R25-110JD Video Management System - ADA.pdf

R25-110JD Video Management System 1

REQUEST FOR INFORMATION

Video Management System (VMS)

Jennifer Davis City of Colorado Springs Procurement Services

107 N. Nevada Ave Suite 125 Colorado Springs, CO 80903

TEL: (719) 385-5172

E-Mail: Jennifer.davis@coloradosprings.gov.

Issue date: October 2, 2025

R25-110JD Video Management System 2

1.1 PURPOSE

The City of Colorado Springs IT department is requesting information to explore options to standardize the Video Management Service (VMS).

It is the City's intent to issue this Request for Information (RFI) to determine whether there are a sufficient number of interested and qualified sources that can provide the requested software system.

1.2 REQUESTS FOR INFORMATION DEFINITION

Responses to this RFI are considered non-binding and are only used to gather information to be used for budgetary and specification preparation purposes. It will also be used to determine the number of companies that exist in the industry for a possible future competitive procurement.

It is not the intent of the City to award a contract as a result of this RFI. If this RFI determines that there are sufficient interested and qualified vendors/contractors and favorable monetary estimates, the City may issue a formal RFP (Request for Proposal) for these services. If an RFP is issued, then all firms that responded to this RFI will be added to our source list and will be formally invited to propose.

1.3 BACKGROUND

The primary objective of this RFI is to seek vendors who offer Video Management Service (VMS). The City needs a Video Management System, (VMS), that can integrate with the multiple makes and models of cameras, some with external microphones for interviews, in use at the City today. The VMS also needs to be able to host and access stored video in the cloud.

Additionally, it needs to be able to integrate with our door controller system called Ccure. The City has approx. 1000 cameras and is interested in replacing current cameras as they age out so we would like a proposal for both hardware and VMS. We may only look at the VMS at this time, so please break down the proposals for hardware and software components.

1.4 CITY OF COLORADO SPRINGS CYBER SECURITY VENDOR QUESTIONS

Please answer the following questions for the City Information Technology Office:

1. Will the vendor sign or request changes to the City Information Technology Data Rider?

2. Does the vendor solution support the uses of SSO/MFA?

3. Does the vendor have a current Cyber Security SOC2 certification? If not, please explain why.

4. Does the vendor maintain Cyber Security insurance? What are those liability thresholds for each deployed situation?

5. What is the vendor process for communicating a security breach or incident to its customers?

6. Does the vendor conduct any recurring vulnerability or penetration testing?

7. What industry standard frameworks does the vendor use to maintain solution security?

R25-110JD Video Management System 3

1.5 PROCEDURAL INFORMATION

A. Inquiries

Questions about the RFP must be submitted electronically with BidNet. A written response to any inquiry may be provided in the form of an Amendment to the RFI. Questions are due by October 9, 2025 1:00PM MST.

Request for information or support shall be addressed to:

Jennifer Davis Jennifer.davis@coloradosprings.gov.

Questions are due by October 9, 2025 1:00PM MST.

Amendments to this RFI may be issued at any time prior to the time set for receipt of submittals. The City will post all addenda using the Rocky Mountain E-Purchasing System (www.bidnetdirect.com) It is the respondent’s responsibility to check the website for posted addenda.

1.6 RESPONSE SUBMISSION

Responses should be prepared simply and economically while still providing pertinent details of the vendor's ability to meet the requirements specified in this document (or portions thereof) and as stated below. At a minimum they should include the following information:

1. Company name, owner, address, phone #, e-mail, website if applicable.

2. Company background and previous successful relevant experience in VMS solutions

3. Experience working with municipalities

4. Quote providing the estimated cost to be used to help develop a budget.

5. Any additional relevant information.

6. Answers to the Cybersecurity questions.

Responses will be accepted electronically through the Rocky Mountain E-Purchasing System (www.bidnetdirect.com) and must be submitted by November 3, 2025 10:00AM

MST.

1.7 COST OF RESPONSES

The City of Colorado Springs is not liable for any cost incurred by vendors in preparing their response. Respondents may be asked to clarify or expand upon information provided.

1.8 PROPRIETARY INFORMATION

If a response contains information that the respondent does not want disclosed to the public, or used for any purpose other than the evaluation of this response, all such information must be indicated with the following or similar statement: “The information contained on pages

R25-110JD Video Management System 4

_____, _____, and _____ shall not be duplicated or used in whole or in part for any purpose other than to evaluate the response provided. If a contract is awarded to this firm as a result of the submission of such information, the City of Colorado Springs shall have the right to duplicate, use, or disclose this information to the extent provided in the contract. This restriction does not limit the City of Colorado Springs’ right to use the information herein if obtained from another source.”

All such nondisclosure items specified in the response shall be subject to disclosure as provided in the Colorado Open Records Act (CORA) or as otherwise provided by law.

1.9 RESPONSE MATERIAL OWNERSHIP

All material submitted in response to this RFI becomes the property of the City of Colorado Springs except for software products that are made available for demonstration purposes and proprietary material.

R25-110JD Video Management System 5

EXHIBIT 1 – REQUIREMENTS BY DEPARTMENTS

FOLLOWS THIS PAGE

1. Video storage

a. Needs to be stored in the cloud

b. Edge storage necessary

c. On premise storage – Optional*

d. Usages

i. City - 150 TB

ii. Transit - 500 TB.

iii. Pikes Peak - 10TB

iv. Traffic – Does not record but needs 24x7x365 access to cameras

v. Optional 100 TB Buffer for potential request for 24x7x365

e. Scheduled uploads to control the volume of data being uploaded to the cloud.

2. Cameras

a. Types

i. PTZ

ii. 360 Fixed cameras

iii. License Plate Cameras

iv. 180 Degree cameras

v. Dome cameras

vi. Drones

vii. Mobile trailer

viii. Timelapse cameras

ix. 360 panoramic (fisheye)

x. Vehicle (interior and exterior) – Bus, Fleet, etc

b. Features

i. LTE Connections

ii. Standard 1080p Resolution

1. Option for 4k cameras

iii. Outdoor / Indoor

iv. Motion detection

v. Object analytics

vi. Alarms / built speakers

vii. Solar to power cameras

viii. Video and audio

ix. People counting

x. GEO fencing

xi. Weather notification and analytics

xii. Forensic examination cameras

xiii. Money Counting Cameras

xiv. Facial Recognition

c. Other requirements

i. Number of Cameras

1. City – 750

2. Transit – 150

3. Pikes Peak – 30

ii. Axis branded cameras

1. Would like compatibility with new system as the City may take some time to switch to a different camera brand if required by vendor.

d. Central camera management software

3. Additional Devices

a. Radar

b. Laser

c. Fire detection

d. Air quality detection

e. Metal detectors

f. Gas monitoring

g. Flood lighting

h. Speakers (Alarm)

i. Microphones (limited audio recording)

4. What we record

a. Interview rooms and Airport CSPD Holding Cell

i. Physical button to turn recordings on and off

ii. Each room has two cameras (two angles)

iii. Microphones tied into the cameras for audio recording

b. Election Recording

i. Select cameras isolated

ii. Dual system recording, separate recording instances

iii. Direct export for City Clerk staff

1. 5TB Exports

5. Video Management System

a. Features

i. Camera geo location and mapping

1. Preferably ESRI GIS compatible.

ii. Mobile client required

iii. Desktop / Web client

iv. Adaptive and direct streaming: Supports live multicasting/adaptive streaming and direct streaming to mobile

v. Recording modes: Schedule-based, event-triggered, continuous recording across system tiers

vi. Evidence Lock: Prevents modification or deletion of important video footage

vii. Secure evidence handling: Provides features to safely share video with authorities while maintaining integrity

viii. User access control & dual authorization: Fine-grained permission settings; two-step verification for added security

ix. Security compliance: Support for HTTPS camera connectivity, external identity provider (OIDC), metadata support, and Active Directory integration

x. Alarm management: Built-in alarm list with filtering, escalation, and reporting capabilities

xi. Video Wall - Visual display feature for real-time situational awareness

xii. Third Party Integrations – Software house Ccure. If the solution does not replace Fusus, must provide integration. Would like integration with Safe Fleet.

xiii. Real time crime center software / Tools and features.

xiv. Controlling door access

1. Must control software house Ccure

2. Needs to offer a digital button to control doors remotely

3. Rules on door access need to be able to call up a camera to the area

xv. Ability for the City to directly contact vendor without use of 3 rd party support vendor would be preferred.

6. Door Access Control

a. Must integrate with Software House Ccure

b. Can offer more integrated system.

7. Vendor Support

a. Install new and tech refresh current cameras, microphones, solar and other connected devices.

b. Clean and maintenance 900 plus cameras per year

c. Low voltage wiring

d. Provide pricing on full camera environment support

e. Provide vendor support for video management software

AirPort

- 215 current cameras - will increase over time. Should plan for 230 camera.

- 24 x 7 recording of all cameras required

- 30 day minimum storage required

- 150TB Storage currently - gives us about 50-60 days per camera. This can be manipulated with image quality, frame rates and increased implementation of motion based recording. Might be different with Milestone.

- 7.5 – 15 frames max. 1 frame per second until motion is detected.

- Live stream and recorded stream. Higher resolution I better.

- TSA supervisors and CSPD have access to view and control certain airport cameras.

A solution must be available for this purpose.

- Airport communications center monitors cameras 24 x 7 and exports video for various airport entities.

- Compatibility with Bosch and Axis cameras.

- Bosch on-board camera analytics

- Integration with AMAG symmetry access control system

- Department camera view segregation.

PD – Real Time Crime Center

These are what would be needed to replace FUSUS. May not be possible and will need to find a solution which integrates with FUSUS.

-Integrates officers Axon BWC’s

-Integrates CSPD and FD Drones

-Integrates CAD Call For service data

-Rapid SOS locations

-We can integrate business floorplans

-Integrates Flock ALPR hits

-Shows officer locations -City owned cameras

-Privately owned cameras

-Red light camera locations but not actual photos (We need to make sure our next red light camera contract is forced to integrate into Fusus)

If Keeping FUSUS, PD Wants

My primary requests for a new camera system are:

Cloud to Cloud integration into Fusus

PTZ Controlled within Fusus or native software

I would prefer our cameras record all the time because our current motion only cameras miss a lot of incidents

I would like to have enough coverage so our cameras don’t have to “patrol or scan”. Maybe 4-way cameras instead of patrolling cameras?

And generally more cameras all over the city

R25-110JD Video Management System 6

EXHIBIT 2 – IT TECHNOLOGY RIDER

FOLLOWS THIS PAGE

City of Colorado Springs Innovation and Technology (IT) Department Technology Rider

City of Colorado Springs Information Technology Department-Cybersecurity

City Technology Rider (Contract Rider) Release v5_DRAFT

Introduction The IT Technology Rider was created to ensure good and proper cyber hygiene is implemented and practiced on technology that is installed on vendor technology systems, services used by the City to execute City operations, or within the City’s on-premises (on-prem) network. Vendor cloud-based technology systems and services are most often consumed as Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS), or Infrastructure-as-a- Service (IaaS). By ensuring good and proper cyber hygiene, due diligence is applied to vendor engagements to prevent and/or minimize the likelihood of cyber incidents negatively impacting public safety and municipal operations through loss of availability or capability, unauthorized use, destruction, or modification of technology or data.

Binding Intentions of this Technology Rider This rider applies directly to the actual Service Provider (operator or original equipment operator (OEM)) and the vendor (together, jointly and severally, the “Vendor”) of the service being consumed by the City. If the service is purchased through a value-added reseller (VAR), the VAR hereby certifies and guarantees it will obtain signature of this Technology Rider by the Service Provider and return proof of said signature approval with the VAR’s final signed contract.

Scope This IT Technology Rider is applicable to all City contracts and other vendor engagements where vendors provide one or more of the following:

- Storage and/or transmission of City sensitive and/or restricted data;

- Storage and/or transmission of City data that is the source of record with any City data classification level;

- Computation and analytic capabilities required as part of the delivery of a City service or capability;

- Technology installed directly onto the City on-prem network or cloud-based network infrastructure, Infrastructure as a Service (IaaS), and/or Platform as a Service (PaaS);

- Application integrations that allow data sharing between a City technology asset and a third-party technology asset;

- The technology or Service directly underpins a business process with a Business Impact Analysis (BIA) tier classification of 0-2;

- Primary and secondary internet service provider (ISP) contracts;

- Managed service provider (MSP) or Managed security service provider (MSSP) contracts, to include any vendor engagement requiring access to any type of City asset in order to perform any support, design, or maintenance activities;

- When Artificial Intelligence (AI) or Machine Learning (ML) are included in a technology or service and the output will require business action, will drive business spending, or is automated to a business process;

or

- If City Data will be ingested or consumed by an AI/ML platform and may be shared with third parties or leveraged in the learning data set.

After departmental request and approval from City IT, the following do not require the IT Technology Rider:

- Hardware only purchases with no third-party software installed;

- Subscriptions to web-based research and analysis services that do not include any of the above configurations;

- Software technology purchased and installed on City network infrastructure by City IT personnel;

- Some transport/circuit only contracts;

- Vendor training engagements/workshops where vendor does not have access to City sensitive and/or restricted data on their corporate systems;

- If the only scope element that requires this technology rider is the sole source of data and the business element procuring/using this service determines it does not pose any impact to necessary services, without the possibility of loss or discontinuation of service; or

City Technology Rider (Contract Rider) Release v5_DRAFT

- If City IT Cyber staff can articulate an appropriate reason and the business unit procuring or consuming the service agree this rider may be excepted.

Minimum Requirements The following minimum requirements will be applied to Vendor’s staff, technology, information systems, services, and applications. At any time during the term of service, the IT Department may request a written attestation from the Vendor for any of the following minimum requirements. The Vendor shall provide the written attestation within fifteen (15) business days of City’s request. Minimum requirements will be noted and applied when providing direct support to City on-premises or cloud-based information systems (IaaS/PaaS)).

City and Vendor Governance

1) Vendor Governance: During the term of service, the Vendor shall operate an information security program designed to meet the confidentiality, integrity, and availability (CIA) requirements of the service or product being supplied. Vendor shall ensure all of its partners and sub-contractors meet or exceed the same requirements.

a) Information Security Policy: Vendor shall develop, implement, and maintain an information security policy and shall communicate the policy to all of Vendor’s employees, agents, representatives, and contractors.

b) Information Security Accountability: Vendor shall appoint and identify to the City an employee who shall be accountable for Vendor’s information security program. Minimum contact information shall include said employee’s name, primary phone number, and email address. The City shall be updated regarding changes in this point of contact within thirty (30) days of a change.

c) Risk Management: Vendor shall employ a formal risk assessment process to identify security risks that may impact the products or services being supplied and to mitigate risks in a timely manner commensurate with the risk.

2) City Governance: (NOTE: Only applies when providing direct support to City on-premises or cloud-based information systems (IaaS/PaaS))

a) Vendor shall comply with applicable City technology policies and governance, such as, but not limited to, the City’s Acceptable Use Policy, Privileged Account Acceptable Use Policy, Password Policy, Colorado Privacy Law (C.R.S. § 6-1-713 et seq.), Purchase Card Industry Data Security Standards (PCI DSS), and the Criminal Justice Information System Security Policy (CJIS) (external) during the life cycle of the service.

Asset Management

3) Asset Inventory: Vendor shall maintain an inventory of all Vendor hardware and software assets used to provide service to the City.

4) Data Classification: Vendor shall develop, implement, and maintain a data classification scheme and process designed to ensure that Vendor data used to provide service to the City is protected according to its confidentiality requirements.

Supply Chain Risk Management

5) Supplier Security Assessments: Vendor shall engage in appropriate due diligence assessments of potential suppliers that may impact the security of the services or products being supplied to the City.

6) Security in Supplier Agreements: Vendor shall ensure that agreements with suppliers who may impact the security of the services or products being supplied to the City contain appropriate security requirements.

City Technology Rider (Contract Rider) Release v5_DRAFT

Human Resource Security

7) Information Security Awareness: Vendor shall develop and implement an information security awareness program designed to ensure that all Vendor employees and contractors receive security education as relevant to their job function.

8) Background Checks: Vendor shall conduct an appropriate background review on all new employees, based on the sensitivity of the role that they are being hired for within the Vendor’s organization.

Vendor Identity Management, Authentication, and Access Control

9) Authentication: Vendor shall ensure that all access by Vendor’s employees, agents, representatives, and contractors to City or Vendor systems used to provide services or supply products, require appropriate authentication controls that, at a minimum, include:

a) Strong passwords/passphrases, or multi-factor authentication for users; and

b) Multi-factor authentication for all remote access.

10) Authorization: Vendor shall ensure that all access to the Vendor’s information systems, used to provide services or supply products to the City, is authorized by a Vendor approved identity and access management process.

11) Privileged Account Management: Vendor shall appropriately manage and control privileged accounts on the Vendor’s information systems that, at a minimum, includes:

a) Use of dedicated accounts for privileged activity; and

b) Maintaining an inventory of privileged accounts.

12) Access Termination: Vendor shall develop and maintain a process designed to ensure that user access to the Vendor’s information system, and/or network is revoked upon termination of employment, or revoked upon termination or expiration of a contractor’s contract, as applicable.

City Network Access and Vendor Remote Access System

13) City Network Access Request: (NOTE: Only applies when providing direct support to City on-premises or cloud-based information systems (IaaS/PaaS))

a) Staff augmentation services (where one or more of Vendor’s employees is augmenting City IT staff): Each Vendor employee must (i) complete City Cybersecurity Awareness Training; (ii) read, sign, and comply with City Acceptable Use Policy; and, (iii) if required, complete the City Privileged Account Acceptable Use Policy/Vendor Access Policy.

b) Managed Services (where a full service is provided by Vendor): Vendor shall identify a company officer or program manager that can read and sign the Acceptable Use Policy and, if required, the City Privileged Account Acceptable Use Policy/Vendor Access Policy, and ensure all Vendor employees comply with same.

c) Access Termination: The City reserves the right to limit or terminate any City network account at any time, in its sole discretion, to protect City information systems and data.

14) Vendor Remote Access System: Vendor shall ensure that all access, by employees or contractors, to the Vendor’s information systems, used to provide services or supply products to the City, require appropriate authentication controls, that, at a minimum, include:

a) Strong passwords/passphrases or multi-factor authentication for users;

b) Multi-factor authentication for all remote access; and

c) Maintaining an inventory of privileged accounts.

City Technology Rider (Contract Rider) Release v5_DRAFT

Data Custodian, Access, Ownership, and Security

15) Data Access: Vendor will provide access to receive and store raw data via City approved interfaces during the subscription or license period.

a) Data should include both structured and unstructured data.

b) These interfaces are typically Application Programing Interface (API) (i.e., REST), direct database access, or delimited files per Secure File Transfer Protocol (SFTP) transfer. Other mechanisms may be accepted at the written discretion of the City.

c) Access to data shall not be throttled or disabled without prior written approval and agreement from the City.

d) Data should always (24x7x365) be available at download speeds acceptable to the City.

16) Data Ownership: Data generated by the City (i.e. data entry), as well as unique data derived from City data, is owned solely by the City at all times. As such, Vendor shall not mine or share data, aggregated, itemized, or otherwise, with third party entities, without the prior written consent of City.

17) Encryption: Vendor shall ensure all Vendor laptops, mobile devices, and removable media owned by Vendor and Vendor’s employees, agents, representatives, and contractors that are used to store, process, or transport City identified restricted or sensitive organizational data are encrypted at all times. Encryption shall meet or exceed current industry standards and best practices.

18) Secure Disposal: Vendor shall ensure all Vendor media and technology that is used to store, process, or transport City data is disposed of in compliance with industry recognized disposal methods approved by City

System Acquisition, Development, and Maintenance

19) Security Requirements: Vendor shall ensure that information security requirements are defined for all new

Vendor information systems, whether acquired or developed.

20) Separation of Environments: Vendor shall ensure that Vendor development and testing environments are separate from its production environments.

21) Data Anonymization: Vendor shall not use City data in the development or testing of new systems unless the data is appropriately anonymized and prior written approval from the City is obtained.

22) Secure Coding: Vendor shall ensure that all Vendor applications are developed with secure coding best practices, such as the OWASP Top 10 Most Critical Web Application Security Risks.

Physical and Environmental Security

23) Risk Assessment: Vendor shall use a formal risk assessment methodology to identify physical and environmental threats to Vendor and implement controls to minimize the risks.

Information Protection Processes and Procedure

24) Hardening: Vendor shall develop and implement security configuration baselines for all Vendor endpoint and network device types.

25) Network Segregation: Vendor shall segregate the Vendor network into zones based on trust levels and control the flow of traffic between said zones.

26) Anti-Malware: Vendor shall ensure that all Vendor information systems that are susceptible to malware are protected by up-to-date anti-malware software.

27) Wireless Access Control: Vendor shall ensure that the Vendor’s wireless network access is protected, including, at a minimum:

City Technology Rider (Contract Rider) Release v5_DRAFT

a) All wireless network access should be encrypted;

b) All wireless network access to the production network should be authenticated using multi-factor authentication, such as machine certificates; and

c) Wireless network access for personal devices and guest access should be segregated from the production network.

28) Patching: Vendor shall evaluate, test, and apply patches to Vendor information systems in a timely fashion, according to their risk.

29) Disaster Recovery: Vendor shall create, maintain, and exercise tools, techniques, and procedures to enable the recovery and/or continuation of service in the event of an unexpected disaster (environmental, man-made, cyber-attack, or other). This includes, but is not limited to, a backup and recovery process designed to ensure that the Vendor’s data and City’s data can be promptly recovered within documented recovery point objectives (RPO) in the event of an unexpected loss.

Protective Technology

30) Logging: Vendor shall ensure that security event logging requirements have been defined and that all of

Vendor’s information systems are configured to meet logging requirements.

31) Intrusion Detection: Vendor shall deploy intrusion detection or prevention systems at the Vendor’s network perimeter.

32) Denial of Service Protection: Vendor shall deploy a control to detect and mitigate denial of service attacks against Vendor networks and information systems used to provide services to the City.

Security Continuous Monitoring

33) Security Monitoring: Vendor shall deploy automated tools to collect, correlate, and analyze security event logs from multiple sources, and monitor them for suspected security incidents on Vendor networks and information systems used to provide services to the City.

34) Vulnerability Assessments: Vendor shall conduct vulnerability assessments against all Vendor internet-facing information systems on a regular basis.

35) Penetration Testing: Vendor shall perform penetration tests on all vendor web applications and services used to provide services to the City, in accordance with standard penetration testing methodologies, on a regular basis, no less often than annually.

Artificial Intelligence (AI) or Machine Learning (ML)

36) Security Features: Vendor shall ensure security controls are enabled to prevent City data leakage to AI or

ML systems. The Vendor shall also ensure prevention measures are in place to minimize impacts from adversarial machine learning.

37) Vendor shall ensure that there are proper technical and human security controls in place that prevent AI/ML misuse.

38) Management of AI/ML platform: Vendor staff must undergo annual training to protect the AI/ML platform.

The Vendor must establish and maintain procedures to enhance the quality of AI/ML platform outputs, including appropriate human oversight to minimize errors and bias.

39) The Vendor shall adhere to a framework, such as ISO/IEC 42001:2023 or NIST AI Risk Management Framework (RMF), to ensure trustworthiness is integrated into the design, development, deployment, management, and utilization of AI systems.

Cyber Insurance

City Technology Rider (Contract Rider) Release v5_DRAFT

40) A Technical Errors & Omissions policy is required. For details on policy requirements see Section 4 of the City contract.

Information Security Incident Management

41) A Cybersecurity Incident is defined as: An event that, without lawful authority, jeopardizes, disrupts, or otherwise impacts, or is reasonably likely to jeopardize, disrupt, or otherwise impact, the integrity, confidentiality, or availability of computers, information, or communications systems or networks, physical or virtual infrastructure controlled by computers or information systems, or information residing on the system.

42) Incident Response: Vendor shall develop, implement, and maintain an information security incident response process and will test the process on a regular basis, no less often than annually.

43) Data Breaches: Vendor shall provide written notice to the City of any unauthorized access, acquisition, or disclosure of City data or information systems. Additionally, the Vendor shall provide written notice to the City of any unauthorized access or acquisition of Vendor information systems that could negatively impact CIA of City data or operations.

44) Vendor acknowledges and understands that it will have access to City’s confidential information (“Confidential Information”) under this Contract, including, but not limited to, personally identifiable information (PII), employee health information, financial information, and other sensitive and restricted information. Vendor agrees, warrants, and guarantees that it will protect all Confidential Information and shall not disclose the Confidential Information to any party other than City. All Confidential Information shall be kept strictly confidential by Vendor. Vendor shall not directly or indirectly disclose, publish, communicate, or make available Confidential Information, or allow it to be disclosed, published, communicated, or made available, in whole or part, to any third-party entity or person, except with the prior written consent of City. Vendor, its employees, agents, and contractors shall not access or use any Confidential Information, and shall not copy or remove any documents, records, files, media, or other resources containing any Confidential Information, in a manner inconsistent with this Contract. Nothing in this Contract shall be construed to prevent disclosure of Confidential Information as may be required by applicable law or regulation, or pursuant to the valid order of a court of competent jurisdiction or an authorized government agency. Vendor understands and acknowledges that its obligations under this Contract with regards to any Confidential Information shall commence immediately upon Vendor first having access to such Confidential Information and shall continue until such time as such Confidential Information has become public knowledge.

45) All City owned data and Confidential Information shall be secured by Vendor in a manner at least as stringent as that used by City. All City owned data and Confidential information shall be maintained and secured by Vendor in accordance with all federal, state, and local laws, including, but not limited to, the Health Insurance Portability and Accountability Act (HIPAA) and Criminal Justice Information Services (CJIS) regulations. Upon termination or expiration of this Contract, at City’s option,

46) Vendor shall protect all City Confidential Information from unauthorized access, use, modification, disclosure, or destruction. In accordance with C.R.S. § 24-73-102 and C.R.S. § 6-1-713.5, Vendor shall implement and maintain reasonable security procedures and practices that are: (a) appropriate to the nature of the personal identifying information disclosed to Vendor; and (b) reasonably designed to help protect the personal identifying information from unauthorized access, use, modification, disclosure, or destruction. Vendor shall have primary responsibility for implementing and maintaining said security procedures and practices. Vendor shall be solely liable for any security breach and will comply with all provisions of C.R.S. § 6-1-716 and C.R.S.

§ 24-73-103 and provide all required notices.

47) Cybersecurity Incident and Data Breach Reporting:

a) The Vendor shall provide notice, in accordance with Subsection (b) of this section, to the City within eighteen (18) hours of becoming aware of any security breach that has or may negatively impact City

City Technology Rider (Contract Rider) Release v5_DRAFT data and/or information systems in order to allow the City to meet required Federal and State reporting requirements.

b) Reporting delivery shall be made verbally and in writing to the City’s Chief Information Security Officer (CISO). The following reporting methods must both be executed:

i) Encrypted electronic mail with a Subject line of “COCS Breach Notification” sent to:

ITCyberSecurity@ColoradoSprings.gov; and

ii) Voice call to the IT Service Desk: 719-385-5831.

c) In the initial report, the following minimum data shall be provided:

i) Details that caused the incident/breach;

ii) Whether the incident/breach involved City data exposure, scanning, exfiltration, destruction/modification, or other misuse or misappropriation of City data of any classification;

iii) The amount and nature of the City data involved in the incident/breach;

iv) The entity, if known, that gained access to City data or information systems; and

v) The initial plan to contain and eradicate incident/breach.

d) In Follow-up and Closure reports, the following minimum data shall be provided:

i) Any updated details to the information provided in the initial report;

ii) Validation that the incident/breach has been confirmed actual, false positive, or benign;

iii) Updated containment, eradication, and resolution plans; and

iv) Final root cause analysis (RCA) and documented impact to the City.

Payment Card Industry (PCI) Data Security Standard (DSS) Compliance:

(NOTE: Only applies when vendor is to provide financial transactions services for or on behalf of the City in the execution of activities during the term of service.)

48) Vendor solutions shall be fully compliant with the PCI DSS, with no requirement for the City to implement any PCI DSS controls. If installed on City networks or infrastructure, the Vendor solution shall be PCI DSS Point-to-Point Encryption (P2PE) compliant.

49) Report of Compliance (RoC): For all solutions that are consumed without any City responsibility to implement PCI DSS controls, Vendor shall provide City Finance with a RoC. The RoC shall be sent to:

a) City Finance at: accountants@coloradosprings.gov.

b) Questions or follow-up delivery confirmation can be called into 719-385-5224.

50) Self-Assessment Questionnaire (SAQ): In the event the City is required to provide any PCI DSS required SAQ in relation to Vendor’s solution, the Vendor shall support the completion of the SAQ where applicable.

Vulnerability and Audit Mitigation

51) The City reserves the right to request audit results or the attestation that specific audits have been conducted and mitigation actions have been completed. For open findings, the City reserves the right to request attestation that the findings have proper mitigation controls in place or a resolution roadmap.

52) For applicable vulnerabilities released as a common vulnerabilities and exposures (CVE) 10, an emergency directive from the DHS Cybersecurity and Infrastructure Agency (CISA), or product vendor “Patch Now” recommendation, Vendor shall provide a statement of resolution or an executable mitigation plan within thirty

(30) calendar days of the CVE or CISA release.

City Technology Rider (Contract Rider) Release v5_DRAFT

Contract completion or termination

53) Within thirty (30) calendar days of contract expiration or termination, the Vendor shall deliver to the City, a signed attestation that the following actions were completed:

a) Vendor shall return all City data to the City in a structured and secured digital format compatible with City information systems and technology standards.

b) Vendor shall delete all City technology credentials retained in or stored in any Vendor-owned systems upon expiration or termination of City contract.

c) All connections made to the City network or information systems shall be terminated upon expiration or termination of City contract.

d) All City data residing on any Vendor owned system is fully and completely removed and returned to the City or destroyed beyond restoration with industry standard destruction practices.

Exception Requests

- Depending on Vendor provided justification, some requirements herein may be reserved by City.

- Vendor may provide a written request for City review and submit a change request to City Procurement to start the review and exception process. If approved, changes will be made and accepted by incorporating approved changes into the final signed and executed contract.