2_ Exhibit B_C_D_E and Appendix A.pdf

EXHIBIT B

SPECIAL TERMS AND CONDITIONS

The following special terms and conditions modify and amend the Contract terms and conditions specifically referenced herein. In the event of a conflict between the terms and conditions contained in this Exhibit B and the balance of the Contract, the terms and conditions set forth in this Exhibit B shall control.

1. Information Security Requirements attached hereto as Exhibit B-1

2. Train Control and SCADA Security Requirement as Exhibit B-2

3. Distraction Avoidance Policy as Exhibit B-3

4. Alertness Assurance Project as Exhibit B-4

5. Supplementary Conditions

Docusign Envelope ID: 87DD59A1-E16A-450F-A748-0BA2F96D9F7E

EXHIBIT B-1

INFORMATION SECURITY REQUIREMENTS

1. Scope

This Exhibit outlines the information security expectations and requirements between the Metropolitan Atlanta Rapid Transit Authority (“MARTA”) and third-party Contractors (“Contractors”). It describes the technical and organizational security measures that must be implemented by the Contractor to secure MARTA’s data prior to and during the performance of any part of the Contract.

Applicable Requirements and Standards: NIST Risk Management Framework (RMF), NIST Cybersecurity Framework (CSF), NIST SP 800 53-r5, NIST SP 800 82-r3, NIST AI 100-1: Artificial Intelligence Risk Management Framework, Center for Internet Security (CIS) 18 controls.

2. Network Security

(A) To maintain network security, Contractor will at all times implement: next-generation firewalls, intrusion detection/prevention, advanced threat detection technology, and regular third-party security audits.

(B) Contractor will maintain network security that conforms to MARTA’s approved industry standards and best practices. MARTA approved industry standards and best practices are NIST Cybersecurity Framework (CSF), NIST Risk Management Framework (RMF), NIST SP 800 53-r5, NIST AI 100-1: Artificial Intelligence Risk Management Framework, and Center for Internet Security (CIS) 18 controls.

3. Application Security

(A) Contractor will provide, maintain, and support its software, updates, upgrades, and bug fixes such that the software is and remains secure from security vulnerabilities.

(B) Contractor will perform regular vulnerability scans and conform to the following requirements:

i. For vulnerabilities which risk compromising MARTA’s network, system, or data and which are considered to be “critical” according to the latest Common Vulnerability Security Score (“CVSS”) guidelines, Contractor will repair or mitigate such vulnerabilities within thirty (30) days of patch availability or work around.

ii. For vulnerabilities which risk compromising MARTA’s network, system, or data and which are “high” according to the latest CVSS guidelines, Contractor will repair or mitigate vulnerabilities within forty- five (45) days of patch availability or workaround.

iii. All vulnerabilities discovered as a result of an internal or external security audit will be repaired at Service Provider’s expense within forty-five (45) days of notification.

(C) Contractor writing code will conform to one of the following latest industry best practices:

i. The Open Web Application Security Project’s (“OWASP”) “Top Ten Project”

ii. Common Weakness Enumeration’s Top 25 Programming Errors

iii. SANS Institute’s Top 25 Programming Errors

(D) Contractor will protect application accounts using one or more of the following methods:

i. Disable application account after certain number of failed password attempts

ii. Implement multi-factor authentication

iii. Implement IP address filtering, restricting access to MARTA-approved networks

iv. Monitor and alert for attacks and fraudulent activity

4. Data Security

(A) Contractor will preserve the confidentiality, integrity, and availability (CIA) of MARTA’s Data with administrative, technical, and physical measures that conform to generally recognized industry standards, such as the NIST 800-53 and NIST Cybersecurity Framework and Center for Internet Security (CIS) 18 controls. Maintenance of a secure processing environment includes, but is not limited to, the timely application of patches, fixes, and updates to operating systems and applications as provided by a Contractor or open-source support.

(B) Data Storage

i. Contractor will store, process, and maintain any and all MARTA’s Data solely on designated target systems.

ii. Contractor will not process or transfer any MARTA’s Data to any portable computing device or any portable storage medium, unless that device or storage medium is:

(a) in use as part of the Contractor's designated backup and recovery processes, and

(b) encrypted in accordance with Federal Information Processing Standards (FIPS) 140-2, entitled “Data Encryption”.

(c) Approved by MARTA

(C) Data Transmission

i. Contractor will ensure that any and all electronic transmission or exchange of system and application data with MARTA and/or any other parties expressly designated by MARTA will take place via secure means (using HTTPS, SFTP) and solely in accordance with the requirement in Section 4(D) entitled “Data Re-Use”. Email, instant message, text message, File Transfer Protocol (“FTP”), or other similar methods are not a secure means of transmission.

ii. Contractor will encrypt data as described in Section entitled “Data Encryption” before transmitting via insecure means.

(D) Data Encryption

i. Contractor will deploy encryption solutions with no less than Advanced Encryption Standard (AES) 256-bitkeys encryption.

ii. Contractor will store all MARTA backup data as part of its designated backup and recovery processes in encrypted form if tapes or portable media are used, using a commercially supported encryption solution.

iii. Contractor will encrypt any and all MARTA Data defined as personally identifiable information under current legislation or regulations stored on any laptop, portable computing device or portable storage medium.

iv. Contractor will store private keys on a server behind a firewall.

v. Contractor will implement encryption at rest and transit for any data which includes personally identifiable information.

(E) Data Re-Use

i. Contractor will use all MARTA Data and data exchanged between MARTA and

Contractor expressly and solely for the purposes enumerated in the current Contract.

ii. Contractor will not distribute, repurpose or share MARTA Data across other applications, environments, business units, or with other affiliates of Contractor.

iii. Contractor will not transmit or exchange MARTA Data with other Contractors or interested parties except on a case-by-case basis, as specifically agreed to in writing by MARTA.

(F) General Data Protection Regulation (“GDPR”) Requirements

If Contractor stores data that is personally identifiable information from a “data subject” as defined by GDPR, Contractor will abide by GDPR’s “Processor” responsibilities and data transfer terms.

(G) Compliance with Applicable Laws

To the extent Contractor receives, processes, transmits, or stores data for or on behalf of MARTA, Contractor represents and warrants that its information security procedures, processes, and systems will meet or exceed all applicable standards, rules, and regulations, including but not limited to those related to data security and privacy.

(H) End of Contract Data Handling

i. Upon termination of this Contract, Contractor will transfer MARTA Data in a standard readable format.

ii. Contractor will additionally erase, destroy, and render unrecoverable all MARTA Data, using one of the following methods:

a. Perform a media sanitization in accordance with the standards set by the National Institute of Standards, Guidelines for Media Sanitization, SP800-88; or

b. Encrypt MARTA Data and then overwrite the encryption keys (crypto-shredding).

iii. Contractor will certify in writing that one of the actions in Section 4(G)(ii) have been completed within thirty (30) days of termination of this Contract or at the request of an authorized agent of MARTA, whichever will come first.

5. Notification, Backup and Audit Requirements

(A) Security Breach Notification

i. Contractor will comply with all applicable laws that require affected individuals to be notified in the event of unauthorized release of their personally identifiable information or any other security event requiring notification.

ii. In the event of a breach of any of Contractor’s security obligations, or other event requiring notification under applicable law, Contractor will:

(a) Notify MARTA primary contact by telephone and e-mail as well as MARTA’s Information Security team at: esrm@itsmarta.com of such an event within forty-eight (48) hours of discovery.

(b) Assume responsibility for informing all such affected individuals in accordance with applicable law; and

(c) Indemnify, hold harmless and defend MARTA and its trustees, officers, and employees from and against any claims, damages, or other harm related to such notification event.

(B) Audits & Right to Test

i. Contractor will provide MARTA with any third-party compliance and security audits (e.g., SSAE 16 reports, penetration tests, etc.) as they become available and inform MARTA primary contact and MARTA’s Information Security team of any non-compliance, exceptions, and remediation plans.

ii. MARTA may perform penetration or vulnerability testing from the Internet provided MARTA informs Contractor at least ten (10) business days before the test.

(C) System Audit Logging

i. Contractor will log all actions, including date, time, and unique identifiers, and user activity.

ii. Contractor will centrally manage logs and prevent unauthorized users from accessing the central logging system.

iii. Contractor will review logs regularly or automatically with SIEM solutions.

mailto:esrm@itsmarta.com

(D) Industry Standards and Best Practices Generally recognized industry standards include, but are not limited to, the following standards or best practices listed at:

i. Center for Internet Security - http://www.cisecurity.org

ii. National Institute for Standards and Technology - http://csrc.nist.gov

iii. Federal Information Security Management Act (“FISMA”) -http://csrc.nist.gov

iv. ISO/IEC 27000-series - http://www.iso27001security.com/

v. Organization for the Advancement of Structured Information Standards

(“OASIS”) - http://www.oasis- open.org/

vi. Cloud Security Alliance CCM - https://cloudsecurityalliance.org/group/cloud-controls- maMARTAx/#_overview

vii. CIS Controls - https://www.cisecurity.org/controls/

(E) Administrative Account Management

Contractor will protect Administrator account management based on controls listed in CIS Controls - Controlled Use of Administrative Privileges (https://www.cisecurity.org/controls/)

(F) Disaster Recovery and Business Continuity Plans

Contractor will provide a specific, detailed backup plan for systems, files, and data.

(G) System Uptime For cloud services or third-party providers managing service level Contracts, Contractor will provide a specific and detailed system uptime that meets MARTA 99.999% availability requirements.

(H) Contractor Warranty to Self-Audit

i. Contractor warrants that the services provided in the Contract will be in substantial conformity with the information provided in this Exhibit, through one of the following forms of self-audit:

(a) Cloud Security Alliance Consensus Assessment Initiative questionnaire,

(b) an audit conducted by Statement on Standards for Attestation Engagements (“SSAE”) No. 16 or the Payment Card Industry Data Security Standard (“PCI DSS”), or

(c) a similar third-party annual audit report.

ii. Contractor will inform MARTA promptly of any material variation in operational controls from those reflected in this Exhibit and

iii. Any material discrepancy between the requirements in this Exhibit and the response to Section (“Data Security”) will be deemed a material breach of the Contract.

Docusign Envelope ID: 87DD59A1-E16A-450F-A748-0BA2F96D9F7E http://www.cisecurity.org/ http://csrc.nist.gov/ http://csrc.nist.gov/ http://www.iso27001security.com/ http://www.oasis-open.org/ http://www.oasis-open.org/ https://www.cisecurity.org/controls/

EXHIBIT B-2

TRAIN CONTROL AND SCADA SECURITY REQUIREMENT

Scope This outlines the Information Security expectations and requirements between the Metropolitan Atlanta Rapid Transit Authority (“MARTA”) Train Control and SCADA Network (TCSN) and third-party Contractors (“Contractors”). It describes the technical and organizational security measures that must be implemented by the Contractor to secure MARTA’s data prior to and during the performance of any part of the MARTA’s Master Services Contract (“Contract”) or accompanying Statement of Work.

Applicable Requirements and Standards: NIST Risk Management Framework (RMF), NIST Cybersecurity Framework (CSF), NIST SP 800 53-r5, NIST SP 800 82-r3, APTA-SS-CCS-RP-002-13, ISO 21434, Center for Internet Security (CIS) 18 controls.

1. ISO 21434

ISO 21434 standard is specifically designed to address the cybersecurity concerns associated with Industrial Control Systems (ICS). It provides guidance and requirements for organizations throughout various stages of the ICS lifecycle, including design and engineering, production, operations, maintenance, and decommissioning. This comprehensive approach ensures that cybersecurity measures are incorporated from the early stages until the end of an ICS's lifecycle.

Design and Engineering:

The design and engineering phase of an ICS is crucial as it lays the foundation for the system's security. ISO 21434 recommends considering threat modeling and risk analysis to identify potential vulnerabilities and determine appropriate countermeasures.

Contractors follow security testing, vulnerability assessments, and ensure the use of trusted components and software tools. Implementing access control mechanisms, authentication processes, and encryption techniques to protect against unauthorized access and data breaches is vital.

Production:

The production phase involves the manufacturing and assembly of the ICS components. ISO 21434 emphasizes the importance of supply chain security during this stage. Contractors should ensure that the components used in the ICS are from trusted sources, and they should implement validation and verification processes to ensure the integrity of the components. The standard also recommends monitoring and controlling the production environment to prevent unauthorized or malicious modifications to the ICS components.

Operations:

Once the ICS is deployed and operational, ISO 21434 provides guidance for maintaining its cybersecurity posture. Contractors should establish formal procedures for secure asset management, including regular asset inventory, vulnerability assessments, and patch management. The standard emphasizes the need for continuous monitoring and logging of ICS activities to detect potential cybersecurity incidents promptly. Incident response plans should be developed and tested periodically to ensure an effective response to any detected incidents.

Maintenance:

Regular updates and patches should be applied to the ICS components, without production interruption, to address any identified vulnerabilities. The standard recommends establishing secure remote access mechanisms for maintenance purposes and testing security assessments after any modifications to the ICS.

Decommissioning:

ISO 21434 highlights the importance of securely erasing any sensitive data stored on the devices before decommissioning them or physical destroy the components.

ISO 21434 provides comprehensive guidance throughout the entire lifecycle of Industrial Control Systems (ICS). By following the standards outlined, this approach ensures that cybersecurity measures are integrated at every stage, minimizing the risk of cyber threats and ensuring the safe and secure operation of ICS throughout its lifecycle.

2. Network Security

(A) To maintain network security, Contractor will at all times implement: next-generation firewalls, intrusion detection/prevention (IDS/IPS), advanced threat detection technology, and regular third-party security audits.

(B) Contractor will maintain network security that conforms to MARTA’s approved industry standards and best practices. MARTA approved industry standards and best practices are NIST Cybersecurity Framework this incudes NIST Special Publication such as NIST SP 800 53 Rev.5, NIST SP 800-82 Rev. 3 , ISO 21434, , CSRC.NIST.Gov, and Center for Internet Security (CIS) 18 controls.

3. Application Security

a. Contractor will exercise proper cyber hygiene, this includes, provide, maintain, and support its software, updates, upgrades, and bug fixes such that the software is and remains secure from security vulnerabilities.

b. Contractor will perform regular vulnerability scans and conform to the following requirements:

i. For vulnerabilities which risk compromising MARTA’s network, system, or data and which are considered to be “critical” according to the latest Common Vulnerability Security Score (“CVSS”) guidelines, Contractor will repair or mitigate such vulnerabilities within thirty (30) days of patch availability or work around.

ii. For vulnerabilities which risk compromising MARTA’s network, system, or data and which are “high” according to the latest CVSS guidelines, Contractor will repair or mitigate vulnerabilities within forty- five (45) days of patch availability or workaround.

iii. All vulnerabilities discovered as a result of an internal or external security audit will be repaired at Service Provider’s expense within forty-five (45) days of notification.

c. Contractor will protect application accounts using one or more of the following methods:

i. Disable application account after certain number of failed password attempts

ii. The system shall ensure system level accounts have limited privileges in accordance with NIST 800-53

iii. Implement multi-factor authentication (MFA)

iv. The system shall ensure business users accounts cannot be administrative accounts and vice versa in accordance with NIST 800-53

v. Implement IP address filtering, restricting access to MARTA-approved networks.

vi. Monitor and alert for attacks and fraudulent activity

4. Data Security

a. Contractor will preserve the confidentiality, integrity, and availability (CIA) of MARTA’s Data with administrative, technical, and physical measures that conform to generally recognized industry standards, such as the NIST 800-53 and NIST Cybersecurity Framework and Center for Internet Security (CIS) 18 controls.

Maintenance of a secure processing environment includes, but is not limited to, the timely application of patches, fixes, and updates to operating systems and applications as provided by a Contractor or open-source support.

b. Data Storage

i. Contractor will store, process, and maintain any and all MARTA’s Data solely on designated target systems.

ii. Contractor will not process or transfer any MARTA’s Data to any portable computing device or any portable storage medium, unless that device or storage medium is:

1. in use as part of the Contractor's designated backup and recovery processes, and

2. encrypted in accordance with Federal Information Processing Standards (FIPS) 140-2 , entitled “Data Encryption”.

3. Approved by MARTA

c. Data Transmission

i. Contractor will ensure that any and all electronic transmission or exchange of system and application data with MARTA and/or any other parties expressly designated by MARTA will take place via secure means (using HTTPS, SFTP) and solely in accordance with the requirement in Section 4(D) entitled “Data Re-Use”. Email, instant message, text message, File Transfer Protocol (“FTP”), or other similar methods are not a secure means of transmission.

ii. Contractor will encrypt data as described in Section entitled “Data Encryption” before transmitting via insecure means.

d. Data Encryption

i. Contractor will deploy encryption solutions with no less than AES 256-bit key for symmetric encryption and a 1024 (or larger) bit key length for asymmetric encryption.

ii. Contractor will store all MARTA backup data as part of its designated backup and recovery processes in encrypted form if tapes or portable media are used, using a commercially supported encryption solution.

iii. Contractor will encrypt any and all MARTA Data defined as personally identifiable information under current legislation or regulations stored on any laptop, portable computing device or portable storage medium.

iv. Contractor will store private keys on a server behind a firewall.

v. Contractor will implement encryption at rest and transit for any data which includes personally identifiable information.

e. Data Re-Use

i. Contractor will use all MARTA Data and data exchanged between

MARTA and Contractor expressly and solely for the purposes enumerated in the current Contract.

ii. Contractor will not distribute, repurpose or share MARTA Data across other applications, environments, business units, or with other affiliates of Contractor.

iii. Contractor will not transmit or exchange MARTA Data with other Contractors or interested parties except on a case-by-case basis, as specifically agreed to in writing by MARTA.

f. General Data Protection Regulation (“GDPR”) Requirements

If Contractor stores data that is personally identifiable information from a “data subject” as defined by GDPR, Contractor will abide by GDPR’s “Processor” responsibilities and data transfer terms.

g. Compliance with Applicable Laws

To the extent Contractor receives, processes, transmits, or stores data for or on behalf of MARTA, Contractor represents and warrants that its information security procedures, processes, and systems will meet or exceed all applicable standards, rules, and regulations, including but not limited to those related to data security and privacy.

h. End of Contract Data Handling

i. Upon termination of this Contract, Contractor will transfer MARTA Data in a standard readable format.

ii. Contractor will additionally erase, destroy, and render unrecoverable all MARTA Data, using one of the following methods:

a. Perform a media sanitization in accordance with the standards set by the National Institute of Standards, Guidelines for Media Sanitization, SP800-88; or

b. Encrypt MARTA Data and then overwrite the encryption keys (crypto-shredding).

iii. Contractor will certify in writing by providing a certificate of destruction (COD) letter that one of the actions in Section 4(G)(ii) have been completed within thirty (30) days of termination of this Contract or at the request of an authorized agent of MARTA, whichever will come first.

iv. Vendor’s employees this includes contractors will not have access from forbidden foreign countries as listed by MARTA.

5. Notification, Backup and Audit Requirements

a. Security Breach Notification

i. Contractor will comply with all applicable laws that require affected individuals to be notified in the event of unauthorized release of their personally identifiable information or any other security event requiring notification.

ii. In the event of a breach of any of Contractor’s security obligations, or other event requiring notification under applicable law, Contractor will:

1. Notify MARTA primary contact by telephone and e-mail as well as MARTA’s Information Security team at:

esrm@itsmarta.com of such an event within forty-eight (48) hours of discovery.

2. Assume responsibility for informing all such affected individuals in accordance with applicable law; and

3. Indemnify, hold harmless and defend MARTA and its trustees, officers, and employees from and against any claims, damages, or other harm related to such notification event.

b. Audits & Right to Test

i. Contractor will provide MARTA with any third-party compliance and security audits (e.g., SSAE 16 reports, penetration tests, etc.) as they become available and inform MARTA primary contact and MARTA’s Information Security team of any non-compliance, exceptions, and remediation plans.

ii. MARTA may perform penetration or vulnerability testing from the Internet provided MARTA informs Contractor at least ten (10) business days before the test.

c. System Audit Logging

i. Contractor will log all actions, including date, time, and unique identifiers, and user activity.

ii. Contractor will centrally manage logs and prevent unauthorized users from accessing the central logging system.

iii. Contractor will review logs regularly or automatically with SIEM solutions.

d. Industry Standards and Best Practices Generally recognized industry standards include, but are not limited to, the following standards or best practices listed at:

i. Center for Internet Security - http://www.cisecurity.org

ii. National Institute for Standards and Technology - http://csrc.nist.gov

iii. Federal Information Security Management Act (“FISMA”) -http://csrc.nist.gov

Docusign Envelope ID: 87DD59A1-E16A-450F-A748-0BA2F96D9F7E mailto:esrm@itsmarta.com http://www.cisecurity.org/ http://csrc.nist.gov/ http://csrc.nist.gov/

iv. ISO/IEC 27000-series - http://www.iso27001security.com/

v. Organization for the Advancement of Structured Information Standards

(“OASIS”) - http://www.oasis- open.org/

vi. Cloud Security Alliance CCM -https://cloudsecurityalliance.org/group/cloud-controls-maMARTAx/#_overview

vii. CIS Controls - https://www.cisecurity.org/controls/

viii. OWASP Top Ten Best practices ix TSA Compliance - SD 1582-21-01B: Enhancing Public Transportation and

Passenger Railroad Cybersecurity. SD 1582-21-01B becomes effective on October 24, 2023 at 12:01 a.m. (EDT).

e. Administrative Account Management

Contractor will protect Administrator account management based on controls listed in CIS Controls - Controlled Use of Administrative Privileges (https://www.cisecurity.org/controls/)

f. Disaster Recovery and Business Continuity Plans

Contractor will provide a specific, detailed backup plan for systems, files, and data.

g. System Uptime For cloud services or third-party providers managing service level Contracts, Contractor will provide a specific and detailed system uptime that meets MARTA 99.999% availability requirements.

h. Contractor Warranty to Self-Audit

i. Contractor warrants that the services provided in the Contract will be in substantial conformity with the information provided in this Exhibit, through one of the following forms of self-audit:

1. Cloud Security Alliance Consensus Assessment Initiative questionnaire,

2. an audit conducted by Statement on Standards for Attestation Engagements (“SSAE”) No. 16 or the Payment Card Industry Data Security Standard (“PCI DSS”), or

3. a similar third-party annual audit report.

ii. Contractor will inform MARTA promptly of any material variation in operational controls from those reflected in this Exhibit and

iii. Any material discrepancy between the requirements in this Exhibit and the response to Section (“Data Security”) will be deemed a material breach of the contract.

Docusign Envelope ID: 87DD59A1-E16A-450F-A748-0BA2F96D9F7E http://www.iso27001security.com/ http://www.oasis-open.org/ http://www.oasis-open.org/

Distraction Avoidance Policy

Prepared By:

Department of Safety and Quality Assurance

June 2024

EXHIBIT B-3

POLICY

ISSUE DATE

06-04-2024

Revision No: 6

REFERENCE

NO.

SAQ-PO-0360

TITLE: Distraction Avoidance Policy

WARNING! This document is uncontrolled when printed.

Document Revision History

Revision Description Date

0 Initial release. December 2016

1 Revised to establish criteria for exemptions within the Authority and external stakeholders from the policy's provisions.

March 2023

2 Revised to provide clarification on exemptions related to the use of electronic devices on the wayside.

June 2023

3 Revised to clarify the disciplinary process and types of distractions. Defined new terms.

March 2024

4 Reviewed by technical writer. May 2024

5 This has been updated to include progressive disciplining for policy violations and the addition of language to allow for wayside cell phone usage during emergencies or special situations.

May 2024

6 Revised to add a definition of Emergency June 2024

DocuSign Envelope ID: 65432CE9-67DC-4DF9-9241-0D0E501723E1Docusign Envelope ID: 87DD59A1-E16A-450F-A748-0BA2F96D9F7E

06-04-2024

Revision No: 6

REFERENCE

TABLE OF CONTENTS

I. Background

II. Georgia Hands-Free Distracted Driving Law, O.C.G.A. §40-6-241

III. General

A. Purpose

B. Scope

C. Review

D. Terms, Acronyms & Definitions

E. Exemptions

1. MARTA Police

2. Wayside Activities

IV. Policy

A. Revenue Vehicles

B. On-Track Equipment

C. Equipment Operation and Other Safety-Critical Functions

D. Non-Revenue/Fleet Vehicles

E. Personal Vehicles When Conducting MARTA Business

F. Roles and Responsibilities

G. Violations and Disciplinary Actions

1. Actions Resulting in Termination or Discharge

2. Actions Resulting in Progressive Discipline

3. Appeals

V. REFERENCES

DocuSign Envelope ID: 65432CE9-67DC-4DF9-9241-0D0E501723E1Docusign Envelope ID: 87DD59A1-E16A-450F-A748-0BA2F96D9F7E

06-04-2024

Revision No: 6

REFERENCE

ISSUING

DEPARTMENT:

Department of Safety and Quality Assurance

PREPARED BY: Office of Safety

APPROVED BY:

Collie Greenwood General Manager/CEO

Signature Date

George Wright Chief Operating Officer

Ralph McKinney Chief Safety Officer

SUPERSEDES: This policy supersedes any existing policies, notices, bulletins, and rules that contain language regarding restrictions on using cell phones and other personal electronic equipment, eating, drinking, smoking and other distracting behavior while operating vehicles or equipment or performing safety-critical functions.

DocuSign Envelope ID: 65432CE9-67DC-4DF9-9241-0D0E501723E1

6/11/2024

6/11/2024

6/10/2024

06-04-2024

Revision No: 6

REFERENCE

I. Background

Operator distraction diverts attention away from activities critical for the safe operation of vehicles, equipment, and other safety-critical functions, such as performing work while on the

Authority's Wayside.

Numerous studies have shown that distractions when operating trains, buses, motor vehicles, and equipment can lead to serious accidents.

In November 2020, the National Safety Council (NSC) and the National Transportation Safety Board (NTSB) joined forces and urged the following:

Employers should establish strong transportation and driving policies that prohibit cell phone use by employees and mandate no calls, social media, texts, or accessing email accounts while driving.

Operators should utilize the "do not disturb" feature on phones, place phones out of reach or simply turn phones off until a destination is reached.

Manufacturers of portable electronic devices should develop a distracted driving lock-out mechanism or application that automatically disables any driver-distracting functions when a vehicle is in motion. However, the device can still be used in an emergency.

While the use of electronic devices is a growing cause of driver distraction, other types of distractions also have the potential to cause accidents when an employee's attention to their job is diverted.

To that end, MARTA has established rules and operating procedures that prohibit or restrict eating, smoking, reading, use of electronic devices, and other distracting behaviors while operating vehicles because of the possible danger to passengers, the public, and employees.

II. Georgia Hands-Free Distracted Driving Law, O.C.G.A. §40-6-241

The rising number of traffic deaths is one reason the state of Georgia passed House Bill 673, Hands-Free Law, in July 2018. The following mandates are encompassed in the Georgia Hands-Free Distracted Driving Law, O.C.G.A. §40-6-24:

A driver cannot have a phone in their hand or use any part of their body to support a phone.

A driver may not send or read any text-based communication unless using voice-based communication that automatically converts the message to a written text or is used for navigation or GPS.

A driver may not write, send, or read any text messages, emails, social media, or internet date content.

A driver may not watch a video unless it is for navigation.

A driver may not record a video; however, continuously running dash cams are exempt.

DocuSign Envelope ID: 65432CE9-67DC-4DF9-9241-0D0E501723E1Docusign Envelope ID: 87DD59A1-E16A-450F-A748-0BA2F96D9F7E

06-04-2024

Revision No: 6

REFERENCE

Music streaming apps are permissible, provided the driver activates and programs them while parked. Drivers cannot touch their phones to do anything to a music app while on the road. Music streaming apps that include video are disallowed.

MARTA is adopting the following exceptions to the Hands-Free Law for operators of non-revenue vehicles when the driver is:

Reporting a traffic crash, medical emergency, fire, criminal activity, or hazardous road conditions

Serving as a first responder (law enforcement, fire, EMS) during the performance of their official duties (i.e., MARTA Police)

In a lawfully parked vehicle. Note: This does not include vehicles stopped for traffic signals and stop signs on the public roadway.

A link to the complete law can be found at www.headsupgeorgia.com.

III. General

Activities that distract from the operation of a vehicle or equipment or the performance of other safety-critical functions are a hazard and may lead to an accident. Distractions include but are not limited to the use of electronic devices, eating, smoking, reading, and other activities that take attention away from driving or operating equipment.

Engaging in activities that distract from the safe operation of a vehicle or equipment or the performance of other safety-critical functions is prohibited. Safe driving and the operation of equipment require good judgment and focus. Managing all aspects of safe vehicle and equipment operation is an important component of this policy and part of everyone's safety responsibilities.

The use of an electronic device includes, but is not limited to, making or receiving telephone calls, texting, playing games, reading, emailing, internet browsing, and listening to music or other audio content.

Business communication during transit operations is an essential safety and operational function. MARTA-issued two-way radios are provided for this vital communication.

Accordingly, these devices are to be used exclusively for business communication. Use of a MARTA-issued two-way radio for communication necessary for the operation of the transit vehicle or equipment or the performance of a safety sensitive function is excluded from this prohibition. Personnel that have been issued two-way radios and personnel operating a vehicle equipped with a two-way radio must always use the radio as prescribed by MARTA-approved training and as the primary business communications system.

DocuSign Envelope ID: 65432CE9-67DC-4DF9-9241-0D0E501723E1Docusign Envelope ID: 87DD59A1-E16A-450F-A748-0BA2F96D9F7E http://www.headsupgeorgia.com/

06-04-2024

Revision No: 6

REFERENCE

A. Purpose

This policy aims to establish the regulations, guidelines, and disciplinary actions for all MARTA personnel related to avoiding unnecessary distractions while operating MARTA vehicles, operating personal vehicles while conducting MARTA business, operating equipment, and performing other safety-critical functions.

B. Scope

This policy applies to all MARTA employees operating MARTA revenue vehicles, non-revenue vehicles, and personal vehicles while conducting MARTA business, operating MARTA equipment, and performing safety-critical functions. The policy also applies to all contractors and consultants performing work for the Authority.

This policy supersedes all existing MARTA policies, procedures, rulebooks, or guidelines pertaining to avoiding distractions, including the use of cell phones and other existing electronic devices, eating, drinking, smoking, and reading by MARTA personnel while operating MARTA vehicles and equipment.

C. Review

This policy shall be reviewed by the DSQA every three years or as circumstances dictate.

Any supporting Rulebooks, General Notices, or Standard Operating Procedures (SOPs) will be updated to ensure consistency with this policy and its requirements.

DocuSign Envelope ID: 65432CE9-67DC-4DF9-9241-0D0E501723E1Docusign Envelope ID: 87DD59A1-E16A-450F-A748-0BA2F96D9F7E

06-04-2024

Revision No: 6

REFERENCE

D. Terms, Acronyms & Definitions

The following terms, acronyms, and definitions are associated with this SOP.

TERM ACRONYM DEFINITION

Department of Safety and Quality Assurance

DSQA DSQA is comprised of System Safety, Environmental Health and Safety, Bus and Rail Safety, Configuration Management, Quality Assurance, Continuous Improvement, and Program Management.

Electronic Device Wireless and/or portable electronic handheld equipment that may be hands-free or not.

Employee- Controlled Distractions

This includes, but is not limited to, the use of electronic devices, eating, smoking, reading, applying makeup, engaging in an unnecessary conversation, and other activities that take attention away from driving or operating equipment.

Emergency An emergency is a situation requiring immediate action to preserve the safety of passengers, employees and the public, or an unexpected event which causes or has the potential to cause major disruption to revenue service.

Examples of emergencies include, but are not limited to, situations requiring immediate train or station evacuation (such as major fire or smoke events), large scale weather events causing unexpected disruption to revenue service, or an unexpected major technical or system failure inhibiting normal operations and maintenance activities.

Equipment Operation

The use of any mechanically powered equipment, including, but not limited to, forklifts, backhoes, mowers, scrubbers, sweepers, utility vehicles (such as tugs and golf carts), powered lifts, and platforms.

Integrated Operations Center

IOC Rail Control, Bus Communication, Police Communication, and Emergency Operation Center.

On-Track Equipment

OTE Maintenance vehicles utilizing the rail system. These vehicles (non-revenue vehicles and equipment) include, but are not limited to, contractor vehicles, tampers, ballast regulators, rail grinders, contractor test vehicles, and hi-rail vehicles.

Safety-Critical Function

Operating revenue and non-revenue vehicles, operating personal vehicles while conducting MARTA business, operating MARTA equipment, working on a console at the

DocuSign Envelope ID: 65432CE9-67DC-4DF9-9241-0D0E501723E1Docusign Envelope ID: 87DD59A1-E16A-450F-A748-0BA2F96D9F7E

06-04-2024

Revision No: 6

REFERENCE

TERM ACRONYM DEFINITION

IOC and any functions and/or activities performed on the Wayside.

Safety Event Any accident, incident, or occurrence

Serious Injury Any injury which: (1) Requires hospitalization for more than 48 hours, commencing within 7 days from the date of the injury was received; (2) Results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) Causes severe hemorrhages, nerve, muscle, or tendon damage; (4) Involves any internal organ; or (5) Involves second- or third-degree burns, or any burns affecting more than 5 percent of the body surface.

E. Exemptions

1. MARTA Police

MARTA Police Officers have established internal cell phone and electronic device usage policies that comply with the Commission on Accreditation for Law Enforcement Agencies.

2. Wayside Activities

Stakeholders may be exempt from this policy's Wayside safety-critical function provisions regarding cell phone usage and electronic devices through a request process located on the DSQA SharePoint site at DSQA - Home (sharepoint.com). The person requesting the exemption must state the reason for the exemption, including the use of cell phones and/or electronic devices.

After receiving written approval from DSQA, personnel within the limits of a flagged restriction shall be permitted to utilize cell phones and electronic devices only in conjunction with performing MARTA work activities. An approved site-specific work plan (SSWP) created specifically for the restriction shall be implemented. The approved SSWP must include designated location(s) where the use of an electronic device is permissible, types of electronic devices to be used during the restriction, and specific personnel who may require the use of an electronic device. This exemption EXCLUDES individuals operating OTE and the individual designated as the dedicated lookout for the restriction. All exemptions will be limited to a specific project and will have an expiration date. Requests for the use of electronic devices on the wayside must be renewed before the expiration date if work needs to continue.

DocuSign Envelope ID: 65432CE9-67DC-4DF9-9241-0D0E501723E1Docusign Envelope ID: 87DD59A1-E16A-450F-A748-0BA2F96D9F7E https://itsmartacloud.sharepoint.com/sites/DSQA

06-04-2024

Revision No: 6

REFERENCE

3. Emergency Situations/Special Circumstances

Wayside

During emergencies, authorized MARTA Personnel are allowed to use their cell phone to call for assistance and document the scene.

In the event of a major communication system outage, MARTA-issued cell phones may be used wayside only to expressly communicate with Rail Control and for wayside communication purposes.

Investigation Purpose

The Safety Operational Officers and DSQA Personnel will only be allowed to use electronic devices on the wayside during investigations.

IV. Policy

A. Revenue Vehicles

An operator of a revenue vehicle is prohibited from engaging in activities that distract from its safe operation.

Revenue vehicle operators are NOT allowed to wear or carry cell phones, smartwatches, other wearable communication devices, or electronic devices on their person. Electronic devices must be in a bag or purse and must be in the OFF position (not "silent" or "vibrate").

Non-smart watches may be worn on their person for time-keeping purposes only.

Revenue vehicle operators may engage in activities such as using electronic devices, eating, drinking, reading, etc., provided the vehicle is parked in a safe location with the parking brake engaged. The exception is train operators, who must key down the railcar and exit the operator's cab before engaging in any prohibited activity. Smoking in revenue vehicles is always prohibited.

The above requirements apply to the operation of all revenue vehicles even if the vehicle is not in revenue service.

If programming is required, mobility operators may use GPS devices provided the vehicle is parked in a safe location with the parking brake engaged.

In case of an emergency or if radio communications fail, a personal cell phone may be used as backup only if the vehicle is safely stopped and secured. Train operators must exit the operator's cab before using a cell phone; however, in extenuating circumstances and at the discretion of the IOC, train operators may utilize a cell phone to preserve life.

B. On-Track Equipment

An operator of on-track equipment (OTE) is prohibited from engaging in activities that distract from the safe operation of the OTE.

DocuSign Envelope ID: 65432CE9-67DC-4DF9-9241-0D0E501723E1Docusign Envelope ID: 87DD59A1-E16A-450F-A748-0BA2F96D9F7E

06-04-2024

Revision No: 6

REFERENCE

On-track equipment operators may engage in activities such as eating and reading, provided the vehicle is parked in a safe location with the parking brake engaged.

In case of an emergency, if radio communications fail, a cell phone may be used as backup only if the equipment is safely parked and/or secured and the operator is outside of the equipment cab, off the equipment, and has moved away from the controls.

C. Equipment Operation and Other Safety-Critical Functions

Employees operating equipment (e.g., forklifts and scissor lifts) or performing safety-critical functions (e.g., flagging) must keep cell phones or electronic devices on silent.

Employees operating equipment or performing safety-critical functions are prohibited from engaging in activities that distract from the safe operation of the equipment or the safety-critical functions they perform.

In case of an emergency or if radio communications fail, a cell phone may be used as backup only if the equipment is safely parked and/or secured and the employee is outside the train envelope.

D. Non-Revenue/Fleet Vehicles

An operator of a non-revenue vehicle is prohibited from engaging in activities that distract from the safe operation of the vehicle in accordance with the mandates referenced in Section II, Georgia Hands-Free Distracted Driving Law, O.C.G.A. §40-6-241.

E. Personal Vehicles When Conducting MARTA Business

Employees are encouraged to use MARTA vehicles while conducting MARTA business.

The use of a MARTA-issued electronic device constitutes conducting MARTA business. Use of any electronic device in a personal vehicle while conducting MARTA business shall be in accordance with the mandates referenced in Section II, Georgia Hands-Free Distracted Driving Law, O.C.G.A. §40-6-241.

Access to Records

MARTA employees must cooperate with the investigation as part of any investigation of a safety event.

Only information related to the investigation must be provided, and the information is not to be used for any other purpose.

F. Roles and Responsibilities

Any MARTA employee must immediately report any accident, incident, or other safety policy violation to their supervisor.

DocuSign Envelope ID: 65432CE9-67DC-4DF9-9241-0D0E501723E1Docusign Envelope ID: 87DD59A1-E16A-450F-A748-0BA2F96D9F7E

06-04-2024

Revision No: 6

REFERENCE

DSQA is responsible for facilitating a formal data review of the policy every three years and revising it as needed.

The Department of Safety and Quality Assurance is responsible for the following:

• Implementation of the requirements of this policy through the issuance of Authoritywide rules and procedures governing distracted driving, including the use of electronic devices.

• Enforcing the provisions of this policy and the associated rules and procedures, including, but not limited to, investigating reported or observed violations of this policy and/or the associated rules and procedures.

All other departments are responsible for the following:

• Enforcing the provisions of this policy and the rules and procedures governing distracted driving, including the use of electronic devices in conjunction with the operation of non-revenue vehicles and other equipment and the performance of any safety-critical function.

G. Violations and Disciplinary Actions

1. Actions Resulting in Termination or Discharge

Employees are prohibited from engaging in the following activities while operating a revenue vehicle, on-track equipment, operating equipment, or performing a safety-critical function as defined in Section IV, sub-paragraphs A, B, and C.

Employees found in violation of using a cell phone or other electronic device are subject to the following disciplinary action:

First Offense: Termination / Discharge

Employees found in violation of engaging in other employee-controlled distractions are subject to the following disciplinary action subject to the severity of the safety event (i.e., fatality, serious injury, and/or damage to equipment/property):

First Offense: Five (5) day suspension or Termination / Discharge

2. Actions Resulting in Progressive Discipline

Employees are also prohibited from engaging in the following activities while operating a revenue vehicle, on-track equipment, operating equipment, or performing a safety-critical function as defined in Section IV, items A, B, and C.

Wearing or carrying cell phones or electronic devices on their person

Employees found in violation are subject to the following disciplinary actions:

First Offense: Five (5) day suspension

DocuSign Envelope ID: 65432CE9-67DC-4DF9-9241-0D0E501723E1Docusign Envelope ID: 87DD59A1-E16A-450F-A748-0BA2F96D9F7E

06-04-2024

Revision No: 6

REFERENCE

NO.

SAQ-PO-0360

TITLE: Distraction Avoidance Policy

WARNING! This document is uncontrolled when printed.

Second Offense: Termination / Discharge

3. Appeals

An employee appeal of disciplinary action shall be in accordance with the appeal process for the business unit to which the employee is assigned.

Represented employees shall appeal through the process outlined in the Collective Bargaining Agreement.

V. REFERENCES

• Agency Safety Plan SAQ-PL-0101

• Office of Safety Accident/Incident Investigation Procedure SAQ-PR-1160

DocuSign Envelope ID: 65432CE9-67DC-4DF9-9241-0D0E501723E1Docusign Envelope ID: 87DD59A1-E16A-450F-A748-0BA2F96D9F7E

CONDITIONS OF EMPLOYMENT

ALERTNESS ASSURANCE PROGRAM

PROCEDURE

PREPARED BY: COMMON RULES COMMITTEE

MANAGER: MYCHAL ROLLINS

DATE: 8/1/2022

EXHIBIT B-4

PROCEDURE

8-1-2022

REFERENCE

HR-PPO-4370

Rev. 3

TYPE: Conditions of Employment – Alertness Assurance Program

TABLE OF CONTENTS

I. General

A. Scope

B. Purpose

C. Goal

D. Review

E. Applicability

F. Responsibilities

II. Policy

DocuSign Envelope ID: F7C091B9-E35D-4508-8B96-58D3A54A5C41Docusign Envelope ID: 87DD59A1-E16A-450F-A748-0BA2F96D9F7E

ACKNOWLEDGEMENT OF REVIEW

REVIEWER SIGNATURE DATE

RALPH MCKINNEY

CHIEF SAFETY & QA OFFICER

DocuSign Envelope ID: F7C091B9-E35D-4508-8B96-58D3A54A5C41

8/3/2022

ISSUING

DEPARTMENT:

Labor Relations, Bus Operations, Rail Operations

PREPARED BY: Common Rules Committee

APPROVED BY:

LaShanda R. Dawkins

AGM, Labor & Employee Relations

Signature Date

Herold B. Humphrey Deputy Chief Bus Transportation

Signature Date

Daniel Hecht Deputy Chief Mechanical Officer

SUPERSEDES: Conditions of Employment - Alertness Assurance Program IV. Y

I. General

A. Scope

This document covers the policy for Alertness Assurance Program.

B. Purpose

The purpose of the Alertness Assurance Program Procedure is to improve workplace safety by

a) increasing the awareness of the relationship between fatigue and accident/injury; b) establishing limits on the maximum time at work; and c) establishing the minimum number of hours off work; d) establishing a rule that governs all employees with exceptions for specified operational employees. Limited work time, opportunity for rest, and awareness of the results of fatigue comprise three aspects of the MARTA Alertness Assurance Program.

C. Goal

The result of accidents can be death, impairment, loss of income, loss of assets, and increased absenteeism. Therefore, the goal of the program is to reduce on the job fatigue by providing time off before work.