Commuter rail operating agreement

5. 
   Commuter Rail IT Environment and Risk Management Policy
   

6. 
   Commuter Rail IT Environment Physical & Environmental Security Policy
   

7. 
   Enterprise Security Incident Handling and Response Procedures and Policies.
   

8. 
   Information Technology Security Policy
   

4. 
   SECURITY; INFORMATION ASSURANCE.
   
   1. 
      Information Assurance.
      
      1. 
         The Operator shall protect and safeguard sensitive MBTA Data from inadvertent disclosure, access, acquisition, misuse, display, theft or other unauthorized actions (each, an “Unauthorized Disclosure”).
         
      2. 
         The Operator shall implement and maintain throughout the Term safeguards to protect the confidentiality, security and integrity of MBTA Data and the Commuter Rail IT Environment in a manner fully consistent with the protection requirements set out in this Agreement, Applicable Law and best practices (the “Information Protection Safeguards”). The Operator shall maintain such Information Protection Safeguards until such time that the MBTA deems that the applicable MBTA Data is no longer sensitive and provides corresponding written notification to the Operator.
         
      3. 
         Notwithstanding anything to the contrary, the Operator shall ensure that the Information Protection Safeguards comply with then-current applicable MBTA security and information assurance policies, regulations, standards, guidelines and Applicable Laws.
         
      4. 
         The MBTA’s Enterprise Access Control effort is a comprehensive effort to consolidate and reorganize many of the MBTA's enterprise security access policies and standards and align them with the structure of Section 11 “Access Control” of the ISO/IEC 27002:2005, “Information technology - Security techniques - Code of practice for information security management”. The Enterprise Access Control Policy and supporting standard, Enterprise Access Control Security Standards have been drafted together as a suite with sections that are aligned with each other as well as with ISO 27k. The Policy is generally higher level and relies on the associated Standards to elaborate into the detail required for further technical use. The Operator is required to comply with this policy and the supporting standards in addition to any agency or third party that connects to the MBTA's wide or local area networks.
         
      5. 
         The Operator shall provide and ensure that it, its personnel and MBTA employees with access to the Commuter Rail IT Environment or the MBTA Internal IT Environment shall complete initial information assurance awareness and annual refresher training in MBTA policies governing security, information assurance and workforce management, and such trainees shall certify to said training.
         
      6. 
         The Operator shall perform actions in support of MBTA Security by following National Institute of Standards and Technology (“NIST”) Special Publications SP800-18 Guide for Developing Security Plans for Federal Information Systems, NIST SP800-100 Information Security Handbook: A Guide for Managers, NIST SP800-44 Guidelines on Securing Public Web Servers, NIST SP800-45 Guidelines on Electronic Mail Security, NIST SP800-81 Secure Domain Name System (DNS) Deployment Guide, NIST SP800-48 Wireless Network Security (802.11, Bluetooth, and Handheld Devices), NIST SP800-92 Guide to Computer Security Log Management for Certification and Accreditation Process of MBTA Systems; NIST SP800-14 – Generally Accepted Principals and Practices for Security Information Technology Systems; and NIST SP800-18 – Guide for Developing Security Plans for Information Technology Systems.
         
      7. 
         The Operator shall update the Information Protection Safeguards as necessary or desirable, with updates included as necessitated by IT security notifications, the information assurance vulnerability management program, as required by officially appointed information assurance personnel or Applicable Law.
         
      8. 
         The Operator shall comply with the appropriate security notifications within the Commuter Rail IT Environment. The Operator shall promptly acknowledge receipt of all security notifications and test and install security patches per component of the Commuter Rail IT Environment within ninety (90) days.
         
   2. 
      Operator Training and Certification.
      
      1. 
         The Operator shall ensure that personnel accessing the Commuter Rail IT Environment have the proper and current information assurance certification in its performance of information assurance functions in accordance with the MBTA security policies and industry standards. Such information assurance certification requirements shall include (i) MBTA-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of NIST Special Publications SP800-100 chapter 4 Security Awareness, and (ii) appropriate operating system certification for information assurance technical positions as required by NIST SP800-18 and NIST SP800-37.
         
      2. 
         The Operator shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions.
         
      3. 
         The Operator shall ensure that its personnel who do not have proper and current certifications are denied access to the Commuter Rail IT Environment.
         
   3. 
      Security Assurances for the Commuter Rail IT Environment.
      
      1. 
         The Operator shall prepare and provide by the Agreement Services Commencement Date, documentation on security policies and procedures in support of the Commuter Rail IT Environment and provision of the Commuter Rail Services including server hardening, patches, updates, operations and maintenance within the existing Commuter Rail IT Environment.
         
      2. 
         The Operator shall develop Information Assurance Certification and Accreditation Process structure using NIST Special Publications NIST SP800-12, 18, 37, 53, and 100 preliminary “as is” artifacts submission and other industry standard information assurance policies and procedures for the Commuter Rail IT Environment on or before the Agreement Services Commencement Date.
         
      3. 
         The Operator shall conduct an initial and annual security risk assessment through the Term of the Agreement. The Operator shall ensure that total system security services effectively and efficiently incorporate IA/security provisions and implementation in accordance with the security risk assessment, the security and contingency plan, related documentation developed in previous test phases and all Applicable Laws and industry best practices. The product/service/system must adhere to all Program System Security Authorization Agreement (SSAA) and Security Technical Information Guide (STIG) requirements while keeping integrity intact.
         

1. 
   Disaster Recovery (DR) and Business Continuity (BC) Support Services.
   

4. 
   Overview of DR/BC.
   

5. 
   Operator Responsibilities Regarding DR/BC Services.
   

1. 
   The Operator will retain sole responsibility for overall business continuity plans, application and network recovery, and recovery process management activities with MBTA oversight.
   
2. 
   The Operator must support business continuity plans as they relate to in-scope environment elements (i.e., in-scope infrastructure and facility elements only) as specified by the MBTA and participate in and support the regular testing and improvement of the business continuity plans. Unless otherwise agreed to by the MBTA, such testing shall take place on a quarterly basis.
   
3. 
   To the extent agreed appropriate, support MBTA IT standards and upon request participate in planning sessions, testing review sessions and other meeting activities between MBTA IT and participating MBTA staff for in-scope environment elements.
   
4. 
   Support implementation of business continuity plans as agreed in statements of Work between Operator and MBTA for in-scope environments as they pertain to the support of the implementation, testing and remediation of agency DR/BC plans for in-scope environment elements;
   
5. 
   Support MBTA activities, processes and procedures for in-scope work and environments to support MBTA disaster recovery capabilities.
   
6. 
   Timely update applicable business continuity plans and testing procedures in light of any Commuter Rail IT Environment changes, modifications, or adds.
   
7. 
   Support the MBTA’s potential future specification, design and implementation of infrastructure disaster recovery plans for in-scope environments and environment elements, but exclusive of middleware, application or presentation software as agreed based upon the following principles:
   
   1. 
      Leverage a State provided offsite and geographically diverse alternate disaster recovery site that has sufficient computing and network capabilities which are adequate to process the MBTA’s transactions and to provide systems access to end-user personnel during an outage period
      
   2. 
      Document requirements and support design reviews to facilitate transfer of operations to disaster site for in-scope environment elements to occur within 48 hours of failure of MBTA primary site
      
   3. 
      Document procedures to restore primary operations for in-scope environment site operations (once available) within 24 hours
      
   4. 
      Identification of redundant processing environment requirements to ensure 24x7 operations for MBTA critical infrastructure components
      
   5. 
      Specification of redundant power requirements to ensure 24x7 operations for MBTA critical infrastructure components
      
   6. 
      Specification of redundant networking requirements (network devices and telecommunications access) to ensure 24X7 operations for MBTA critical infrastructure components
      
   7. 
      Specification of fire detection and suppression requirements to comport with service levels contained elsewhere in this document with regard to systems availability, failover and service levels as agreed for in-scope environment elements.
      
1. 
   Operator Responsibilities Regarding Testing.
   
   1. 
      Support MBTA IT in establishing joint test objectives with an agency designed to verify that the in-scope environment elements will be available within the agreed upon timeframes contained in an agency business continuity plan as they pertain to in-scope environment elements.
      
   2. 
      Support MBTA IT in scheduling and testing in scope environment elements of the disaster recovery and business continuity plans relating to in-scope environment elements at least annually in support of the agency, its designees, any testing and recovery providers, and relevant MBTA third party Operators/Contractors.
      
   3. 
      Continuing to operate and manage the in-scope environment elements during periodic disaster recovery tests
      
2. 
   Operator Responsibilities Regarding Communications.
   
   1. 
      Notifying impacted MBTA personnel as soon as practicable upon becoming aware of a disaster or outage affecting the contracted Services.
      
   2. 
      Supporting with the MBTA to support an agency disaster recovery and business continuity plan. In such regard, the Operator will:
      
      1. 
         Perform necessary migrations of the software code and data as defined in the MBTA disaster recovery plan to reinstate the in-scope environment elements so that they are functional at a backup location designated by an agency in accordance with the established procedures.
         
      2. 
         Coordinate with the MBTA personnel to support the reinstatement of the in-scope Environment(s) at such backup location for in-scope environments.
         
      3. 
         Maintain provision and ongoing operation of the Services for unaffected areas.
         
      4. 
         Following any disaster, at the MBTA’s request, the Operator will support MBTA IT and staff in the reinstallation of any in-scope environment elements affected by such disaster in accordance with the process for such re-installation set forth in an MBTA disaster recovery plan and business continuity plan.
         
      5. 
         Following any disaster, conducting a post-disaster meeting with the MBTA for the purpose of developing or enhancing plans to mitigate the adverse impact of future occurrences as they relate to in-scope environment elements.
         
      6. 
         To the extent applicable to the in scope environment elements, maintain compliance with MBTA documented disaster recovery policies, standards, and procedures contained in a provided disaster recovery and business continuity plan.
         
      7. 
         Support an annual test, documented results and feedback procedures contained the MBTA provided disaster recovery and business continuity plan for in-scope Infrastructure environment elements.
         
   3. 
      The Operator shall not be responsible for, or quote or specify services associated with:
      
      1. 
         Providing alternate data processing facilities or capabilities to the MBTA inclusive of data centers, networking, redundant or failover equipment and associated software; and
         
      2. 
         Develop detailed disaster recovery or business continuity plans for MBTA applications; these plans shall remain the sole responsibility of the MBTA agency that owns the applications.
         

4. 
   
   SERVICE LEVEL AGREEMENT AND SERVICE CREDITS
   
   1. 
      GENERAL OVERVIEW.
      

This Schedule 3.18 (Service Level Agreement and Service Credits) sets forth certain quantitative Service Levels and key measurements against which the Operator’s performance of the Commuter Rail Services shall be measured, as well as procedures relating to Service Credits and related provisions. Capitalized terms not otherwise defined in this Schedule 3.18 (Service Level Agreement and Service Credits) or Appendix 1 (Definitions) to Schedule 3.15 (Intellectual Property; Ownership) shall have the meaning ascribed to them in Schedule 1 (Definitions). The Operator shall perform the Commuter Rail Services and provide the Commuter Rail IT Environment at or above the performance levels described in this Schedule 3.18 (Service Level Agreement and Service Credits).

2. 
   FREQUENCY AND TYPE OF MONITORING; REPORTING.
   

By the fifteenth (15th) day of each month, the Operator shall provide to the MBTA, as part of the Operator's monthly performance reports, a set of hard and soft copy of its Service Level Reports concerning its Continuous Monitoring to verify the Operator’s performance and compliance with the Service Levels during the preceding month. The Operator shall provide a Service Level Report concerning an instance of By-Sample Monitoring conducted by the Operator promptly after completion of such By-Sample Monitoring,

The MBTA shall timely provide the Operator with Service Level Reports resulting from MBTA Monitoring, subject to the Operator’s right to contest such results in accordance with the dispute resolution procedures of the Agreement.

Upon request, the Operator shall provide supporting information (including applicable raw data) for a Service Level Report in machine-readable form suitable for use on a personal computer, and as may otherwise be reasonably requested by the MBTA. The raw data and supporting information shall be the MBTA’s property and the MBTA’s Confidential Information, and the Operator shall provide the MBTA with access to such information online and ad-hoc during the Term and any transition period.

3. 
   REPORTING FORM.
   

4. 
   ROOT CAUSE ANALYSES; RESOLUTION OF FAILURES.
   

• 
  Promptly initiating problem investigations, including root cause analysis ;
  
• 
  Reporting any problems to the MBTA in accordance with the escalation process set forth in this Schedule 3.18 (Service Level Agreement and Service Credits);
  
• 
  Correcting any problems and beginning to restore Service Levels;
  
• 
  Advising the MBTA of the root cause of problems and the status of remedial efforts being undertaken with respect to such problems;
  
• 
  Providing documentary evidence to the MBTA (i) that the causes of such problems have been or will be corrected, and (ii) of steps for prevention of future related problems (where applicable); and
  
• 
  Making written recommendations to the MBTA for improvement and preventive measures (where applicable) in procedures related to Service Levels and correcting Service Level problems.
  

5. 
   SERVICE LEVEL MEASUREMENT PERIOD.
   

6. 
   AUTHORIZED SERVICE INTERRUPTIONS.
   

The MBTA shall not be entitled to Service Credits from the Operator for a system's or application's lack of availability during the Authorized Service Interruption.

7. 
   REQUESTING AN AUTHORIZED SERVICE INTERRUPTION.
   

• 
  The purpose and reason for the action;
  
• 
  Authorization from the IT Change Control Board and MBTA representative;
  
• 
  The systems and users to be affected;
  
• 
  Actions to be undertaken;
  
• 
  A roll back and recovery plan in the event of a failure;
  
• 
  A schedule demarcating the outage window; and
  
• 
  An after-action report (to be submitted upon completion).
  

8. 
   AVAILABILITY SERVICE LEVEL AGREEMENTS EXCEPTIONS.
   

9. 
   SEVERITY LEVELS.