REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF SAN BERNARDINO COUNTY
AND RECORD OF ACTION
June 13, 2023
FROM
LYNN FYHRLUND, Chief Information Officer, Innovation and Technology Department
SUBJECT
Title
Agreements with Microsoft Corporation and Cisco Systems, Inc. for an Online Marketplace and Cloud Security Plugin
End
RECOMMENDATION(S)
Recommendation
1. Approve non-financial Commercial Marketplace Terms of Use, including non-standard terms, with Microsoft Corporation, for access to and use of an online marketplace referred to as Azure Marketplace and AppSource, effective upon acceptance of the online terms and continuing until the online marketplace is no longer in use by the County.
2. Approve non-financial contract, including non-standard terms, with Cisco Systems, Inc. for a cloud security plugin offered through the Microsoft Corporation Azure Marketplace and AppSource, effective upon acceptance of the online terms and continuing until termination by either party.
3. Designate the Chief Information Officer, Assistant Chief Information Officer, or IT Division Chief to electronically accept the Terms of Use and contract referenced in Recommendation Nos. 1 and 2, and any future updates, subject to review by County Counsel, provided that such updated terms do not substantively modify the original terms or contract.
4. Direct the Chief Information Officer, Assistant Chief Information Officer, or IT Division Chief to transmit printed copies of any updated terms to the Terms of Use and contract referenced in Recommendation Nos. 1 and 2 that are electronically accepted to the Clerk of the Board of Supervisors within 30 days of electronic acceptance.
(Presenter: Lynn Fyhrlund, Chief Information Officer, 388-5501)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Operate in a Fiscally-Responsible and Business-Like Manner.
FINANCIAL IMPACT
Approval of this item will not result in the use of Discretionary General Funding (Net County Cost). The Commercial Marketplace Terms of Use with Microsoft Corporation (Microsoft) and the contract with Cisco Systems, Inc. (Cisco) (collectively the “Agreements”) are non-financial in nature and do not commit the County to make any purchases. If future purchases are made under the Agreements, the Innovation and Technology Department (ITD) will adhere to County purchasing policies and return to the Board of Supervisors (Board) for approval, if necessary.
BACKGROUND INFORMATION
ITD provides information technology infrastructures and solutions to County departments that facilitate their ability to provide public services. The Microsoft Azure Marketplace and AppSource (Azure Marketplace) is an online store that features a broad range of information technology (IT) software applications and services from Microsoft and various third-party publishers.
Approval of the Commercial Marketplace Terms of Use (MS Agreement) with Microsoft will enable ITD to procure and deploy necessary software and services from the Azure Marketplace to build new solutions and manage the cloud infrastructure.
Upon approval of the MS Agreement, ITD will proceed to download the Cisco Umbrella plugin from the Azure Marketplace. This plugin is offered by Cisco, a publisher in the Azure Marketplace, at no cost and integrates multiple security functions such as content filtration, centralized security policy management, and malware detection and spread prevention, providing one comprehensive solution that extends data protection to devices, remote users, and distributed locations throughout the County. Approval of the contract with Cisco (Contract) will allow ITD to download and use the Cisco Umbrella plugin. ITD plans to utilize the Azure Marketplace to procure additional software applications and services and will return to the Board for approval of specific contracts.
The MS Agreement is Microsoft’s standard commercial contract, which includes terms that differ from the standard County contract and omits certain County standard contract terms. The MS Agreement is a non-negotiable clickwrap agreement accepted by accessing and using the Microsoft Commercial Marketplace. The non-standard and missing terms include the following:
1. Governing law is Washington State law.
• The County standard contract requires California governing law.
• Potential Impact: The MS Agreement will be interpreted under Washington state law. Any questions, issues or claims arising under this MS Agreement will require the County to hire outside counsel competent to advise on Washington law, which may result in fees that exceed the total MS Agreement amount.
2. Microsoft may change the terms of the MS Agreement at any time upon notice and the County’s continued access and use of the Microsoft Commercial Marketplace constitutes acceptance.
• The County standard contract requires that any changes to the contract to be reduced to writing, executed and attached to the original contract and approved by the person(s) authorized to do so on behalf of contractor and County.
• Potential Impact: The County could be agreeing to new terms without review by anyone, including County Counsel, and without approval of the new terms by the Board. County Counsel cannot advise on whether and to what extent Washington law may affect the enforceability of unilateral changes to the terms.
3. There is no requirement in the MS Agreement that Microsoft provide notice and obtains the County’s consent to assign the MS Agreement.
• The County standard contract requires that the County must approve any assignment of the contract.
• Potential Impact: Microsoft could assign the MS Agreement to a third party or business with which the County is legally prohibited from doing business due to issues of Federal debarment or suspension and conflict of interest, without the County’s knowledge. Should this occur, the County would be out of compliance with the law until it becomes aware of the assignment and terminates the MS Agreement. County Counsel cannot advise on whether and to what extent Washington law may permit or restrict a party’s right to assign without an express provision in the MS Agreement.
4. There is no provision in the MS Agreement addressing each party’s responsibility for paying attorneys’ fees.
• The County standard contract requires each party to bear its own costs and attorney fees, regardless of who is the prevailing party.
• Potential Impact: County Counsel cannot advise on, whether and to what extent, Washington law may affect a party’s requirement to pay the prevailing party’s attorneys’ fees and costs in a legal action where no specific provision is provided in the MS Agreement.
5. The MS Agreement does not require Microsoft to indemnify the County, as required by County Policy 11-07.
• The County standard contract indemnity provision requires the contractor to indemnify, defend, and hold County harmless from third party claims arising out of the acts, errors or omissions of any person.
• Potential Impact: Microsoft is not required to defend, indemnify or hold the County harmless from any claims, including indemnification for claims arising from Microsoft’s negligent or intentional acts. If the County is sued for any claim based on its use of the Microsoft Commercial Marketplace, the County may be solely liable for the costs of defense and damages, which could exceed the total MS Agreement amount. County Counsel cannot advise on whether and to what extent Washington law may allow the County to require Microsoft to defend or indemnify it absent an express provision in the MS Agreement.
6. The MS Agreement does not require Microsoft to meet the County’s insurance standards as required pursuant to County Policy 11-07.
• County Policy requires contractors to carry appropriate insurance at limits and under conditions determined by the County’s Risk Management Department and set forth in the County standard contract.
• Potential Impact: The County has no assurance that Microsoft will be financially responsible for claims that may arise from the County’s use of the Microsoft Commercial Marketplace, which could result in expenses to the County that exceed the total MS Agreement amount.
7. Microsoft limits its liability to direct damages up to $5,000, without exclusion.
• The County standard contract does not include a limitation of liability.
• Potential Impact: Claims could exceed the liability cap and the MS Agreement amount leaving the County financially liable for the excess. County Counsel cannot advise on, whether and to what extent, Washington law may limit or expand the exclusion of limits to the extent prohibited by applicable law.
8. There is no stated term of the MS Agreement.
• County Policy 11-06SP does not permit indefinite term or automatically renewing contracts unless approved by the Board.
• Potential Impact: There is no end term to the MS Agreement and the County is indefinitely bound to the terms and conditions of the MS Agreement until it ceases use of the Microsoft Commercial Marketplace.
9. Venue for disputes arising under the MS Agreement is in King County, Washington.
• The County standard contract requires venue for disputes in Superior Court of California, County of San Bernardino, San Bernardino District.
• Potential Impact: Having a venue in King County, Washington may result in additional expenses that exceed the amount of the MS Agreement.
10. Microsoft provides no warranties, and use of the Microsoft Commercial Marketplace “as is”, “with all faults” and “as available”.
• There is no warranty requirement in the County standard contract. The County expects its vendors and service providers to fully warrant the products and services they provide to the County.
• Potential Impact: The County’s access to and use of the Microsoft Commercial Marketplace is solely at its own risk. County Counsel cannot advise on, whether and to what extent, Washington law may limit or expand the disclaimers of warranty to the extent prohibited by applicable law.
The Contract is a template that Microsoft created to facilitate a transaction between Cisco, as the Publisher of the application and the customer downloading the application. Microsoft is not a party to the Contract. The Contract includes terms that differ from the standard County contract and omits certain County standard contract terms. The Contract is a non-negotiable clickwrap accepted by downloading, installing, or using the software. The nonstandard and missing terms include the following:
1. The County is required to defend and indemnify Cisco against third party claims arising from the County’s breach of the Contract or user terms.
• The County standard contract does not include any indemnification or defense by the County of a contractor.
• Potential Impact: By agreeing to indemnify Cisco, the County could be contractually waiving the protection of sovereign immunity. Claims that may otherwise be barred against the County, time limited, or expense limited could be brought against Cisco without such limitations and the County would be responsible to defend and reimburse Cisco for costs, expenses, and damages, which could exceed the total Contract amount.
2. The Contract does not require Cisco to meet the County’s insurance standards as required pursuant to County Policy 11-07.
• County Policy requires contractors to carry appropriate insurance at limits and under conditions determined by the County’s Risk Management Department and set forth in the County standard contract.
• Potential Impact: The County has no assurance that Cisco will be financially responsible for claims that may arise from the County’s use of the application, which could result in expenses to the County that exceed the total Contract amount.
3. Cisco’s maximum liability to the County is limited to direct damages up to the amount paid by the County for the application or in the 12 months prior to the incident for subscriptions, without exclusion for Cisco’s gross negligence, willful misconduct or violation of law.
• The County standard contract does not include a limitation of liability.
• Potential Impact: Claims could exceed the liability cap and the Contract amount leaving the County financially liable for the excess.
4. The Contract has an indefinite period beginning on Microsoft’s acceptance of an order and continuing under the end of the subscription period set forth in the order, unless renewed, or for a perpetual term.
• County Policy 11-06SP does not permit indefinite term or automatically renewing contracts unless approved by the Board.
• Potential Impact: There is no end term to the Contract and the County is indefinitely bound to the terms and conditions of the Contract until it ceases use of application.
ITD recommends approval of the Agreements, including non-standard terms, to allow ITD to take advantage of innovative software and services within the Azure Marketplace, such as this plugin for Cisco Umbrella to improve overall network security.
PROCUREMENT
The Agreements, including non-standard terms, will be used to accompany future purchase orders to be approved, as necessary, per County Policy 11-04, Procurement of Goods, Supplies, Equipment, and Services, provided that Microsoft does not substantively modify the terms. The Cisco plugin is a free product that was selected based on its integration with the Cisco Umbrella cloud-delivered security service, which is currently in use by ITD.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Bonnie Uphold, Supervising Deputy County Counsel, 387-5455) on May 3, 2023; Purchasing (Tevan Stremel, Buyer III, 387-2098) on April 27, 2023; Risk Management (Victor Tordesillas, Director, 386-8623) on May 10, 2023; Finance (Ivan Ramirez, Administrative Analyst, 387-4020) on May 23, 2023; and County Finance and Administration (Paloma Hernandez-Barker, Deputy Executive Officer, 387-5423) on May 30, 2023.