The City shall accept the item(s) on the twentieth (20th) business day after the date of receipt of the item(s) by the "City" unless prior to the twentieth (20th) day, the Chief Procurement Officer (CPO) or his/her designee delivers a notice to the Vendor stating the reason(s) why the item(s) have not been accepted.

Except as otherwise provided in this Award, this Award shall be subject to change, amendment, or modification only by the mutual written consent of the parties hereto.

The City, by written notice from the Chief Procurement Officer to the Vendor, at any time during the term of this award, may add or delete like or similar equipment, supplies, locations and/or services to the list of equipment, supplies, locations, and/or services to be provided. Any such written notice shall take effect on the date stated in the notice from the City. Similar equipment, supplies, services, or locations added to the award shall be in accordance with the solicitation specification/scope of services, and the charges or rates for items added shall be the same as specified on the Bid. In the event additional equipment, supplies, locations and/or services are not identical to the item(s) already awarded, the charges therefore will then be the Vendor’s normal and customary charges or rates for the equipment, supplies, locations and/or services classified on the Bid.

If the Vendor’s Direct Cost decreases at any time during the full term of this award, Vendor shall immediately pass the decrease on to the City and lower its prices by the amount of the decrease in Direct Cost.

Vendor shall notify the Chief Procurement Officer of price decreases in the same way as for price increases set out below. The price decrease shall become effective upon Chief Procurement Officer’s receipt of Vendor’s notice.

Vendors may request a price increase after twelve (12) months from the solicitation due date. Subsequent price increases may be requested four (4) months from the date of the previous approved price increase. The amount of the first increase shall not exceed actual documented increase in Vendor’s Direct Cost and shall not ever be more than 10% above the previous Bid price. The amount of the subsequent price increase shall also not exceed this percentage.

To request a price increase, Vendor must submit a letter setting the amount of the increase, along with an itemized list of any increased prices, showing the Vendor’s current price, revised price, the actual dollar difference and the percentage of the price increase by line item. Documentation from the Vendor’s Vendor(s) showing the actual dollar increase to the Vendor must accompany this request. Such documentation from the Vendor’s Vendor must clearly show the dollar increase incurred by the Vendor on the applicable solicitation per item bid. The letter and documentation shall be sent to the following address:

Chief Procurement Officer
City of Houston
P.O. Box 1562
Houston, Texas 77251

If the Chief Procurement Officer approves the price increase, he or she shall notify Vendor in writing; no price increase will be effective until Vendor receives this notice. If the Chief Procurement Officer does not approve Vendor’s price increase, Vendor may terminate its performance upon sixty (60) days advance written notice to the Chief Procurement Officer. Termination of performance is Vendor’s only remedy if the Chief Procurement Officer does not approve the price increase.

If, at any time after approving a price increase, the Chief Procurement Officer determines that the City can obtain the same item at a lower price from a different source without violating the State Bid laws, the City may then purchase the item from the lower price source without any obligation to the Vendor.

In the event of unforeseen changes in the market, the awarded Vendor may request an off-cycle price adjustment to be approved at the discretion of the Chief Procurement Officer or his/her designee.

This Award shall be construed and interpreted in accordance with the applicable laws of the State of Texas and City of Houston. Venue for any disputes relating in any way to this Award shall lie exclusively in Harris County, Texas.

The captions contained in these Terms and Conditions are guides and labels to assist in locating and reading such Terms and Conditions, and shall not be restrictive of the subject matter of any article, section, or part of this Award.

At any time the Agreement Term, the CPO may issue a Change Order to increase or decrease the scope of services or change plans and specifications as he or she may find necessary to accomplish the general purposes of this Agreement. Vendor shall furnish the services or deliverables in the Change Order in accordance with the requirements of this Agreement plus any special provisions, specifications, or special instructions issued to execute the extra work.

The CPO will issue the Change Order in substantially the following form:

CHANGE ORDER

TO: (Name of Vendor)
FROM: City of Houston, Texas (the "City")
DATE: (Date of Notice)
SUBJECT: Change Order under the Agreement between the City and (Name of Vendor) countersigned by the City Controller on (Date of Countersigned of the Agreement)

Subject to all terms and conditions of the Agreement, the City requests that Vendor provide the following: (Here described the additions to or changes to the equipment or services and the Change Order Charges applicable to each.)

Signed: (Signature of CPO)

The CPO may issue more than one Change Order, subject to the following limitations:

• The City Council expressly authorizes the CPO to approve one or more Change Orders, provided each Change Order cannot exceed $50,000. A Change Order of more than $50,000 must be approved by the City Council.
• If a Change Order describes items that Vendor is otherwise required to provide under this Agreement, the City is not obligated to pay any additional money to Vendor.
• The total of all Change Orders issued under this section may not increase the original award amount by more than 25%.

Whenever the Vendor receives a Change Order, Vendor shall furnish all material, equipment, and personnel necessary to perform the work described in the Change Order. Vendor shall complete the work within the time prescribed. If no time for completion is prescribed, Vendor shall complete the work within a reasonable time. If the work described in any Change Order causes an unavoidable delay in any other work Vendor is required to perform under this award, Vendor may request a time extension for the completion of the work. The CPO’s decision regarding a time extension is final.

A product or service provided under a Change Order is subject to inspection, acceptance, or rejection in the same manner as the work described in the original award and is subject to the terms and conditions of the original award as if it had originally been a part of the award.

Vendor shall comply with all applicable state and federal laws and regulations and the City Charter and Code of Ordinances.

Anti-Boycott of Israel. Vendor certifies that Vendor is not currently engaged in and agrees for the duration of this Agreement not to engage in, the boycott of Israel as defined by Section 808.001 of the Texas Government Code.

Anti-Boycott of Energy Companies. Vendor certifies that Vendor is not currently engaged in and agrees for the duration of this Agreement not to engage in, the boycott of energy companies as defined by Section 809.001 of the Texas Government Code.

Anti-Boycott of Firearm Entities or Firearm Trade Associations. Vendor certifies that Vendor does not have a practice, policy, guidance, or directive that discriminates against a firearm entity or firearm trade association or will not discriminate against a firearm entity or firearm trade association for the duration of this Agreement, as defined by Section 2274.001 of the Texas Government Code.

Certification of No Business with Foreign Terrorist Organizations. For purposes of Section 2252.152 of the Texas Government Code, Vendor certifies that, at the time of this Purchase Order neither Vendor nor any wholly owned subsidiary, majority-owned subsidiary, parent company or affiliate of Vendor, is a company listed by the Texas Comptroller of Public Accounts under Sections 2252.153 or 2270.0201 of the Texas Government Code as a company known to have contracts with or provide supplies to a foreign terrorist organization.

The requirements of Subchapter J, Chapter 552, Texas Government Code, may apply to this Award and the Vendor agrees that this Award can be terminated if the Vendor knowingly or intentionally fails to comply with a requirement of that subchapter. If the requirements of Subchapter J, Chapter 552, Texas Government Code, apply to this Award, then for the duration of this Award (including the initial term, any renewal terms, and any extensions), Vendor shall preserve all Contracting Information, as defined by Section 552.003 of the Texas Government Code, related to this Award as provided by the records retention requirements applicable to the City pursuant to federal or state law or regulation, City ordinance or City policy, which record retention requirements include but are not limited to those set forth in Chapters 201 and 205 of the Texas Local Government Code and Texas Administrative Code Title 13, Chapter 7. Within five business days after receiving a request from the Director, Vendor shall provide any Contracting Information related to this Award that is in the custody or possession of Vendor. Upon the expiration or termination of this Award, Vendor shall, at the Director’s election, either (a) provide, at no cost to the City, all Contracting Information related to this Award that is in the custody or possession of Vendor, or (b) preserve the Contracting Information related to this Award as provided by the records retention requirements applicable to the City pursuant to federal or state law or regulation, City ordinance or City policy.

If Vendor fails to comply with any one or more of the requirements of this Section or with Subchapter J, Chapter 552, Texas Government Code, then, in accordance with and pursuant to the processes and procedures set forth in Sections 552.373 and 552.374 of the Texas Government Code, the Director shall provide notice to the Vendor and may terminate this Award. To effect final termination, the Director must notify Vendor in writing with a copy of the notice to the CPO. After receiving the notice, Vendor shall, unless the notice directs otherwise, immediately discontinue all services under this Award, and promptly cancel all orders or subcontracts chargeable to this Award.

If the Vendor fails to provide the item(s) listed on the purchase order and/or change order at the unit prices quoted, the City, at its option, may terminate this Award for default by delivering a written notice to the Vendor, and the City shall have no further obligation under this Award. At the City's option, through a notice to the Vendor in writing from the CPO, the Vendor may be allowed to cure such default within the time specified in said notice. In the event there is a failure to deliver any item(s), the City may cover its loss by reasonably procuring from another source the item(s) not delivered. The Vendor shall be responsible for and shall pay to the City immediately upon demand; the difference in price between that offered by the Vendor and that which the City was forced to pay for covering the Vendor's failure to deliver. Default by the City shall occur if the City fails to perform, or observe the terms and conditions of this Award, and the “Vendor" gives notice in writing to the City within thirty (30) days of the act or omission claimed by the Vendor. Upon receipt of such notice in writing from the Vendor, the City shall have thirty (30) days to cure such default.

The Vendor shall:

• Deliver the item(s) specified on the purchase order and/or change order to the designated "FOB Point", within the time specified by the "City". Timely delivery is of the essence to this Award.
• Ensure all deliveries are made on a business day, during business hours (Monday through Friday, except City Council designated holidays, from 8:00am to 4:00pm).
• Provide, at no additional charge, any equipment, labor, packaging, crating, or padding necessary to load, tie down and unload the item(s) to be delivered, so that they may be transported in a normal, safe manner without damage.
• Be liable for all risks for the item(s) until accepted by the "City". The "Vendor" is responsible for any freight charges incurred in delivering the item(s) to the "FOB Point." A representative of the "City" will sign the "Vendor's" delivery ticket to acknowledge receipt of the item(s) by the "City". Unless the "contractor" receives such signature, the "City" shall not be responsible for the receipt of the item(s). The "City" retains the right to inspect the delivered item(s) prior to acceptance, and shall not accept item(s) that do not conform to the requirements of this Award.

In the event the item(s) on the face of the purchase order and/or the change order are services rather than goods, such services shall be performed in accordance with the specifications, or scope of work, and the "City" reserves the right to require the "Vendor" to provide service(s) in conformance with such description prior to accrual of the City's obligation for payment.

Vendor shall maintain a drug-free workplace and ensure that its employees, agents, and subcontractors engaged in the performance of work on this award are free from the unlawful use, possession, distribution, or manufacture of controlled substances and alcohol while on duty or on City premises. The requirements and terms of City of Houston Executive Order 1-31, as revised from time to time, relating to drug-abuse deterrence for City contractors, are incorporated into this award for all purposes. Vendor agrees it has reviewed Executive Order No. 1-31, as revised, and will comply with it.

Vendor shall comply with the City’s Equal Employment Opportunity Ordinance as set forth in Section 15-17 of the City’s Code of Ordinances.

Federal Provisions

The price(s) specified on the face of the purchase order and/or the change order is firm, and may not be increased or supplemented on the Vendor's invoice.

Timely performance by both parties is essential to this Award.  However, neither party is liable for reasonable delays in performing its obligations under this Award to the extent the delay is caused by Force Majeure that directly impacts the City or Vendor.  The event of Force Majeure may permit a reasonable delay in performance but does not excuse a party’s obligations to complete performance under this Award.  Force Majeure means:  fires, interruption of utility services, epidemics in the City, floods, hurricanes, tornadoes, ice storms and other natural disasters, explosions, war, terrorist acts against the City or Vendor, riots, court orders, and the acts of superior governmental or military authority, and which the affected party is unable to prevent by the exercise of reasonable diligence.  The term does not include any changes in general economic conditions such as inflation, interest rates, economic downturn or other factors of general application, or an event that merely makes performance more difficult, expensive, or impractical.  Force Majeure does not entitle Vendor to extra reimbursable expenses or payment.

This relief is not applicable unless the affected party does the following:

• uses due diligence to remove the effects of the Force Majeure as quickly as possible and to continue performance notwithstanding the Force Majeure; and
• provides the other party with prompt written notice of the cause and its anticipated effect.

The Director will review claims that a Force Majeure that directly impacts the City or Vendor has occurred and render a written decision within 14 days. The decision of the Director is final.

The City may perform Award functions itself or contract them out during periods of Force Majeure. Such performance is not a default or breach of this Award by the City.

If the Force Majeure continues for more than 7 days from the date performance is affected, the Director may terminate this Award by giving 7 days’ written notice to Vendor. This termination is not a default or breach of this Award. Vendor waives any claim it may have for financial losses or other damages resulting from the termination except for amounts due under the Award up to the time the work is halted due to force majeure.

Vendor is not relieved from performing its obligations under this Award due to a strike or work slowdown of its employees. Vendor shall employ only fully trained and qualified personnel during a strike.

Vendor agrees to and shall release the City, its agents, employees, officers, and legal representatives (collectively the “City”) from all liability for injury, death, damage, or loss to persons or property sustained in connection with or incidental to performance under this Award, even if the injury, death, damage, or loss is caused by the City’s sole or concurrent negligence and/or the City’s strict products liability or strict statutory liability.   Vendor hereby covenants and agrees not to sue the City for any claims, demands, or causes of action directly or indirectly related to its release under this section, for the avoidance of doubt, this covenant not to sue does not apply to claims for breach of this Award.

Vendor agrees to and shall defend, indemnify, and hold the City, its agents, employees, officers, and legal representatives (collectively the “City”) harmless for all claims, causes of action, liabilities, fines, and expenses (including, without limitation, attorneys’ fees, court costs, and all other defense costs and interest) for injury, death, damage, or loss to persons or property sustained in connection with or incidental to performance under this Award including, without limitation, those caused by:

• Vendor’s and/or its agents’, employees’, officers’, directors’, Vendors’, or subcontractors’ (collectively in this and the following subsections, “Vendor”) actual or alleged negligence or intentional acts or omissions;
• The City’s and Vendor’s actual or alleged concurrent negligence, whether Vendor is immune from liability or not; and
• The City’s and Vendor’s actual or alleged strict products liability or strict statutory liability, whether Vendor is immune from liability or not.

Contactor shall defend, indemnify, and hold the City harmless during the term of this Award and for four years after the Award terminates. Vendor’s indemnification is limited to $600,000 per occurrence. Vendor shall not indemnify the City for the City’s sole negligence.

Vendor shall require all of its subcontractors (and their subcontractors) to release and indemnify the City to the same extent and in substantially the same form as its release and indemnity to the City.

Notice of Claims. If the City or Vendor receives notice of any claim or circumstances which could give rise to an indemnified loss, the receiving party shall give written notice to the other party within 30 days.  The notice must include the following:

• a description of the indemnification event in reasonable detail
• the basis on whihc indemenification may be due. and
• the anticipated amount of the indemnified loss.

Defense of Claims

Assumption of DefenseVendor may assume the defense of the claim at its own expense with counsel chosen by it that is reasonably satisfactory to the City Attorney. Vendor shall then control the defense and any negotiations to settle the claim, subject to the City Attorney’s consent or agreement to the settlement, which consent or agreement shall not unreasonably be withheld. Within 10 days after receiving written notice of the indemnification request, Vendor must advise the City as to whether or not it will defend the claim. If Vendor does not assume the defense, the City shall assume and control the defense, and all defense expenses constitute an indemnification loss.

Continued ParticipationIf Vendor elects to defend the claim, the City may retain separate counsel to participate in (but not control) the defense and to participate in (but not control) any settlement negotiations.

Vendor shall perform its obligations under this Award as an independent contractor and not as an employee of the City.

City representatives may perform, or have performed, (1) audits of Vendor’s books and records, and (2) inspections of all places where work is undertaken in connection with this Award. Vendor shall keep its books and records available for this purpose for at least four years after this Award terminates. If the books and records are located outside of Harris County, Texas, Vendor agrees to make them available in Harris County, Texas. This provision does not affect the applicable statute of limitations.

Risks and Limits of Liability. Vendor shall maintain the following insurance coverages in the following amounts:

VENDOR SHALL GIVE 30 DAYS’ ADVANCE WRITTEN NOTICE TO THE DIRECTOR IF ANY OF ITS INSURANCE POLICIES ARE CANCELED OR NON-RENEWED. Within the 30-day period, Vendor shall provide other suitable policies in order to maintain the required coverage. If Vendor does not comply with this requirement, the Director, at his or her sole discretion, may immediately suspend Vendor from any further performance under this Award and begin procedures to terminate for default

The City shall be an Additional Insured under this Award. All policies, except Professional Liability and Worker’s Compensation, shall extend coverage to the City as an additional insured. The City shall enjoy the same coverage as the Named Insured without regard to other Award provisions. Vendor waives any claim or right of subrogation to recover against the City, its officers, agents, or employees, and each of Vendor’s insurance policies, except professional liability, must provide a Waiver of Subrogation in favor of the City. Each policy, except Workers’ Compensation and Professional Liability, must also apply as primary to any other insurance available to the Additional Insured with respect to claims arising under this Award.

Vendor, its agents, employees, Vendors, and subcontractors shall hold all City information, data, and documents (collectively, the “Information”) that they receive, or to which they have access, in strictest confidence. Vendor, its agents, employees, Vendors, and subcontractors shall not disclose, disseminate, or use the Information unless the Director authorizes it in writing. Vendor shall obtain written agreements from its agents, employees, Vendors, and subcontractors which bind them to the terms in this Section.

The prices stated on the face of the Purchase Order and/or any Change Order are firm and not subject to increase or supplementation on the Vendor’s invoice.

The City of Houston’s standard payment terms include early payment discounts as follows:

• Payment within 10 days: 2% discount
• Payment within 20 days: 1% discount

A Vendor may request to opt out of the early payment discount program by submitting a written request to the Chief Procurement Officer (CPO). The opt-out becomes effective only upon written approval by the CPO.

Unless otherwise agreed or modified under the early payment terms above, payment will be made within 30 days after the later of (1) the City's receipt of a proper invoice, or (2) the City's receipt of the goods or services, in accordance with the Texas Prompt Payment Act (Texas Government Code, Chapter 2251).

All invoices shall be submitted through the City's SAP Business Network ("Ariba"), unless a vendor requests, in writing, an alternate submission and the Chief Procurement Office approves the request.

The Vendor shall submit an invoice no later than thirty (30) days after the date of receipt of the item(s) or service(s) by the City. At a minimum, each invoice will contain the:

• Purchase order number;
• Vendor's name and address;
• Description of the item(s) delivered;
• Exact quantity of each item delivered;
• Date of delivery to the City;
• Unit price for each item, if a unit price was offered by the Vendor;
• Total amount of the charge(s) for the item(s) delivered, which amount shall not exceed the amount of the purchase order; and the
• Name of the City Department that requested the item(s) or service(s).

The City shall pay the Vendor either the lump sum for the item(s) or, if unit prices are specified, the unit price per item for each item multiplied by the number of units actually delivered and received and accepted by the City. The City shall never be obligated to pay a sum greater than the segregate price offered for the item(s). The unit price shall control in the event of a conflict. Payment is due thirty (30) days after the City has approved the invoice or after the City has accepted the goods, whichever occurs later.

If, for any reason, the City disputes all or part of any Vendor invoice, the Director shall not authorize payment of the disputed part of the invoice, and may, in the sole discretion of the Director, elect to pay any undisputed portion of the invoice. The Director shall (1) promptly notify Vendor that the City disputes all or part of the Vendor’s invoice, and (2) request that the Vendor correct the invoice or otherwise respond to the City’s concerns. The Director and/or the City Attorney are authorized to settle disputes and pay disputed invoices without approval by City Council if the amount paid by the City to the Vendor to resolve the dispute does not cause the total of all payments by the City to Vendor under this Award to exceed the maximum Award amount approved by City Council for this Award.

The City is exempt from payment of Federal Excise and Transportation Tax and Texas Limited Sales and Use Tax. Vendor’s invoices to the City must not contain assessments of any of these taxes. The Director will furnish the City’s exemption certificate and federal tax identification number to Vendor if requested.

Section 1. Definitions:

"City's Information" or "City Information" means any and all City information or data, including but not limited to, City-specific information, user information, data, materials, processes, documents, citizen information, and any other information, materials, or data Vendor receives or to which Vendor has access to, in any form whatsoever including oral, written, and machine-readable form, video, audio, phonorecord, recorded media, drawings, schematics, samples, devices, software, formulas, services, processes, procedures, protocols, trade secrets, intellectual property, and business or strategic plans.

“Incident” means as defined in Section 4.1 of this Security Addendum.

“Mitigate” means deployment of security controls as necessary to reduce the adverse effects of threats and reduce risk exposure to a level reasonably acceptable by City.

“Remediation” or “Remediate” means, as applicable, that Vendor has completely resolved a security exposure or Incident, such that the vulnerability no longer poses a risk to City Information, Vendor systems in which City Information is stored or transferred through, and City systems.

Section 2. Vendor’s General Obligations and Responsibilities:

2.1 Vendor shall maintain the security of all City Information, including but not limited to, all City-specific data, user data, citizen data, and any other data that is provided to or made accessible to Vendor by City, by any user, by any citizen, or that Vendor generates, creates, compiles, or analyzes for the City, as further described below and in this Agreement. Vendor shall regularly test and audit the systems, controls, and procedures outlined in this Agreement, which tests and audits shall occur at least once per calendar month. Vendor shall implement and maintain, at least at industry standards, administrative, technical, and physical controls, safeguards, measures, and procedures to (i) protect and safeguard the privacy, security, integrity, and confidentiality of the City’s Information, (ii) prevent, detect, contain, and correct security breaches in, involving, or against the City’s Information, and (iii) ensure that the City’s Information is not accessed, processed, stored, transmitted, transferred, copied, disposed of, archived, or disclosed contrary to the provisions of this Agreement or applicable laws concerning information technology security, network or data security, and privacy laws. At a minimum, Vendor shall develop, implement, and maintain a reasonable written security program that includes appropriate administrative, technical, organizational, and physical safeguards and security measures that: (i) maintain user identification and access controls designed to limit access to authorized users; (ii) protect the City’s Information from unauthorized activity; (iii) use encryption technology, and (iv) comply with any specifications as requested by the City.

2.2 Vendor shall be responsible and liable for the acts and omissions of Vendor’s personnel, temporary employees, agents, contractors, representatives, counsel, and subcontractors in connection with the provision of the services required under this Agreement, as if such acts or omissions were Vendor’s acts or omissions. With respect to any of Vendor’s personnel, temporary employees, agents, contractors, representatives, counsel, and subcontractors who process, store, transmit, access, dispose of, or have access to the City’s Information or the Software in so far as it relates to or is the result of Vendor’s performance of this Agreement, Vendor shall: (i) Advise these persons of and require that they comply with the provisions of this Agreement, which includes this Security Addendum, applicable to each person, including without limitation, the provisions relating to the privacy, security, integrity, and confidentiality of the City’s Information; (ii) Require these persons to execute and deliver to Vendor written agreements that are a direct flow-down of, or substantially similar to (or no less restrictive than) the terms of this Agreement, including this Security Addendum, and including without limitation, with respect to privacy, security, integrity, and confidentiality of the City’s Information; and (iii) With respect to Vendor’s personnel, temporary employees, agents, contractors, representatives, counsel, and subcontractors with access to the City’s physical property or premises, Vendor shall advise these persons of applicable visitor policies and require that they comply with them and only access authorized areas. Pursuant to this Agreement, Contractor shall be responsible for any fraudulent or dishonest acts committed by Contractor’s employees, personnel, temporary employees, agents, contractors, representatives, counsel, subcontractors, directors, or officers.

2.3 Vendor shall ensure that, at all times, all of the City Information shall remain in networks, systems, facilities, data centers, gateways, hosting facilities, and cloud facilities physically located solely in the continental United States. Vendor shall not transmit, disclose, have access to, or process City Information outside of the continental United States of America. At all times, Vendor shall provide support calls from within the boundaries of the continental United States of America.

2.4 Vendor represents and warrants it has used and will use commercially reasonable efforts utilizing generally accepted industry tools and practices to provide services under this Agreement that does not contain any time bombs, worms, viruses, Trojan horses, protect codes, data destruct keys, or other programming devices that are intended to access, modify, delete, damage, deactivate, or disable software or services. Furthermore, Vendor shall utilize up-to-date and comprehensive virus and malware protection capabilities, and commercially reasonable practices, including but not limited to, detection, scanning, and removal of known viruses, worms, and other malware on any Vendor-controlled, owned, or hosting systems. These virus protection capabilities shall be in force on all computers, equipment, and/or devices utilized in connection with the services provided under this Agreement, as well as on all data files or other transfers that have access or are connected to Vendor’s hosting systems. Vendor shall mitigate security vulnerabilities through the use of perimeter and host countermeasures such as intrusion prevention, web application firewall, IP address shunning, and other measures designed to prevent exploitation of vulnerabilities.

2.5 Vendor shall use best efforts to prevent, monitor, mitigate, and remediate against: (i) services that sends or stores infringing, obscene, threatening, libelous, or otherwise unlawful or tortious material, including material harmful to children or violative of third party privacy rights; (ii) any upload to the services or use the services to send or store viruses, worms, time bombs, Trojan horses or other harmful or malicious code, files, scripts, agents, or programs; (iii) interference with or disruption of the integrity or performance of the services or the data contained therein; attempts to gain unauthorized access to the services or its related systems or networks; or (iv) export, re-export, transfer, or make available, whether directly or indirectly, any regulated item or information to anyone outside of the United States in connection with this Agreement without first complying with all applicable export control laws and regulations that may imposed by the U.S. Government and any country or organization of nations within whose jurisdiction Vendor operates or does business, and shall not Cause City to violate the same.

2.6 Vendor shall proactively address security risks by applying released security patches, including, but not limited to, Windows security patching and updates to patch known vulnerabilities in an applicable operating system.

2.7 Vendor shall provide City and Director with the vendor name, location, and any other security information of any third-party hosting or cloud facility that will be utilized to hold, store, transmit, or otherwise have access to City Information within two (2) days of the Director’s request. Vendor shall provide City and Director with at least 90 days’ prior written notice of any relevant material changes to Vendor’s information technology infrastructure, facilities (including but not limited to, vendor or location changes of any third-party hosting or cloud facility), or resources associated with information security governance and oversight, security, network, and infrastructure operations and any key personnel responsible for ensuring a secure environment spanning Vendor, any of its subcontractors, and the City.

Section 3. Vendor's Security Assessment Requirements:

3.1 Vendor shall maintain an information security program that provides for the security and protection of the City Information, including, but not limited to, processes and procedures to respond to security incidents. Vendor shall operate in conformance with the physical, technical, operational and administrative measures and protocols regarding data security as set forth in its then current Standards for Attestation Engagements (“SSAE”) No. 18 SOC2 Report (or equivalent report), received from its third-party auditors. Vendor shall, upon written request, provide City with copies of then-current SSAE No. 18 report issued by its third-party independent auditors in relation to the data security policies and procedures designed to meet the requirements set forth in this Agreement, which includes this Security Addendum. This provision shall survive the expiration or termination of this Agreement so long as Vendor holds or has access to City Information.

Section 4. Security Monitoring and Response:

4.1 Vendor shall maintain formal processes to detect, report, respond to, and mitigate and remediate Incidents in a timely manner. If Vendor learns or has reasonable suspicion that any person (including without limitation, Vendor’s personnel and third parties) has gained unauthorized access to City Information, or any person has gained unauthorized access to Vendor’s network and/or data storage facilities such that any City Information is obtained by an outside party, or the City Information has otherwise been disclosed to unauthorized parties (other than in the proper performance of those services or support therefor), each an “Incident”, then Vendor shall promptly (within 24 hours) (i) notify the City Attorney and Director in writing of the nature and extent of the Incident; (ii) conduct an investigation to determine when and, if possible, how the Incident occurred, and then (iii) assist the City in investigating and assessing the extent and nature of the Incident; (iv) promptly remedy the Incident and prevent the occurrence of any similar Incident; and (v) inform the City upon request as to the current status of such endeavors. Vendor shall be liable for such data breach or unauthorized access, including but not limited to, any related costs or expense (including cost of notification) and any notification required by law or regulation.

Section 5. Incident Remediation:

5.1 Upon becoming aware of an Incident, Vendor shall Mitigate or Remediate any Incident within 48 hours from the time Vendor becomes aware of the Incident. With respect to Incidents that are Mitigated (but not Remediated), Vendor shall Remediate such Incidents within five business days after being Mitigated. If Vendor fails to Mitigate or Remediate any Incident within the required timeframe: (a) such failure shall be deemed a material breach of this Agreement; and (b) City may immediately terminate this Agreement or Vendor’s access to City Information, including any system interfaces, connectors, or links without cost or penalty, and Vendor shall not be relieved of its obligation to continue to provide services under this Agreement, except to the extent such services are directly impacted by the termination of access.

Section 6. Data Recovery:

6.1 If as a result of Vendor’s performance under this Agreement, any City Information is lost or corrupted, Vendor shall restore the data to the previous day's uncorrupted state. Loss or corrupted data means data that is inaccessible, and not merely one that contains inaccurate data due to service defects or other reasons.

6.2 Vendor shall maintain and implement disaster recovery and avoiding procedures to ensure that the services provided by Vendor are not interrupted during any disaster and the City’s Information is not lost or destroyed during any disaster. For any of the City’s Information that is managed, maintained, stored, or hosted by or on behalf of Vendor, Vendor shall execute nightly database or systems backups to a backup server.

Section 7. Confidentiality Obligations and Information Disposal Procedures

7.1 Vendor and its personnel, temporary employees, agents, contractors, representatives, counsel, and subcontractors shall hold all City Information that they receive, or to which they have access, in strictest confidence. Vendor and its personnel, temporary employees, agents, contractors, representatives, counsel, and subcontractors shall not disclose, disseminate, or use the City Information unless the Director authorizes it in writing prior to such disclosure, dissemination, or use. Vendor shall obtain written agreements from its personnel, temporary employees, agents, contractors, representatives, counsel, and subcontractors which bind them to the terms in this Security Addendum and shall provide a copy of such written agreement to City upon request by City or the Director. The placement of a copyright notice on any City Information will not be construed to mean that such information has been published and will not release Vendor from its obligation of confidentiality hereunder. The terms and conditions of this Confidentiality section shall survive the expiration or termination of this Agreement for any reason.

7.2 Upon request by the Director at any time during the Term of this Agreement and upon expiration or termination of this Agreement, Vendor shall retain, migrate, or dispose of the City's Information as directed by the Director. Within two (2) days of Vendor's receipt of the Director's written request to retain, migrate, or dispose of the City's Information, Vendor shall notify the Director in writing of the estimated storage size and types of data to be retained, migrated, or disposed of. Within thirty (30) days of Vendor's receipt of the Director's written request to retain, migrate, or dispose of the City's Information, Vendor shall perform the following to the extent applicable unless otherwise directed by the Director at no additional cost to the City:

(1) deliver the City’s Information (in whole or in part, as directed by the Director) and physical media owned or provided by the City to the Director, in the format and on the media requested by the Director;

(2) destroy the City’s Information (in whole or in part, as directed by the Director) and provide a certified statement of destruction to the Director;

(3) destroy physical media using secure industry standard methods;

(4) remove the City’s Information (in whole or in part, as directed by the Director) from the hosted database, storage device, server, or other repository or storage means; or

(5) retain the City’s Information (in whole or in part, as directed by the Director) and migrate the designated information to a mutually agreed upon, secure location, database, or storage device for storage and retention of City Information.

7.3 In the event the Director directs the Vendor to destroy City Information without the destruction of the physical media, then Vendor shall destroy City Information in a manner that prevents attempts to restore that City Information.

1. PCI DSS Compliance & Acknowledgement of PCI Responsibilities

The Contractor acknowledges and shall maintain full compliance with the Payment Card Industry (PCI) Data Security Standard (DSS), currently version 4.0.1, as it may be updated or replaced by the PCI Security Standards Council from time to time (the “Standard”) upon approval of the Award and throughout the Term of the Contract. The Contractor shall comply with all applicable requirements of the Standard to the extent the Contractor stores, processes, transmits, or otherwise has access to cardholder data (“CDH”) or sensitive authentication data (“SAD”), or to the extent the Contractor’s services could impact the security of City’s cardholder data environment (“CDE”).

For clarity, this requirement includes all applicable PCI DSS requirements and testing procedures, as published by the PCI Security Standards Council, from time to time.

The Contractor, in addition to the requirements set forth in this PCI DSS Addendum, shall also provide the City, upon approval of the Award, annually thereafter, and upon request, tangible documented evidence of such compliance, including without limitation and as applicable, an executed and valid Attestation of Compliance (AoC), Report on Compliance (RoC), a Self-Assessment Questionnaire (“SAQ”) and associated attestation, or other audit/assessment documentation as requested by the City, and Contractor shall represent and warrant that it remains and will remain in compliance throughout the duration of this Award. Furthermore, Contractor shall also promptly provide evidence of compliance for any subcontractor or third-party service provider engaged by the Contractor that participates in storing, processing, or transmitting cardholder data or that may affect the security of the City’s CDE.

In accordance with the Standard, including PCI DSS v4.0.1, under Requirement 12.8.2, the Contractor hereby expressly acknowledges in writing its responsibility for the security of cardholder data and sensitive authentication data that it stores, processes, transmits, or can otherwise impact on behalf of the City. Contractor further acknowledges that it is responsible for implementing and maintaining all administrative, technical, and physical safeguards required under the Standard, including under the current PCI DSS v4.0.1, including all applicable controls, sub-controls, and testing procedures relevant to the services provided under this Award.

2. Scope and Responsibilities

a) The Contractor shall identify and document the scope of its cardholder data environment (CDE) and/or any cardholder data it processes, stores or transmits on behalf of the City, including any third-party subcontractors engaged by the Contractor.

b) The Contractor shall implement and maintain all controls required by the Standard, including but not limited to network security controls, secure configurations, access controls, encryption, logging/monitoring, vulnerability management, incident response, physical security, and regular testing of security systems and processes.

c) The Contractor shall ensure that any subcontractor or downstream service provider that it engages in connection with processing, storing, or transmitting cardholder data on behalf of the City is bound by at least as stringent as the obligations under this Addendum and the Standard, and allows audit/verification by the City or its agents or representatives.

Data Handling, Transmission, and Storage Restrictions
Contractor shall only store, process, or transmit cardholder data to the extent strictly necessary to perform services under this Award and only with prior written authorization from the City. Contractor shall not retain sensitive authentication data after authorization, in compliance with the Standard. Contractor shall ensure all CHD/SAD is protected with strong encryption, secure key management, and other controls required under the Standard.

Subcontractors and Third-Party Service Providers
Contractor shall not engage any subcontractor or service provider that may store, process, transmit, or have access to CHD/SAD, or may impact the City’s CDE without the City’s prior written approval. Contractor shall ensure each approved subcontractor agrees in writing to the Standard’s compliant terms no less stringent than those contained in this Award, including but not limited to, compliance with PCI DSS v4.0.1 Section 12.8.2, as it may be updated or amended from time to time. Contractor remains fully responsible for the acts and omissions of its subcontractors.

Data Return and Secure Destruction
Upon the expiration or termination of this Award, and upon City’s request, the Contractor shall return all City CHD/SAD or shall securely destroy such data in accordance with PCI DSS-compliant destruction methods. Contractor shall provide written certification of secure destruction after completion of destruction within five business days, and upon request of the City.

3. Audit, Assessment & Reporting
a) The Contractor shall permit the City, or a designated auditor on City’s behalf, to audit, assess, or otherwise verify the Contractor’s compliance with the Standard and this Award, including but not limited to, the Contractor’s PCI-relevant systems, controls, policies, and procedures at reasonable intervals and upon reasonable notice.

b) The Contractor shall notify the City without promptly if it becomes subject to a PCI DSS non-compliance event (including but not limited to a material deficiency in controls, a failed audit/assessment, or a security incident impacting cardholder data) and shall provide a remediation plan with milestones and updates until full compliance is restored

c) At least annually (or upon change to the Standard), the Contractor shall submit to the City a current Attestation of Compliance (AoC) and relevant supporting documentation.

d) Contractor shall promptly remediate any identified PCI compliance deficiencies at its own expense and at no cost to the City.

4. Incident Response & Breach Notification
a) The Contractor shall maintain an incident response plan addressing cardholder data security breaches and shall exercise that plan at least annually through testing or tabletop exercises.

b) In the event of any actual or suspected compromise of cardholder data, security incident, breach, compromise, unauthorized access involving CHD/SAD or the CDE, or other incident requiring notification under the Standard or applicable law, the Contractor shall immediately notify the City (and, in any event, no later than 24 hours after discovery) and cooperate fully with the City in investigation, forensic analysis, regulatory notification, remediation, and post-incident review, and any other actions as required under the Standard, applicable laws, law enforcement, or a card brand.

5. Indemnification & Liability; Survival
The Contractor shall indemnify, defend, and hold the City harmless from any claims, losses, costs (including forensic audits and card brand assessments), fines, assessments, penalties, liabilities, or damages arising out of the Contractor’s failure to comply with this PCI DSS Addendum, including those resulting from a breach of cardholder data or failure to maintain compliance with the Standard. Contractor’s PCI compliance obligations, data protection obligations, and indemnification obligations shall survive the termination or expiration of this Award.

6. Termination for Non-Compliance
If the Contractor fails to achieve or maintain compliance with the Standard or fails to provide the documentation required under this Addendum, the City shall have the right to suspend or terminate this Award immediately, without penalty, and to pursue any remedies available to it.

7. Change in Standard
If the PCI Security Standards Council issues a revised version of PCI DSS (such as, but not limited to, a new major version) during the term of this Award, the Contractor shall comply with the new version by the effective date established by the Standard and shall provide written confirmation of compliance to the City within 30 days of the new version’s effective date.

If either party fails to require the other to perform a term of this Award, that failure does not prevent the party from later enforcing that term and all other terms. If either party waives the other’s breach of a term, that waiver does not waive a later breach of this Award.

An approval by the Director, or by any other employee or agent of the City, of any part of Vendor’s performance does not waive compliance with this Award or establish a standard of performance other than that required by this Award and by law. The Director is not authorized to vary the terms of this Award.

The City Attorney or his or her designee may enforce all legal rights and obligations under this Award without further authorization. Vendor shall provide to the City Attorney all documents and records that the City Attorney requests to assist in determining Vendor’s compliance with this Award, with the exception of those documents made confidential by federal or State law or regulation.

The City Attorney or his or her designee may enforce all legal rights and obligations under this Award without further authorization. Vendor shall provide to the City Attorney all documents and records that the City Attorney requests to assist in determining Vendor’s compliance with this Award, with the exception of those documents made confidential by federal or State law or regulation.

In the event the City rejects any item(s), the Vendor shall have ten (10) days after receipt of notice of such rejection to replace any item(s) with replacements which conform to this Contract, at no additional cost to the City.

• All prices quoted shall be made on the form(s) provided by the City of Houston. The use of other forms will not be considered unless Vendor specifically indicate otherwise.
• By submitting a response to the City of Houston, Vendor certifies that all items to be furnished to the City of Houston, will not infringe any valid patent or trademark, and if a Vendor receives a Contract/Purchase Order from the City of Houston, Vendor will (at its own expense) defend any and all actions of suits charging such infringement and save the City of Houston harmless in case of any such infringement.
• When a brand or trade name appears in any specification(s) provided by the City of Houston, it is understood that the brand or trade name referred to, or its approved equal shall be furnished. If, however, Vendor proposes similar but not identical items, Vendor must furnish full particulars. If no mention is made of any exception(s), it is assumed that Vendor is offering the item(s) specified and not an approved equal, and will be required to furnish and deliver the exact item(s) specified.
• Vendors are required to submit with their response descriptive literature of the equipment or supplies, if the equipment or supplies are from a different manufacturer than those specified by the City of Houston. Should the description(s) furnished in the literature differ from the specification(s) specified by the City of Houston, and no mention is made to the contrary, it shall be construed to mean that Vendor proposes to furnish equipment or supplies in accordance with such description(s) and not in accordance with the City's specification(s).
• If requested by the City of Houston, samples of items shall be furnished without charge, and if not destroyed, returned upon request at your expense.
• Time of proposed delivery should be stated in number of calendar days. General terms such as “stock”, “immediately”, and “as soon as possible” may be cause for rejection.
• Prices should be itemized. The City of Houston reserves the right to award by item or by total bid. In case there is a discrepancy between the unit price(s) and the extension(s), the unit price(s) shall govern.
• The City of Houston reserves the right to reject any or all quotes, or any part(s) thereof.
• The City of Houston is exempt from all Federal Excise Taxes. Consequently, DO NOT include these taxes in your price(s) or invoice(s). Taxable items must be so designated, and the City will supply you with a Tax Exemption Certificate. If you believe that certain taxes are payable by the City of Houston, you should list the taxes directly below each item.
• All prices quotes shall be F.O.B. Destination unless otherwise stated by the City of Houston and will be irrevocable for ninety (90) days.
• All invoices shall be submitted through the City's SAP Business Network ("Ariba").
• If Vendors elect not to respond to the solicitation, please sign and indicate that on the solicitation, and return it to the Buyer along with the reason(s).
• Submission or attachment of quotation forms containing Vendor's terms and/or conditions is not acceptable, and may result in the response being considered nonresponsive.
• The City of Houston's standard payment term is to pay 30 days after receipt of invoice or receipt of goods or services, whichever is later, according to the requirements of the Texas Prompt Payment Act (Tx. Gov’t Code, Ch. 2251). However, the City will pay in less than 30 days in return for an early payment discount from vendor as follows:
  • Payment Time - 10 Days: 2% Discount
  • Payment Time - 20 Days: 1% Discount
• A Vendor may elect not to offer a discount for early payment and the City will make payment net 30 days. Discounts will not be considered in the award evaluation.
• If the City fails to make a payment according to the early payment schedule above, but does make the payment within the time specified by the Prompt Payment Act, the City shall not receive the discount, but shall pay no other penalty. When the payment date falls on a Saturday, Sunday, or official holiday when City offices are closed and City business is not expected to be conducted, payment may be made on the following business day.

If the Vendor receives payment from the City for work performed by any sub-vendor(s), or for materials provided by any supplier(s), and the Vendor withholds or has withheld payment to the sub-vendor(s) or supplier(s) on account of a deficiency in the quality or quantity of that sub-vendor's or supplier's work or materials, the City may withhold the amount associated with such work or materials from any pending or future payments to the Vendor until the next regular payment to the Vendor occurring after the City receives reasonable documentation that the deficiency has been remedied.

This Award shall bind and benefit the respective parties and their legal successors, and shall not be assignable, in whole or in part, by any party hereto without first obtaining the written consent of the other party. This provision is not intended to limit the Vendor's ability to assign receivables under this Award, but only applies to performance of the Award. Nothing herein shall be construed as creating any personal liability on the part of any officer or agent of the City.

Vendor shall remain obligated to the City under all clauses of this agreement that expressly or by their nature extend beyond the expiration or termination of this agreement, including, but not limited to, the indemnity provisions.

Notwithstanding any provision to the contrary in the underlying Award, this Purchase Order (PO) shall remain valid and enforceable beyond the stated expiration date of the original Award term solely to the extent that encumbered funds remain available on the PO and have not been fully expended. The City of Houston shall have the right to continue placing orders, receiving goods, or accepting services under this PO until such time as the remaining funds are fully utilized, or until the PO is formally closed by the City, whichever occurs first.

All terms and conditions of the original Award, including but not limited to indemnification, warranties, limitations of liability, confidentiality, and dispute resolution, shall survive and continue to apply throughout the extended use of the PO as described herein.

The continuation of the PO beyond the Award term shall not be construed as an extension, renewal, or modification of the original Award, nor shall it obligate the City to procure additional goods or services beyond the original encumbered amount.

The City is exempt from the Federal Excise and Transportation Tax and the limited Sales and Use Tax. Unless the City of Houston Bid Form or specifications specifically indicates otherwise the price bid must be net exclusive of above mentioned taxes. A vendor desiring refunds of, or exemptions from taxes paid on the item(s) accepted by the City, must submit the proper forms, and the City of Houston Chief Procurement Officer, if satisfied as to the facts, and will issue the necessary certificate.

The CPO, or Director with notice to the CPO, may terminate this Award at any time by giving 30 days written notice to Vendor. The City’s right to terminate this Award for convenience is cumulative of all rights and remedies which exist now or in the future.

On receiving the notice, Vendor shall, unless the notice directs otherwise, immediately discontinue all services under this Award and cancel all existing orders and subcontracts that are chargeable to this Award. As soon as practicable after receiving the termination notice, Vendor shall submit an invoice showing in detail the services performed under this Award up to the termination date. The City shall then pay the fees to Vendor for services actually performed, but not already paid for, in the same manner as prescribed in Article 4 unless the fees exceed the allocated funds remaining under this Award.

Receipt of payment for services rendered is Vendor’s only remedy for the City’s termination for convenience, which does not constitute a default or breach of this Award. Vendor waives any claim (other than its claim for payment as specified in this section), it may have now or in the future for financial losses or other damages resulting from the City’s termination.

If Vendor defaults under this Award, the CPO, or Director with notice to the CPO (CPO or Director), may either terminate this Award or allow Vendor to cure the default as provided below. The City’s right to terminate this Award for Vendor’s default is cumulative of all rights and remedies which exist now or in the future. Default by Vendor occurs if:

• Vendor fails to perform any of its duties under this Award;
Vendor becomes insolvent;
• all or a substantial part of Vendor’s assets are assigned for the benefit of its creditors; or
• a receiver or trustee is appointed for Vendor.

If a default occurs, the CPO or Director may, but is not obligated to, deliver a written notice to Vendor describing the default and the termination date. The CPO or Director, at his or her sole option, may extend the termination date to a later date. If the CPO or Director allows Vendor to cure the default and Vendor does so to the Director’s satisfaction before the termination date, then the termination is ineffective. If Vendor does not cure the default before the termination date, then the Director may terminate this Award on the termination date, at no further obligation of the City.

To effect final termination, the CPO or Director must notify Vendor in writing. After receiving the notice, Vendor shall, unless the notice directs otherwise, immediately discontinue all services under this Award, and promptly cancel all orders or subcontracts chargeable to this Award.

Vendor shall make no announcement or release of information concerning this Award unless the release has been submitted to and approved, in writing, by the Director.

Unless otherwise specified elsewhere in this Award, risk of loss or damage for each Product passes from Vendor to the City upon acceptance by the City.

This Award does not bestow any rights upon any third party, but binds and benefits the City and Vendor only.

Vendor shall not assign this Award at law or otherwise or dispose of all or substantially all of its assets without the Director’s prior written consent. Nothing in this clause, however, prevents the assignment of accounts receivable or the creation of a security interest as described in Section 9.406 of the Texas Business and Commerce Code. In the case of such an assignment, Vendor shall immediately furnish the City with proof of the assignment and the name, telephone number, and address of the Assignee and a clear identification of the fees to be paid to the Assignee.

Unless otherwise specified elsewhere in this Award, the rights and remedies contained in this Award are not exclusive but are cumulative of all rights and remedies which exist now or in the future. Neither party may terminate its duties under this Award except in accordance with its provisions.

If Vendor, at any time during the term of this Award, incurs a debt, as the word is defined in Section 15-122 of the City of Houston’s Code of Ordinances, it shall immediately notify the City Controller in writing. If the City Controller becomes aware that Vendor has incurred a debt, he or she shall immediately notify Vendor in writing. If Vendor does not pay the debt within 30 days of either such notification, the City Controller may deduct funds in an amount equal to the debt from any payments owed to Vendor under this Award, and Vendor waives any recourse therefor. Vendor shall file a new affidavit of ownership with the City Controller using the form designated by City between February 1 and March 1 of every year during the term of this Award.

The Vendor warrants that each item delivered will (1) be new (unless otherwise specified on the face of the purchase order, change order or specifications), free from liens and defects in design, materials, workmanship and defects in title (including any defect in the Vendor's right to sell a patented or copyrighted product or to use a patented process), (2) conform in all respects to the terms of the purchase order, change order or specifications, and (3) be of the best quality, if no specific quality is established in the specification(s). If within one (1) year from the date of acceptance by the City, it appears that an item, or any commercial unit thereof, does not conform to these warranties, and the Chief Procurement Officer notifies the Vendor within a reasonable amount of time after discovery, the Vendor shall correct such nonconformity to the satisfaction of the Chief Procurement Officer at the Vendor's expense.

Should this occur, the City may revoke acceptance, and purchase substitute item's correcting the nonconformity. The cost of the substitute item(s) correcting any nonconforming item(s) shall be borne by the Vendor.

Additionally, the Vendor shall transfer to the City any manufacturer's warranty that it has for the item(s).

The terms and conditions specified in the bid will apply to the outline agreement. The quantities specified on the outline agreements are an estimate; consequently, the City of Houston makes no representation either orally or in writing as to the quantity of items that may be purchased from the Vendor.

The requirements and terms of the City of Houston’s Zero Tolerance Policy for Human Trafficking and Related Activities, as set forth in Executive Order 1-56, as revised from time to time, are incorporated into this Agreement for all purposes. Vendor has reviewed Executive Order 1-56, as revised, and shall comply with its terms and conditions as they are set out at the time of this Agreement's effective date. Vendor shall notify the City’s Chief Procurement Officer, City Attorney, and the Director of any information regarding possible violation by the Vendor or its sub-vendors providing services or goods under this Agreement within 7 days of Vendor becoming aware of or having a reasonable belief that such violations may have occurred, have occurred, or are reasonably likely to occur.