Exhibit P - Professional Services Rider.docx

Exhibit P

PROFESSIONAL SERVICES RIDER

(Onsite or Remote)

For

RFP-YK-006732

Prescription Safety Eyewear

Professional Services Rider

For the purpose of coordinating cybersecurity controls regarding vendor access (onsite or remote), Contractor acknowledges and agrees to the following Terms as part of any Agreement including professional services conducted onsite or remotely via access to Colorado Springs Utilities (“Utilities”)-managed networks and Services. “Services” are defined as any Internet-accessible cloud solution utilized by Utilities or hosting, storing, or processing Utilities’ data. “Contractor” is further defined as the Contractor, Contractor’s personnel, and any subcontractors and their personnel. Contractors are fully responsible for ensuring their personnel and any subcontractors are in compliance with these Terms at all times. *

Terms

1. Unless Utilities’ “Data Security Rider” is attached to this Agreement, all Utilities non-public data shall remain within Utilities’ Services and Utilities-managed networks, behind Utilities’ firewall, at all times. Utilities’ “non-public data” is further clarified to mean any information / data which is not considered to be public-facing (e.g. information posted on www.csu.org, etc.) excluding limited business contact information.

2. Non-public data may be accessed remotely via Utilities’ Services or VPN but may not be transferred or uploaded to a location outside Utilities-managed networks to include Contractor’s workstation(s). Taking screenshots of Utilities’ systems are allowed for documentation purposes provided there is no sensitive or confidential information visible, and the documentation must remain within Utilities’ authorized file storage locations such as properly secured Utilities’ SharePoint Online sites or Utilities’ OneDrive for Business.

3. Contractor agrees to appropriately Clear, according to NIST SP 800-88 media sanitization guidelines, temporary copies of Utilities’ information / data created during access.

4. Utilities prohibits the connection of any computing equipment, network, storage, or any other device which is not owned, managed, and secured by Utilities to Utilities-managed networks or computing equipment. The only three exceptions are (a) the Contractor’s use of Utilities-approved VPN solution(s), (b) Contractor’s onsite usage of Utilities’ guest Wifi network, and (c) the physical media scanning kiosks as detailed in #11 below.

5. Using the principle of least privilege, any VPN and Service access provided to Contractor by Utilities will be limited to only those components / systems required for Contractor to complete their duties described in the Agreement. Utilities VPN access will be restricted to a ‘jump server’ through which internal resources will be accessed. File transfers between Contractor’s VPN clients and the jump server are prohibited and will be blocked.

6. Any access, to include VPN, Service, or “Over the Shoulder” connections (as defined below), from countries embargoed or sanctioned by the United States are strictly prohibited. Contractors within the United States and any non-embargoed / sanctioned country may utilize the following methods for system access:

a. Urgent Access or Limited Engagement. “Over the Shoulder” access may be initiated by a Utilities’ employee using the organization’s approved collaboration tool. Screen-sharing is allowed, but the display of confidential data is prohibited. Contractor may be provided mouse / keyboard control if manually approved by an employee. All activities during the collaboration session must be supervised by a Utilities’ employee knowledgeable of and experienced with the system and work being performed.

b. Data Sharing Only. Contractors may be provided access to Utilities’ Services without VPN.

c. Unescorted Digital Access from a Foreign Company. Contractors which require VPN access from outside the United States must provide static IP address(es) that are owned / leased by their company (verifiable through WHOIS information) to whitelist through our perimeter protections.

d. Unescorted Digital Access from a Foreign Individual. Contractors which require VPN access from outside the United States who cannot provide a static IP address must, at their own expense, setup a US-based system within a major public cloud provider. This system must meet the ‘industry-standard precautions’ listed in #7 below and utilize a static public IP address. Once the contractor has provided proof of adherence to these requirements, Utilities may provision VPN access from this system.

PLEASE NOTE: This method should be used as a ‘last resort’ as the experience will be less than ideal.

Only Contractors within the United States may utilize the following method for remote access:

a. Unescorted Digital Access. Contractors within the United States may be provided VPN access to Utilities-managed networks without the need to provide a static IP address.

7. Contractor is responsible for taking industry-standard precautions to ensure their equipment does not introduce malicious content or provide unintended access prior to connecting to Utilities’ VPN or Services. At a minimum, such precautions include active industry-standard endpoint security software suite in addition to operating system (OS) provided security features, properly configured host-based firewall, installation of all currently available OS and application security patches, and only utilizing operating systems currently supported by the vendor. Utilities may validate these precautions and prevent access if devices are determined to be non-compliant.

8. Any set of credentials or access tokens provided to Contractor must be used only by the named individual to which they were provisioned. Sharing or re-use of access credentials or access tokens is strictly prohibited. Contractor’s access to Utilities’ Services and VPN will be disabled on the date of contract expiration or upon project completion, whichever is sooner.

9. Contractor is authorized to access only those Utilities’ systems, devices, or information and perform only those actions which are required to perform the duties as described in the Agreement. Accessing any other Utilities’ system, device, or information or performing any action outside the scope of the Agreement is strictly prohibited. The recording / transcription of meetings and the use of note-taking bots by a Contractor are strictly prohibited.

10. For contracts / Agreements involving publicly accessible information systems or Services, Contractor is responsible for reviewing content posted to publicly accessible information systems for non-public information and, if discovered, removing such information prior to allowing public access.

11. Contractor is responsible for ensuring files, scripts, software, or other data / information transferred or otherwise introduced into Utilities’ network or information systems are free from malicious content (i.e. ‘malware’), backdoors, viruses, adware, etc. All physical media must be scanned by a Utilities’ media scanning kiosk and deemed safe prior to introduction into any Utilities’ information system, network, device, or Service.

12. Contractor agrees that any equipment used to connect to Utilities’ Services or network via approved VPN solutions is actively monitored for cybersecurity threats and anomalous behavior and, if discovered, will not be used for any Utilities-related work until all events have been thoroughly investigated and remediated.

13. Contractor agrees to immediately notify Utilities when remote or onsite access is no longer needed and should be revoked from Contractor, Contractor’s personnel, or any subcontractors or their personnel. *

14. Contractor must immediately report any suspected or confirmed compromise, misuse, or unauthorized disclosure of Utilities non-public information (to include credentials, access tokens, etc.), Contractor account compromise, or other anomalous behavior to Utilities’ cybersecurity personnel by calling 719-668-CYBR (719-668-2927).

*For Agreements involving access to Utilities’ assets which are subject to Critical Infrastructure Protection (CIP) standards under the North American Reliability Corporation (NERC), these sections cannot be removed or modified.

Revised 06/2025 2 of 2 image1.jpeg