RFP_1100_LLM3009_ATT_9_v1.pdf

Austin Energy Data Handling Controls Rev 2.2 | March 24, 2025

Information Technology © Austin Energy – All Rights Reserved 1

Rev. No.: 2.2 Date: March 24, 2025

Owner: Enterprise Information Security Category: Information Security

Author: Steven Trevino, Patrick Jordan SME: Michael O’Connell, Patrick Jordan, AE Risk Management, AE Legal

Doc Type: Contract Exhibit

CONTENTS

Contents

1. Data Handling Controls: Security Directives and Requirements

1.1. Contractor Responsibilities regarding treatment of City Data

1.2. Location Parameters

1.3. Specific Security Directives

1.4. Data Disposition

1.5. General Compliance Requirements

1.6. Logging/Auditing Requirements

1.7. Media Reuse

1.8. Security

2. Data Handling Controls: Additional Compliance Requirements

2.1. Contractor Practices

2.2. Security Incident Reporting Procedures

2.3. Remediation

2.4. Recovery

2.5. Lessons Learned

3. Definitions

2 Information Technology © Austin Energy – All Rights Reserved

1. DATA HANDLING CONTROLS: SECURITY DIRECTIVES AND

REQUIREMENTS

1.1. Contractor Responsibilities regarding treatment of City Data

1.1.1. The City requires that controls (“Data Handling Controls” or “DHC”) be in place to manage risk to the confidentiality, integrity and availability of City Data, categorized as Public, Non-Public, and Restricted in any form in the care, custody or control of Contractor. These Data Handling Controls represent a minimum acceptable standard for protection. Additional controls required under applicable laws, regulations, or standards governing specific forms of data (e.g., health information, credit cardholder data) may also apply.

1.1.2. Contractor agrees to comply with these Data Handling Controls in performing the Services (including information technology-based Services) and in providing the deliverables under the Contract. Contractor accepts all responsibility and liability for the Confidentiality, Integrity and Availability of all City Data in its custody or control, including but not limited to when City Data is received, transmitted, processed, stored, backed up, archived, returned, or as occurs otherwise during performance of Services, including that involving a subcontractor. Contractor agrees that any damages or liability arising from any violation of these Data Handling Controls, including damage to City Data as well as all work to restore City Data and its integrity, are Contractor’s responsibility.

Contractor agrees that compliance with these Data Handling Controls is not an affirmative defense to any losses, disclosures, corruption or other damage to City Data which may occur for which Contractor is responsible, as Contactor acknowledges and agrees that there may be situations for which the Data Handling Controls may be inadequate to reasonably protect City Data as a project matures during the term of the Contract, and Contractor agrees to use appropriate additional measures in its reasonable judgment to protect City Data in such situations.

1.2. Location Parameters

1.2.1. The authorized geographical data center region for the storage and processing of

City Data under this Contract is the contiguous United States.

1.2.2. Contractor may utilize non-US based personnel by request and at the discretion of the City, who have passed a background check and are legally authorized to work in the United States.

1.2.3. Contractor must ensure that City Data cannot be stored, viewed, downloaded, or transported outside the contiguous United States.

Information Technology © Austin Energy – All Rights Reserved 3

1.3. Specific Security Directives

1.3.1. To access City Data, Contractor must grant an Authorized Person only the minimum rights necessary to fulfill contractual duties, in accordance with the Principle of Least Privilege.

1.3.2. Unless otherwise approved by the City in advance, in writing, Contractor must encrypt all City Data using current Industry Standards. Only an Authorized Person may view unencrypted City Data.

1.3.2.1. Contractor must have in place, policies and controls that prohibit the unauthorized viewing, exporting, copying, modification, or destruction of any unencrypted City Data (including any image). Contractor must not make unencrypted City Data, in any form, available to any unauthorized person unless approved by the City in advance in writing.

1.3.3. Unencrypted City Data may not be stored on any Contractor or Subcontractor Endpoint Device; however, in the case of an exception the following apply:

1.3.3.1. The Contractor agrees to have in place policies and controls governing the use of Endpoint devices strictly designed to satisfy the terms of the service agreement.

1.3.3.2. Any authorized endpoint device containing City Data must be connected to a system capable of remote erasure of all City Data contained on the endpoint, and/or remote deactivation. The Contractor will have the ability to remotely deactivate and/or erase the City Data contained on these devices at the City’s request.

1.3.3.3. The Contractor shall employ multi-factor access control methodologies on all authorized Endpoint Devices to uniquely identify user accounts and have the capability to log and store user activity.

1.3.3.4. If any authorized Endpoint Device is lost, stolen or otherwise removed from Contractors physical control, Contractor shall immediately delete the City Data contained on the Endpoint Device and deauthorize or deactivate the Endpoint Device by remote means. The contractor shall notify the City PM within 2 business days of the Endpoint Device reported missing. The notification shall include the following information:

1.3.3.4.1. Serial and/or Unit number,

1.3.3.4.2. Last User,

1.3.3.4.3. All activity in the 24 hours prior to reported missing,

1.3.3.4.4. Last known location, 4 Information Technology © Austin Energy – All Rights Reserved

1.3.3.4.5. Confirmation of City Data deletion operation,

1.3.3.4.6. Confirmation of Deauthorization operation,

1.3.3.4.7. Confirmation of Deactivation operation and,

1.3.3.4.8. Any endpoint activity after reported missing

1.3.4. Contractor must have in place its own internal security program that includes policies using applicable industry best practices designed to ensure the Confidentiality, Integrity and Availability of City Data. Contractor will provide documentation of these policies and procedures within ten business days of written request by the City.

1.3.5. Contractor must detach all removable storage media containing City Data from any device when not in use and store the media in Contractor’s physically-secure location.

1.3.6. Contractor must ensure that only an Authorized Person may access devices containing City Data.

1.4. Data Disposition

1.4.1. Contractor agrees to return all City Data obtained under this Contract (including this Document) or otherwise in its care, custody or control to the originating City department, and to delete any remaining copies from Contractor’s storage/production/use/possession at the end of the engagement, including:

1.4.1.1. as stated in any scope of work and/or

1.4.1.2. at City’s request, or upon

1.4.1.3. Contractor’s failure to follow the compliance directives of this Data Handling Controls document.

1.5. General Compliance Requirements

1.5.1. Contractor’s failure to comply with any provision of these Data Handling Controls is a material default under the Contract.

1.5.2. Contractor agrees that City or its authorized representatives may audit or review Contractor’s compliance with these Data Handling Controls under Contract section 1.7, AUDITS AND RECORDS, security audit. Except in an emergency (including a Breach or Security Incident), such audit or review shall be conducted only during normal business hours and without disrupting normal business practice, and City shall provide reasonable advance notice of exercising its right of audit or review.

Audits or reviews may include, but are not limited to:

Information Technology © Austin Energy – All Rights Reserved 5

• system, security, application, operating system, and database logs;

• physical access logs at all data centers;

• Endpoint Device compliance;

• data center location or ownership changes;

• access control procedures;

• procedures for the physical and digital destruction of media;

• environment changes that have the potential for outages;

• workplace inspections for compliance with these Data Handling Controls and review of any Vendor supplied documentation submitted to document/demonstrate compliance; and

• procedures for and evidence of routine testing and updating of systems to prevent attacks.

1.6. Logging/Auditing Requirements

1.6.1. Contractor must create system, security, application, operating system, and database logs:

1.6.1.1. when Contractor creates, reads, updates, or deletes City Data;

1.6.1.2. at user authentication and authorization, including failed access attempts;

1.6.1.3. for user login and logout;

1.6.1.4. when Contractor grants, modifies, or revokes access rights, privilege levels, and permissions, firewall rules, and user passwords;

1.6.1.5. when Contractor makes any system, network, or services configuration changes, including installation of software patches and updates, other installed software and operating system changes.

1.6.1.6. if contractor detects suspicious or malicious activity, such as from an Intrusion Detection or Prevention System (IDS/IPS), anti-virus system, or anti-spyware system.

1.6.2. Contractor will retain system activity logs (and make all such logs available to City) for a period of three years after final payment on this Contract, or three years after all forensic, audit and litigation matters are resolved, whichever is longer.

6 Information Technology © Austin Energy – All Rights Reserved

1.6.3. Contractor will review all relevant security logs for anomalies for potential Security Incidents and forensic analysis.

1.7. Media Reuse

1.7.1. Contractor must promptly Securely Erase all City Data from any permanent or non-volatile storage media:

1.7.1.1. once immediate use of such media is no longer necessary,

1.7.1.2. at City’s request, or

1.7.1.3. within 30 days of termination of the Contract.

1.7.2. For all endpoint and mobile devices containing City Data, Contractor agrees to utilize full disk encryption with pre-boot authentication methodologies to ensure all City Confidential Data is encrypted at rest.

1.7.3. Contractor shall Securely Erase all City Data by destructively overwriting all City Data to ensure that even deleted files cannot be recovered from the media.

Contractor shall provide a written attestation to the City PM, detailing the specific data destruction method(s) used, including any tools or standards followed (e.g., NIST 800-88, DoD 5220.22-M), and confirming that all City Data has been irretrievably destroyed.

1.8. Security

1.8.1. City retains ownership over all City Data.

1.8.2. Contractor must use industry best practices for encryption of City Data at rest and in transit.

1.8.3. Contractor will ensure that all electronic and physical access to City Data is secured. Contractor must verify the identification, authentication, and authorization of each user and their specific role and access level, and Contractor must immediately block all physical and electronic access to City Data for any terminated employee.

1.8.4. Contractor must use due diligence to evaluate and respond to potential Security Incidents and events that create suspicions of unauthorized disclosure, modification, or destruction of City Data. The response must maintain or restore the confidentiality, integrity, and availability of the environment(s) compromised or potentially compromised, and establish root causes and remediation steps and determine the nature and extent of the event. If Contractor determines that there has been a Security Incident involving City Data, Contractor shall report such Security Incident to the City PM within four (4) hours of determination.

Information Technology © Austin Energy – All Rights Reserved 7

1.8.5. Upon written request, Contractor shall make its then current key management policy for encryption keys and certificates available to the City within 10 business days.

2. DATA HANDLING CONTROLS: ADDITIONAL COMPLIANCE

REQUIREMENTS

2.1. Contractor Practices

2.1.1. In addition to any other requirements of these Data Handling Controls, Contractor agrees it shall maintain and enforce its own reasonable and adequate security procedures during the term of the Contract for the protection of City Data, which procedures must be designed to protect City Data and the hosting environment from a Security Incident, including using Contractor’s best efforts to avoid the unauthorized access, modification or loss during transmission and storage, including the use of data encryption techniques described herein.

2.1.2. Contractor confirms that all use, transmission, storage, and destruction of City Data shall be in strict accordance with all terms, covenants, and conditions of the Contract and all applicable Federal, State, and local laws, rules, and regulations.

2.1.3. Contractor agrees that City may conduct, at no extra cost to City, network penetration tests of all systems at Contractor’s facilities used for the processing, storage or transmission of City Data. City may also, at its discretion, contract out penetration testing services to a third party. City shall provide reasonable notice of each network penetration test and shall conduct each network penetration test at reasonable times. If, following any testing, vulnerabilities are identified, Contractor shall promptly document Contractor’s remediation action plan and provide it to the City PM within 10 business days, including at a minimum:

2.1.3.1.1. nature of the vulnerability including scope and breadth,

2.1.3.1.2. potential impact to service of vulnerability and subsequent mitigation,

2.1.3.1.3. summary of mitigation, and

2.1.3.1.4. known or suspected loss of City Data and ability to recover; and

2.1.3.2. implement the remediation action plan not later than 10 business days after delivery of the plan unless otherwise approved by City in writing. The implementation of remediation activity must be communicated to and approved by the City in advance, ensuring the avoidance of unplanned outages; and

8 Information Technology © Austin Energy – All Rights Reserved

2.1.3.3. provide City with written documentation and reports on the status of all modifications to correct such vulnerabilities, including interim and final reports.

2.1.4. Contractor shall perform criminal and financial background checks on its employees and subcontractors with access to City Data.

2.1.5. Contractor shall prohibit access to City Data for Contractor employees and subcontractors who fit into any of the following classifications:

2.1.5.1. Anyone who has been convicted of a felony offense;

2.1.5.2. Anyone who has been convicted of a misdemeanor offense related to computer security, theft, fraud or violence; or

2.1.5.3. Anyone who is currently awaiting trial for any of the above-stated offenses.

2.1.6. The COA CISO may, at any time in writing, require Contractor’s employees and subcontractors to submit to additional background checks. Continued access to City Data, and secured facilities shall be contingent on the Contractor’s employee’s agreement to submit to a background check and the results of the background check. Refusal shall be grounds for immediate termination of the User ID and password, and where applicable, access to COA premises and networks, and any ID badge issued shall immediately be decommissioned.

2.2. Security Incident Reporting Procedures

2.2.1. Contractor must telephone the City PM and e-mail AE-Exec-Info-

Sec@austinenergy.com within four business hours of when Contractor discovers, is notified of, or otherwise has knowledge of any Security Incident. Contractor must include the following information in the report emailed:

2.2.1.1. person reporting the Security Incident ;

2.2.1.2. person who discovered the Security Incident;

2.2.1.3. date and time the Security Incident was discovered;

2.2.1.4. nature of the Security Incident;

2.2.1.5. actions taken and by whom;

2.2.1.6. involved system and possible interconnectivity with other systems;

2.2.1.7. description of the information lost or compromised, or potentially lost or compromised;

2.2.1.8. storage medium from which information was lost or compromised;

mailto:AE-Exec-Info-Sec@austinenergy.com mailto:AE-Exec-Info-Sec@austinenergy.com

Information Technology © Austin Energy – All Rights Reserved 9

2.2.1.9. controls in place to prevent unauthorized use of the lost or compromised information;

2.2.1.10. number of individuals potentially affected;

2.2.1.11. whether law enforcement or other external agencies were involved for any reason and, if so, those contacted; and

2.2.1.12. any other relevant information pertaining to the Security Incident.

2.2.2. Within four hours of discovering the Security Incident, the Contractor shall contain the Security Incident.

2.2.3. Contractor shall investigate (with City’s participation, if so desired by City) the Security Incident, perform a root cause analysis, and create and provide to the City a remediation plan within seven days of becoming aware of the Security Incident.

2.3. Remediation

2.3.1. As soon as practicable, and at no additional cost to the City, Contractor will remedy the source of the Security Incident, as required by the remediation plan.

2.3.2. The Contractor shall reimburse the City for all costs to City associated with the Security Incident.

2.4. Recovery

2.4.1. Within seven days of completing the remediation plan, Contractor must provide the City reasonable written assurance declaring full system recovery, signed by an executive with proper authority, attesting that the Security Incident is remediated and shall not recur.

2.5. Lessons Learned

2.5.1. Contractor shall, at no cost to the City and as part of the Services, update policies, procedures, or enforcement methods in a manner designed to prevent similar Security Incidents from recurring and provide summary of updates to City within 14 days of declaring full system recovery.

3. DEFINITIONS

3.1.1. Authorized Person – Contractor personnel (including subcontractor personnel) located in the contiguous United States having successfully completed the required background check and related requirements of the Contract

3.1.2. City Project Manager or City PM – City of Austin project manager, or their designee, assigned to this Contract

10 Information Technology © Austin Energy – All Rights Reserved

3.1.3. City Data - data or information (in any form) regarding the City or its customers that is created, collected, provided, obtained, or otherwise made available in connection with this Contract to an Authorized Person. City Data is classified as Public, Non-Public or Restricted.

3.1.4. Confidential Information – all written or oral information, which may be disclosed by either Party to the other, related to the business operations of either Party or a third party that has been identified as confidential or that by the nature of the information or the circumstances surrounding disclosure ought reasonably to be treated as confidential; “City Confidential Information” is a subsets of Confidential Information. The data classification for Confidential Information is Restricted.

3.1.5. Data Center Region – means the authorized geographical region for the storage and processing of City Data, and is presently only the contiguous United States.

3.1.6. Data Handling Controls – this document.

3.1.7. Endpoint Device – Any authorized, uniquely identified, network-capable computer hardware device that meets the requirements of these Data Handling Controls , but not limited to, desktop computers, laptops, smart phones, tablets, thin clients, printers or other specialized hardware such as point of sale (POS) terminals and smart meters.

3.1.8. Personal Identifying Information (“PII”) – means any information, classified as Restricted Information, that, either alone or in conjunction with other information, identifies an individual, including an individual’s:

3.1.8.1. name, social security number, date of birth, or government-issued identification number;

3.1.8.2. mother's maiden name;

3.1.8.3. unique biometric data, including the individual's fingerprint, voice print, and retina or iris image; or

3.1.8.4. unique electronic identification number, address, or routing code

3.1.9. Securely Erase – secure deletion of any information, including a recognized destructive delete algorithm, for example, at least seven overwrites with pseudorandom data or at least seven overwrites with zeroes.

3.1.10. Security Incident – any unauthorized disclosure of, or unauthorized access to, City Data; or a violation or imminent threat of violation of computer security policies, acceptable use policies, or compliance requirements under these Data Handling Controls; or violation or imminent threat of violation of industry standard security practices.

Information Technology © Austin Energy – All Rights Reserved 11

Data Classifications for City Data

3.2. Public Data - typically created for public release or released to the public through management decision and/or a public information request.

3.3. Non-Public Data - typically considered internal and used for city business or mission needs. All information is considered Non-Public unless otherwise classified or explicitly defined through the Information Governance Program or official policy or procedural documents. The intent is to ensure the proper handling of data held by the city until evaluation is complete.

3.4. Restricted Data - typically exempt from public disclosure requirements under the provisions of applicable state or federal law. Examples of restricted information are regulated and confidential data.