY: � �r,f����;�
I
(Print Name) (Print/ Name)
TITLE: V i CjCPS den+
STATE OF FLORIDA }
COUNTY OF a"
,PERSONALLY APPEARED before me, the undersigned authority, ivL/Z
, [ well known to me or [] who hasroduc, d hi er as
identification, and known by me to be the V t C�1E5r of-6r1& of the corporation named above, and
acknowledged before me that he/she executed the foregoing instrument on behalf of said corporation as
its true act and deed, and that he/she was duly authorized to do so. / M/�,
WITNESS my hand and official seal this Zday of Nt U'' 1S o) f
49‘
NOTARY PUBL1 , kidd
Print Name: r
My Commission Expires:
evesw"a,••,, CARLA M.GAYLORD 11
, YA MY COMMISSION#DD 212796
l EXPIRES:June 25,2007
""4amOF -fsgz,, Bonded Tmm Pichard Insurance Agency
CITY OF OCOEE
WATER SYSTEM
THREAT AND VULNERABILITY ASSESSMENT
SCOPE OF SERVICES
APPROACH TO WORK
The comprehensive vulnerability assessment to be done for the City of Ocoee covers several
different areas that will require different methods. Hartman & Associates, Inc. (HAI) therefore
proposes doing the vulnerability assessment in two (2) phases. For purposes of time, these
phases can be done in parallel, but are best seen as separate pieces of work because they will
require different methods and different personnel to complete.
Our recommended approach to the work for each of the phases is described below.
PHASE A-WATER SYSTEM RAM-W TVA
The purpose of this project is to perform a vulnerability risk assessment of the City of Ocoee,
Florida water production and distribution facilities. HAI will perform the assessment in
accordance with the Risk Assessment Methodology for Water Utilities (RAM-W) as developed
by Sandia National Laboratories and the American Water Works Association Research
Foundation(AWWA-RF).
The Public Health Security and Bio-terrorism Response Act of 2002 (PL107-288)requires all
community water system providers to conduct Vulnerability Assessments and amend their
emergency response plans (ERP). HAI is well suited to help the City of Ocoee meet the
challenge of bringing water facility security to the levels required in this age of terrorism.
The assessment will address facilities within the City's water department, including the water
treatment and distribution systems. The following facilities are included:
1. The City's three (3) water treatment plants (Forest Oaks, Jamela, and South) and
associated on-site wells
2. Water distribution system
In order to provide the City of Ocoee with a general understanding of our project approach we
offer the following summary description of our plan for accomplishing the proposed RAM-W
VA. These tasks will be accomplished during a workshop that HAI will coordinate and lead.
Site visits by HAI will be made as required before the workshop or prior to Task 700 (Estimate
System Effectiveness).
hes/mg/corresp/scope-rev.doc
HAI#04.0063.000 -1-
Task A-1: Planning-Prioritize Mission Objectives and Facilities/Assets
Purpose: To identify and prioritize the Utility's mission objectives (the primary purposes
of the Utility). These will be used to help measure the importance of the various facilities
and assets.
Action: For each mission objective, list the facilities, subsystems and assets with the
Utility that can impact that mission objective. Rank-order the facilities and assets under
each mission objective.
Task A-2: Planning-Define Risk Reduction Goals
Purpose: Determine the risk reduction goals for the system. This information will be
used during decision making implementing system upgrades to reduce risk.
Action: Establish potential risk reduction goals for the Utility and list them.
Task A-3: Threat Assessment-Develop Threat Spectrum
Purpose: Define the type of threat against which the facility and assets will be protected
(Design Basis Threat, DBT)
Action: Review the Threat Spectrum table. Pick two (2) or three (3) threats to be used as
the DBT. Modify their description per our best and most realistic judgment.
Task A-4: Site Characterization -Asset Identification
Purpose: Identify and list the critical assets within each facility
Action: List each asset identified and provide a brief description of them.
Task A-5: Consequence Assessment-Develop a Site Specific Consequence Matrix
Purpose: Establish the Consequence Matrix that will be used to determine the level of
consequence caused by the loss of each critical asset.
Action: Use the provided worksheet and establish the "Site-specific Consequence
Matrix".
Task A-6: Consequence Assessment-Determine Consequence Levels for Assets
Purpose: Determine the consequence for the loss of each critical asset in the system.
Action: Consider each asset's contribution to meeting the mission objectives of the utility
and define the level of consequence for each. Review each asset and determine the
hes/mg/corresp/scope-rev.doc
HAI#04.0063.000 -2-
highest level of consequence for it. That value becomes the Overall Consequence Value
for the asset.
Task A-7: System Effectiveness-Estimate System Effectiveness
Purpose: Estimate the effectiveness of the existing security system and operations system
in protecting each asset.
Action: Make a sketch (or use a drawing) to show the locations of the high consequence
critical assets and physical protection features. Mark the sketch with possible adversary
paths to the critical assets. Describe the worst-case path for each asset. Answer each of
the system effectiveness questions for detection, delay and response. Estimate overall
system effectiveness.
Task A-8: Risk Analysis-Determine Baseline Relative Risk
Purpose: Calculate the relative risk value for each specific adversary at each asset.
Action: Identify those assets with "M" to "VH" relative risk from an earlier step. Define
potential upgrades that could be implemented to reduce the risk. List the most effective
potential upgrades for each critical asset. Re-evaluate the values for consequence and
system effectiveness for each critical asset.
PHASE B - SCADA/CYBER VA
This phase includes an in-depth vulnerability assessment of the City of Ocoee's SCADA and
information technology(IT) systems. The RAM-W assessment methods only provide a general,
cursory assessment of the vulnerabilities of the SCADA and IT systems. In order to find
vulnerabilities in the computer systems and networks, special knowledge and tools are required.
Unlike physical security, computer and SCADA security cannot be evaluated by visual
inspection. Hackers utilize electronic tools to search for security holes in Operating Systems,
software, and network infrastructure. The only means of detecting these holes is by analyzing
the systems electronically. HAI will perform Automated Vulnerability Detection utilizing
software tools to properly evaluate your systems.
Our project approach is based upon our experience in performing similar assessments as well as
ongoing support services, and is tailored to meet your specific project requirements and
schedule.
An effective Risk/Vulnerability Assessment identifies gaps in security related to people,
operations and technology. HAI proposes that a certification standard consistent with the
Common Criteria Level RAL4 (ITSEC level C2) be used through out the vulnerability
assessment. HAI will complete a risk assessment of the vulnerabilities that exist relating to the
City of Ocoee's IT networks and systems.
hes/mg/corresp/scop e-rev.doc
HAI#04.0063.000 -3-
This portion of the assessment will include the following services:
1. Background information
2. System architecture review
3. Automated IT vulnerability assessment
4. Incorporation into the Final Report
Task B-1: Background Information
Prior to assessment team arrival on site, background information will be gathered and
reviewed by HAI. The City of Ocoee will be requested to supply the following
information on it's' IT systems:
1. SCADA/IT system and network block diagrams
2. List of software applications running on the systems
3. SCADAIIT security policy,procedures, standards and plans
4. Network administration and version control procedures.
The information will be reviewed, and interview templates and other worksheets will be
prepared.
Task B-2: System Architecture Review
A brief kick-off meeting with the assessment team and the City of Ocoee's stakeholders
will be held to discuss coordination and the assessment goals and schedule. Immediately
after the meeting, interviews with City of Ocoee SCADA/IT staff familiar with the design
and operation of the City of Ocoee's SCADA/IT facilities will be conducted. The City of
Ocoee is requested to identify three interview candidates most familiar with the
SCADA/IT architecture, operations and governance. These interviews will be conducted
using security questionnaires, document reviews and site surveys.
A review of the current system architectures and design will be performed. An interview
will be conducted with IT personnel to capture any recent modifications. Particular
emphasis will be placed on any Internet and extra-net configurations, Virtual Private
Network (VPN) configurations, modem access points, wireless access points, intrusion
detection systems, routers, firewalls, and switches.
The HAI team will examine and evaluate the direct infrastructure linkages between and
among the infrastructures that support the facilities critical to the City of Ocoee's
SCADA/IT infrastructure. This task is limited to one-half day of on-site work by the one
person assessment team.
Task B-3: Policies and Procedures Review
A review of IT policies and procedures will be performed. The review will include email
policies, acceptable internet use policies, password policies, hiring/termination policies,
hes/mg/corresp/scope-rev.doc
HAI#04.0063.000 -4-
anti-virus policies, system log policies, incident response policies, remote access policies,
system/network administrator certification and training policies, backup and restore
policies, and business continuity/disaster recovery plans and policies.
The IT policies and procedures review will be a general audit to identify weaknesses in
the policies and procedure program. The detailed review of the individual policies and
procedures themselves with recommendations for refinement would require additional
cost.
Task B-4: Automated IT Vulnerability Assessment
Identification of vulnerabilities on the SCADA/IT network will use automated tools
specifically designed to look for most known vulnerabilities. An automated TCP/IP
vulnerability assessment will be conducted to identify, in detail, vulnerabilities on the
subnets within the scope of the vulnerability assessment. Automated tools will identify
potential vulnerabilities on dial-up analog telephone lines, through TCP/IP network
connections such as the internet, and wireless TCP/IP WAN/LAN connections.
The automated network assessment will include scans of internet-facing machines as well
as assessment of internal machines. This task is limited to 2-days of on-site work.
Task B-5: Final Report
A section in the draft and final TVA report identifying the findings and recommendations
will be provided. The section of the final TVA report covering the SCADA and IT
system s will include specific findings and recommendations.
COMPENSATION FOR ENGINEERING SERVICES
Based on the scope of services and schedule the estimated project cost for services is $24,500.00,
and can be brokendown as noted in the Table below:
Descri tion Cost
1. Physical VA $8,120.00
2. SCADA/Cyber VA $6,960.00
3. Draft and Final Reports $9,420.00
TOTAL $24,500.00
hes/mg/corresp/scope-rev.doc
HAI#04.0063.000 -5-