REPORT/RECOMMENDATION TO THE BOARD OF DIRECTORS
OF SAN BERNARDINO COUNTY FIRE PROTECTION DISTRICT
AND RECORD OF ACTION
February 27, 2024
FROM
DAN MUNSEY, Fire Chief/Fire Warden, San Bernardino County Fire Protection District
SUBJECT
Title
Non-Financial Agreement with Cohesity, Inc. for Cohesity Data Cloud Services
End
RECOMMENDATION(S)
Recommendation
Acting as the governing body of the San Bernardino County Fire Protection District:
1. Approve non-financial Terms of Service Agreement, which contains the Business Associate Agreement, including non-standard terms, with Cohesity, Inc. for Cohesity Data Cloud Services, beginning upon download, installation, or use of the services, and continuing until terminated by either party.
2. Authorize the Fire Chief/Fire Warden to electronically accept the Terms of Service Agreement identified in Recommendation No. 1.
(Presenter: Dan Munsey, Fire Chief/Fire Warden, 387-5779)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Improve County Government Operations.
Operate in a Fiscally-Responsible and Business-Like Manner.
Provide for the Safety, Health and Social Service Needs of County Residents.
FINANCIAL IMPACT
Approval of the recommended actions will not result in the use of Discretionary General Funding (Net County Cost). The Cohesity, Inc. (Cohesity) Terms of Service Agreement, which includes the Business Associate Agreement (collectively Agreement), is non-financial in nature and does not commit the San Bernardino County Fire Protection District (SBCFPD) to make any purchases. If future purchases are made in conjunction with the Agreement, SBCFPD will adhere to purchasing policies and return to the Board of Directors (Board) for approval, if necessary.
BACKGROUND INFORMATION
SBCFPD uses multiple information technology products to provide professional fire protection and advanced life support services to the public. Cohesity provides backup data solutions that protect the safety and integrity of data in case of server failure, user deletion, or ransomware attack. Cohesity will protect and manage SBCFPD data from attacks and outages, across any environment. It provides fast response and recovery from cyberattacks or any disruptions that threaten operations.
The Agreement is Cohesity’s standard commercial contract, which includes terms that differ from the standard County contract and omits certain County standard contract terms. The Agreement is a non-negotiable clickwrap agreement accepted upon downloading, installing, or using the services. The non-standard and missing terms include the following:
1. Cohesity may assign the Agreement without notice to SBCFPD and without SBCFPD’s approval.
• The County standard contract requires that the County must approve any assignment of the contract.
• Potential Impact: Cohesity could assign the Agreement to a third party or business with which SBCFPD is legally prohibited from doing business due to issues of Federal debarment or suspension and conflict of interest, without SBCFPD’s knowledge. Should this occur, SBCFPD would be out of compliance with the law until it becomes aware of the assignment and terminates the Agreement.
2. All disputes arising under the Agreement must be settled by binding arbitration.
• The County standard contract does not require arbitration.
• Potential Impact: Binding arbitration decisions are not appealable. In addition, disputes that might otherwise be settled in small claims court would incur arbitration costs that could exceed the costs of a small claims action, and the Agreement amount.
3. The prevailing party is entitled to recover attorneys’ fees and costs.
• The County standard contract requires each party to bear its own costs and attorney fees, regardless of who is the prevailing party.
• Potential Impact: If either party demands arbitration related to the Agreement, the arbitrator may award reimbursement of reasonable expenses, including attorneys’ fees to the prevailing party, which could exceed the total Agreement amount.
4. The Agreement does not require Cohesity to indemnify the County, as required by County Policy 11-07.
• The County standard contract indemnity provision requires the contractor to indemnify, defend and hold harmless the County and its authorized officers, employees, agents and volunteers from any and all claims, actions, losses, damages, penalties, injuries, costs and expenses (including costs for reasonable attorney fees) that are caused by or result from the acts or omissions of Contractor, its officers, employees, agents and subcontractors, with respect to the use, access, maintenance or disclosure of County’s Protected Health Information (PHI), including without limitation, any breach of PHI or any expenses incurred by County in providing required breach notifications.
• Potential Impact: Cohesity is not required to defend, indemnify or hold the County harmless from any claims, including indemnification for claims arising from its use or or access to County PHI. If the County is sued for any claim of breach or misuse of PHI, the County may be solely liable for the costs of defense and damages, which could exceed the total Agreement amount.
5. SBCFPD is required to indemnify Cohesity against third party claims arising out of the SBCFPD’s breach of the Agreement or violation of law by SBCFPD or SBCFPD users.
• The County standard contract does not include any indemnification or defense by the County of a contractor.
• Potential Impact: By agreeing to indemnify Cohesity, SBCFPD could be contractually waiving the protection of sovereign immunity or other statutory immunities. Claims that may otherwise be barred against SBCFPD, time limited, or expense limited could be brought against Cohesity without such limitations and SBCFPD would be responsible to reimburse Cohesity for costs, expenses, and damages, which could exceed the total Agreement amount.
6. The Agreement does not require Cohesity to meet SBCFPD’s insurance standards as required pursuant to County Policy 11-07.
• County Policy requires contractors to carry appropriate insurance at limits and under conditions determined by the County’s Risk Management Department and set forth in the County standard contract.
• Potential Impact: SBCFPD has no assurance that Cohesity will be financially responsible for claims that may arise from SBCFPD’s use of the service, which could result in expenses to SBCFPD that exceed the total Agreement amount.
7. Cohesity limits its aggregate maximum liability to the greater of the amount of fees paid to Cohesity for the applicable services during the twelve-month period prior to the date the cause of action arose and $250,000, excluding (a) liability that cannot be limited by law; (b) bodily injury or death resulting from negligence; (c) gross negligence or willful misconduct; (d) breach of confidentiality; and indemnification.
• The County standard contract does not include a limitation of liability.
• Potential Impact: Claims could exceed the liability cap and the Agreement amount leaving SBCFPD financially liable for the excess.
8. Venue for disputes arising under the Agreement is in the federal and state courts in the Northern District of California.
• The County standard contract requires venue for disputes in Superior Court of California, County of San Bernardino, San Bernardino District.
• Potential Impact: Having a venue in the Northern District of California may result in additional expenses that exceed the amount of the Agreement.
Notwithstanding the non-standard provisions, SBCFPD is recommending that the Board approve the Agreement associated with Cohesity Data Cloud Services as it will allow SBCFPD to purchase a software solution for data to be safely backed up in case of server failure, user deletion, or ransomware attack.
PROCUREMENT
The recommended Agreement will be used to accompany future purchase orders to be approved, as necessary, per County Policy 11-04 Procurement of Goods, Supplies, Equipment and Services.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Bonnie Uphold, Supervising Deputy County Counsel, 387-5455) on January 30, 2024; Risk Management (Victor Tordesillas, Director, 386-8623) on January 30, 2024; Finance (Ivan Ramirez, Administrative Analyst, 387-4020) on February 5, 2024; and County Finance and Administration (Valerie Clay, Deputy Executive Officer, 387-5423) on February 8, 2024.