Exhibit X - Technology Security Rider.docx

Exhibit X

TECHNOLOGY SECURITY RIDER

For

RFP-YK-006732

Prescription Safety Eyewear Technology Security Rider

Vendor acknowledges and agrees to the following terms as part of any Utilities’ acquisition of a technology solution (hereafter known as the “Solution”) which includes, but is not limited to, cloud-based services, network-connected hardware including Electronic Assets, peripherals, appliances, virtual appliances, containers, or software including trials, freeware, and open-source packages that are installed or run on an Electronic Asset connected to a Utilities-managed network including cloud-based resources. “Electronic Assets” are further defined as virtual or physical endpoints to include, but not limited to laptops, servers, desktops, mobile devices, networking / infrastructure devices, IoT devices, or any other type of devices that are connected to Utilities-managed networks.

Terms

1. Transmission of Data

· If the Solution or component of the Solution is installed, connected to, or run in a Utilities-managed network, Vendor acknowledges and agrees that their Solution does not transmit Utilities’ data to any destination outside Utilities-managed networks without explicit configuration by Utilities and attachment of Utilities’ “Data Security Rider” to all Agreements with the parties who receive, store, process, or otherwise access the data.

· If the Solution is cloud-based or includes a cloud-based component, Vendor acknowledges and agrees that their Solution (or cloud-based component) does not transmit Utilities’ data to any destination outside only those systems which comprise the Solution without explicit written agreement from Utilities or configuration by Utilities.

· For Solutions or components of the Solution installed on, connected to, or run in a Utilities-managed network, Vendor may collect aggregate technical data regarding their Solution, it’s usage, and environment provided that such data, to include data for licensing, does not include any information that could potentially identify a specific individual (e.g. username, ID, etc.) or attributable information from the resident host (e.g. hostname, private IP address, etc.). With the exception of technical data transmissions used for licensing, Utilities reserves the right to filter or block these technical data transmissions and Vendor agrees that their Solution will function to its full extent in the absence of these technical data transmissions.

2. Vulnerability Management

· Vendor acknowledges and agrees to disclose all known material defects or weaknesses that expose Utilities to a threat (collectively, “Vulnerabilities”) within the Solution at the time of Utilities’ acquisition. If the Solution includes a vendor-managed component, Vendor agrees that these components are properly configured using industry-standard best practices to maintain the security of the Solution.*

· Vendor acknowledges and agrees that they will continually evaluate their Solution for Vulnerabilities and security misconfigurations and either apply the necessary updates to the Solution / amend any misconfigurations themselves within recommended industry-standard timeframes for remediation and provide software, firmware, and hardware updates / patches (collectively, “Updates”) to Utilities which remove identified Vulnerabilities within a timeframe which corresponds to the relative threat / risk. Using coordinated vulnerability disclosure practices, Vendor agrees to disclose Vulnerabilities within their Solution to Utilities in a timely manner.*

3. Updates

· Vendor acknowledges and agrees that their Solution does not automatically download and install Updates unless one of the following conditions are true:

a) Automatic updates are integral to the core functionality or security of the Solution. Examples include software packages that rely on real-time updates (e.g. anti-virus programs) to provide the value of the software. Utilities reserves the right to determine in its reasonable opinion whether or not automatic updates are integral to the core functionality of the Solution.

b) Automatic updates can be disabled such that user intervention is required to manually apply updates.

· All updates to the Solution must use reasonable cryptographic measures to ensure the integrity and authenticity of updates to include both:*

a) verification of the identity of the server providing the update (e.g. using mTLS).*

b) verification of the integrity of the update (e.g. using file hashes / digital signatures).*

4. Incidents

· Vendor acknowledges and agrees to notify Utilities in writing at cybersecurity@csu.org of and coordinate response activities to any vendor-identified incidents related to the Solution that pose a material cybersecurity risk to Utilities. “Coordination of response activities” is further defined as, at a minimum, providing Utilities with timely updates regarding the incident, potential impact to Utilities to include any required actions, response activities, and post-incident plans to prevent future occurrences. Utilities will coordinate their response to the incident based upon the information provided.*

*For Solutions which would be subject to Critical Infrastructure Protection (CIP) standards under the North American Reliability Corporation (NERC) as result of this Agreement, these sections cannot be removed or modified.

Revised 04/2022 1 of 2 image1.jpeg