RFP_1100_LLM3008_ATT_10_v1.docx

Title, Rev # Date

Appendix: AE Consultant/Vendor Acceptable Use Policy Rev 0 | 10/26/09

Appendix: AE Consultant/Vendor Acceptable Use Policy Rev 11 | 2/11/22

Network Connection Agreement Austin Energy Network and Systems Access

PART I

This Network Connection Agreement for Network and Systems Access (“Agreement”) is entered into as of [ENTER MONTH, DAY, YEAR] (the “Effective Date”), by and between AUSTIN ENERGY, the Electric Utility Department of the City of Austin (“Austin Energy”) and [ENTER COMPANY NAME] (“Consultant” or “Company”).

Part II of this Agreement sets forth the terms and conditions under which Austin Energy is willing to permit Consultant access to Austin Energy’s corporate computer network (the “Network”) and one or more Austin Energy information and computer systems (the “Systems”).

Austin Energy has, at substantial cost, developed the Network and Systems to provide information services to itself and other City of Austin departments. The Network and Systems perform vital functions for these departments. The unwarranted or unauthorized access or use of the Network or Systems could put Austin Energy and these departments at significant risk of damage, including power plant power outages, interruption of electric utility service, interference with statewide power grids, danger to life and property, destruction of data, and the unwanted disclosure of sensitive or private information.

Consultant (and/or its subcontractors) has requested access to some or all of the Austin Energy Network and Systems, to facilitate the performance of its obligations to Austin Energy relative to the following project or contracted service:

[ENTER PROJECT OR SERVICE NAME]

For the purpose of clarification, the terms of this Agreement apply to the Consultant’s access or Consultant’s subcontractors’ access to Austin Energy via Anywhere Outside Connect (AOC). “Consultant” includes Consultant’s subcontractors wherever that term is used in this Agreement.

Austin Energy is willing to permit such access based on the level of risk to Austin Energy’s physical and information assets and Consultant’s assurance that it will abide by the terms and conditions as defined in Part II of this Agreement.

Network Connection Agreement Austin Energy Network & Systems Access PART II: Terms and Conditions

1. Scope of Access Consultant shall use this access to the Network and Systems solely for the purpose of performing services associated with the project or contract at Austin Energy as specified in Part I of this Agreement. Consultant shall limit its access to the means and method approved by Austin Energy, as further described below in Section 6, Specific Connections.

Austin Energy may terminate or otherwise curtail Consultant’s access to the Network or Systems at any time without notice to Consultant. However, Consultant will be relieved of any obligation to perform implementation or services as required by Austin Energy to the extent the termination was without cause, and access by Consultant was necessary to perform such obligation.

Consultant shall comply with the terms and conditions set forth in this Agreement, and with any security procedures, guidelines or alerts issued by Austin Energy from time to time. Austin Energy may, upon written notice to Consultant, require modification or supplementing of any of the terms and conditions contained in this Agreement, and Consultant agrees to abide by those terms.

The complete, working computer. Includes not only the computer, but also any software and peripheral devices that are necessary to make the computer function.

Information System

The business application that operates on a computer system. Includes the database, application programs, and machine procedures.

3. Consent to Monitoring Austin Energy may monitor and record any access to the Network and Systems at any time without notice to Consultant. Consultant consents to this monitoring and recording, and Consultant will ensure that all persons obtaining access to the Network and Systems through Consultant consent to this monitoring and recording.

Consultant shall limit access to the Network and Systems to those employees of Consultant (“Consultant Personnel”) who need to have such access. Consultant shall provide a copy of this Agreement to all Consultant Personnel requiring remote access and shall require each person to review and sign the individual Consultant Remote Access Request form acknowledging such. Consultant agrees it shall be entirely responsible for the acts and omissions of any person to whom it authorizes access.

Austin Energy may elect to issue a personal Login ID and security token to authorized Consultant Personnel to be used during login. Consultant Personnel assigned a token are responsible to keep said token secure. Only the authorized individual is permitted to use his or her assigned Login ID and token passcode.

Austin Energy may request the return of the token at any time. A fee of $100 will be paid by the Consultant if the token is not returned or, upon return, is not in working order.

4.2.2 Shared Token Login IDs

Austin Energy may assign a shared Login ID to a pool of Consultant Personnel who are authorized to access Austin Energy Systems for the purpose of intermittent technical support. A shared security token for the Consultant Personnel shall be issued to an authorized Austin Energy contact, who shall serve as the token custodian. Consultant must contact the Austin Energy token custodian in order to gain a passcode for single session access.

4.3 Consultant Systems

Consultant shall be responsible for all systems that Consultant uses to access the Network and Systems. Consultant shall ensure that its systems include up-to-date antiviral software reasonably acceptable to Austin Energy to prevent viruses from reaching the Network and Systems through Consultant’s systems. Consultant shall take reasonable precautions to prevent unauthorized access to the Network and Systems through Consultant’s systems.

Consultant assumes full responsibility for any systems it uses to access the Network or Systems, notwithstanding a specification or direction from Austin Energy. Consultant is expected to back up its own files, maintain firewalls, and take such other precautions as will minimize the impact of any malfunction or computer error on its own systems.

4.4 Notice of Breaches

Consultant shall IMMEDIATELY notify Austin Energy upon learning of any security breach by contacting the Austin Energy Technology Control Center at (512) 322-6077 and the Austin Energy contact person identified in the Agreement (by phone or e-mail). Consultant shall communicate the nature of its access and the nature of the security breach. In addition, Consultant shall, within 24 hours of the security breach, notify the Austin Energy contact person by written notice as described in Section 8, Notices and Contacts.

As used in this Section 4.4, the term “security breach” means any actual or threatened unauthorized access to the Network or the Systems, or to the details or specifications that would enable another individual to gain access, or to any information or data obtained during access. By way of examples, (1) knowledge that a specific Login ID has been published or otherwise made available to an unintended recipient constitutes a security breach, or (2) knowledge that an individual might have copied Austin Energy files, without the express permission of Austin Energy, or that an individual might have used access to the Network or Systems for any purpose other than that described in Section 1, Scope of Access, constitutes a security breach.

Consultant shall cooperate fully with Austin Energy to investigate any security breach and to take such steps as to minimize the impact thereof.

4.5 Third-Party Software

Access to the Network and Systems may involve access to software or other technology licensed by Austin Energy or other City departments from third parties. Consultant will use such software or technology for the sole purpose described in Section 1, Scope of Access, and shall comply with all restrictions applicable to that software and technology.

4.6 Transmission of Harmful Material

Consultant will not transmit nor permit the transmission of any unlawful, threatening, libelous, defamatory, obscene, scandalous, inflammatory, pornographic or profane material through the Network and Systems. Consultant acknowledges that Austin Energy intends to cooperate fully with law enforcement, regulatory, or judicial investigations of any access to the Network and Systems. This cooperation can include disclosure of the identity of, and the information transmitted or received by, persons accessing the Network and Systems.

4.7 Security Audits

In addition to, and without limiting, any rights contained in the Agreement, Austin Energy, at its sole expense, may conduct security audits of Consultant’s access and of any Consultant systems that have access to the Network and Systems. These audits can include (1) an inspection of Consultant’s systems and environment, (2) a review of Consultant’s security procedures, and (3) an execution of security tests to verify system integrity. Consultant will immediately resolve any material issues identified through these audits.

4.8 Removal of Data

Consultant shall not retain copies of any data or information (including Third-Party Software) obtained from access to the Network and Systems, except as expressly permitted by Austin Energy in writing. Upon Austin Energy’s request, Consultant shall promptly return such data and information to Austin Energy or destroy it as directed by Austin Energy, and so certify the same to Austin Energy in writing.

4.9 Confidentiality

All details, specifications, and other information regarding Consultant’s access to the Network and Systems, including, but not limited to, all Login IDs and any information obtained as a result of access to, the Network and Systems, shall be deemed “Confidential Information” of Austin Energy.

Consultant agrees that it will not use, disclose, publish, or otherwise divulge to any third party either during or after the termination of this Agreement or permit its officers or employees to so divulge any Confidential Information of Austin Energy without prior written consent of Austin Energy. Consultant shall employ no less stringent procedures than the procedures used to protect its own confidential data. If disclosure to a third party, such as an auditor, is required, the third party is required to first sign a confidentiality agreement with the owner of the confidential information.

5. Disclaimer ACCESS TO THE NETWORK, THE SYSTEMS AND ANY SOFTWARE OR EQUIPMENT PROVIDED THEREWITH IS PROVIDED “AS IS” WITHOUT ANY WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. Nothing in these terms and conditions shall be construed as granting Consultant a right of access to the Network or Systems, a right to access the premises of Austin Energy, or a right to use any software or equipment provided therewith without express permission from Austin Energy.

Consultant agrees that it or any of its associated affiliates, subsidiaries, or subcontractors is prohibited from directly accessing or connecting to the Network from any non-U.S.-based remote access or connection point, and agrees any such connection constitutes an immediate violation of this Agreement such that Austin Energy shall immediately sever any such access without liability or legal exposure of any sort.

Unless otherwise authorized by Austin Energy, all remote access for support or monitoring purposes shall go through Austin Energy’s secure corporate remote access solution.

All access to the Network and Systems shall be strictly limited, both physically and technologically, to that which is necessary to perform the permitted tasks.

6.2 Conditions for Cyber Security Adherence

Consultant agrees to comply with Austin Energy Consultant/Vendor Acceptable Use Policy (attached as Appendix) and any other mutually agreed upon cyber security requirements defined in this Agreement or other contract.

Consultant is responsible for implementing antivirus software and updating virus signatures on a regular basis (at least monthly) and for implementing applicable system security software updates. Such updates shall be applied within a reasonable period after software release, availability or written notification, not to exceed 30 days. In the event of serious network security incident or breach deemed by Austin Energy Information Security, Consultant may be required to immediately apply updates or to disconnect from the Network at Austin Energy’s request.

Consultant shall immediately notify Austin Energy, as described in Section 4.4, upon discovery of any security incident. Security incidents include but are not limited to, virus, network intrusion, or other event on Consultant’s computer network that could affect the Network or system or data contained therein. During such incidents, Consultant shall immediately disconnect the computer network connection, either at the request of Austin Energy or as Consultant deems appropriate to protect the Network, the Systems, or data.

7. Delegation of Authority Consultant Executive shall delegate a Consultant Delegated Agent who shall be responsible for reviewing and approving individual Consultant Personnel requests for remote access as defined in this Agreement. All Consultant Personnel connections are subject to Austin Energy consent, and subject to continued compliance with this Agreement.

The Consultant Executive or Delegated Agent may designate a replacement by providing written notice to the Austin Energy contact named in this Section 8, Notices and Contacts.

8. Notices and Contacts Unless otherwise provided above, all notices and contacts regarding remote access to the Network or Systems shall be made to the following:

If to Austin Energy:

Austin Energy 721 Barton Springs Rd Austin, Texas 78704 Attn: Michael Goin E-mail: Michael.Goin@austinenergy.com

(512) 322-6076 If to Consultant:

[Consultant Company name] [Company Address] [City, State Zip] Attn: [Consultant Delegated Agent] E-mail: [xxxxxxx@xxx.com] [(area) xxx-xxxx] All written notices must be delivered by hand-delivery, nationally recognized overnight courier, or U.S. mail and sent in a manner that provides confirmation of receipt. Where immediate notice is specifically required, notices shall be communicated first by telephone and followed up by e-mails, and then by written notice.

Either party may change its contact by providing written notice to the other using the above contact information.

9. Survival; Miscellaneous This Agreement and its provisions shall survive the expiration or termination of the project implementation or contracted service for so long as necessary as to carry out the intent of this Agreement. No act or omission on the part of Austin Energy shall be construed as a waiver of the terms and conditions contained in this Agreement unless in writing signed by Austin Energy, and no waiver in any particular instance shall act as a waiver in any future instance unless so stated in the writing.

Network Connection Agreement 2 of 7 Form revision 11: 2/11/22 Appendix to Network Connection Agreement Austin Energy Consultant/Vendor Acceptable Use Policy 1 Purpose The purpose of this policy is to establish guidelines and minimum requirements governing the acceptable use of Austin Energy (AE) information technology resources and remote access connections provided to vendors and consultants as part of a contract agreement.

This policy is in addition to any mutually agreed upon cyber security requirements as defined by contract or connection agreement.

2 User Responsibilities

2.1 Be accountable for all activity conducted under the user’s login or e‑mail account.

2.2 Take all reasonable precautions to prevent the unauthorized use of workstations and laptops by unauthorized individuals.

2.3 Lock the keyboard or use a password-enabled screen saver whenever you leave your workstation or laptop to protect your account from unauthorized access.

2.4 Ensure up-to-date virus protection is installed and activated on any information technology system that is connected to the AE information technology systems.

2.5 Communicate data security needs of information under your purview to your AE Customer Relationship Manager or Project Manager.

2.6 Save all AE business data to authorized AE drives or AE-approved disk storage.

2.7 Follow all security requirements as specified in the contract and/or connection agreement approved by AE and the authorized consultant/vendor company representatives.

2.8 Use information technology resources efficiently and productively.

2.9 Do not download and/or install non-authorized software on AE information technology resources.

2.10 Be courteous and follow accepted standards of etiquette for e-mail communication.

3 General Statement of the Policy

3.1 The use of AE Internet, e-mail and information technology systems must be related to, and for the benefit of City of Austin government and\or AE business.

3.2 All on-line communications, such as e-mail messages (and attachments) and postings to various on-line discussion groups and forums, are subject to the same laws, regulations, policies, and other requirements as information communicated in other written forms and formats. This includes proper business correspondence practices and other appropriate use policies for AE equipment and systems.

3.3 Network resources must be used responsibly to avoid creating a negative impact on others who share those same resources (see section 4.7 Resource Considerations).

4 Implementation

4.1 Security

4.1.1 Because the Internet and its tools adhere to open and documented standards and specifications, it is inherently an unsecured network that has no built-in security controls.

4.1.1.1 Avoid including confidential and sensitive information in e-mail and on-line communications unless proper, formalized security precautions have been established and are used (such as, encryption).

4.1.1.2 Protect privileged or confidential information whenever intentional, inappropriate, or accidental disclosure of the information might expose AE or an individual to loss or harm.

4.1.2 Protect your password. Passwords must not be shared with anyone, including managers.

4.1.3 Authorized AE information technology staff reserve the right to access your password information and change it through legitimate means for business or security reasons.

4.1.4 Remote access connections shall be through Secure Shell (SSH) that provides encryption to protect the transferred information and authentication that the target remote system is correct. Telnet use for remote access is prohibited.

4.2 Privacy

Users acknowledge that they have no legitimate expectation of privacy when using AE resources as follows:

4.2.1 All electronic files and data developed under contract are the property of AE, regardless of their physical location or the form in which they are maintained. These files and data may be used, stored and disclosed at AE’s discretion.

4.2.2 Internet usage, e-mail, or other forms of electronic messaging are not considered personal or private when using AE resources.

4.2.3 AE has the right to access and disclose all messages, attachments, and other electronic data sent or received over the AE electronic mail system or stored in its files.

4.2.4 Any e-mail and attachments sent from or received under an AE e-mail account can be public records and are subject to the mandatory public disclosure requirements of the Texas Open Information Act, unless excepted by the Act.

4.2.5 AE ITT staff routinely monitors every connection to the Internet (including e-mail, Websites, and instant messaging) to ensure compliance with this policy.

4.3 Acceptable Use

Acceptable uses of computer resources are those that conform to the purpose, goals, and mission of AE, to each user's job duties and responsibilities according to contracted services between AE and the consultant or vendor. The following list, although not all-inclusive, provides some examples of acceptable uses:

4.3.1 Accessing computer systems and resources to perform work required to fulfill contractual obligations

4.3.2 Communications and information exchanges directly relating to the mission, charter, and work tasks of AE including e-mail in direct support of work-related functions or collaborative projects.

4.3.3 Communications with vendors of products used or being considered for use by AE, either to investigate use of their product or to receive help in using their product.

4.3.4 Research and information gathering in support of AE.

4.4 Unacceptable Use

Unacceptable use can be defined as activities that do not conform to the purpose, goals, and mission of AE and to each user's job duties and responsibilities as contracted between AE and the consultant or vendor. Any questionable computer usage should be avoided. When in doubt, seek clarification with AE management prior to pursuing the activity.

AE computers, e-mail, and/or Internet or remote access connections cannot be used to perform any of the following activities:

4.4.1 Seek or gain unauthorized access to AE or City of Austin network resources or Internet or intranet resources. Provide a means of unauthorized access to any AE or City of Austin resources.

4.4.2 Destroy the integrity of computer-based information.

4.4.3 Compromise the privacy and/or security of users.

4.4.4 Disrupt the functions of AE and/or City of Austin networks or other computer resources, including, but not limited to, propagation of worms or viruses or other debilitating programs.

4.4.5 Circumvent legal copyrights or trademarks or participate in their infringement.

4.4.6 Conduct or promote commercial or private/personal business enterprises or products.

4.4.7 Support or solicit on behalf of groups, organizations, or such that are not related to AE or City of Austin or engage in political lobbying.

4.4.8 Transmit unsolicited commercial information (such as junk mail or advertising). Issue or propagate unsolicited e-mail or bulk e-mail.

4.4.9 Listen to, view, or download audio or video files for entertainment or leisure activities unless authorized by the appropriate AE project manager or supervisor.

4.4.10 Transmit material that may be deemed offensive to its recipient. View, transmit, or receive sexually explicit material. Advocate racial, ethnic, religious, or gender-based slurs.

4.4.11 Threaten or harass others. Contribute to the harming of minors.

4.4.12 Conduct or participate in illegal or fraudulent activity. Commit forgery or impersonation.

4.5 Remote Access

4.5.1 Remote access is a privilege, not a right. Any violation in its use can result in access being terminated.

4.5.2 Do not share connection information, such as passwords, phone numbers, encryption keys or software, with anyone.

4.5.3 Follow all Terms and Conditions of the Network Connection Agreement approved by AE and the authorized consultant/vendor company representatives.

4.6 Wireless Network/Access

4.6.1 Wireless connections to the AE network are expressly prohibited unless sanctioned by AE Information Technology Infrastructure Management.

4.6.2 Wireless home networks are not allowed to be connected to AE's network.

4.7 Resource Considerations

The following policies relate to activities that can negatively affect network performance and resources:

4.7.1 Only approved staff within AE are permitted to broadcast messages to all AE employees at once. Contact the AE Technology Control Center if such notifications are needed.

4.7.2 Delete unnecessary messages and attachments on AE e-mail accounts, according to AE record retention requirements. Contact the AE Records Coordinator for the appropriate workgroup for more information.

4.7.3 Whenever possible, avoid sending e-mails with 100kb or larger document attachments. For internal correspondence, when possible, place the document in a shared location and link it in the e‑mail. For external correspondence, it is preferable to use FTP to transfer large files.

4.7.4 Limit downloading large files to a time after normal business hours at both local time and the time at the remote site. Users must be knowledgeable about the network and desktop resource requirements for the transfer.

4.7.5 Only subscribe to very active mailing lists, discussion groups or news groups if absolutely necessary to support a job duty or assignment. A high volume of messages can impact your time, network resources, and file storage requirements.

4.7.6 Avoid downloading music or videos to AE’s resources for entertainment purposes. These programs can have virus, copyright and bandwidth issues.

Information Technology & Telecommunication © AE – All Rights Reserved 1 For AE Internal Distribution Only

image1.png