City Council Committee of the Whole Meeting November 2, 2016|5:00 Pm City Council Chambers

CITY COUNCIL COMMITTEE OF THE WHOLE MEETING NOVEMBER 2, 2016|5:00 PM CITY COUNCIL CHAMBERS

Call to Order Roll Call Approval of Minutes of Previous Meeting –  October 12, 2016 Committee of the Whole Meeting  October 22, 2016 Special Committee of the Whole Meeting Special Presentations and Reports All items listed in section “Special Presentations and Reports” are for informational purposes only. As such, the city council is not expected to take action at this time on any item listed below.

A. 2017 Budget Discussion

Initiatives and Other Items B. Consideration of Resolution Establishing a Schedule of City Council Meetings for 2017 (No cost to the City)

Objective: Establish a schedule of city council meetings for 2017 to comply with requirements of the Open Meetings Act.

C. Consideration of Agreement with Sikich LLP to Provide Professional Auditing Services ($74,199)

Objective: Retain the professional services of a quality accounting firm to perform the city’s annual audit.

D. Consideration of Agreement with Box Inc. for Cloud Based Data Storage and Document Management Platform ($120,000)

Objective: Create a cloud based data storage and document management solution that integrates with existing city cloud services and desktop applications.

E. Consideration of Naming of a City Park Located in the Bowes Creek Subdivision (Item must be removed from the Table) (No cost to the City) Objective: Provide a name for a new city park located in the Bowes Creek Subdivision.

COMMITTEE OF THE WHOLE AGENDA November 2, 2016

Announcements from Council Announcements from Staff Adjournment

PLEASE NOTE: The City of Elgin is subject to the requirements of the Americans with Disabilities Act of 1990. Individuals with disabilities who plan to attend this meeting and who require certain accommodations in order to allow them to observe and/or participate in this meeting, or who have questions regarding the accessibility of the meeting or the facilities, are requested to contact the Human Resources Department at (847) 931‐6076 or TT/TDD (847) 931‐5616 promptly to allow the City of Elgin to make reasonable accommodations for those persons.

STRATEGIC PLAN 2013‐2017 ICON KEY

Public Safety Financial Stewardship

Neighborhoods Economic Development

Downtown Education & Workforce Development

Diverse Workforce Image and Engagement

AGENDA ITEM: A MEETING DATE: November 2, 2016

2017 BUDGET DISCUSSION

NO MATERIALS

AGENDA ITEM: B MEETING DATE: November 2, 2016

ITEM: Resolution Establishing a Schedule of City Council Meetings for 2017 (No cost to the City)

OBJECTIVE: Establish a schedule of city council meetings for 2017 to comply with requirements of the Open Meetings Act.

RECOMMENDATION: Authorize adoption of the resolution setting forth the schedule of city council meetings for 2017.

The proposed schedule of city council meetings for 2017 eliminates the Saturday, quarterly forecast meetings that occurred in 2016. Those quarterly meetings were intended to address what was expected to be inconsistent revenue transfers from State of Illinois. With the state making timely transfers throughout 2016 despite the continuing budget impasse, the need to continue with the practice no longer exists.

BACKGROUND

The Illinois Open Meetings Act [5 ILCS 120/2.02(a)] requires the city council to give public notice of the schedule of regular city council meetings at the beginning of each calendar year.

OPERATIONAL ANALYSIS

The city council regularly meets on the second and fourth Wednesdays of the month. The attached resolution sets forth such meeting dates with the exception of the months of November and December, 2017. The meetings for November and December are scheduled for the first and third Wednesdays of the month.

During the 2018 budget deliberation process, an additional Committee of the Whole meeting is scheduled on the second Wednesday of November (the 8th). A Saturday morning meeting on December 9, 2017 is also scheduled to solicit public opinion on the proposed 2018 budget.

If meetings are rescheduled after a meeting schedule is adopted, there are restrictions on the business which may be conducted. Therefore, such revisions as may be anticipated now should be made at this time.

INTERESTED PERSONS CONTACTED

None.

FINANCIAL ANALYSIS

None.

BUDGET IMPACT

FUND(S) ACCOUNT(S) PROJECT #(S) AMOUNT AMOUNT BUDGETED AVAILABLE N/A N/A N/A N/A N/A

LEGAL IMPACT

Schedule of regular meetings must be established to comply with the Open Meetings Act.

ALTERNATIVES

The city council may choose to consider a different meeting schedule for 2017.

NEXT STEPS

Adopt and post a resolution setting forth the schedule of city council meetings for 2017.

Originator: Richard G. Kozal, City Manager

Final Review: Debra Nawrocki, Chief Financial Officer William A. Cogley, Corporation Counsel/Chief Development Officer

ATTACHMENTS

A. Resolution Setting Forth the Schedule of City Council Meetings for 2017

Resolution No. 16‐xxx

RESOLUTION SETTING FORTH THE SCHEDULE OF CITY COUNCIL MEETINGS FOR 2017

BE IT RESOLVED BY THE CITY COUNCIL OF THE CITY OF ELGIN, ILLINOIS, that the schedule of city council meetings for 2017 shall be as follows:

ELGIN CITY COUNCIL MEETINGS FOR 2017

Committee of the Whole January 11, 2017 6:00 PM City Council January 11, 2017 7:00 PM Committee of the Whole January 25, 2017 6:00 PM City Council January 25, 2017 7:00 PM

Committee of the Whole February 8, 2017 6:00 PM City Council February 8, 2017 7:00 PM Committee of the Whole February 22, 2017 6:00 PM City Council February 22, 2017 7:00 PM

Committee of the Whole March 8, 2017 6:00 PM City Council March 8, 2017 7:00 PM Committee of the Whole March 22, 2017 6:00 PM City Council March 22, 2017 7:00 PM

Committee of the Whole April 12, 2017 6:00 PM City Council April 12, 2017 7:00 PM Committee of the Whole April 26, 2017 6:00 PM City Council April 26, 2017 7:00 PM

Committee of the Whole May 10, 2017 6:00 PM City Council May 10, 2017 7:00 PM Committee of the Whole May 24, 2017 6:00 PM City Council May 24, 2017 7:00 PM

Committee of the Whole June 14, 2017 6:00 PM City Council June 14, 2017 7:00 PM Committee of the Whole June 28, 2017 6:00 PM City Council June 28, 2017 7:00 PM

Committee of the Whole July 12, 2017 6:00 PM City Council July 12, 2017 7:00 PM Committee of the Whole July 26, 2017 6:00 PM City Council July 26, 2017 7:00 PM

Committee of the Whole August 9, 2017 6:00 PM City Council August 9, 2017 7:00 PM Committee of the Whole August 23, 2017 6:00 PM City Council August 23, 2017 7:00 PM

Committee of the Whole September 13, 2017 6:00 PM City Council September 13, 2017 7:00 PM Committee of the Whole September 27, 2017 6:00 PM City Council September 27, 2017 7:00 PM

Committee of the Whole October 11, 2017 6:00 PM City Council October 11, 2017 7:00 PM Committee of the Whole October 25, 2017 6:00 PM City Council October 25, 2017 7:00 PM

Committee of the Whole November 1, 2017 5:00 PM City Council November 1, 2017 7:00 PM Special Committee of the Whole November 8, 2017 5:00 PM Committee of the Whole November 15, 2017 5:00 PM City Council November 15, 2017 7:00 PM

Committee of the Whole December 6, 2017 5:00 PM City Council December 6, 2017 7:00 PM Special Committee of the Whole December 9, 2017 9:00 AM Committee of the Whole December 20, 2017 6:00 PM City Council December 20, 2017 7:00 PM

BE IT FURTHER RESOLVED BY THE CITY COUNCIL OF THE CITY OF ELGIN, ILLINOIS, that the foregoing city council meetings shall be held in the city council chambers in City Hall at 150 Dexter Court, Elgin, Illinois 60120.

______David J. Kaptain, Mayor Presented: Adopted: Vote: Yeas Nays: Recorded:

Attest:

______Kimberly A. Dewis, City Clerk

AGENDA ITEM: C MEETING DATE: November 2, 2016

ITEM: Agreement with Sikich LLP to Provide Professional Auditing Services ($74,199)

OBJECTIVE: Retain the professional services of a quality accounting firm to perform the city’s annual audit.

RECOMMENDATION: Accept the proposal of Sikich LLP to provide auditing services for the city for the next five years in the amount of $74,199.

The city solicited proposals for professional auditing services with the purpose of obtaining the highest quality auditing services at the most competitive price for the next five years. The city received seven proposals and is recommending the selection of Sikich, LLP at an annual fee that is five thousand dollars less than its expiring professional auditing services agreement with the city.

BACKGROUND

The city has retained the professional auditing services of Sikich LLP for the past fifteen years. Sikich is one of the country’s top 35 Certified Public Accounting firms. Their managing office is located in Naperville and will provide the professional staff that is responsible for performing the city’s audit. Sikich is a high caliber accounting firm with extensive experience and expertise with state and local governments. Sikich brings an experienced team which includes five partners and a number of managers and staff members that work exclusively in the local government industry. In addition to audit services, Sikich also provides governmental accounting and financial reporting expertise and technical assistance throughout the year as needed.

OPERATIONAL ANALYSIS

Each year, the city is required to undergo a financial audit which begins with a planning meeting in the fall to prepare for the audit which begins after year end. This meeting includes the partner assigned to the audit and the partner in charge of Sikich’s government services division. During this meeting, city staff present any significant changes or developments that have occurred during the year. It is at this meeting that Sikich lends its expertise by informing and educating staff

on changing accounting standards and what impact the new standards will have on the city. This enables the finance team to be prepared to implement new standards as required by the Gov- ernmental Accounting Standards Board (GASB). Sikich returns in January for three days of pre- liminary field work and again in late March for three weeks of field work. After field work culmi- nates, staff spends several weeks working with audit staff to complete the city’s Comprehensive Annual Financial Report (CAFR). The “audit process” begins in November of the audit year and is completed in May of the following year. This intensive process involves significant city staff time and requires productive working relationships with the city’s audit firm. Sikich has provided all services in a professional and timely manner.

A request for proposals (RFP) was solicited on the city of Elgin’s website for the purpose of obtaining the highest quality auditing services at the most competitive price for the next five years. An advertisement was placed in the September 12, 2016 issue of the Daily Herald. The bid opening date was September 26, 2016.

The RFP asked for each firm to separately submit a Technical Proposal and a Cost Proposal. The purpose of the Technical Proposal was to demonstrate the firm’s qualifications, competency and capacity as well as their ability to perform the city audit in accordance with stated specifications. The Cost Proposal included the not-to-exceed cost for performing the audit services as well as the number of hours to be worked by each level of staff.

Seven proposals were received. Each of the responding firm’s proposals were evaluated separately and then combined for a final analysis. Firms were reviewed and ranked based on prior auditing experience, the organization and size of the firm, the qualifications of audit staff members, the firms understanding of the work to be performed and the cost for audit services. Sikich received the highest evaluation score. The results of the review of the firm’s technical proposals is included in Attachment A (RFP Evaluation Averages). Staff then negotiated compensation terms with Sikich and obtained a favorable final cost proposal from Sikich. The cost proposals are summarized in Attachment B (RFP Tabulation of Bids). The Sikich LLP proposal was considered the most favorable and taking into account all of the circumstances, the best value to the city. The total all-inclusive maximum price for auditing services for 2016 through 2020 totals $383,857.

INTERESTED PERSONS CONTACTED

None

FINANCIAL ANALYSIS

Audit fees for calendar year 2015 were $79,000. The proposal presented by Sikich reflects a six percent decrease in audit fees for the 2016 audit. Audit fees for the remaining four years of the five year contract increase one to three percent per year. The proposed contract begins with the 2016 annual audit which will occur during 2017. As such, the 2017 proposed budget will include funding for the audit services in the amount of $74,199.

BUDGET IMPACT

FUND(S) ACCOUNT(S) PROJECT #(S) AMOUNT AMOUNT BUDGETED AVAILABLE General 010-2003-718.30-02 N/A $74,199 $74,199

LEGAL IMPACT

A request for proposal was released and advertised in the Daily Herald and on the city’s website on September 12, 2016. Seven responses were received and reviewed by the finance department.

ALTERNATIVES

The city council may choose not to accept the proposal to award a contract for professional auditing services to Sikich, LLP.

NEXT STEPS

Once the proposal is accepted, the city will enter into a contract with Sikich LLP and planning for the city’s 2016 audit will begin.

Originators: Debra Nawrocki, Chief Financial Officer

Final Review: William A. Cogley, Corporation Counsel/Chief Development Officer Richard G. Kozal, City Manager

ATTACHMENTS A. RFP Evaluation Averages B. RFP Tabulation of Bids

City of Elgin Audit RFP Evaluation Averages 2016 Baker, Tilly, Point Crowe Plante Virchow, BKD RSM Sikich Wipfli Range Horwath Moran Krause I. Prior Auditing Experience A. Auditing (type of audit under consideration) 0 to 10 10 5 5 10 9 10 5 B. Auditing local governments 0 to 5 5 5 5 5 5 5 5 C. Auditing similar entities (cities) 0 to 10 10 5 5 10 9 10 5 D. Auditing OMB circular A-133 requirements 0 to 5 5 4 3 5 4 5 3

II. Organization, size & structure of firm 0 to 5 5 3 4 5 4 5 3

III. Qualifications of staff to be assigned to the audit, education, position in the firm, and years and types of experience will be considered A. Qualifications and audit team make-up 0 to 20 20 15 15 18 18 20 15 B. Overall supervision to be exercised over audit team by firm's management 0 to 5 5 5 4 5 5 5 4 C. Concern for quality, as evidenced by quality control procedures and peer review 0 to 5 5 4 5 4 5 5 5

IV. Firm's Understanding of work to be performed. This will be determined by the approach to the audit and ability to complete in a timely manner. 0 to 10 5 5 5 5 5 10 5

V. Cost Lowest cost of all bids x 25 = Score Cost of bid of the firm 0 to 25 25 25 23 24 23 24 25 TOTALS 95 76 74 91 87 99 75 Tabulation of Bids City of Elgin Baker, Tilly, Virchow, Krause BKD Crowe Horwath Plante Moran RSM US, LLP Sikich, LLP Wipfli, LLP Invitation No: 16-044 1301 West 22nd St. 1901 S Meyers Rd One Mid America Plaza 2155 Pointe Blvd. 20 N Martingale Rd. 1415 We Diehl Rd. 485 E Half Day Rd. Date of Opening: Sept 26, 2016 Suite 400 Suite 500 Suite 700 Suite 200 Suite 500 Suite 400 Suite 250 Department: Finance Oakbrook, IL 60523 Oak Brook Terr., IL 60181 Oak Brook, IL 60522 Elgin, IL 60123 Schaumburg, IL 60173 Naperville, IL 60563 Buffalo Grove, IL 60089

Description Audit Year Annual Price Annual Price Annual Price Annual Price Annual Price Annual Price Annual Price 2016 69,960 70,000 75,000 75,000 73,700 74,199 73,800 2017 72,350 72,040 77,060 76,900 76,600 74,941 74,300 2018 74,740 74,130 79,300 78,808 79,500 76,440 74,800 2019 77,130 76,565 81,600 80,786 82,400 77,969 75,300 2020 79,520 78,855 84,170 82,583 85,200 80,308 75,800 Total all inclusive maximum price $ 373,700 $ 371,590 $ 397,130 $ 394,077 $ 397,400 $ 383,857 $ 374,000

2016 Hours Breakdown Partner 97 66 60 62 60 90 41 Manager 116 134 70 120 100 120 66 Supervisor 238 184 200 181 150 210 0 Staff 240 211 270 232 240 150 388 Administrative 0 0 0 0 0 30 6 Total Hours 691 595 600 595 550 600 501

AGENDA ITEM: D MEETING DATE: November 2, 2016

ITEM: Agreement with Box Inc. for Cloud Based Data Storage and Document Management Platform ($120,000)

OBJECTIVE: Create a cloud based data storage and document management solution that integrates with existing city cloud services and desktop applications.

RECOMMENDATION: Approve the agreement with Box Inc. in the amount of $120,000.

Box is a cloud-based data storage and document management platform that will enable the city to both eliminate the need for additional physical data storage servers and also create a document management solution that will generate internal efficiencies and enable the public to more easily locate city documents and records.

Any file stored in Box—as basic as a Word document or as complex as three-dimensional render- ing of a building—appears and can be shared (and in some cases edited) on any device with a browser. Box integrates seamlessly with Office 365, SharePoint, Salesforce and many other applications in use by the city. Significantly, Box has no upper limit on the amount of data the city can utilize for its data storage needs; unlimited data storage is included in the subscription fee.

BACKGROUND

Providing adequately sized, high-performance data storage in a large enterprise network environment has always been a top priority challenge for the information technology services department (ITS). Data storage is one of the most important aspects of the enterprise network system. Without the data, the applications, servers and all the peripheral hardware are worthless. Data must be secure, protected, replicated and available when needed. To provide this high level of data storage service, the city began using virtualized data storage systems in 2004 with the purchase of its first storage area network system. Over the years, the on premise based storage systems have been replaced, upgraded and expanded several times to accommodate continuing growth in data storage requirements.

Studies by International Data Corporation, a premier technology research firm, have shown that data storage requirements grow at an annual compound rate of 61 percent. The storage utiliza- tion rates of the city have followed that trend. Electronic document storage has been replacing paper filing cabinets at an increasing rate and the requirements of government transparency and reporting means documents must be kept on-line for a longer period of time.

OPERATIONAL ANALYSIS

In addition to the normal data growth, disaster recovery and operations continuity requirements, new applications that will likely be deployed in public services and public safety will require huge amounts of new storage to accommodate video and other data from multiple sources. The traditional method to manage this data storage growth would be to budget a large capital outlay to purchase hardware, install on premise, provide a vendor support contract and manage with existing ITS staff. There are several issues with the traditional method. Time from planning to roll out can be a year or more. In that time, many things can change in the project plan. On premise storage requires staff time to manage and maintain, the more storage racks and disks there are, the more management time is required.

A new option to consider in a data storage project is off premise based storage commonly called cloud storage or infrastructure-as-a-service. Similar to as-software-as-a-service has become the preferred method of acquiring new software, infrastructure-as-a-service is quickly gaining acceptance as a preferred alternative to adding more in house storage hardware. Basically, cloud storage is a large, very secure data center with lots of racks of servers and data storage units and internet service connections. Access is through an internet connection or through a dedicated direct network link. Advantages with cloud storage include that it (1) can be quickly provisioned, in hours instead of a year; (2) can just as quickly de-provisioned if it is no longer needed; (3) is backed up to multiple storage facilities for data protection; (4) is monitored and maintained 24x7 by expert staff to guarantee uptime and availability; and (5) requires no city staff time in the management and maintenance of the storage system other than the provisioning and management of subscriptions.

The cloud storage system actually being proposed and currently in limited proof of concept testing is known as Box. Box is more than just storage-as-a-service, it is a storage platform. The dif- ference is significant. A service just provides another place to store and maintain documents. A platform offers the opportunity to create productivity enhancing applications benefitting not only city staff, but all constituents of the city. Freedom of Information Act and e-discovery processes can be automated and improved, saving much staff time in responding to those requests. Documents can be searched and placed on legal hold by content or topics similar to the process used for email discovery and retention. Documents can also have a standardized retention policy applied to them. Box offers unlimited storage ensuring that staff will always have adequate space.

Box offers extremely strong security including two factor authentication and meets or exceeds all federal security guidelines and standards. Box integrates seamlessly with Office 365, Share- Point, Salesforce and many other applications in use by the city. Box is the perfect fit for the city because it not only meets all the current technical requirements, but as a powerful content platform service it meets the long term goal of having one single content layer that spans across the entire technology landscape. Box is a key cloud partner for the city’s effort to change how cities work and most importantly how they think. Box is the missing piece of infrastructure that will allow the city to continue to lead local government innovation in the cloud industrial revolution.

The project being proposed in this memo is a large scale pilot involving as many as 250 employees and multiple city departments and work groups. The concept is that with minimal investment staff can create content processes tailored to specific departmental requirements to improve document handling processes. The pilot can also be used as a training platform for city wide use of Box and a proving ground for application development within the platform. As the pilot project successfully progresses as expected, additional staff users can be added to the platform and slowly ramp up to the full staff count of approximately 800 users. This ramp up can be done over the next several years as the system expands. In addition to the paid subscriptions that entitle the city as an enterprise and each individual subscriber unlimited storage, Box also allows staff to invite an unlimited number of external users to be able to share documents, folders and applications in the enterprise. This concept is now being used for the cooperative CDBG document process between the city community development staff and Kane County, allowing county staff full access to all of the CDBG documents in the Elgin Box system. Box is priced as per-user per- year subscription. To get to full deployment, the city will need to purchase 800 user subscriptions, based on the number of Office 365 subscriptions.

INTERESTED PERSONS CONTACTED

None.

FINANCIAL ANALYSIS

The cost of Box is $352 per-user per-year plus $13,035 per-year for premier service support, a total annual cost of $99,940. This price reflects a 35 percent discount from the standard list price of $480 per-year for unlimited Box subscription. The project includes a one-time cost of $20,000 for Box consulting services to work with city staff to create the city’s box organization and structure, to create custom integrations with Salesforce, to migrate existing city documents and data from the Microsoft shared drives to Box. The annual cost for subscriptions, service and support will be budgeted in fiscal year 2017 and each year following.

The per-user subscription model is becoming the standard model for delivering quality infrastructure-as-a-service to enterprise organizations of every size, from thousands of users to just a few. It is the most effective and cost efficient method for system and service acquisition in the fast changing world of modern technology. Infrastructure services are being treated like other utili-

ties, electric and natural gas. Turn it on, purchase as much or as little as is needed by the organization. The annual cost of infrastructure-as-a-service is comparable to the legacy model of capital acquisition and annual maintenance. When the total cost of ownership of a legacy system, including amortized capital acquisition costs plus staff time to maintain and vendor maintenance fees is annualized and compared to the cost of infrastructure-as-a-service, the subscription fees are very reasonable, especially considering that the vendor maintains and supports the entire platform with no city staff time required.

BUDGET IMPACT

FUND(S) ACCOUNT(S) PROJECT AMOUNT AMOUNT #(S) BUDGETED AVAILABLE Equipment Re- 601-4800-796.40-06 N/A $120,000 $120,000 placement

LEGAL IMPACT

The proposed agreement would necessitate an exception to the procurement ordinance which requires approval by two thirds of the members of the city council.

ALTERNATIVE COURSES OF ACTION

The city council may choose not to approve the agreement with Box Inc.

NEXT STEPS

1. Execute contract documents.

2. Begin full start consulting engagement.

3. Add city staff to the city’s Box org and data is migrated.

Originators: Jeffery D. Massey, Chief Technology Officer

Final Review: Debra Nawrocki, Chief Financial Officer William A. Cogley, Corporation Counsel/Chief Development Officer Richard G. Kozal, City Manager

ATTACHMENTS A. Contract Proposal for 247 User Subscriptions B. Service Agreement C. Custom Full Start Consulting Scope of Work D. Content Platform Use Cases

Box, Inc. 900 Jefferson Ave Redwood City, CA 94063 Executed Order must be received by: October 31, 2016 Service Order

This Box Service Order (“Order”) is entered into by and between Box, Inc. ("Box") and City of Elgin ("Customer") as of the Service Start Date and is governed by the Box Service Agreement ("Agreement") as per the link below, or as attached to this Order. Order Details

City of Elgin Billing Terms 150 Dexter CT Service Start Date1: November 16, 2016 Elgin Service Renewal Date: November 16, 2019 IL StPayment Frequency: Annual 60120-5555 Payment Method: Check United States Payment Terms: Net 30

Bill To:2 Sold To: Name: Jeff Massey Name: Jeff Massey Email: [email protected] Email: [email protected] Phone: 8479315642 Phone: 8479315642

Products

Product Type Charge Unit Price Quantity Discount Recurring Amount Per Total Order Price Type Payment Frequency Box Enterprise with Recurring $351.84 247 12.0% $86,904.48 $260,713.44 Governance FullStart One-Time $20,000.00 1 33.33% $0.00 $20,000.00

Premier Services Recurring $13,035.67 1 0.0% $13,035.67 $39,107.01

Total One Time Charges: $20,000.00 USD Total Recurring Amount Per Payment Frequency: $99,940.15 USD Total Order Amount: $319,820.45 USD

Additional Terms

Statement of Work for FullStart can be found at the following link: https://cloud.box.com/s/6oxr3203le9q4ytnl43ajcghkry0i123

Signature

IN WITNESS WHEREOF, Customer has authorized this Order as of the Date of signature below.

Customer City of Elgin

Agreement can be found at the following link or attached: https://www.box.com/docs/BSA_v08012016US/

Q083300-A

Box, Inc. 900 Jefferson Ave Redwood City, CA 94063 Executed Order must be received by: October 31, 2016 Service Order

1 If this order is executed by Customer or received by Box after the Service Start Date above, Box may adjust that date, without increasing the Total Price, based on the date Box provisions the products listed. 2 Please note: All future invoices and billing inquiries will be emailed to this contact

Unless otherwise set forth in this Order, upon prior written notice to Customer or upon renewal of the Subscription Period, Box reserves the right to charge Customer for Account Licenses deployed above the total number of such Account Licenses set forth in the applicable Order(s). Unless Premier Support is purchased under this order, SLC credits are not provided. Prices shown above do not include any taxes that may apply. Any such taxes are the responsibility of the Customer. This is an Order not an invoice. Notwithstanding anything to the contrary in the underlying agreement between the parties, any terms and conditions in any purchase order or similar documents issued by Customer shall be null and void.

Q083300-A

BOX SERVICE AGREEMENT (v.02012015US) This Box Service Agreement contains the terms and conditions that govern the access and use of the Box Service (as defined below) and is entered into by and between Box, Inc. (“Box”) and the customer identified in the corresponding Order (as defined below) referencing this Agreement (“Customer”). Box and Customer are sometimes referred to herein individually as a “Party” and together as the “Parties.” This Agreement is effective and Customer agrees to be bound by its terms when Customer either first accesses the Box Service or upon the first Order Effective Date (defined below), whichever occurs first (“Agreement Effective Date”). For good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties hereby agree as follows: Section 1. Definitions When used in this Agreement with initial letters capitalized, in addition to terms defined elsewhere in this Agreement, the following terms have the following meaning: “Account(s)” means the number of User account(s) specified in the applicable Order and created by a User for itself or on behalf of Customer (including accounts created by or for its Administrators, Managed Users, or External Users) within the Box Service. “Administrator(s)” means a person designated by Customer to have an Account with the authority to utilize the Administrative Console to create and manage Accounts associated with Customer. “Administrative Console” means the functionality for managing User access, security and other administrative functionality for Accounts associated with the Box Service provided to Customer. “Agreement” means this Box Service Agreement together with all Orders and Exhibits. “Bandwidth Limit” means 1 terabyte (1TB) transferred per User per month. “Box Service” means the cloud-based content collaboration platform provided by Box. “Box Software” means software that allows a User to use certain functionality in connection with features of the Box Service that is provided by Box either for installation on a Customer’s or a User’s device or that is otherwise accessed by Users from the Customer’s or User’s software, hardware or other devices. “Content” means electronic files, materials, data, text, audio, video, images or other content transmitted, stored, retrieved or processed by Customer and Users using the Box Service. “Customer Domain” means all Customer web addresses registered, owned or controlled by Customer and used by one or more Users to register an Account. “External User(s)” means a person who is permitted to access, store, retrieve or manage Content with a Managed User of the Customer, and is not in a Customer Domain. "Malware" means any software program or code intended to destroy, interfere with, corrupt, or cause undesired effects on program files, data or other information, executable code or application software macros. “Managed User(s)” means a person who is permitted to access, store, retrieve or manage Content, and is associated with a Customer Domain. “Order” means a Box order or other ordering document agreed to in writing by the Parties under this Agreement, or by Customer and a Box authorized reseller, which is accepted and provisioned by Box as set forth in Section 2.2, and as a result of such acceptance is incorporated into this Agreement. “Privacy Policy” means the then-current Box privacy policy found at https://www.box.com/static/html/privacy.html which identifies how Box collects, uses and discloses, on a limited basis, information of Users, expressly excluding Content. “Service Level Commitments” means the service level commitments set forth in Exhibit A that Customer subscribed to and paid for as specified in the applicable Order. “Subscription Period” means the time commencing on the Order Effective Date and continuing for the period specified in the applicable Order. “Support Services” has the meaning set forth in Exhibit A.

Page 1 of 12 Box Confidential

“Term” has the meaning set forth in Section 11.1. “User(s)” means, collectively, any person who is permitted by Customer, an Administrator or a Managed User to access, store, retrieve or manage Content in any Account, including any Administrator, Managed User or External User. “User Guide” means Box’s then current published written or electronic documentation specifying the functionality of the Box Service that is made generally available by Box to its customers or its users. Section 2. Access and Use of the Box Service 2.1 Access Grant. Subject to the terms and conditions of this Agreement and the purchase of an Account for each User, Box hereby grants Customer the non-exclusive right during the applicable Subscription Period to access the Box Service to: (a) allow Users designated as Administrator(s) to access and use the Administrative Console to create and administer Accounts registered to Customer; and (b) except to the extent otherwise set forth in the applicable Order, allow Users to store, retrieve, collaborate and share Content through the Box Service in accordance with the User Guide. 2.2 Orders; Delivery. Customer may from time to time place Orders for the Box Service. Customer is required to purchase an Account for each User in accordance with the applicable Box Service plan specified in the applicable Order. Orders will be deemed accepted by Box upon the earlier of when the requested access to the Box Service has been provisioned by Box or when Box otherwise informs Customer of Box’s acceptance of such Order, whichever is earlier (“Order Effective Date”). Unless otherwise specified in an Order or previously provided to Customer, Box will deliver to Customer, within five (5) business days after the Order Effective Date, a copy of the passwords and usernames for the Administrator(s) to manage Customer’s use of the Box Service under this Agreement. 2.3 Service Plan Upgrade Option. During the Term, Box may from time to time provide Customer with the right to obtain the next level of the Box Service plan (e.g., from Box Business to Box Enterprise) or features and functionality available subject to a separate fee (each a “Box Service Plan Upgrade”) at pricing and terms to be mutually agreed upon by the Parties. Fees for such Box Service Plan Upgrade will be invoiced to Customer, prorated on an annual basis to be coterminous with the applicable Order. 2.4 Restrictions on Use of the Box Service. The Customer’s use of the Box Service is subject to the Bandwidth Limit as well as the features and functionality of the Box Service plan level specified in the applicable Order. Without limiting any other remedies under this Agreement, if Customer exceeds the Bandwidth Limit or Box Service plan level, reasonable restrictions will be placed on Customer’s Account(s) until any such excess usage is adequately mitigated or eliminated by Customer. Customer agrees that it is solely responsible for the nature and content of all materials, works, data, statements, and other visual, graphical, video, written or audible communications of any nature submitted by any User or otherwise used through its Account. Customer agrees not to use or permit the use of the Box Service: (a) to communicate any message or material that is defamatory, harassing, libelous, threatening, or obscene; (b) in a way that violates or infringes upon the intellectual property rights or the privacy or publicity rights of any person or entity or that may otherwise be unlawful or give rise to civil or criminal liability; (c) in any manner that is likely to damage, disable, overburden, or impair the Box Service or interfere in any way with the use or enjoyment of the Box Service by others; (d) to introduce any Malware or other malicious activity in Customer’s or a User’s use of the Box Service; or (e) in violation of any U.S. denied party-list, embargoed country restriction, export law or regulation. 2.5 Suspension of Service. Box may at any time suspend any User’s use of the Box Service and/or remove or disable any Content as to which Box reasonably and in good faith believes is in violation of this Agreement. Box agrees to provide Customer with notice of any such suspension or disablement before its implementation unless such suspension or disablement is necessary to comply with legal process, regulation, order or prevent imminent harm to the Box Service or any third party, in which case Box will notify Customer to the extent allowed by applicable law of such suspension or disablement as soon as reasonably practicable thereafter. Section 3. Non-Box Applications and Services. Box may make available to Customer and/or User certain third-party applications, services or products, which are licensed by their provider to Customer and/or User, for use in connection with the Box Service (“Third-party Products”). Box makes no warranties of any kind and assumes no liability whatsoever for Customer’s or User’s use of such Third-party Products. Section 4. Content Security; Data Privacy 4.1 Security. Box will implement commercially reasonable administrative, physical, and technical measures, including disaster recovery procedures, designed to secure the Content against accidental or unlawful loss, access or disclosure. Box will maintain, at a minimum, a SOC-1 Type II report compliance audit documentation, or its equivalent, during the Term and will provide a copy to Customer once per year during the Term upon prior written request.

Page 2 of 12 Box Confidential

4.2 Content Storage Location. The Box Service is provided from the United States and Content is stored in the United States. Box reserves the right to provide the Box Service from outside the United States and to store Content outside the United States. Box will use commercially reasonable efforts to provide Customer with at least 30 days’ notice of any such changes in the Content storage location. Notwithstanding the foregoing, Customer understands that nothing herein prohibits: (a) a User from accessing the Box Service, including Content, outside of the United States (subject to applicable law); and (b) processing of other information outside of the United States. The Privacy Policy identifies how Box collects, uses and discloses, on a limited basis, information of Users other than Content. 4.3 EU Data Protection and Onward Transfer. Box is, a certified member of the EU and Swiss Safe Harbor Frameworks, operated by the U.S. Department of Commerce and enforced by the Federal Trade Commission (“Safe Harbor”), and as such adheres to the EU and Swiss Safe Harbor Principles with respect to the transfer, processing and security of any data transferred from the European Economic Area or Switzerland. The parties acknowledge that for Content, and for purposes of the Safe Harbor, Customer is the data controller and Box is a data processor. Box will only process Content as directed by Customer or a User, or as described or contemplated by this Agreement. Section 5. Customer Responsibilities 5.1 Establishment of Accounts. Customer will comply with the procedures set forth below in establishing and maintaining Accounts. Customer will promptly appoint an Administrator for the Administrative Console and such Administrator shall be responsible for configuring the settings of the Box Service. Box will initially provide the necessary passwords or other unique identifiers to the Administrator to access the Administrative Console. As between the Administrator and Box, the Administrator will be solely responsible for the assignment and management of Accounts.

5.2 Content. Customer will: (a) be solely responsible for the nature, quality and accuracy of the Content; (b) ensure that the Content complies with the this Agreement and all applicable laws and regulations; (c) promptly handle and resolve any notices and claims relating to the Content (e.g. take-down notices pursuant to the Digital Millennium Copyright Act); and (d) maintain appropriate security and protection of the Customer’s and User’s devices accessing the Box Service. Box has no liability to Customer or any third party for any reason as a result of: (i) any unauthorized disclosure or access to Customer’s or User’s Account or Content as a result of Customer’s or a User’s misuse of the Box Service or loss or theft of any User password or username, except to the extent resulting from Box’s negligence or willful misconduct; or (ii) any deletion, destruction, damage or loss of Content caused by or at the direction of Customer or a User. 5.3 Notification of Unauthorized Use. Customer will promptly notify Box in writing of any unauthorized use of any Account, Content or the Box Service that comes to Customer’s attention. In the event of any such unauthorized use by any third party that obtained access to the Box Service directly or indirectly through Customer or through any User, Customer will take all steps within Customer’s control as reasonably necessary to terminate such unauthorized use and will provide Box with such cooperation and assistance related to any such unauthorized use as Box may reasonably request. Section 6. Support and Service Level Commitments. 6.1 Support Services. Subject to payment of the corresponding fees, Box will provide the support services (“Support Services”) specified in the applicable Order and as further described in Exhibit A (Service Level Commitments and Support Services). 6.2 Service Level Commitments. The Service Level Commitments for the Box Service are as specified on Exhibit A, subject to the level subscribed to and paid for by the Customer under the applicable Order. The sole and exclusive remedy for any breach of any Service Level Commitment is set forth in Exhibit A; provided that if Box is in material breach of this Agreement Customer may terminate this Agreement subject to the notice and cure provisions of Section 11.3 (Termination for Cause) in which case Customer will be entitled to a pro-rated refund of the fees unused pre-paid to Box for the remainder of the corresponding Subscription Period.

7. Warranty and Disclaimer

7.1 Box Service Warranty. Box warrants that while the corresponding paid-for Subscription Period is in effect, the Box Service will perform substantially in accordance with the functions specified in the User Guide when under use by Users in a manner that conforms to the terms and conditions of this Agreement and the User Guide. Subject to the notice and cure provisions of Section 11.3 (Termination for Cause), Customer’s sole and exclusive remedy and Box’s entire liability for a breach of this warranty shall be for Box to use commercially reasonable efforts to modify the Service to substantially achieve in all respects the functionality described in the User Guide and if Box is unable to restore such functionality, Customer shall be entitled to terminate the applicable Order and receive a pro-rated refund of the fees pre-paid to Box for the

Page 3 of 12 Box Confidential corresponding unused portion of the Subscription Period. The warranties set forth herein are made to and for the benefit of Customer only.

7.2 Mutual Warranties. Each Party represents and warrants to the other that: (a) this Agreement has been duly authorized, executed and delivered and constitutes a valid and binding agreement enforceable against such Party in accordance with its terms; (b) no authorization or approval from any third party is required in connection with such Party’s execution, delivery or performance of this Agreement; and (c) the execution, delivery and performance of this Agreement does not violate the terms or conditions of any other agreement to which it is a party or by which it is otherwise bound.

7.3 Customer Warranties. Customer represents and warrants to Box that: (a) Customer or its licensors own all right, title and interest in and to the Content as necessary in order to grant the rights to Box contemplated by this Agreement; (b) the Content does not violate privacy or publicity rights; and (c) the Content is not unlawful or otherwise gives rise to civil or criminal liability.

7.4 Disclaimer of Warranties. EXCEPT AS PROVIDED IN THIS SECTION 7, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY MAKES ANY (AND EACH PARTY SPECIFICALLY DISCLAIMS ALL) REPRESENTATIONS OR WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, INCLUDING, WITHOUT LIMITATION, ANY WARRANTY THAT THE BOX SERVICE WILL BE UNINTERRUPTED, ERROR-FREE OR FREE OF HARMFUL COMPONENTS, THAT THE CONTENT WILL BE SECURE OR NOT OTHERWISE LOST OR DAMAGED, OR ANY IMPLIED WARRANTY OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, AND ANY WARRANTY ARISING OUT OF ANY COURSE OF PERFORMANCE, COURSE OF DEALING OR USAGE OF TRADE. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES. IN SUCH AN EVENT, THE ABOVE EXCLUSION WILL NOT APPLY SOLELY TO THE EXTENT PROHIBITED BY LAW.

Section 8. Proprietary Rights

8.1 Content Ownership by Customer. As between Customer and Box, Customer or its licensors own all right, title and interest in and to the Content. Customer hereby grants Box the right to transmit, process, use and disclose the Content solely to provide the Box Service to Customer or any User or to comply with any request of a governmental or regulatory body (including subpoenas or court orders), as otherwise required by law, or to respond to an emergency which Box believes in good faith requires Box to disclose information to assist in preventing the death or serious bodily injury of any person.

8.2 Ownership of Box Service by Box. As between Box and Customer, Box or its licensors own and reserve all right, title and interest in and to, including any improvements or derivatives, the Box Service, the Box marks and other items used to provide the Box Service, other than the access rights explicitly granted to Customer in Section 2.1. No title to or ownership of any proprietary rights related to the Box Service is transferred to Customer or any User pursuant to this Agreement. All rights not explicitly granted to Customer are reserved by Box. Box reserves the right, in its sole discretion, to change or require Customer to change its Box Service user ID and any custom or vanity URLs, custom links, or vanity domains Customer may obtain through the Box Service. In the event that Customer makes suggestions regarding any features, functionality or performance that Box adopts for any of its products including the Box Service (expressly excluding Customer Confidential Information), such features, functionality and performance shall be deemed to be automatically assigned under this Agreement to Box, and shall become the sole and exclusive property of Box.

Section 9. Training or Professional Services

9.1 General Terms. Customer may wish to receive certain professional, educational, operational or technical services (collectively, “PS”) as described in a mutually agreed upon Statement of Work (“SOW”) accompanying the applicable Order. Box and Customer may, from time to time, execute additional SOWs that specify the PS to be provided to Customer. Each SOW will include, at a minimum: (a) a description of the PS and any work product or other tangible and/or training materials to be developed and/or provided to Customer (each, a “Deliverable”); (b) the scope of PS; and (c) the applicable fees and payment terms for such PS unless specified in the corresponding Order. To the extent payment terms are not specified in the SOW, the payment terms in this Agreement shall apply.

9.2 Deliverables, Ownership. (a) Deliverables. Unless otherwise set forth in the applicable SOW, Box shall own all rights, title and interest in and to the Deliverables (excluding any Customer Property, defined below), and related intellectual property rights. Subject to terms and conditions of the Agreement, and during the Term, Box hereby provides Customer with a limited, non-exclusive, non-

Page 4 of 12 Box Confidential transferable and terminable license to use the Deliverables solely for Customer’s internal operations in connection with its authorized use of the Box Service.

(b) Box Tools. Nothing herein shall be construed to assign or transfer any intellectual property rights in the proprietary tools, libraries, know-how, techniques and expertise (“Box Tools”) used by Box to develop the Deliverables, and to the extent such Box Tools are delivered with or as part of the Deliverables, they are licensed, not assigned, to Customer, on the same terms as the Deliverables.

(c) Customer Property. Customer shall own all rights, title and interest in and to any Customer Property. “Customer Property” means any technology, Customer-specific business processes, or deliverables, specifically as such materials are designated as Customer-owned property in a SOW. Box shall have the right to use any such Customer Property solely for the purpose of providing the PS to Customer hereunder and as set forth in the applicable SOW.

9.4 PS Warranty. In regards to PS only, Box warrants that: (a) it and each of its employees, consultants and subcontractors, if any, that it uses to provide and perform PS has the necessary knowledge, skills, experience, qualifications, and resources to provide and perform the PS in accordance with this SOW; and (b) the PS will be performed for and delivered to Customer in a professional and workmanlike manner in accordance with the laws and governmental regulations applicable to the performance of such PS. Customer acknowledges that Box’s ability to successfully perform the PS is dependent upon Customer’s provision of timely information, access to resources, and participation. If through no fault or delay of Customer the PS do not conform to the foregoing warranty, and Customer notifies Box within seven (7) days of Box’s delivery of the PS, Box will re-perform the non-conforming portions of the PS at no cost to Customer.

Section 10. Fees and Payment

10.1 Fees. Customer agrees to pay all fees set forth on all Orders under this Agreement. In the event that the Parties mutually agree in writing to any extension of a Subscription Period or the provisioning of a Box Service Plan Upgrade, Customer will pay Box the then-current list price for such extension or Box Service Plan Upgrade, unless otherwise set forth in the applicable Order. Subject to any credits or refunds applicable to any Service Level Commitments hereunder, if any, or as otherwise set forth in this Agreement, all Fees are nonrefundable. Unless otherwise specified in an Order, all fees and other amounts are payable in United States Dollars.

10.2 Invoicing and Payment Terms. Unless otherwise specified in the applicable Order, Customer will pay all fees within thirty (30) days of the date of the applicable invoice issued by Box. In the event Customer disputes any invoiced Fees, Customer will provide written notice of the disputed amount within fifteen (15) days after receiving such invoice and timely pay any undisputed portion of such invoice. The Parties will cooperate in good faith to resolve any disputed invoice or portion thereof within fifteen (15) days of notice of dispute. All amounts payable by Customer under this Agreement will be made without setoff and without any deduction or withholding. Customer will promptly reimburse Box for any cost or expense incurred in connection with any collection efforts undertaken by Box in connection with any past due amount owed under this Agreement. At Box’s discretion, past due amounts may accrue a late fee equal to the lesser of 1.5% per month or the maximum amount allowed by applicable law.

10.3 Taxes. Fees are exclusive of Taxes and, Customer will promptly pay or reimburse Box for all Taxes arising out of this Agreement. For purposes of this Agreement, “Taxes” means any sales, use and other taxes (other than taxes on Box’s income), export and import fees, customs duties and similar charges applicable to the transactions contemplated by this Agreement that are imposed by any government or other authority. Customer hereby confirms that Box can rely on the ship- to name and address set forth in the Order(s) Customer places directly with Box as being the place of supply for sales tax purposes. If Customer is legally entitled to an exemption from the payment of any Taxes, Customer will promptly provide Box with legally sufficient tax exemption certificates for each taxing jurisdiction for which it claims exemption. Unless otherwise prohibited by law, Box will apply the benefits of any requested tax exemption to charges occurring under Customer’s Account after the date Box receives and reasonably processes such tax exemption certificates.

10.4 Purchases Through Authorized Box Resellers. The terms of this Agreement related to pricing, payment and taxes do not apply to any Customer Orders placed through an authorized Box reseller (“Box Reseller”) where Customer pays the applicable fees directly to such Box Reseller. Customer will establish such terms independently with the Box Reseller.

Page 5 of 12 Box Confidential

Section 11. Term and Termination

11.1 Term of Agreement and Term of Order. This Agreement will commence on the Agreement Effective Date and will remain in effect for as long as there is an Order in effect (“Term”), unless otherwise terminated as provided for in Section 11.3 herein below. Each Order placed under this Agreement will be in effect for a period of one (1) year from the Order Effective Date unless otherwise agreed in writing by the Parties.

11.2 Order Renewal. Unless the Agreement is terminated as provided for herein, the Order(s) under this Agreement will automatically renew for the same period of time as the Subscription Period of the prior Order subject to payment of the corresponding fees, with either Party having the ability to provide the other Party with its intent not to renew the applicable Order(s) with at least thirty (30) days written notice prior to the end of the then-current Subscription Period of such Order(s).

11.3 Termination for Cause. Either Party may terminate this Agreement for cause: (a) upon thirty (30) days written notice to the other party of a material breach if such breach remains uncured after the expiration of such period; or (b) if the other party becomes insolvent, admits in writing its inability to pay its debts as they mature, makes an assignment for the benefit of creditors, becomes subject to control of a trustee, receiver or similar authority, or becomes subject to any bankruptcy or insolvency proceeding. Any failure by Customer to timely pay fees owing hereunder or to represent an intent not to pay, or to comply with Sections 2 or 5 will constitute a material breach of this Agreement.

11.4 Post-Termination Obligations. Upon the termination or expiration of this Agreement for any reason Customer will have no further rights to the Box Service hereunder except as set forth in this Section 11.4. For thirty (30) days following the expiration or the termination of the Agreement and/or applicable Subscription Period, and subject to Customer’s prior written request, Box will grant Customer’s Administrator limited access to the Box Service solely for purposes of Customer’s retrieval of the Content. After such thirty (30) day period, Customer will have no further rights to access the Box Service and Box will have no obligation to maintain the Content.

11.5 Surviving Provisions. Upon any expiration or termination of this Agreement, the following sections will survive: Sections 1, 2.4, 5.3, 7.4, 8, 10, 11.4, 11.5, 12, 13, 14 and 15.

Section 12. Indemnification

12.1 Indemnification by Box. Box will defend Customer against any third party claim that the Box Service infringes a registered patent, registered trademark, or copyright of a third party, or misappropriates a trade secret (“Claim Against Customer”), and will indemnify Customer for the resulting costs and damages finally awarded against Customer to such third party by a court of competent jurisdiction or agreed to in settlement. To the extent permitted by law, Box will have no liability to Customer under this Section 12.1 for any Claim Against Customer that arises out of: (a) any unauthorized use, reproduction, or distribution of the Box Service by Customer; (b) use of the Box Service in combination with any other software or equipment not supported in the User Guide; or (c) any modification or alteration of the Box Service by anyone other than Box or Box’s agents without the written approval of Box. In the event of a Claim Against Customer pursuant to this Section 12.1, Box may (at Box’s option and expense): (i) obtain for Customer the right to continue using the Box Service; (ii) modify the Box Service to make it non-infringing; or (iii) if subsections (i) and (ii) are not commercially viable (as determined by Box in its sole discretion), terminate this Agreement and refund Customer on a pro-rated basis any Fees pre- paid to Box for the corresponding unused period of the applicable Subscription Period.

12.2 Indemnification by Customer. Customer will defend Box against any third party claim: (a) that any Content, or Customer’s use of the Box Service in breach of this Agreement, infringes a registered patent, registered trademark, or copyright, or misappropriates a trade secret (to the extent that such infringement or misappropriation is not the result of Box’s actions); or (b) relating to any Content or to Customer’s use of the Box Service in violation of Section 2.4 (Restrictions on the Use of the Box Service). Customer will, with respect to any claim against Box that is subject to this Section 12.2, indemnify Box for the resulting costs and damages finally awarded against Box to such third party by a court of competent jurisdiction or agreed to in settlement.

12.3 Indemnification Process. As a condition of receiving an indemnification under this Agreement, the Party seeking indemnification hereunder (the “Indemnified Party”) will provide the other Party (the “Indemnifying Party”) with (a) prompt

Page 6 of 12 Box Confidential written notice of the claim; (b) complete control over the defense and settlement of the claim (provided, that the Indemnifying Party will not settle any claim without the Indemnified Party’s prior written permission if the settlement fails to unconditionally release the Indemnified Party from all liability pertaining to such claim, such permission not to be unreasonably withheld, delayed or conditioned); and (c) such assistance in connection with the defense and settlement of the claim, at the Indemnifying Party’s expense, as the Indemnifying Party may reasonably request.

12.4 Exclusive Remedy. This Section 12 states the Indemnified Party’s sole and exclusive remedy against, and the Indemnifying Party’s sole liability to, the other party for any type of claim under this Section 12. Notwithstanding the foregoing, each Party will have the right to terminate this Agreement pursuant to Section 11.3, to the extent the event giving rise to indemnification constitutes a material breach of this Agreement. Section 13. Limitation of Liability 13.1 Limitation of Liability. IN NO EVENT WILL BOX’S OR ANY OF ITS AFFILIATES’ TOTAL AND CUMULATIVE LIABILITY, OR THAT OF ITS DISTRIBUTORS AND RESELLERS, FOR ALL CLAIMS OF ANY NATURE ARISING OUT OF THIS AGREEMENT EXCEED THE TOTAL FEES PAID BY CUSTOMER TO BOX FOR THE SPECIFIC USE OF THE BOX SERVICE GIVING RISE TO THE CLAIM IN THE TWELVE (12) MONTHS PRECEDING THE EVENT FIRST GIVING RISE TO THE CLAIM UNDER THIS AGREEMENT. THE FOREGOING LIMITATION DOES NOT LIMIT OR EXCLUDE ANY LIABILITY FOR DEATH OR PERSONAL INJURY CAUSED BY NEGLIGENCE. 13.2 Disclaimer of Consequential and Related Damages. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL EITHER PARTY OR THEIR DISTRIBUTORS AND RESELLERS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, PUNITIVE, COVER, LOSS OF PROFITS OR REVENUE, OR CONSEQUENTIAL DAMAGES (INCLUDING, WITHOUT LIMITATION, LOSS OF GOODWILL OR LOSS OF USE OR DATA) HOWEVER CAUSED, UNDER ANY THEORY OF LIABILITY, INCLUDING, WITHOUT LIMITATION, CONTRACT, TORT, WARRANTY, NEGLIGENCE OR OTHERWISE, EVEN IF SUCH PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH DAMAGES. SOME JURISDICTIONS DO NOT ALLOW THE LIMITATION OF INCIDENTAL, CONSEQUENTIAL OR OTHER DAMAGES. IN SUCH AN EVENT THIS LIMITATION WILL NOT APPLY TO THE EXTENT PROHIBITED BY LAW. Section 14. Confidentiality 14.1 Definition. Either Party may disclose Confidential Information to the other Party during the Term of this Agreement. “Confidential Information” means all information disclosed by one Party (“Disclosing Party”) to the other Party (“Receiving Party”) which is in tangible form and labeled “confidential” or the like, or that reasonably should be understood to be confidential given the nature of the information and the circumstances of the disclosure. The following information will be considered Confidential Information whether or not marked or identified as such: (a) the Box Service; (b) Content; (c) the terms of this Agreement including all Orders and pricing thereto, and (d) the Disclosing Party’s strategic roadmaps, product plans, product designs and architecture, technology and technical information, security processes, security audit reviews, business and marketing plans, and business processes. Confidential Information, other than Content, will not include information that as shown by the Receiving Party’s records was: (i) already known to Receiving Party at the time of disclosure by the Disclosing Party; (ii) was disclosed to the Receiving Party by a third party who had the right to make such disclosure without any confidentiality restrictions; (iii) is, or through no fault of the Receiving Party has become, generally available to the public; or (iv) was independently developed by Receiving Party without use of the Disclosing Party’s Confidential Information.

14.2 Protection. The Receiving Party will use no less than a reasonable standard of care to safeguard the Confidential Information received from the Disclosing Party. The Receiving Party will only use the Confidential Information of the Disclosing Party: (a) to exercise its rights and perform its obligations under this Agreement; or (b) as otherwise required by law.

14.3 Permitted Disclosure. Neither Party will disclose Confidential Information in violation of the terms and conditions of this Agreement to any third party without the prior written consent of the other Party. Notwithstanding the foregoing, each Party may disclose Confidential Information, including the terms and conditions of this Agreement, without the prior written consent of the other Party: (a) as compelled by law provided that to the extent legally permissible the Receiving Party gives the Disclosing Party prior notice of such compelled disclosure and reasonable assistance, at the Disclosing Party’s expense, if the Disclosing Party seeks to contest such disclosure; (b) in confidence, to legal counsel, accountants, banks, and financing sources and their advisors; (c) in connection with the enforcement of this Agreement or rights under this Agreement; (d) the terms and conditions of this Agreement in confidence, in connection with an actual or proposed merger, acquisition, or similar transaction; or (e) or to respond to an emergency which Box believes in the good faith requires Box to disclose information to assist in preventing the death or serious bodily injury of any person.

Page 7 of 12 Box Confidential

Section 15. Miscellaneous 15.1 Contractual Relationship. The Parties are entering into this Agreement as independent contracting parties. Neither Party will have, or hold itself out as having, any right or authority to incur any obligation on behalf of the other Party. This Agreement will not be construed to create an association, joint venture or partnership between the Parties or to impose any partnership liability upon any Party. 15.2. Anti-Corruption. Customer agrees that it has not received or been offered any illegal or improper bribe, kickback, payment, gift, or thing of value from any of Box’s employees, agents or subcontractors in connection with this Agreement. Customer will use reasonable efforts to promptly notify Box at [email protected] should Customer learn of any violation of this restriction.

15.3 Press Release; References. Box may reference Customer as a Box customer or a user of the Box Service in sales and marketing materials including press releases. Any Customer logo or trademark usage will be in accordance with Customer’s trademark and logo usage guidelines as provided to Box. Upon Box’s reasonable request, Customer agrees to provide confidential references to either existing customers or prospects of Box and/or to work on a case study with Box. 15.4 Notices. Any notice or other communication under this Agreement given by any Party to any other Party will be in writing and will be effective upon delivery as follows: (a) if to Customer, (i) when delivered via registered mail, return receipt requested, to the address specified in an Order; or (ii) when sent via email to the email address specified in an Order or otherwise on record for Customer; and (b) if to Box, when sent via email to [email protected], with a duplicate copy sent via registered mail, return receipt requested, to the appropriate Box address listed here: Attention LegalOps, Box, Inc., 4440 El Camino Real, Los Altos, California, 94022, United States of America. Any such notice, in either case, must specifically reference that it is a notice given under this Agreement. 15.5 Nonwaiver. The failure of either Party to insist upon or enforce strict performance of any of the provisions of this Agreement or to exercise any rights or remedies under this Agreement will not be construed as a waiver or relinquishment to any extent of such Party’s right to assert or rely upon any such provision, right or remedy in that or any other instance; rather, the same will remain in full force and effect. 15.6 Assignment. Customer will not, directly, indirectly, by operation of law or otherwise, assign all or any part of this Agreement or its rights hereunder or delegate performance of any of its duties hereunder without the prior written consent of Box. Box may assign this Agreement (or Order) without obtaining Customer’s consent: (a) to an affiliate of Box; or (b) in connection with a successor in interest in a merger, reorganization or a sale of all or substantially all of the assets of Box. Subject to the foregoing restrictions, this Agreement will be fully binding upon, inure to the benefit of and be enforceable by the Parties and their respective successors and assigns. 15.7 Integration; Order of Precedence. This Agreement, together with any Orders and the Exhibits which are incorporated and included into this Agreement, constitutes the entire agreement between the Parties and supersedes any and all prior agreements or communications between the Parties with regard to the subject matter hereof. In the event of a conflict between terms of this Agreement and an Order, the terms of the Order shall prevail. This Agreement may not be amended or modified except by a writing signed by both Parties hereto. The terms of this Agreement shall supersede and control over any conflicting or additional terms and conditions of any purchase order, acknowledgement, confirmation or other document issued by Customer. 15.8 Severability. In the event that any provision of this Agreement, or the application thereof, becomes or is declared by a court of competent jurisdiction to be illegal, void or unenforceable, the remainder of this Agreement will continue in full force and effect and the application of such provision will be interpreted so as reasonably to effect the intent of the Parties. The Parties will promptly replace such void or unenforceable provision with a valid and enforceable provision that will achieve, to the extent possible, the economic, business and other purposes of such void or unenforceable provision. 15.9 Applicable Law; Dispute Resolution. This Agreement will be construed and enforced in all respects in accordance with the laws of the State of California, U.S.A., without reference to its choice of law rules. Any dispute, controversy or claim arising under, out of or relating to this Agreement, will be finally determined by arbitration conducted by the Judicial Arbiter Group (or, if unavailable, then such other similar group that can provide former judges as arbiters) in accordance with the Rules of Arbitration of the International Chamber of Commerce applicable to commercial disputes by a single arbiter who is (a) fluent in written and spoken English, the language governing this Agreement, and (b) skilled and experienced with cloud or internet services. The place of such arbitration will be in Palo Alto, California, U.S.A. The judgment of the arbitrator will be final, non-appealable (to the extent not inconsistent with applicable law) and binding upon the Parties, and may be entered in any court of competent jurisdiction. The foregoing does not limit or restrict either Party from seeking injunctive or other equitable relief from a court of competent jurisdiction.

Page 8 of 12 Box Confidential

15.10 Third-Party Beneficiaries. Nothing in this Agreement shall confer, or is intended to confer, on any third party any benefit or the right to enforce nay term of this Agreement. 15.11 Force Majeure. In the event that either Party is prevented from performing, or is unable to perform, any of its obligations under this Agreement due to any cause beyond the reasonable control of the Party invoking this provision (including, without limitation, for causes due to war, fire, earthquake, flood, hurricane, riots, acts of God, internet service provider failures or delays, denial of service attacks, or other similar causes) (“Force Majeure”) the affected Party’s performance will be excused and the time for performance will be extended for the period of delay or inability to perform due to such occurrence; provided that the affected Party (a) provides the other Party with prompt notice of the nature and expected duration of the event, (b) uses commercially reasonable efforts to address and mitigate the cause and effect of such event, (c) provides periodic notice of relevant developments, and (d) provides prompt notice of the end of such event. For the avoidance of doubt, Customer understands that the Box Service is not provided in countries listed in the Office of Foreign Control (“OFAC”) and that restricted access to the Box Service due to Customer 15.12 Government Users. If Customer is a U.S. government entity or if this Agreement otherwise becomes subject to the Federal Acquisition Regulations (FAR), Customer acknowledges that elements of the Box Service constitute software and documentation and are provided as “Commercial Items” as defined at 48 C.F.R. 2.101, and are being licensed to U.S. government User as commercial computer software subject to the restricted rights described in 48 C.F.R. 2.101 and 12.212.

Page 9 of 12 Box Confidential

EXHIBIT A SERVICE LEVEL COMMITMENTS AND SUPPORT SERVICES

Commencing on the Order Effective Date, Box will provide to Customer the Service Level Commitments and Support Services defined herein and as otherwise may be specified in the Order. In the event of a conflict between the terms of the Agreement, this Exhibit A, and an Order, the terms of this Exhibit A shall prevail.

1) Exhibit Definitions “Downtime" means any period during which the Customer is unable to access the Box Service, as measured at the Box network by industry standard tools, because of a Box Service system wide Issue preventing access to Content. “Issue” means a single, reproducible issue or problem materially or significantly affecting the functionality of the Box Service for multiple Users of Customer. “Enhanced Support Services” means that specific subscription level of support purchased and identified under the applicable Order as either “Premier Service” or “Platinum Service” and subscribed to by Customer under such Order. "Scheduled Downtime” means a scheduled time period in which the Box Service is unavailable for use not to exceed one (1) hour per calendar quarter. “Standard Support Service” means the standard level of support provided by Box for the Box Service at no additional charge to Customer and as specified under Section 4(a). “Premier Response Credit” means the credit that may be available to a Customer who has subscribed to one of the Enhanced Support Services under the applicable Order and as specified under Section 4(b)(iii) of this Exhibit. “Premier SLC Credit” means the credit that may be available to a Customer who has subscribed to one of the Enhanced Support Services under the applicable Order and as specified under Section 4(b)(i) of this Exhibit. "Uptime Percentage" means the total number of minutes in a calendar month minus the number of minutes of Downtime experienced in such calendar month, divided by the total number of minutes in such calendar month. 2) Case Prioritization Any Issues reported by Customer to Box and verified by the Box support team will be classified and assigned a priority by Box in its reasonable discretion. The following priorities and their meanings are used herein: a) Level 1 – Urgent – An Issue that renders the Box Service completely inoperative for all Users and no workaround is available. b) Level 2 – High – An Issue that materially impairs substantial features of the Box Service for many Users and no reasonable workaround is available. c) Level 3 – Normal – An Issue that impairs a feature of the Box Service for a few Users and a reasonable workaround is available. Box will provide an acknowledgement of a reported Issue to Customer and respond within the target time frames specified below in Section 4 (“Response”). The Response will include the priority assigned to the case by Box, any actions taken, estimated resolution time if available, and any escalation plans. Resolution of an Issue is subject to verification and reproduction of the Issue by Box, with Customer’s reasonable assistance in verifying and reproducing the Issue. Resolution(s) may include a temporary workaround, patch or bypass supplied by Box.

3) Applicability of Exhibit A Box's obligations under this Exhibit do not extend to any ongoing test or training instances of the Box Service provided to Customer or Downtime, Issues or errors that are caused by: a) Third party hardware or software; b) Use of the Box Service in violation of the terms of the Agreement; c) Use of the Box Service other than in accordance with any User Guide or the reasonable instructions of Box; or

Page 10 of 12 Box Confidential

d) Services, circumstances or events beyond the reasonable control of Box, including, without limitation, any Force Majeure events, the performance and/or availability of local ISPs employed by Customer, or any network beyond the demarcation or control of Box.

4) Support Services. Box will provide the level of support services as described in this Exhibit A to assist Customer in resolving Issues (“Support Services”). Support Services do not include: (a) physical installation or removal of the API, the Box Software and any User Guides; (b) visits to Customer’s site; (c) any professional services associated with the Box Service, including, without limitation, any custom development, data modeling, training and knowledge transfer; or (d) the set-up, configuration and use of the Box Service.

a) Standard Support Service i) Service Level Commitment for Standard Support Service: For Customers with Standard Support Service, Box will use commercially reasonable efforts to meet an Uptime Percentage of at least 99.9%. ii) Standard Services Response Time for Issues: For Customers with Standard Support Service, Box will use commercially reasonable efforts to meet the target response times listed in the table herein:

Hours of Operation 9 AM – 6 PM Local Time Monday – Friday Support Access Method Web/Phone Support Response Method Web/Phone Number of Support Requests Unlimited

Level 1 – Urgent Within 4 business hours Level 2 – High Within 8 business hours Level 3 – Normal Within 1 business day

b) Enhanced Support Services i) Service Level Commitments and Premier SLC Credits: For Customers who have purchased one of the Enhanced Support Services, Box will use commercially reasonable efforts to meet an Uptime Percentage of at least 99.9%. In the event that Box does not meet such Uptime Percentage, a Customer will receive Premier SLC Credits as identified in the SLC Table below during the applicable Subscription Period if: (1) Customer has reported an Issue by filing a ticket with Box support within fifteen (15) days of experiencing a possible Downtime event and (2) Customer has provided Box a written claim request for Premier SLC Credits within fifteen (15) days of receiving the uptime percentage report (as made available by Box) for the period in which the possible Downtime event occurred. Failure to comply with this requirement will forfeit Customer's right to receive the Premier SLC Credits as set forth herein. The Premier SLC Credits will be equal to the SLC Credit Percentage multiplied by the Customer’s Box Service license fees paid by Customer for the Box Service that are attributable to the corresponding month (calculated on a straight line pro-rated basis with respect to any Fees paid in advance) and then pro-rated for the basis attributable to affected Users. Customer is not eligible to receive Premier SLC Credits during any period of time when payments owed are past due. Box (including where applicable through a Box Reseller) will settle Premier SLC Credits, as determined in its sole discretion, either by applying to future billing cycle(s) or as a refund against annual fees earlier paid. In no event will the total amount of Premier SLC Credits if any, exceed the Box Service fees paid by Customer for the corresponding month.

Page 11 of 12 Box Confidential

SLC Table Uptime Percentage Premier SLC Credit Percentage Less than 99.9% but equal to or more than 99.8% 5% Less than 99.8% but equal to or more than 99.7% 10% Less than 99.7% but equal to or more than 99.6% 15% Less than 99.6% but equal to or more than 99.5% 20% Less than 99.5% but equal to or more than 99.4% 25% Less than 99.4% but equal to or more than 99.3% 30% Less than 99.3% but equal to or more than 99.2% 35% Less than 99.2% but equal to or more than 99.1% 40% Less than 99.1% but equal to or more than 99.0% 45% Less than 99.0% 50% ii) Enhanced Support Services Response Times for Issues: For Customers who have purchased one of the Enhanced Support Services, Box will use commercially reasonable efforts to meet the guaranteed response times listed in the table herein: Hours of Operation 24 Hours/Day 7 Days/Week 365 days/year Support Access Method Web/Phone Support Response Method Web/Phone Number of Support Requests Unlimited Level 1 – Urgent Within 1 hour Level 2 – High Within 2 hours Level 3 – Normal Within 2 hours

iii) Premier Response Credits: Customer will be eligible to receive a Premier Response Credit, provided that a Customer: (1) has purchased one of the Enhanced Support Services, (2) has opened a support ticket for an Issue; and (3) Box fails to meet the Response Times for Level 1 and Level 2 support tickets three times during the given month. In the event that the foregoing three requirements are achieved, Customer will receive a Premier Response Credit of 15% of the Enhanced Support Services fees paid by Customer for Enhanced Support Services that are attributable to such month (calculated on a straight line pro-rated basis with respect to any fees paid in advance). The Premier Response Credit is Customer's sole and exclusive remedy for any failure by Box to meet any response time performance obligations pertaining to the Box Service as set out in this Exhibit A. Customer is not eligible to receive Premier Response Credits during any period of time when payments owed are past due. Box (including where applicable through a Box Reseller) will issue Premier Response Credits, as determined in its sole discretion, either by applying to future billing cycle(s) or as a refund against annual fees earlier paid. In no event will the total amount of Premier Response Credits exceed the Enhanced Support Services fees paid by Customer for the corresponding month.

Page 12 of 12 Box Confidential

Statement of Work

STATEMENT OF WORK

Prepared for City of Elgin (“Customer”) Provided by Box on 10-17-16

Prepared by: Darren Smith Solutions Consultant [email protected] Phone # 650-209-3401

Page 1 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

SECTION 1: General Terms

This Statement of Work (“SOW”) describes the professional services (“Professional Services”) to be performed by Box, Inc. (“Box”) for Customer (Box and Customer are sometimes referred to herein individually as a “Party” and together as the “Parties”) pursuant to (in order of preference, as applicable): (i) the separate Box Professional Services Agreement entered into by and between the Parties; or (ii) the applicable service agreement entered into by the Parties for the provision of the Box Service (e.g., the Box Service Agreement); or (iii) to the extent the Parties have not entered into an agreement referenced in (i) or (ii), the Box Consulting Additional Terms and Conditions set forth below (collectively, the “PS Terms”).

If the Professional Services that are the subject of this SOW are being purchased through a Box Reseller: • Box Reseller makes no warranties or conditions, express or implied, regarding the Professional Services. Warranties from Box, if any, are as set forth in this SOW. • Box Reseller is not a party to any SOW or responsible for the delivery or use of the Professional Services. Customer must bring any issue related to the delivery of the Professional Services to Box. • Box Reseller does not provide technical support for the Professional Services. Box will define the support obligations and processes available for the Professional Services herein. Box is responsible for processing any credits or rebates they may make available. • The Professional Services charges for this SOW are set forth below. Box Reseller will invoice Customer for the Professional Services in accordance with Box Reseller’s agreed upon payment terms with Customer. All charges are exclusive of any applicable taxes.

In the event of any inconsistency or conflict between the terms and conditions of this SOW and the PS Terms, the terms and conditions of this SOW shall govern with respect to the subject matter of this SOW only. Capitalized terms used in this SOW shall have the meaning defined under the PS Terms, unless otherwise defined herein.

The scope and pricing set forth in this SOW shall be valid starting from the date this SOW is provided to Customer and will expire thirty (30) days from such date.

Box Consulting Additional Terms and Conditions: For the avoidance of doubt, Box shall own all rights, title and interest in and to the materials and information (“Deliverables”) provided as part of the PS and any related intellectual property rights therein. During the term specified in the Order, Box hereby provides Customer with a limited, non- Page 2 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work exclusive, non-transferable and terminable license to use the Deliverables solely for Customer’s internal operations in connection with authorized use of the Box Service. Nothing herein shall be construed to assign or transfer any intellectual property rights in the proprietary tools, libraries, know-how, techniques and expertise (“Box Tools”) used by Box to develop the Deliverables, and to the extent such Box Tools are delivered with or as part of the Deliverables, they are licensed, not assigned, to Customer, on the same terms as the Deliverables. Box warrants that: (a) it and each of its employees, consultants and subcontractors, if any, that it uses to provide and perform PS hereunder has the necessary knowledge, skills, experience, qualifications, and resources to provide and perform the PS; and (b) the PS will be performed for and delivered to Customer in a professional and workmanlike manner. If through no fault or delay of Customer the PS do not conform to the foregoing warranty, and Customer notifies Box within seven (7) days of Box’s delivery of the PS, Box will re-perform the non-conforming portions of the PS at no cost to Customer.

Project Context

Customer is in the process of implementing, configuring, customizing and/or integrating Box’s proprietary hosted application(s) (the “Box Service”) into Customer’s business environment. Customer has requested that Box’s professional services organization (“Box Consulting”) provide resources to assist Customer’s staff as set forth below (the “Project”). Box Consulting and Customer shall commit resources to work on the Project (the “Project Team”).

Page 3 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

SECTION 2: Scope of Services Executive Summary: Our Understanding of the Project

The City of Elgin ("COE") is looking to move away from the world of on premise storage and USB drives, to a secure centrally managed cloud based environment that can be accessed from anywhere and on any device. Box is the perfect fit for COE because technically it meets all their current short term requirements, but also is a powerful content platform that meets their longer term goal of having one single content layer that spans across their entire technology landscape.

The purpose of this engagement is for the Box Consulting team to work with COE to successfully deploy the Box Service to an Early Adopters group of users. The Early Adopters group will help to provide initial feedback on Box configurations, folder structure, and will assist with use case validation across their respective teams. The findings we gather from the Early Adopters will help us to refine the configurations, folder structure, and change management strategy when we deploy to the remainder of users during a Phase 2 engagement expected to begin in January.

Engagement Goals IT, Administrative, and Security Goals • Setup administrative and security settings to support Early Adopters needs • Design a top level folder structure to be used during the Early Adopter program • Support the migration of up to 1TB of content from network file share to Box • Drive end user change management efforts so that they understand: o How to securely store and share files internally within COE, and externally with customers/vendors/partners o Why COE has chosen Box and help them to appreciate "What's in it for me?" for their specific roles within the organization

End User Goals • Easily navigate Box and be able to find their content • Understand folder structure, folder naming conventions, permissions, and how to manage collaboration • Organize folders and content to fit their department/project/workflow needs • Understand the two ways of sharing in Box: Collaboration vs. Links, and when it is appropriate to use each method • Understand how Box makes them more efficient using Box Edit, Box Sync, Box for Office, Box Mobile, version control, comments, tasks and access stats

Page 4 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

Project Duration

Based on the scope of the services outlined in this section, the Project is expected to be completed in 8 to 10 weeks. This Project duration estimate has been made under the assumption that Customer will provide Box Consulting timely access to the key resources and decision makers outlined in Section 3.

Box Consulting and Customer have made reasonable commercial efforts to provide initial estimates for planning purposes. A Project plan will be created with the following deployment schedule model as guidance (“Project Plan”). Customer acknowledges the visual model below does not reflect a deliverable; it only represents a draft:

Page 5 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

Use Cases Summary

The project scope includes the following use cases:

Use Case Description Targeted User Groups

Personal Box will become the primary location for all Early Adopters Drive/Corporate User end user personal working content, replacing Drive the use of Network File Shares, USB drives, and other unsanctioned tools. Department and Group Box will become the single source of truth for Early Adopters Collaboration all departmental content, replacing Network File Shares, email attachments, and unsanctioned tools.

Implementation Stages

In performing the PS, Box Consulting expects to follow the Box Project Methodology (“Box Methodology”), which is detailed below. The Box Methodology is composed of activities and tasks grouped around distinct project stages which Box Consulting believes makes it easier to provide management and control during the duration of the Project. Not all projects will always use all stages and complete all the activities outlined below in this methodology. This staged approach has been designed to be flexible enough to allow specific requirements to be properly addressed and for methods and techniques to be selected and implemented as needed.

PLAN

ACTIVITIES • Conduct Project kickoff meeting • Validate and document business objectives for identified use cases o Define and document value proposition to guide Early Adopter activities • Administer and complete Box Admin Essentials training o 5 seats in Box Admin Essentials training course included • Create Project Plan • Conduct primary stakeholder identification for up to 5 stakeholder groups to participate in the Early Adopter engagement planning • Conduct Early Adopter stakeholder kickoff and align expectations for their participation in Early Adopter program

Page 6 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

o Up to 5 stakeholder groups; one kickoff session for all groups

DELIVERABLES • Project Plan

MILESTONES • Project Plan complete • Early Adopters identified, and kickoff complete

ASSUMPTIONS • Project timelines consider availability of Customer resources and key decision makers • Customer has identified an internal point of contact for driving change management activities to partner with Box Consulting team

CONNECT

ACTIVITIES • Single Sign-On (“SSO”) Strategy Overview o Conduct overview of SSO with Box o Determine SSO strategy for Phase 2 engagement • Determine deployment strategy for native Box Service applications: o In scope applications include: § Box Edit § Box Sync § Box for Office o Provide application packaging details and deployment guidance • Determine deployment strategy for Box Service Mobile application

DELIVERABLES • SSO Overview Deck o Standard Box Service SSO overview presentation

MILESTONES • SSO overview complete, and strategy for Phase 2 defined • Deployment plan for all Box native and 3rd party applications defined

Page 7 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

CONFIGURE

ACTIVITIES • Conduct Line of Business (“LOB”) discovery sessions with up to 5 stakeholder groups • Introductory consultation for the Box Admin Console and Enterprise Settings o Initial configuration to support Early Adopters use cases • Design top level folder structure for Early Adopter Box users o Determine top level folder security properties • Determine User provisioning approach • Determine content migration strategy. In scope content migration activities include the following: o Discussion of content migration methods to the Box Service and recommendations o Migration of the following content to Box:

Size Source Migration Method (GB/TB) 1TB Network File Share Managed Migration Service * See Managed Content Migration: Scope of Services (STANDARD) at the end of Section 2.

• Determine communications, training and engagement plan o Create initial communications plan (timeline and vehicles) o Box to provide communications templates o Define end user training plan • Conduct one , 1-hour pre-course consultation with Box Consulting team member to prepare for custom training delivery

DELIVERABLES • Communications plan

MILESTONES • Initial Enterprise Settings configured and approved by appropriate stakeholders • Top level folder structure created • Content migration strategy defined • Communications plan defined

ASSUMPTIONS • Customer is responsible for configuring and implementing Enterprise Settings and folder structure. Box Consulting will not have access to the Customer’s environment and will be providing advisory services only. • Detailed configuration and documentation will be provided in Phase 2 Page 8 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

• Design consultation on folder structure will not exceed 3 levels of hierarchy • Customer is responsible for the development of code to support any work with Box Service APIs. Box Consulting resources will only serve in an advisory capacity.

DEPLOY

ACTIVITIES • Setup shared helpdesk o 5 seats of Box Helpdesk Essentials training included o Define technical issue escalation procedures • Define and document Early Adopter activities checklist o These are specific activities for users to test during the Early Adopters program • Deploy Users • Deploy Early Adopter communications • Deliver Custom End User Training – Standard Course, Private Delivery (Model 1) o 2 virtual private deliveries of Box User Essentials (60 minutes) • Go-Live Services, 1.5 onsite days for kickoff go-live services. Activities to include: o 1 on 1 training sessions with Executive Council or other VIP Early Adopters o Genius Bar § Set time where end users or departments can come by and chat with a Box expert o 1 Lunch & Learn o Office Hours § Time that can be scheduled with a Box expert

DELIVERABLES • Customized communications o Introduction to Box and the Early Adopters timeline o Directions for how to log-in and link to Early Adopters activities checklist of action items • Recording of custom training session(s) in .mp4 format for distribution

MILESTONES • Users deployed and active in Box • End user training distributed/delivered

Page 9 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

ASSUMPTIONS • Customer is responsible for deploying users and distributing all end user communications • Custom training delivery assumptions: • Course delivered in your Box Service instance • Course delivered via web-conferencing service of your choice • Each course delivery includes Q&A with your instructor

OPTIMIZE

ACTIVITIES • Early Adopter stakeholder check in with up to 5 stakeholder groups • Conduct post-deployment assessment using the following: • Adoption and usage reporting tools • Create end user survey to capture Early Adopter feedback • Review survey results and plan to incorporate into Phase 2 • Define and document project goals and strategy for Phase 2 • Begin 4-weeks post go-live support

DELIVERABLES • End-User survey results • Customized Communications o Link to user survey questionnaire o Standardized reminder email • Deployment Assessment & Go-Forward Plan Document

MILESTONES • End user survey created, deployed, and feedback gathered • Goals for Phase 2 defined and documented • End users educated on their responsibilities during Phase 2 • Transition to Customer Success Manager complete • Early Adopter wrap-up discussion complete

Page 10 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

Managed Content Migration: Scope of Services (STANDARD)

MEHTHODOLOGY

Box Consulting follows the below process for managing the migration of the source data set: 1. Pre-Migration Preparation 2. Migration Configuration 3. Migration 4. System Cutover 5. Box Go-Live

SCOPE

Box Consulting will manage the migration of up to 1 TB of content from Customer share drive to Box.

ACTIVITIES

Phase 1 - Pre-Migration Preparation • Customer to perform folder structure analysis/clean-up/re-organization • Customer to provide Box with analysis report of content to be migrated • Customer to confirm access to content and required hardware • Customer to provision target user(s) in Box

Phase 2 – Migration Configuration • Customer to install local application at data source(s) • Customer to provide source details and destination account details o Box will connect to a single destination account • Customer to confirm source content to be migrated and destination location • Box to configure source/destination connections and migration job(s) • Box to provide pre-migration analysis report of content to be migrated

Phase 3 – Migration • Box to initiate migration of content • Box to monitor progress and provide regular updates • Box to confirm completion and provide post-migration report(s) • Customer to review migrated content and reports and confirm success

Phase 4 – System Cut-Over • Box to run synchronization of source content to capture changes • Customer to schedule and communicate cutover date • Box to run final synchronization of content following source shutoff date

Page 11 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

Phase 5 – Box Go-Live • Customer to confirm migration completion and finalize launch procedures • Customer to apply folder access permissions in Box • Customer to communicate Go-Live to end users

DELIVERABLES • Pre-migration analysis report of content to be migrated • Customer content in Box • Post-migration reports showing the results of the migration

ASSUMPTIONS • Customer will provide admin access to the content to be migrated • Customer will provide a Box account to act as the migration destination account • Box Consulting will transfer all content as-is. Box does not support the migration of folder permissions that do not follow Box's waterfall permission structure (e.g. subfolder disinheritance). Content that breaks this permission model may require manual re-organization by customer prior to moving to Box • Box agrees to work with Customer on a mutual transition schedule and transition plan to ensure a smooth, orderly and successful transition of all Customer folders and files • Migration timelines are subject to number of factors, including, but not limited to content volume, number of files, and source location. Transfer speeds are not guaranteed • The migration process may require use of a cloud based service with a locally installed on premise agent, or a full on premise migration stack including a SQL Server and Windows service. If either of these services are required, Customer will be responsible for installation and procurement of requisite hardware (or virtual machines). Box will provide installation and configuration assistance • The customer will provide the appropriate project management and administrative technical resources • Migrations will be configured and initiated during regular business hours

EXCLUSIONS • The permissions (read / write user level access) of the files will not be mapped to Box as part of the migration. Content outside of the designated source(s) are not in scope

Page 12 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

SECTION 3: Project Team

Customer is responsible for providing and ensuring Customer’s committed participation of resources required during the Project. The pricing and schedule reflect this important assumption. Professional Services delivered in this SOW are performed by Box Consulting jointly with Customer as a cooperative, hands-on project, jointly managed by Box Consulting and Customer.

The following table lists the Project roles, not individuals, required to complete the Project. Depending on the size of the engagement, a single individual may take responsibility for any number of roles or a single role may require more than one individual.

Customer Customer Box Role Box Role Responsibility Equivalent Responsibility Project Responsible for providing Project Sponsor Responsible for providing Box Sponsor Customer resources needed for resources needed for a a successful implementation. successful implementation. Assist with removing Assist with resolution of organizational roadblocks as the issues or roadblocks requiring need arises to keep the project executive escalation. on track. Project Responsible for the oversight of Implementation Primary Project Lead Manager Customer resources, schedules Consultant responsible for oversight of and tasks day-to-day project tasks, ● Attend all key Project activities and schedule. meetings Provides project guidance, ● Point of contact for all day- recommendations and best to-day Project operations practices. ● Participate in regular Project status meetings The Implementation ● Manage risks and issues Consultant will serve as the Customer’s primary Box contact during the project. Technical Responsible for execution of Technical Responsible for providing Lead technical project components Consultant guidance and completing Box such as: tasks related to: • SSO Configuration • SSO Configuration • Application integrations • Application integration • API development configuration • APIs and the Box Service Platform • Content Migration Administrator Responsible for all configuration N/A Provide configuration tasks and ongoing Service recommendations and administration guidance ● Assess and apply configuration changes in Page 13 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

the Box Service environment ● Manage user acceptance tasks, including testing documentation ● Support and manage organization’s ongoing Service use

Enterprise Responsible for advising on Solution Architect Design the overall solution as Architect Customer’s overall application it relates to the technical and architecture, system solution architecture of the requirements Box Service and other integrated systems. This may include facilitation of design session and overall technology strategy.

Change Coordinate access to Customer Change Provide guidance and best Management resources, deliver Management practices for change Lead communication and feedback Specialist, management activities to tools provided by the Box team Implementation maximize Box Service user Consultant adoption Education Provide feedback on education Education Provide guidance and best Lead materials, ensure training Specialist practices for user education, facilities are available, schedule deliver custom training Customer team to assist as services Customer Experts during training sessions

Business Provide context to business- Change Engage stakeholders and Champions specific use cases and Management participate in use case workflows to inform enterprise Specialist, discussions configuration and folder Implementation structure conversations Consultant

Extended Additional Customer resources Subject Matter As needed Box Consulting Team as needed to support the scope Experts, Education resources (including subject of the Project resources, etc. matter experts, technical and/or education resources) to support the scope of the Project

Box Consulting resources are not necessarily dedicated to any single project and may be engaged across many projects for various customers.

Page 14 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

Onsite Staffing Assumptions

A summary of planned onsite visits by Box resources is as follows:

Stage Activity Visits Duration Location (Days) Configure Onsite Workshop 1 1.5 Elgin, IL

Deploy Go Live Services 1 1.5 Elgin, IL

Agendas for onsite workshops will be jointly agreed upon by Box and the Customer. Example topics include:

• LOB discovery sessions • Enterprise setting configurations • Design Early Adopter folder structure • Go-live support: Genius Bar, Lunch and Learn • Conversations about adoption programs and Enterprise messaging for roll-out

All onsite PS engagements are assumed to be a single location over consecutive days.

Page 15 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

SECTION 4: Project Assumptions

Customer acknowledges that its participation and cooperation are critical for the success of the Project. Unless otherwise noted in this SOW or agreed to in writing by the Parties, the following assumptions are based on information provided by Customer to Box Consulting relating to the Project and have been used to develop Box’s current level of effort and fees. Deviations from these assumptions may lead to commensurate changes in the timeline and fees and will be handled through the Change Control Process described below in this SOW.

a) SOW Term/Expiration: Unless otherwise agreed upon by the Parties in writing, the obligation of Box to provide PS to the Customer under this SOW expires the earlier of: 1) expiration or termination of the PS Terms; 2) completion of the Professional Services described in this SOW; or 3) 12-months from the date this SOW was last executed by the Parties below. b) Change Control Process: If Customer or Box requests a change in any of the specifications, requirements, Deliverables, or scope (including drawings and designs) of the PS described in this SOW, the Party seeking the change shall propose the applicable changes by written notice. Within forty-eight (48) hours of receipt of the written notice, each Party’s project leads shall meet, either in person or via telephone conference, to discuss and agree upon the proposed changes. Box will prepare a change order describing the proposed changes to the SOW and the applicable change in fees and expenses, if any (each, a “Change Order”). Change Orders are not binding unless and until they are executed by both Parties. Executed Change Orders shall be deemed part of, and subject to the PS Terms. If the Parties disagree about the proposed changes, the Parties shall promptly escalate the change request to their respective senior management officers for resolution. c) Standard Functionality: Service functions referenced herein are assumed to be standard functionality implemented through configuration changes only, except as may otherwise be specified in this SOW. d) Future Product Release: This SOW does not include time for management of the release process, analysis or implementation of functions and features that are not available within the current general release of the Box Service.

Page 16 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work e) Timeliness of Responses: Customer is responsible for acknowledging and responding to documents relating to this Project. These documents could be requirements documents, escalation issues or end-of-project notices. Some documents will require Customer’s signature / e-signature before Box can continue with the implementation and Customer is responsible for responding in a timely and collaborative fashion. f) No Compliance with Law Representation: Customers are solely responsible for ensuring they are in compliance with any applicable laws and regulations, and nothing contained herein will be deemed legal advice or a representation that Box Consulting will ensure Customers are in compliance with applicable laws or regulations. Customer acknowledges that purchasing Box Consulting, or any other Box service, does not ensure or provide an attestation that Box Customers are in compliance with specific compliance, legal, or regulatory requirements.

g) Delivery of Professional Services:

i. Scope: Any item or activity not specifically included within the scope of this SOW is deemed outside the scope of this SOW and may require a Change Order or separate SOW.

ii. Remote Professional Services: The PS outlined in this SOW will be provided remotely in English (whether verbally or in writing), with communication via telephone, email and web-conference (the standard platform for online delivery is Cisco WebEx tools) from Box’s own facilities.

iii. Onsite Professional Services: If onsite services are incorporated into this SOW, the schedule for any onsite services will be determined between Box Consulting and Customer upon Project start.

iv. Recording: Customer shall not film or record Box delivery of PS, Box resources, or Box materials without written consent from Box.

v. Business Hours/Overtime: Any and all hours outside normal business hours and/or in excess of eight (8) hours per day per Box Consulting resource or forty (40) hours per week per Box Consulting resource require the prior written consent of Box. Normal business hours for the working week are defined as Monday through Friday.

Page 17 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

vi. Project Hour Allocations: In the event project hour allocations are included within the scope of this SOW (“Project Hour Allocations”), Customer is responsible for identifying the work to be provided by Box Consulting as Project Hour Allocations under this SOW and Customer is also responsible for determining the priority of objectives regarding such Project Hour Allocations. Customer acknowledges and agrees that: (a) any Project Hour Allocations specified in this SOW include up to the number of Professional Service hours listed and not specific deliverables; (b) any Project Hour Allocations listed in this SOW may not have been fully scoped and there is no assurance that the work identified by Customer for Box Consulting to provide as Project Hour Allocations can be completed within the hours allotted under this SOW or even that such work can be completed at all; and (c) Box Consulting reserves the right in its sole discretion to reject any request for work identified by Customer to be provided by Box Consulting as Project Hour Allocations if Box reasonably believes such work is outside of the types of services normally provided by Box Consulting. Project Hour Allocations may be consumed by Box Consulting in completing preparations for meetings, completing offline research, completing offline configurations or other action items.

vii. Cancellation / Postponement: Box and Customer shall use commercially reasonable efforts to attend all scheduled Project meetings. The repeated cancelation of Project meetings may result in Project delay and additional costs. h) Training Professional Services:

i. Training Deliverables: Customer is solely responsible for any printing, shipping and copying charges for any training Deliverables. Slide decks, recordings, instructor guides, or other resources are not provided to Customer unless they are stated as a Deliverable in Section 2. All electronic and hard copy versions of the training Deliverables are provided for Customer’s internal training purposes only. Customer is prohibited from: (a) modifying the training Deliverables (only Custom Training materials may be altered); and (b) reselling or sublicensing any training Deliverables. Customer may not record, film, stream or otherwise capture any performance or aspect of the training Professional Services unless done so at the request of the Box Education team. Training Deliverables are not subject to any maintenance, support or updates.

ii. Virtual Training Delivery. The standard platform for virtual training delivery is Adobe Connect. All training will be conducted in English only.

Page 18 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

i. Capacity. Box virtual training sessions are delivered for a maximum of two hundred (200) participants per session. If virtual training is required for more than two hundred (200) participants, an additional session may need to be purchased through the Change Control Process.

ii. Virtual Training Facilities. Customer is responsible for providing the appropriate facilities for the training delivery, including Internet connectivity, telephone, an individual computer for each student, a Box account for each student, and other reasonable classroom amenities.

iii. Cancellation / Postponement: The cancellation or postponement of virtual training services within five (5) business days of the scheduled training deployment may result in additional costs. Box reserves the right to reschedule a course with less than 10 users registered 20 business hours prior to the session.

iv. Attendee Resources. Box will provide one (1) Box Specialist for every 75 users registered up to 20 business hours prior to the session. Box Specialists are responsible for supporting users and answering questions throughout the course. If Customer is managing course registration using their own tools, Customer is responsible for providing accurate registration numbers no later than 40 hours prior to delivery.

iii. Onsite Training Delivery. When purchased, onsite end user training is assumed to be a one-time visit at a single location. Onsite training will be conducted solely for onsite individuals and will not be streamed for remote attendees. All training will be conducted in English only.

i. Capacity. Box Onsite Training sessions are delivered for a maximum of five hundred (500) participants per session. If onsite training is required for more than five hundred (500) participants, an additional session may need to be purchased through the Change Control Process.

ii. Onsite Training Facilities: Customer is responsible for providing the appropriate facilities for the training delivery, including Internet connectivity, a Box account for each student projector, an individual computer for each student, and other reasonable classroom amenities. Customer facility must support capacity of training participants.

Page 19 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

iii. Cancellation / Postponement: The cancellation or postponement of onsite training services within 14 business days of the scheduled training deployment may result in additional costs.

iv. Attendee Resources. Customer will have member(s) of their project team or helpdesk present during training to assist with questions or support during hands on activities. Customer will provide 1 individual for every 100 users registered up to 20 business hours prior to the session. If Customer is managing course registration using its own tools, Customer is responsible for providing accurate registration numbers no later than 40 hours prior to delivery. i) Project Staffing:

i. Customer Resources Availability: Project timeline estimates are based on availability of Customer resources and key decision makers. Lack of access or change to project stakeholders will impact project timelines and costs if decisions cannot be made in timely fashion.

ii. Administrator: The Administrator role on the Project is critical to the success of the Project and long term adoption of the Box Service. The Administrator is to be in place prior to the start of the Project and remain for the duration of the engagement. j) Travel and Expenses i. As described in Onsite Staffing Assumptions in Section 3

Page 20 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Statement of Work

SECTION 5: Pricing and Payment Terms

The pricing in this SOW represents the fixed fees for the PS set forth in this SOW (“Fixed Fee”). All fees described below are exclusive of taxes (including VAT), which shall be the responsibility of Customer in accordance with PS Terms. In the event of a conflict between the pricing in this SOW and the pricing set forth in the Order applicable to this SOW, then the pricing set forth in the Estimate/Order shall govern and control. Any expenses (as described below) are not included in the Fixed Fees and are an additional cost to Customer.

This SOW includes all currently contemplated Box travel and living expenses as part of the total Fixed Fees. Additional travel and living expenses required as a result of adding scope to this SOW will be included in any new fee estimate provided as part of the Change Control Process. Additional travel and living expenses required where there is no change in scope to this SOW will be subject to Customer’s prior written approval and, if such approval is provided, billed to Customer by Box subject to the payment terms in the PS Terms.

Customer acknowledges that the Fixed Fee is based solely on the information provided to Box and the assumptions documented in this SOW. Any requirement(s) not included herein or items not contemplated will be considered outside of the Fixed Fee scope and will be handled through the Change Control Process defined in this SOW, and may result in additional cost. The Fixed Fee for this SOW are as follows:

Item Price FullStart Custom $20,000 USD

TOTAL $20,000 USD

APPROVED BY: Catherine Moniz 10/17/16 2:36 PM

Page 21 of 21 Version 5.0.1 | Version Date 8/3/2016 |©Box Inc. | BOX CONFIDENTIAL

Modern Content Management Platform

Common Use Cases: Enterprise File Sync & Share Document Management Internal & External Collaboration Secure Mobile Access Custom Application Development Intranet Integration

Prepared By: Kate Sterne, Account Manager [email protected] 9148827282

Box, Inc. 900 Jefferson Ave, Redwood City, CA 94063

Box Confidential 1 Table of Contents

Executive Summary ...... 4 Company Background ...... 5 Supplier Qualification ...... 7 Data Access ...... 7 Intuitive Web Interface ...... 7 Box Preview ...... 7 Box Desktop Sync Access ...... 8 Box for Desktop Streaming Access ...... 9 Mobile Access & Box Capture ...... 9 Box is a Connected Platform ...... 10 Microsoft Office and Outlook Integrations ...... 11 Microsoft SharePoint Integration ...... 14 Salesforce.com and Chatter Integration ...... 15 Jive Integration...... 15 Box DICOM ...... 17 Secure File Sharing ...... 17 Shared links ...... 16 Collaborator Invites ...... 17 Metadata ...... 18 Data Management ...... 18 Reporting ...... 18 Content Management and Federated Search ...... 19 Security Policies & DLP ...... 20 Box Governance & Retention Management ...... 21 Data Security ...... 22 Key Management (Box KeySafe) ...... 24 Data Reliability ...... 25 Disaster Recovery Plan Overview ...... 24 Data Availability ...... 26 References ...... 27 Differentiation and Key Strengths ...... 27 Case Study – General Electric Selects Box out of 14 Vendors ...... 28 Top 3 Customers: General Electric, Schneider Electric, Eli Lilly ...... 29 Customer References: Avago Technologies, Equinix, McAfee ...... 29 Industry Experience ...... 30 Box Consulting & Implementation ...... 33 Box Implementation Methodology ...... 34 Implementation Schedule ...... 33 Performance Standards ...... 36 Box Confidential 2 Box Premier Support ...... 36 Accessing Customer Support ...... 37 Workload and Schedule ...... Error! Bookmark not defined. Pricing ...... 37 BSA ...... 37 Feature Capabilities Matrix ...... 37 The Box Leadership Team ...... 38

Box Confidential 3 Executive Summary

To City of Elgin:

The internet and cloud have forever and fundamentally altered the delivery and consumption of enterprise software. More specifically, it has positively affected how people consume, share, discover and connect around content. Today, businesses need a new kind of solution that re- invents how people access, manage and share content, in ways that dramatically impact productivity anytime, from anywhere and from any device. Box is a modern content management platform that embraces what's best about the cloud, serving these very needs of the next generation workplace, workforce and IT.

Box was founded on a simple, powerful idea: people should be able to access and share their content from anywhere. Since 2005, Box has helped more than 44 million individuals, small businesses and Fortune 1000 companies do just that. Currently over 54,000 businesses have deployed Box, including over 55% of the Fortune 500.

Box is excited to engage with City of Elgin on providing a modern content management platform that will allow its users the ability to securely share and collaborate on content from any location and from any device.

Box is confident that this proposal will deliver substantial value for City of Elgin and its members for the following reasons:

 Open platform: Deliver more of out of your existing applications by integrating Box (SharePoint, Outlook, Office, Salesforce.com and more).  Pervasive access: Ubiquitous access across laptops/desktops, applications and mobile (PC/MAC, web UI and mobile devices).  Administrative Console & Auditing: Manage users, groups and access permissions. Monitor all folder, file and user activity for security and eDiscovery processes.  Role-based access controls: Permission based access with hierarchal access controls for editing, viewing, previewing & uploading.  Data security: 256-bit TLS data encryption on transfer; 256-AES data encryption at rest; Data centers SSAE 16 Type II Certified.  Unlimited storage: Scale the service for additional uses and future needs at no additional cost.

We look forward to partnering with City of Elgin on this robust offering and are excited around the potential of the program.

Best,

The Box Team

Box Confidential 4 Company Background

About Box:

Box provides a cloud-based, mobile-optimized modern Enterprise Content Collaboration platform that enables organizations of all sizes to easily and securely manage their content and collaborate internally and externally. Our platform combines powerful, elegant and easy-to-use functionality that is designed for users with the security, scalability and administrative controls required by IT departments. We have built our platform to enable users to get their work done regardless of file format, application environment, operating system, device or Location.

There are several fundamental technology trends that are dramatically changing both individual behavior and enterprise IT infrastructure. Information workers increasingly expect to be able to access and work with their business content from any internet-enabled device, and they demand solutions that are as simple to use as their consumer internet applications, such as Facebook, LinkedIn and Twitter. However, legacy on-premise IT architectures were not built for ease of use or mobility. As a result, IT departments are increasingly pressured to find easier to use solutions that address employees’ changing work styles, while also protecting confidential content, including documents, presentations, spreadsheets and multimedia.

At our founding, we recognized that content is more accessible, useful and powerful when it is centrally stored, managed and shared. We have architected our Enterprise Content Collaboration platform from the ground up to be cloud-based and mobile-optimized to meet the evolving demands of today’s information worker. Cloud-based Enterprise Content Collaboration is especially powerful because it enables users to access and collaborate on centralized content from anywhere and allows organizations to access new features and apply policies and controls across all users and content simultaneously. Our solution is especially well-suited to support globally distributed workers with multiple devices.

We are building a rich ecosystem around Box. Our platform integrates with the applications of our technology partners, including Office 365, SharePoint, Salesforce.com, NetSuite, Jive and many others, giving our users full access to Box without leaving partner applications. In addition, third- party developers can rapidly build, update and provision new applications that leverage and extend the core functionality of our service, increasingly with a focus on specific industries and vertical market use cases. To date, tens of thousands of third-party developers have leveraged our platform as the secure content layer for their applications, including developers that are part of our Box OneCloud ecosystem, which provides users with access to more than 1,500 iOS and Android third- party applications.

Box held its initially public offering in January 2015 and trades under the NYSE ticker “BOX”.

Co-Founder and CEO, Aaron Levie Aaron Levie is Co-founder and CEO of Box, which he launched in 2005 with co- founder and CFO Dylan Smith. Levie is the visionary behind Box’s product and platform strategy, which is focused on incorporating the best of traditional content management with the with an easy to use user experience suited to the way people collaborate and work today. Levie leads the company in its mission to help businesses of all sizes be more productive, competitive and collaborative by connecting people and their most important information.

Aaron studied at the Marshall School of Business at the University of Southern California before leaving to found Box.

Box Confidential 5

Co-Founder and CFO, Dylan Smith Dylan Smith is Co-founder and CFO of Box, where he leads investor relations and all aspects of financial operations. He has been instrumental in Box's growth and development and is responsible for building the company’s business and finance infrastructure since starting the company with co-founder Aaron Levie in 2005. Prior to Box, Dylan spent his time earning Box's seed funding through various entrepreneurial endeavors.

Dylan received a Bachelor's degree in Economics from Duke University.

Executive Leadership Awards:

 2014: Named Fast Company’s “Most Creative People in Business 1000”  2013: Named Inc. Magazine’s “Entrepreneur of the Year”  2013: Aaron Levie and Dylan Smith Named Forbes’ “30 Under 30”  2013: Named Fortune’s “40 Under 40”  2012: Named Fast Company’s Generation Flux Leader  2011: Named Fast Company’s “100 Most influential Creative People in Business”

Corporate Awards:

 2016: Gold Stevie Award Winner “Front Line Customer Service Team of the Year – Technology Industry – Computer Software “  2015: Gold Stevie Award Winner “Front Line Customer Service Team of the Year – Technology Industry – Computer Software “  2014: Fast Company’s “Most Innovative Companies” in 2014  2014: Gold Stevie Award Winner “Front Line Customer Service Team of the Year – Technology Industry – Computer Software “  2014: MIT Technology Review’s “50 Smartest Companies 2014”  2014: InfoWorld’s “Technology of the Year”  2013: V3.co.uk’s “Best Mobile App for Business” in (UK)  2011, 2012, 2013: Deloitte's Technology Fast 500™ winner

Key Box Stats:

 Box has more than 44 million users worldwide at more than 54,000 paying businesses, including 55% of the Fortune 500.  Customer List: Box customers include Kaiser Permanente, MD Anderson Cancer Institute, General Electric, IBM, Coca-Cola, Toyota, Procter & Gamble, Discovery Communications, Schneider Electric, Eli Lilly, The Gap and many more.  We have more than 1,400 employees worldwide with offices in Redwood City, San Francisco, Austin, TX, New York, NY, London, Tokyo, Paris, and Amsterdam.  Financial Information: Box is an NYSE publicly traded company listed under the ticker $BOX, making financials readily and publicly available. No mergers & acquisitions are currently planned.

Box is widely recognized by industry analysts as one of the most innovative technology companies, and listed in all industry assessments as among the leaders in the content management and EFSS fields. More information can be found at box.com/about-us.

Box Confidential 6

Supplier Qualification Data Access

Intuitive Web Interface Box provides a user-friendly web application for City of Elgin employees and business partners to access information regardless of location or device. The web application is platform agnostic, and works across Chrome, Firefox, Internet Explorer and Safari Internet browsers.

Box Preview With Box’s native preview technology City of Elgin employees and business partners can view files directly within their browser without needing to download them. We allow over 100 file types to be previewed natively including videos, images, presentations, PDF’s and more.

Box Confidential 7

Box Desktop Sync Access In addition to accessing information from the web interface City of Elgin employees can synchronize information to their desktop(s). This means that edits, updates, and revisions on the Box service will automatically be reflected on their desktop and vice-versa. This also provides City of Elgin with off-line access to any information that is synced in the event they do not have an active internet connection, along with automatic data backup.

Box Confidential 8

Box for Desktop Streaming Access Coming later this year, City of Elgin employees will be able to access all their Box files from their desktop utilizing our ‘streaming’ technology. This differs from our desktop sync application in that files will not be synced locally but rather streamed down to their desktops on command. This makes it an optimal application for retiring personal and shared drives without the requirement for full synchronization of all data to a laptop.

Mobile Access & Box Capture Any information that is stored in Box is immediately available to City of Elgin employees from their mobile devices. Box is completely device agnostic, with native support for every major mobile platform (Android, Blackberry, iOS, and Windows) and also a HTML5 mobile site for legacy devices or accessibility.

Box Confidential 9

Box also provides a capture application for iOS called Box Capture. Box Capture allows users to easily capture documents, images, videos, and audio. Box Capture captures metadata including geolocation. Even better, the documents, images, video and audio can skip the camera roll and upload directly to Box’s secure content platform. Custom metadata is also planned for Box Capture.

Box is a Connected Platform Box, a modern content management platform, is a connected platform that delivers content as a service to all of your applications. The benefit of this is two-fold: end users can access content from any place, any device, and any application, and information security can set permissions, monitor, analyze, protect, and optionally manage encryption keys for a single content service.

To demonstrate this, several examples are included in this RFP, including Microsoft, Salesforce.com and Jive.

Box Confidential 10

Microsoft Office and Outlook Integrations Box has an encompassing strategy for customers that leverage Microsoft Office. This includes integrating with the productivity tools that users utilize the most in their daily workflows: Outlook, Outlook.com, Office Desktop, Office Mobile and the Office Web Apps. This makes it easy for uses to access and share Box content from the application they’re already utilizing.

Office applications will support both opening documents from and saving documents directly back to Box. Office content can also be created from directly within the Box interface.

Box Confidential 11

Users can attach Box links directly into an outgoing email via our Outlook integration. Attachments can also be set so that attachments are automatically uploaded and converted to Box links.

Box appears as a file system that users can open or save to via our Office integration.

Box Confidential 12

Office files in Box can be directly opened in Office Online for seamless online editing, including real- time collaborative editing.

Box is available as a place to open files from natively within the Office mobile app.

Box Confidential 13

Box is integrated with Windows 7, 8 and 10 (above).

Additionally, Box is integrated with Microsoft Intune and Azure.

Microsoft SharePoint Integration Box can be integrated with SharePoint on-premises or SharePoint Online in multiple ways. One common to integrate Box with SharePoint is to embed Box content (files, folders, or both) within SharePoint team sites.

A tutorial for embedding Box in SharePoint can be found here. An overview of Box Embed can be found here, and developer-specific information on Box Embed can be found here.

Box Confidential 14 In addition to embeddable Box in SharePoint, another very common integration point is to migrate and sync content from Box to SharePoint and SharePoint to Box, including file metadata. Multiple vendors can sync SharePoint content with Box, but the most popular third-party integration is offered by SkySync.

Salesforce.com and Chatter Integration Box is deeply integrated with other social and customer relationship tools, including Salesforce.com. Box has built an integration with Salesforce.com that includes record-specific folders and granular permission mapping. Rather than storing documents in Salesforce, which has limited capabilities from both a security and usability perspective, content can be centralized in Box but accessed via Salesforce. Content is then also accessible not only from Salesforce but also from box.com, mobile devices, and Box Sync. Additionally, Salesforce-related content becomes accessible from Microsoft Office and other integrated applications.

In addition to Box’s deep integration with Salesforce for object-specific content, Box is integrated with Salesforce Files Connect. Box file references can be posted via Chatter for social collaboration and searched within Salesforce.com directly.

Box also offers custom development via a Developer Toolkit with the Box for Salesforce integration. For full customization, Box has developed a Force APEX SDK that’s wrapped in Box APIs.

Box DICOM Box also offers an FDA approved DICOM viewer. Box DICOM is fully integrated into Box’s HIPAA compliant platform. Use cases for Box DICOM include remote diagnosis, cross-facility collaboration, and physician to patient sharing.

Box Confidential 15 Box’s viewer supports all DICOM modalities, is FDA cleared as a Class 2 Device (diagnostic quality), and allows viewing of images by study, organizing by series, a dyamic grid, and flipping, rotating & inverting. It also comes with standard tools, including stacking, window/level adjusting for contrast, panning & zooming, and keyboard shortcuts.

Additionally, Box DICOM can do much more than upload and store DICOM images. Box offers sharing outside the health system, adding comments & assigning tasks, multiple annotating & measuring tools, metadata overlays, and is optimized for web and mobile usage.

Secure File Sharing City of Elgin employees can leverage Box to send files or folders securely amongst themselves and also to business partners outside of the organization. This is done through via shared links or collaborator invites.

Shared links Shared links will allow City of Elgin employees to share files without having to worry about email size limitations. Shared links are more secure than email attachments because they provide the ability to track file access, set security and access permissions, set expiration dates, password protect, and more.

Box Confidential 16

Collaborator Invites Box provides 7 different levels of folder access that can be provisioned to internal or external users. Internal user permissions can be mapped in Box from AD Security Groups. Certain City of Elgin employees could also have the ability to provision their own folder access, such as creating a shared workspace for other City of Elgin employees and business partners. All collaborator activity can be monitored or restricted by Box admins. Box provides for 7 different granular access levels:

Metadata Box Metadata enables more context to content stored in Box. Metadata lets you associate your own key-value pairs to files stored in Box so that your people can add, edit and view additional types of information around a file. Metadata can be added to a file in Box either via the web user interface or by API call.

Customer Benefits:  Easy searching – By offering more filters to find information, your workers retrieve what they need quickly so they can go about their business Box Confidential 17  Automate business processes – Metadata can be used in tandem with Box’s Automation capability to create lightweight workflows that help streamline reviews of contracts, marketing collateral and more.

Data Management

Reporting Box provides reporting capabilities and comprehensive audit trails for every action or activity that is taken across the Box platform. Administrators can track account actions, document lifecycles, sharing activity and more. The audit logs are kept for the life of the service.

The reporting interface can track:  User file ownership, space use, cost reports, IP address, date/time for all actions  File access and modification history  Data replication status

Box also makes all the reporting data through our events API so that all the information can be passed to a SIEM or reporting/analytics tool that you’ve already invested in. The API is open and agnostic, but we have prebuilt connectors with many vendors already on the market such as Splunk, HP ArcSite, and GoodData.

Box Confidential 18

Content Management and Federated Search Box Admins can leverage ‘Content Manager’ to view and take action on all City of Elgin employees’ user accounts and data including:  View all content and folders, including private and shared content  Recover deleted files from a users’ trash  ‘Silent login’ to login on behalf of that user to take action on their files  Find every person with access to a piece of content  Federated search on all content stored on Box, with the ability to filter by user, file type, date, and more

Box Confidential 19

Security Policies & DLP Box Admins have the ability to create Content Policies that can trigger actions based on three types of events:

Uploading – Box can scan the full text of all documents that are uploaded to our service for PCI, PHI, and custom strings. If a policy violation is detected the file is quarantined and the admin and user are alerted that a violation occurred.

Downloading – Box can detect if a user downloads an unusual amount of content to one of their devices or applications. Admins are immediately alerted and the event is audited.

Sharing – Admins can define a black list of email addresses that will trigger alerts if a user attempts to share information with them.

Box Confidential 20

In addition to native Content Policies, Box is integrated with numerous DLP and Cloud Access Security Brokers via Box’s Trust ecosystem. Partners include SkyHigh, Netkskope, Adallom, CloudLock, CipherCloud, Symantec, Palo Alto Networks, Elastica, IBM Cloud Enforcer and others.

Box Governance & Retention Management Data retention policies are set at a folder level ensuring data stored in Box is held in accordance with compliance requirements. Content stored under a data retention policy cannot be changed or removed, along with full audits of actions taken across that piece of content throughout it’s lifecycle. This ensures Box customers can meet many regulatory requirements such as SOX and FINRA, as well as internal retention management policies.

Box Confidential 21

Data Security

The Box architecture is built from the ground up with security in mind. All information sent to our service is encrypted using 256 Bit TLS during transfer and 256 Bit AES at rest.

Box undergoes an annual SSAE 16 Type II audit that verifies and proves that proper controls are in place for service architecture, corporate policies and physical security. Box has achieved the following security certifications:  SSAE 16 Type II SOC1, SOC2  ISO 27001  HIPAA/HITECH  PCI DSS 2.0 Level 1  US-EU Safe Harbor

Box employs many additional controls for securing data access such as enforcing complex passwords, AD integration and data governance classification. Security controls can be designated based on users, groups, files, folders, or at a global level.

Box can enable optional AV scanning at no additional cost or effect on performance. If enabled the SHA1 hash of files uploaded are sent to trusted third party services (Kaspersky, McAfee, ESET, Sophos) for analysis against known signatures.

Deleted files are stored in a users’ trash, which can be recovered by the users themselves or on their behalf by admins. Admins can restrict users from purging their deleted files from the trash

Box Confidential 22 meaning files are kept indefinitely on the service, allowing Box to act as a full data recovery and backup solution.

Data Reliability

Box employs an active-active data center model, which serves data concurrently out of two west coast datacenters. In the event that a disaster or issue affects a specific datacenter, the unaffected datacenter will sustain full Box operations without interruption. This n+1 redundancy means Box will not have scheduled downtime for maintenance like other cloud services.

In addition to the two active datacenters, Box also concurrently uploads customer data to an offsite storage facility (Amazon Web Services) and a disaster recovery datacenter located in Nevada. The disaster recovery datacenter is part of a SuperNAP facility and is a core part of our disaster recovery and business continuity strategy in the event a natural disaster takes both of our West coast datacenters offline.

Box Confidential 23

Disaster Recovery Plan Overview The Box Disaster Recovery (DR) plan is designed to recover Box’s critical technology platforms and communication infrastructure from a disaster or emergency event (herein “disaster” also refers to emergencies and any other unforeseen circumstances which substantially impacts the Box technology platform and infrastructure). This DR plan summarizes our high-level process, procedures, and overall plan to enable Box to protect personnel, systems, and data.

Objectives

The primary objective of the Box DR plan is to document the DR approach that Box has developed and implemented so that Box can recover safely, efficiently, and effectively from a disaster that interrupts information systems and business operations. Our objectives are:  Ensuring the safety of personnel throughout a disaster  Mitigating the impact to customers affected by a disaster  Ensuring that all employees fully understand their duties in implementing the DR plan  Ensuring that proposed contingency arrangements are effective and efficient  Documenting disaster recovery capabilities as applicable to customers, vendors and others  Ensuring that operational policies are adhered while the Box platform and organization are restored

Box Confidential 24 Emergency Response Process

Initial Disaster Response Recovery and Monitoring Wrap up

•Identification of a disaster event •Identification and •Validation that the Box service is •Engagement of the Emergency implementation of an operating as designed Response Team appropriate action plan •Continued monitoring of the •Evaluation of impacted services •Identify if any connectivity or service to determine if any data and systems data loss issues are present accessibility issues exist •Notification of executive •Monitoring the recovery process •Post-mortem assessment is management and impacted to validate operations of the Box performed to evaluate the customers service response to the disaster •Continued communication to stakeholders of current service status and estimated time to restore services

Emergency Events Box employs an active-active data center model, which serves data concurrently out of two west coast datacenters. In the event of a disaster that affects a specific datacenter, the unaffected datacenter will sustain the full Box operations. In the event of a disaster, which affects a geographic location and impacts both of the west coast datacenters, Box will port over to Box’s backup DR location in Las Vegas, NV.

Emergency Response An Emergency Response Team (ERT) has been created and will be activated to execute the DR plan. The ERT will coordinate emergency operations, communicate alerts and status updates, escalate necessary processes and ensure the safety of people, your data and our systems.

Emergency Response Team Members The ERT consists of team members in IT, Security, Facilities and Executive Management. The basic structure of the ERT is as follows:

Emergency Response Team

Executive Management

Facilities Tech Ops Security

Roles and responsibilities for each member of the ERT are defined as follows:

 Emergency Response Team: Individuals designated to coordinate the response to any disasters, ensure the safety of Box employees and contractors, and facilitate restoration of Box operations. The ERT consists of members in Facilities, Security, and IT and works under advisement of Executive Management as necessary.

 Facilities: Individuals designated to assist with ensuring the safety of Box employees and contractors, Box offices, processing facilities, and provide any physical support to the Box platform and services.

Box Confidential 25  Security: Individuals designated to assist with ensuring the safety of Box employees and contractors and only authorized individuals are allowed in to any affected Box offices and processing facilities.

 Tech Ops: Individuals designated to restore the Box technology platform and/or communication infrastructure.

Data Center Replication Customer data is concurrently uploaded to Box’s West coast datacenters and to an offsite online storage facility, Amazon Web Services (AWS) S3. During a disaster event, partial or full data restorations can be sourced from any of the three specified locations. Additionally, data may be sourced directly from the AWS offsite online storage location in lieu of restoration of the data.

Recovery Time Objective (RTO) and Recovery Point Objectives (RPO) The RTO and RPO objectives for the Box service are defined as follows:

Recovery Time Objective The recovery time objective (RTO) is the duration of time that Box has targeted to be able to recover the Box service from a disaster. Due to the concurrent data replication model utilized by Box, the RTO is set at 8 hours.

Recovery Point Objectives The recovery point objective (RPO) is the maximum period of potential data loss that Box has targeted to be able to minimize the impact of a disaster to customers and the Box service. The current RPOs are:

Box Systems and Data Impacted Recovery Point Objectives Customer Data Stored at Box* 60 seconds Internal Box Data 24 hours

*Note: Customer data which was in the process of being transmitted to Box when a disaster occurs may not be recoverable.

Communication of Disaster and Response Status Within one hour of identifying and assessing a disaster, Box will update the status.box.com website with details of the disaster and service outage. Subsequent periodic updates will provide additional details on the Box service, current status of features, and estimated time to full service restoration. Additionally, Box Customer Support will be available to answer any inquiries regarding problems accessing the Box platform and stored data.

Data Availability

Box is a vendor and platform agnostic solution, accessible on all major browsers, (Safari, Internet Explorer, Chrome, Firefox), operating systems (Microsoft, OSX, Android, iOS) and points of access (Web, Desktop, Mobile, FTP, WebDAV drive mapping). There is no limitation on filetypes that can be uploaded to the service other than an individual file size limit of 15GB, which will be increasing later this year.

Box Confidential 26 To address global data latency issues that plague most cloud services, Box has developed a global data transfer network that improves the speed and performance of Box worldwide. It combines edge nodes deployed in strategic locations around the globe with patent-pending, intelligent routing technology that automatically determines the fastest path for getting content into Box.

Dublin

Portland Chicago Box HQ Virginia Tokyo Dallas

Hong Kong

Singapore

Sao Paulo Global Data Transfer Network

Sydney

EC2 Rackspace

References

Differentiation and Key Strengths

Box as a leader in the Enterprise Synchronization and Sharing

 Box’s vision of cloud-based enterprise content and collaboration, business process and workflow support is centered on cloud storage and secure EFSS/ECC capabilities. It provides APIs for application integration, and customization of the UI. A mobile and optimized user experience is core to that vision. Box aims to become the data backbone in the cloud for business system applications.  Box has thousands of partners, including application developers, ECM vendors and hardware vendors whose apps/systems are tightly integrated with Box's offerings. OneCloud brings a variety of apps for content collaboration on mobile devices. Box has a strong channel program with over 1,000 partners that resell and build Box solutions globally.  Box offers a great user experience, ease of use and support; references rated highly the API that enables integrating Box with internal business processes or building third-party services.  Enhancements to the cloud encryption capabilities will put customers in control of the encryption keys for data stored in the cloud.

Box Confidential 27 Box Customer Success and Support

 For our business clients, our primary strength post-sales is the Box Customer Success team. The Customer Success team works with enterprise customers to ensure that they are supremely successful with and delighted by Box. It is our responsibility to effectively on- board these accounts onto our services, spur usage in the early stages and ongoing, and build high customer satisfaction. We work with our accounts to proactively drive adoption, as well as act as the voice of our customers internally at Box (i.e. Feature requests). We understand the customer and their use cases and know how to be a trusted partner so companies grow with Box. Regarding customer satisfaction surveys, we do run surveys by the Customer Success Manager individually as well as customer satisfaction scores for support as an entire team

Case Study – General Electric Selects Box out of 14 Vendors General Electric Solution Requirements GE sought an enterprise solution to distribute content and enable collaboration between devices, international and domestic regions, disparate business divisions, external customers, partners, and suppliers. GE is looking to remove shadow IT solutions that offer little administrative control or security. In addition, GE is interested in eventually eliminating an internally built content management solution containing 350 TB’s of data.

The solution must allow for secure, global content distribution and syncing while co-existing with GE’s mix of platforms and those of customers, partners, and suppliers; including: iOS, Android, Microsoft, Blackberry, Mobile Platforms, Cloud and On Premise apps. The solution must also provide a robust API that GE can leverage to easily integrate with existing systems, custom software and mobile apps.

Box for General Electric, Solution Overview MOBILITY- Box is the most mobile agnostic solution, with native applications for iOS, Android, Windows and Blackberry. This provides GE cross-platform mobility support for internal and external users and ensures rapid development of new mobile applications for all key platforms.

COLLABORATION- Box has collaborative co-editing and a breadth of features for any file sharing tool available. GE will securely increase efficiency, centralize workflows and conversations around content - anywhere, anytime and on any device.

SECURITY- Box offers the most secure content collaboration platform; 256 bit encryption in transit and at rest, comprehensive audit/reporting and the most granular sharing permission controls in the industry. GE will greatly improve collaboration between internal and external users while being confident that all content and information is safe and secure.

PLATFORM- Box’s API v2 offers endless integration possibilities with on premise applications, cloud applications, and commercial or custom mobile apps. GE will eliminate silos and shadow IT

BEST OF BREED- Box is the highest rated file sync and sharing tool available with the most experience in Enterprise IT. Content is 100% of Box’s focus – not a small part of a larger Box Confidential 28 product portfolio. Everything that Box does is focused on innovating around this core competency and ensuring customer success. Like GE, Box is committed to innovation.

CUSTOMER SUCCESS- Box has extensive experience in deploying content collaboration solutions in enterprises with tens of thousands of users. Large deployments include Schneider Electric, Eli Lily, Procter & Gamble. Box Professional Services team will actively work and collaborate with GE to ensure a successful deployment, leveraging best practices from large deployments and the last 12 months of planning that have taken place between GE and Box.

3 Large Customers: General Electric, Schneider Electric, Eli Lilly General Electric Energy solutions giant rolls out Box to 380,000 employees to connect dispersed business units worldwide

• Largest international customer: 380,000 users across 170 countries; • Helping GE embrace a far more user-centric IT strategy • Box is the way in which employees will securely share corporate information from multiple devices both internally and externally • Box selected out of 14 different vendors

Schneider Electric Energy solutions giant rolls out Box to 100,000+ employees to connect dispersed business units worldwide

• 100,000+ users across 121 countries; 6,000 external collaborators • Created centralized content and social enterprise platform by integrating Salesforce and social tool Tibbr with Box • Growth of 1,000 Box users per 1.5 weeks • Customer Quote: "Moving to a cloud technology like Box that provides more efficiency, security, and simplicity for our employees was a natural choice." [Hervé Coureil, CIO]

Eli Lilly Box allows 15,000 field sales reps to present to clients from iPads

• 35,500 users deployed to date • Global sales force needed secure, scalable mobile content solution • Box on iPads allows 15,000 field reps to present to clients easily and quickly onsite; reps have instant access to latest marketing materials • Box OneCloud productivity apps allow sales reps to retain current workflows on iPads; integration with Notability provides robust note-taking functionality • Box enables collaboration with manufacturers in South America and remote worker back-up via Box sync

Customer References: Avago Technologies, Equinix, McAfee Box will happily provide customer references upon request, including their state, company name, address, contact name and telephone numbers, as well as details on their installed and supported software and duration of the relationship. These details will be shared directly with the customer and cannot be shared via RFP for legal reasons. Box Confidential 29

Avago Technologies Semiconductor manufacturer boosts visibility – and keeps collaboration secure

• Avago’s Oracle document management application, housed in Singapore, was plagued with performance and usability issues, had no mobile access and restricted collaboration to a given region • Migrated 10TB of data (18 million files) to Box for all 3,600 Avago employees, eliminating their Windows servers entirely • Sales team accesses product literature and presentations from Box on tablets; acquisition and HR teams control which external parties have access to sensitive M&A documents • Implementation took only six months, from evaluation to full deployment, including user training and data migration • Customer Quote: “Box has significantly more auditability and tracking than we had before. We were able to make a sound investment.” [Andy Nallappan, CIO]

Equinix World’s Largest data center provider uses MobileIron with Box to secure devices and documents

• With a global, mobile workforce, Equinix sought secure BYOD collaboration solution for all 2,000 employees • Rolled out Box as primary content collaboration solution for all employees; used MobileIron to push Box updates to mobile devices • Marketing team uses Box to share digital assets; Construction shares building plans with contractors building new data centers; IT sets up folders to manage projects with external vendors • Together, MobileIron and Box provide security and reporting capabilities at both the document and device level • Customer Quote: “Box is an enterprise-ready, secure way to collaborate beyond the enterprise—and to do it seamlessly on mobile devices.” [Brian Lillie, CIO]

McAfee The virus-protection leader overhauls an unwieldy file-sharing system

• Legacy SharePoint system prevented users from easily finding, accessing, and sharing files • Box hosts McAfee’s 200GB library, with over 23,400 digital assets, including product data sheets, solution briefs and case studies • Reduced large-file upload time from hours to minutes • Reduced admin time from six hours a week to under one hour a week • Customer Quote: "Box has been the best and easiest implementation I've ever done in my 20+ years in the industry.” [Wilkin Ho, Senior Art Director]

Industry Experience

Experts agree that Box is the leader among enterprise content management and collaboration solutions.

Box Confidential 30 Forrester

Box was also recognized as a Leader in their 2016 Forrester Wave™: Enterprise File Sync and Share, Cloud solutions, noting that Box offers an outstanding product, and should be on the shortlist for any organization looking to replace unsecure consumer-centric versions of popular consumer solutions like Dropbox.” Report available upon request.

Forrester Research named Box a Leader in a new research report evaluating top market leading Enterprise Content Management (ECM) for Business Content service providers (August 2015). Report available upon request.

Box Confidential 31 Gartner

Gartner named Box a Leader in their 2016 Magic Quadrant for Enterprise File Synchronization and Sharing (2016). Box has been in the leadership position for the last 3 years. Report available upon request.

Box is a viable option for publix cloud-friendly organizations that want to use file sync and share as an opportunity to re-engineer business processes.” Report available upon request.

-Monica Basso, Jeffrey Mann, Charles Smulders

Box Confidential 32 InfoTech

As Box continues to mature its platform strategy, its partner ecosystem becomes an important part of this equation. Organizations aggressively moving to the cloud should make Box’s content storage an evaluation criterion for their online content management system as well.” Report available upon request.

Box Consulting & Implementation

Box maintains an in-house consulting practice that carries both broad technical expertise on Box and complimentary products, as well as deep industry experience in Healthcare, Financial Services, Government, Retail, Education, Media & Entertainment, and others.

Box Implementation Methodology The way that Box is architected allows for a far more rapid implementation schedule than is typical with other enterprise products. The infrastructure is hosted in the cloud allowing the implementation to rest more on planning and training than lengthy installation and professional services schedules. In addition, the interface is very user friendly, which both improves user adoption and reduces the amount of training required for a user to get acclimated with the service.

In order to ensure a successful pilot and implementation Box will assign City of Elgin a dedicated account manager and client services manager. The same team will be with the account from pilot to full rollout to establish in house expertise, promote cross-functional relationships, and establish consistency with the rollout.

Implementation Schedule Box utilizes an implementation methodology that is customer proven and success driven, which will be customized based on City of Elgin’s milestones and timelines. It is broken down by 4 phases – Plan, Connect, Configure and Deploy.

Box Confidential 33

Box Confidential 34 Plan Data Migration

Box FTP: Free, self-serve mass migration method. Commonly used for initial migration of critical content (done overnight or on the weekend), and ongoing for purposes of batch uploading archived content.

Box API: Free, self-serve automated migration method. This can be used for any legacy data on existing cloud services.

Box Content Migration: Box will send City of Elgin an encrypted hard drive for data to be uploaded and returned to Box, whereupon Box’s professional services team will upload data directly to Box. Cost $1/GB

Partner Technology: Box will have the option to leverage a partner that provides server-sync and data compression technology. This will allow Box to provide City of Elgin with an end-to-end strategy for migrating content from on-premise storage appliances to Box. Price is variable based on volume, between $0.5 - $2/GB

Project Planning and User Identification  Alignment across all team members involved  Key meeting cadences scheduled  Identification of users and use-cases to be deployed

Connect AD Integration Box relies on SAML to integrate with Active Directory. City of Elgin will need to provide a federated service to enable AD integration such as ADFS or a cloud SSO provider (Okta, OneLogin, Ping, etc). Box professional services will do all work required to enable AD integration assuming a federated service is provided. The majority of our enterprise clients are leveraging an SSO solution as a core part of their security and user management strategy. Integrations with Existing Tools Box integrates with thousands of 3rd party business applications including widely used tools such as  Salesforce  Netsuite  Jive  Sharepoint Other business applications such as project management tools or City of Elgin homegrown solutions can be integrated through our RESTful API or a Box Embed iframe.

Configure Account Configuration and Settings  Collaboration security – shared links and collaborators  Content creation settings  User defaults  Trash settings

Folder Structure and Ownership  Folder and group owners  Shared drive replacement

Box Confidential 35  ‘My Documents’ folder replacement

Deploy Help Desk & Admin Training  Train admins and ensure ‘first point of contact’ for support issues  Determine Co-Admin roles

Change Management Plan  Identify stakeholders and user champions  Document existing processes and future ‘final’ processes

End-User Training and Deployment  Self-help availability (user guides, best practices, videos)  Trainings delivered by department or region, tailored to specific use-cases  Alignment with Change Management Plan to validate success

Performance Standards Box strives to provide a world-class customer support experience to all customers. Policies have been put into place to insure that customers are directed to the correct support resource and have their issues addressed in a timely fashion. While all accounts have access to customer support resources, enterprise and premier customer requests receive priority over other account types. Box Customer Support provides help documentation and live support to all of our customers in a variety of formats.

Box Premier Support  99.9% Uptime SLA. Your content on Box will be accessible anytime, anywhere.  Enhanced Response Time SLA. We guarantee a one-hour-or-less response time to urgent matters and two-hours-or less response time for High and Normal priority matters.  24/7 phone support. Whether you call us at noon on Monday or at 3am on Saturday, we guarantee that you can reach us.  Quarterly Support Reporting. Every three months, we offer you a report summarizing how we did based on satisfaction ratings, response time and managing ticket volume.  Full access to Customer Portal and Support Knowledgebase. Learn about our Customer Success methodologies and tap into our best practice materials.

Box Confidential 36

Accessing Customer Support Box offers 24 hours a day, Monday through Sunday, excluding Box corporate holidays, and can be reached at 877-729-4269.

Box Web and Email Support is operational 24 hours a day, Monday through Sunday, excluding Box corporate holidays, and can be reached via https://support.box.com/home

Box Level 2, Account Manager, and Billing support teams are operational 9am - 5pm (PST), Monday through Friday, excluding Box corporate holidays.

Pricing*

Box License Pricing will be provided at a later date.

BSA

The Box enterprise terms of service and SLA can be found here: Click here for Box BSA

Feature Capabilities Matrix https://cloud.box.com/s/fkekaj13rva5jzbdnb63n2l5vahpkzhr

Box Confidential 37

The Box Leadership Team

Our mission: to transform the way people and organizations work so they can achieve their greatest ambitions.

Box is a modern, secure content management platform designed for digital-age processes and work styles. Since 2005, we’ve helped teams and organizations across industries easily share, manage, and collaborate on their most important information from anywhere, on any device. Our leadership team provides key industry experience and expertise

Dan Levin – COO

Dan served as Interim CEO of Picateers and held several positions at Intuit: SVP/General Manager of Small Business, VP/GM of the Quicken Health Group and VP of Product Management. Prior to Intuit, Dan spent 13 years at venture-backed startups, holding senior executive roles at ReplayTV, GuestConnect and Books That Work. He earned his BA at Princeton.

Chris Yeh - SVP Platform and Product

Chris joined Box from Yahoo!, where he was Product Lead for Yahoo! Groups, Delicious and other community products. Prior to that, he headed the Yahoo! Developer Network (YDN), the company's third- party developer program. He earned his MBA at Wharton and BS in Computer Science from the University of Michigan.

Jon Herstein - SVP of Customer Success

Jon’s mission at Box: guiding the client services, technical support and implementation teams, ensuring enterprise and business customers are successful. Jon brings 20+ years of tech service experience to Box, with key positions at Accenture, Informatica and NetSuite. Jon earned his BS in Computer Science from University of Maryland, College Park.

Financial Services application business at Oracle, and the channel sales team lead at Cramer Systems. Earlier in his career, Graham held several successful tenures at Oracle in the UK, Tibco and IBM in Europe. Graham is a Computer Science graduate from Birmingham City University, England.

Box Confidential 38

AGENDA ITEM: E MEETING DATE: November 2, 2016

ITEM: Naming of a City Park Located in the Bowes Creek Subdivision (Item must be removed from the Table) (No cost to the City)

OBJECTIVE: Provide a name for a new city park located in the Bowes Creek Subdivision.

RECOMMENDATION: Name the new city owned park located in Bowes Creek subdivision Tournament Drive Park.

The developer of the Bowes Creek subdivision is required to establish three parks in phases within that housing development. The first of these three park was completed last year and is now ready to be named. The Parks and Recreation Advisory Board works with neighboring property owners to develop naming alternatives for new city parks. The Parks and Recreation Advisory Board is concurring with the majority vote of 56 percent of the neighboring property owners who prefer the name “Tournament Drive Park” over the alternative, “Creekside Park.”

BACKGROUND

The developer of Bowes Creek subdivision, Toll Brothers, is required to develop three neighborhood parks within their community. They finished the first neighborhood park last year and the city recently took ownership of it. As is the city’s policy, the Parks and Recreation Advisory Board worked with the neighbors to come up with a proposed name for the park as Tournament Drive Park.

OPERATIONAL ANALYSIS

The park is located at 3550 Tournament Drive, at the intersection of Tournament Drive and the actual creek that is called Bowes Creek. The park development was paid for by Toll Brothers, the developer of Bowes Creek Country Club. The park was designed with input from city staff and the residents in the neighborhood, who are very pleased with the park. Site improvements to the park include two separate playground structures, swings, a shelter, basketball courts, bag toss courts, benches, landscaping and walking paths.

The Parks and Recreation Advisory Board discussed potential names for the park at their September 22 board meeting. One of the Board members did some historical research on the park site to see if there was anything of historical significance that took place near the site of the park, but nothing of significance was found. The logical choice discussed was Bowes Creek park, but given that there will eventually be three parks in the subdivision, that name was dismissed. Given its location, the Parks and Recreation Advisory Board came up with two recommended names: Tournament Drive Park and Creekside Park.

Staff worked with the Bowes Creek Master Homeowners Association, who have a data base of area homeowners, to get the neighbor’s input. The HOA facilitated emailing out a survey to the residents asking for their name preference. The residents were provided with the option of Tournament Drive Park, Creekside Park or a choice of their own. The results of that survey were reviewed at the November 17 Parks and Recreation Advisory Board meeting. The majority of the residents (56 percent) preferred the name Tournament Drive Park. Given this, the Parks and Recreation Advisory Board recommends to the city council that the park be named Tournament Drive Park.

INTERESTED PERSONS CONTACTED

Residents of Bowes Creek subdivision

FINANCIAL ANALYSIS

None.

BUDGET IMPACT

FUND(S) ACCOUNT(S) PROJECT #(S) AMOUNT AMOUNT BUDGETED AVAILABLE NA NA NA NA

LEGAL IMPACT

None.

ALTERNATIVES

The city council could chose an alternative name.

NEXT STEPS

1. Inform the residents of Bowes Creek of the park name.

2. Install the park sign.

Originators: Randy Reopelle, Parks and Recreation Director

Final Review: Debra Nawrocki, Chief Financial Officer William A. Cogley, Corporation Counsel/Chief Development Officer Richard G. Kozal, City Manager

ATTACHMENTS A. Location site map