Utilities - Exhibit G - Contractor Security Access Policy.pdf

Exhibit G

CONTRACTOR ACCESS SECURITY POLICY

For

Soliciation/Contract number

Project Title

Revised 08/2020 1 of 6

EXHIBIT G

CONTRACTOR ACCESS SECURITY POLICY

General Information

The day to day security management of the Contractor Access Security Policy is the Security Operations Supervisor and the Security Operations Specialist (SOS). This policy does not pertain to vendors, delivery personnel or consultants. Any security issue shall be reported immediately to Utilities’ Security Operations Center (SOC) at 668-STOP (7867).

Project Contractors and their designated subcontractors are external personnel who work on behalf of Colorado Springs Utilities hereinafter referred to Project Contractors. The management of project contractor’s employees and their subcontractors is the responsibility of Colorado Springs Utilities Project Managers hereinafter referred to as CSU PM.

CSU PMs are required to meet and coordinate with SSOS and SOS before any project work is started to ensure all security requirements are addressed.

Most Project Contractors will have physical access only, to specific work site(s). Project Contractors who require physical and cyber access will have to complete a background investigation before access is granted to their work site(s).

Project Contractors who will require physical access only and will be working on any Utilities’ site for 9 days and less will be treated as a visitor and be escorted at all times in performance or their work.

Project Contractors who require physical access only and will be working on any Utilities’ site for 10 days or more will be required to obtain a CSU Contractor ID badge (ID Badge) with limited access to specific work site(s).

Only Project Contractors in a supervisory role within their company may have the ability to escort other project contractor personnel. Those designated as escorts, will receive an (E) on their ID badge and are allowed to escort up to 10 project contractor employees and their designated subcontractor personnel at their designated work site Those contractor visitors will be seen as visitor and will have to be sign into (VMS) Visitor Management System and be escorted by designee. See NERC Restricted areas for escort requirements into those designated areas.

All Project Contractors shall read and sign a Security Awareness Form prior to receiving an ID badge.

All Project Contractors shall comply with all Utilities’ security measures and requirements for personnel and access to Utilities’ sites. Security measures vary by site and include the following provisions.

Repercussions of violating Utilities’ Security policies could result in denied access.

• Utilities reserves the right to request additional security measures (e.g. background investigations for access to designated critical infrastructure assets) or to further control access to the site as conditions dictate.

• Utilities reserves the right to implement new technology improvements in the management of Project Contractors (e.g. Visitor Management System or enhanced government ID requirements including secure storage of PII information).

• Utilities may refuse access to any Project Contractor for misconduct or illegal activity.

Notifications of any changes or any other nature will be made to the CSU PM who will contact their Project Contractor Manager.

Revised 08/2020 2 of 6

Military Installation Access Colorado Springs Utilities will follow all military installation access procedures and will comply with all government regulations when operating on the local military installations. All local military installations require 72 hours (3 business days) processing time of their required forms before a contractor(s) are granted access, to their installation.

• CSU PM shall contact the SSOS for all questions and the required forms needed related to local military installation access. If unavailable, secondary contact is SOS.

Sharing ID Badges

Sharing an ID Badge with anyone else for any reason (i.e. to gain access to a Utilities’ site or facility) is strictly prohibited. Any project contractor(s) who commits this act is subject to the disciplinary actions:

• Project Contractors shall wear their issued Utilities’ Contractor ID badges on an external garment, above the waist while on Utilities’ property. The only exception to this policy is if wearing the ID badge creates a safety concern. If wearing the ID badge creates a safety concern the badge may not be worn but must be kept on the person while on site and, if asked, must be shown.

Piggybacking Piggybacking is defined as following a person through an entry gate or door without coordinating entry with the onsite Security Officer or following another person through an entry gate or door without using an individual’s access card. Piggybacking into any Utilities’ site or facility is strictly prohibited. Any Project Contractor(s) who commits this act is subject to the following disciplinary actions: First Offense, a written warning and discussion with CSU PM; Second Offense, is access denial and removal from contract. Any damage done to Utilities’ site/facility/property due to piggybacking shall be the sole responsibility of the Project Contractor(s).

Reporting Criminal Activity If, at any time while on Utilities’ property, a criminal act of any type is suspected, Project Contractor(s) shall immediately report the incident to the onsite Security Officer or call the Utilities’ Security Control Center (SOC) at 668-STOP (7867). If the observed incident is life threatening, Project Contractor(s) shall immediately call 911 and then notify Utilities’ Security Operations Center.

Reporting Suspicious Activity If, while working on any Utilities’ site or facility, Project Contractor(s) observes someone performing an act of Sabotage (Known or Suspected), Project Contractor(s) shall immediately report the observation to Utilities’ Security Operations Center (SOC) at 668-STOP (7867). Utilities defines Sabotage as:

Known Acts of Sabotage

• There are known or confirmed sabotage events where there is no question that a deliberate act has been committed to disrupt operations or damage facilities or equipment. Some of the obvious acts may include:

• Tampering with transmission towers, poles, facilities, equipment, vehicles or other Utilities’ facilities

• Disrupting operations by false or real threats (bomb, fire, etc.)

• Causing intentional failure of critical systems or machinery

• Deliberate damage to, and/or, interference with communications sources (including, but not limited to, Energy Management System (EMS), Supervisor Control and Data Acquisition (SCADA), Remote Terminal Units (RTUs), essential communications, and/or other IT Security Devices, networking infrastructures, and servers

• Multiple and coordinated attempted physical intrusions to a Restricted, No Trespassing, and/or “Authorized Individuals Only” identified area

Revised 08/2020 3 of 6

Suspected Acts of Sabotage

• Suspected sabotage events can look like every day abnormal operations, such as:

• Loss of a line or major piece of equipment

• Trip of a major unit

• Relay miss-operation

• Significant interruption or impairment of a function of an energy facility

• Loss of RTU communications circuitry and/or infrastructure services

• Large number of unauthorized cyber or physical attempts to access critical facilities or systems

• Intelligence gathering - unauthorized people requesting information about operations, software, telecommunications, etc.

• Unauthorized physical and/or cyber surveillance activities

• Verbal or written threats to security, operations or facilities by employees or persons not directly associated with the company

• Acts of vandalism on substations or transmission and distribution lines that support critical government agencies or power system operation facilities

• A series of acts of vandalism at numerous substations (within Utilities’ service area, or reported across interconnections) within a short period of time that demonstrate a possible plan to disrupt the bulk electric system

• Social engineering- the art of manipulating people into performing actions or divulging confidential information such as: spear-phishing and impersonation of another person on the phone

• Damage to facilities, equipment or vehicles at various facilities effecting operations

Securing Utilities’ Buildings and Vehicles If working at a Utilities’ Building, Project Contractor(s) shall always ensure the building doors are secure upon entering or exiting the building. If operating any Utilities’ vehicle on or off Utilities’ sites, Project Contractor(s) shall always secure the vehicle anytime it is left unattended.

Site Access Processes Utilities has two ways for Project Contractor personnel to gain access to its sites; utilizing the CSU Contractor ID Badge process or being escorted as a visitor by a designated escort (E) of the Contractor.

• Those project contractor(s) that will be working on any Utilities sites for 9 days or less will be signed in as visitors daily and be escorted at all times.

• Those project contractor(s) that will be working on any Utilities’ site for 10 days or more will require a CSU Contractor ID badge with limited access for specific work site. Only Project Contractor(s) in a supervisory role within their company may have the ability to escort other Project Contractor personnel. Those designated as escorts, will receive an (E) on their badge and are allowed to escort up to 10 project contractor employees and their designated subcontractor personnel at their designated work site.

• Project Contractor Manager/Supervisor will use the Security Operations Specialists (SOS) Project Management Spreadsheet to identify their personnel by filling in all of the required information.

This form will be sent to the CSU PM. The CSU PM will send the form to the Project Contractor Manager/Supervisor who will identify all project contractors’ employees who will work on the identified project (whether it is for one day or to the end of the contract). The Project Contractor Manager/Supervisor will send the spreadsheet to the CSU PM for review and validation. CSU PM will then send the SOS Project Management Spreadsheet via email attention FSS at: eal@csu.org or fss@csu.org. The spreadsheet should not contain any personal information.

• CSU PM’s is/are responsible for maintaining their project contractor’s access to the work site. This responsibility includes reviewing the Contractor spreadsheet.

mailto:eal@csu.org mailto:fss@csu.org

Revised 08/2020 4 of 6

If any of the Project Contractor’s employees or subcontractor personnel terminate employment for any reason, the Project Contractor Manager or Supervisor, shall immediately call to notify the CSU PM and then call the Utilities Security Operations Center at 668-7867 to have the terminated employee(s) CSU ID badge deactivated. Project Contractor Manager/Supervisor shall immediately take possession of the CSU Contractor ID Badge and return it in person to onsite Security or the CSU PM if present during the termination. All CSU Contractor ID Badges are returned to the Security Operations Staff by the onsite Security Officer or direct to Security Operations Staff.

Within 2 hours of termination, the Project Contractor Manager will follow up with an email to the CSU PM and FSS@csu.org with the persons full name and date and time of termination.

Weapons Policy

With the exception of Armed Security Officers or Law Enforcement Officers, open or concealed carrying of a firearm on Utilities’ property is not permitted. Project contractor employees or subcontractor personnel may not have firearms on their person or in a vehicle while on Utilities’ property.

Drug & Alcohol Usage and Drug Possession Utilities conforms with Federal Law as it pertains to drugs, alcohol usage, drug usage and possession. Illegal drugs (to include marijuana) will not be brought onto or consumed on Utilities’ property. Project contractor employees or subcontractor personnel that are under the influence of drugs or alcohol will be escorted off of Utilities’ properties.

Site Operating Hours Utilities normal business hours are Monday – Friday from 8 AM to 5 PM. If a project will require site access outside of these hours the CSU PM must specify each site requested by the hours that the Project Contractor employees or subcontractor personnel are authorized to be onsite. The CSU PM will provide the information in an email to FSS@csu.org with site location, contract number, after hours required at this site, and duration. CSU PM may contact for any questions.

Video/Photography on Utilities’ Sites If Project Contractor Manager requires any video or photography on a Utilities’ site this must be coordinated with the CSU PM and Utilities’ Corporate Communications Department. The CSU PM or a designated CSU sponsor must be present while any videos, drone activity and/or photographs are taken. Any drone operations must be coordinated with the Security Operations Supervisor. At this time, there is no drone activity on CSU sites and property. Has to be pre-approve by Security Operations for any activity on CSU sites and property.

Contractor Termination/Separation When the Project Contractor’s work agreement is complete or terminated, Project Contractor Manager shall collect and return all ID badge/access control cards, to include those used for military installations, to the CSU PM. These badges will be returned to the Security Operations Staff in person by the receiving CSU PM. A penalty of $100.00 will be charged for each Utilities’ badge not returned upon contract completion, termination or cancellation or for any lost badge. This penalty may be recovered from any remaining payment Utilities owes Contractor at the completion, termination or cancellation of the contract.

mailto:FSS@csu.org mailto:FSS@csu.org

Revised 08/2020 5 of 6

Right to Search Utilities reserves the right to search all vehicles entering and exiting Utilities’ sites. All personal containers, lunch boxes, brief cases, etc. are subject to search at Utilities’ security entry points. Failure to submit to these searches will be grounds for Utilities to refuse access to the site or facility.

Theft/Stealing Any Project contractor employee(s) caught in the act of stealing Utilities’ property, or in possession of Utilities’ property without prior approval, will be removed from said property and subject to legal recourse.

In addition, the individual(s) will be banned from Utilities’ property and Project Contractor’s business relationship with Utilities could be jeopardized, including, but not limited to, termination of existing contracts, suspension and debarment.

Verbal/Physical Altercations Project contractors involved in verbal or physical altercations with Utilities’ employees or another contractor will be subject to removal from Utilities’ property, losing contractual associations with Utilities, and possible criminal charges, depending on the severity of the altercation.

Other Security Requirements Depending on the project other security requirements than those outlined in this document may be required when performing work on Utilities’ sites/facilities. If required these additional security requirements will be stipulated in the project contract.

• Contractors who require access to Colorado Springs Utilities critical infrastructure will be required to meet the criminal background investigation requirements as provided on award of contract.

Contractors requiring only perimeter access may not be subjected to conduct criminal background investigations on award of contract.

• NERC Restricted Areas: CSU has implemented a Visitor Control Program for NERC Restricted Areas Physical Security Perimeters (PSP’s). Visitors (vendors, contractors and/or those CSU employees that have not been granted unescorted access to the specific PSP) may only enter a PSP with an authorized CSU PSP escort (someone with authorized unescorted access granted to PSP (NERC Restricted areas). CSU PSP Escorts may only escort up to six visitors at one time and escort must maintain visual contact with all visitor(s) at all times. Please contact the Physical Security Compliance Coordinator for further information in regard to NERC PSP Visitor Access processes and procedures.

• Damaged or defective Utilities’ ID badges shall require a new ID badge be issued. The CSU PM will contact Security Operations Staff to schedule a time for a badging appointment. Lost or stolen Utilities’ ID badges present a security risk to the organization and it is imperative that all Project Contractor employees and subcontractor personnel take all precautions to ensure Utilities’ ID badges are secured. Notification must be made immediately to Utilities Security Operations Center at 668-STOP (7867) and to the CSU PM and the Project Contractor Manager or Supervisor when a Utilities’ ID badge has been lost or stolen. A $100 replacement fee will be imposed to any Project contractor employee or subcontractor personnel that is required to replace its badge if lost or stolen.

Prohibited Articles Any person who possesses, transports, or uses prohibited articles on any Utilities’ site is subject to immediate site removal. Prohibited articles include but are not limited to:

• Dangerous weapons

• Explosives, ammunition, and incendiary devices

• Controlled substances and drug paraphernalia (e.g., illegal drugs and associated paraphernalia, but not prescription medication)

• Alcoholic beverages (includes “near” and “non-alcoholic” beer and wine)

Revised 08/2020 6 of 6

• Contraband (includes other items prohibited by law)

• Marijuana (in all forms)

Project Contractor employees and subcontractor personnel discovered on the site in possession of any prohibited article will have the prohibited article confiscated and the CSU PM will be notified. If the prohibited article is illegal, local Law Enforcement will be contacted. In all cases, the person in possession of a prohibited article is subject to disciplinary action review to include access denial to the site.

Example of SOS Project Management Spreadsheet

Last Name First Name Middle Intial

Type of I-9 Documentation (ID) and Expiration Date Company Name

Designated as an Escort (Supervisor)

Contract Start Date

Contract End Date

Internal Use - Badged

Internal Use - Access

FSS PROJECT MANAGEMENT SPREADSHEET

CSU PROJECT MANAGER: PROJECT NAME:

Company Name: Subcontractor Name: