PHYSICAL SECURITY RISK ASSESSMENT VERIFICATION AGREEMENT

Transcription

1 PHYSICAL SECURITY RISK ASSESSMENT VERIFICATION AGREEMENT This Physical Security Risk Assessment Verification Agreement (the "Agreement"), dated as of DATE, 2015 (the "Effective Date"), is by and between [NAME OF CUSTOMER] ("Customer"), a [STATE OF ORGANIZATION] [TYPE OF LEGAL ENTITY] with offices located at [ADDRESS], and Peak Reliability, a Utah non-profit Corporation with offices located at 7600 NE 41 st Street, Vancouver, WA, and 4850 Hahn s Peak Drive, Loveland, CO ("Peak"). Recitals WHEREAS certain Transmission Owners are subject to the CIP Physical Security Reliability Standard; WHEREAS these Transmission Owners will have to perform an initial and subsequent risk assessment of their Transmission Stations and transmission substations per CIP as may be amended, revised or replaced; WHEREAS each applicable Transmission Owner must have its risk assessments verified by an unaffiliated third party per CIP Requirement R2; WHEREAS Peak as a registered Reliability Coordinator is authorized to perform such a verification and is offering this verification as a service to Transmission Owners; and WHEREAS Transmission Owners seek verification of their CIP Requirement R1 risk assessments by Peak in accordance with CIP Requirement R2. NOW, THEREFORE, in consideration of the mutual promises contained herein, and other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties hereby agree as follows: AGREEMENT 1. Definitions. "Bulk Electric System" shall have the meaning given this term in the NERC Glossary of Terms as may be amended from time to time. "Business Day" means a day other than a Saturday, Sunday or any federally recognized holiday.

2 "Documentation" means all generally available documentation relating to the Services, including all Customer submitted Study Reports as well as all reports, notes, and work product of Peak. "Initial Fee" means the flat fee that Peak charges to initiate the risk assessment verification process. "Interconnection Reliability Operating Limit" or "IROL" shall have the meaning given this term in the NERC Glossary of Terms as may be amended from time to time. "Law" means any statute, law, ordinance, regulation, rule, code, order, constitution, treaty, common law, judgment, decree or other requirement or rule of any federal, state, local or foreign government or political subdivision thereof, or any arbitrator, court or tribunal of competent jurisdiction. "Loss" means any and all losses, damages, liabilities, deficiencies, claims, actions, judgments, settlements, interest, awards, penalties, fines, costs or expenses of whatever kind, including reasonable attorneys' fees and the costs of enforcing any right to indemnification hereunder and the cost of pursuing any insurance providers. "NERC" means the North American Electric Reliability Corporation. "Permitted Uses" means any use of the Services by Customer or any Authorized User only for the purposes expressed or implied herein. "Person" means an individual, corporation, partnership, joint venture, Limited Liability Company, governmental authority, unincorporated organization, trust, association or other entity. "Peak Materials" means all devices, documents, data, know-how, methods, processes, software and other inventions, works, technologies and materials, including any and all Documentation, computer hardware, programs, reports and specifications, client software and deliverables provided or used by Peak in connection with performing the Services, in each case developed or acquired by Peak independently of this Agreement. "Peak Personnel" means all employees and agents and contractors of Peak involved in the performance of Services. "Planning Coordinator" shall have the meaning given this term in the NERC Glossary of Terms as may be amended from time to time. "Reliability Coordinator" shall have the meaning given this term in the NERC Glossary of Terms as may be amended from time to time.

3 "Reliability Standard" shall have the meaning given this term in the NERC Rules of Procedure as may be amended from time to time. "Representatives" means a party and its employees, officers, directors, consultants, legal advisors, independent contractors and subcontractors. "Requirement" means an explicit statement in a Reliability Standard that identifies the functional entity responsible, the action or outcome that must be achieved, any conditions achieving the action or outcome, and the reliability-related benefit of the action or outcome. Each Requirement is a statement with which compliance is mandatory. "Station" or "Transmission Station" means locations where groups of Transmission Facilities exist within a physical border (e.g. fence, wall). Geographical diversity would be the only distinguishing characteristic between two separate Stations. (A physical barrier between two areas would still constitute the same Station.) Study Report unless otherwise agreed to in writing between Peak and Customer, means a document that must contain the items listed in item 6.3 of the Peak Reliability Guideline: CIP as may be amended from time to time. "System Operating Limit" or "SOL" shall have the meaning given this term in the NERC Glossary of Terms as may be amended from time to time. "Territory" means the Western Interconnection. "Transmission Owner" shall have the meaning given this term in the NERC Glossary of Terms as may be amended from time to time. "Transmission Planner" shall have the meaning given this term in the NERC Glossary of Terms as may be amended from time to time. 2. Services. 2.1 Services. Throughout the Term and at all times in connection with its actual or required performance under this Agreement, Peak shall, in accordance with all terms and conditions set forth in this Agreement and any applicable Service Order, provide to Customer through Customer s Authorized Users the following services ("Services"): (a) Customer will transmit to Peak and verify Peak s receipt of Customer s study report or other agreed upon study documentation and the accompanying study case including any necessary associated files.

4 (b) Peak will review the study report or other agreed upon study documentation and the study case(s) to verify completeness, accuracy, and consistency with Peak s CIP- 014 Guideline. (c) Peak will clarify any questions or request modifications to the study or study report or other agreed upon study documentation as needed. 2.2 Customer Responsibilities. Services are based solely on Customer s representations. It is Customer s responsibility to maintain the documentation necessary to support the data used in preparing Customer s physical risk assessments. Peak is not responsible for any determination of Customer s compliance or non-compliance resulting from any review of Customer s physical risk assessments. The facts and assumptions used by Peak relating to the Services are provided by Customer and are based solely on Customer s representations. Peak is not responsible to verify facts or for any Peak deliverable that is based upon incomplete information. If material facts provided by Customer to Peak are incorrect, incomplete or omitted, Peak shall not be held responsible for any resulting inaccuracies or damages whatsoever. 2.3 Service Orders. Service Orders will be effective only when signed by Customer and Peak and Initial Fee payment is delivered to Peak. All Service Orders will set forth the Initial Fee and the hourly rate that Peak will charge Customer to for performing the Services. Customer may, request additional services from Peak hereunder subject to a corresponding forward-going adjustment of the Fees to reflect these changes in accordance with any necessary pricing change or otherwise in an applicable Service Order. Any Services Orders executed by Customers are by this reference incorporated in and made a part of this Agreement. 2.4 Compliance with Laws. Peak shall comply with all applicable Laws as they concern this Agreement or the subject matter hereof, including by securing and maintaining all required and appropriate visas, work permits, business licenses and other documentation and clearances necessary for performance of the Services. 3. Commencing Service and Deliverable. (a) Unless otherwise agreed to between Peak and Customer, Peak will commence the Services for Customer upon receipt of the executed Service Order, receipt of the Initial Fee and receipt of the Study Report. Peak will perform the Services consistent with the costs in the Service Order. (b) Peak will provide a verification report to Customer detailing the results of Peak s verification of Customer s physical risk assessments. Customer acknowledges and understands that Peak s verification report may disagree with Customer s conclusions based upon Customer s study report or other agreed upon study documentation. Unless Peak and Customer otherwise agree to continue Peak providing

5 the Services, including but not limited to further verification of Customer s physical risk assessments, Peak s provision of its verification report to Customer will be complete upon delivery of the Services. 4. Service Availability. 4.1 Peak will respond to Customer regarding its availability to verify a physical security risk assessment within five (5) business days. 5. Term and Termination. 5.1 Term. The initial term of this Agreement commences as of the Effective Date and will continue in effect until the later of Peak rendering the Services including delivering the verification report to Customer or the date that is 180 days after the Effective Date. 5.2 Termination for Cause. In addition to any right of termination set forth elsewhere in this Agreement, either Party may terminate this Agreement by written notice to the other party effective as of the date specified in such notice, if the other party materially breaches this Agreement and such breach: (i) cannot be cured; or (ii) being capable of cure, remains uncured thirty (30) days after the breaching party receives written notice thereof; and 5.3 Termination for Convenience. Customer may terminate this Agreement by written notice to Peak effective as of the date specified in such Notice, however, Customer shall pay to Peak, all undisputed charges and amounts due and payable to Peak, if any, for Services actually performed under the terminated or expired Service Order or Service Orders. 5.4 Effect of Termination; Data Retention. Upon and after the termination or expiration of this Agreement for any or no reason, Customer shall pay to Peak, all undisputed charges and amounts due and payable to Peak, if any, for Services actually performed under the terminated or expired Service Order or Service Orders. Not later than thirty (30) days after the termination or expiration of this Agreement, Peak will return to Customer all originals or copies of the Study Report; provided, however, that Peak may, in lieu of delivering such material to Customer, destroy all such material without retaining any copies thereof and shall certify and confirm in writing to Customer that such destruction occurred. 5.5 Survival. The rights, obligations and conditions set forth in this section and Section 1 (Definitions), Section 5.5 (Effect of Termination; Data Retention), Section 7 (Indemnification), Section 9 (Limitations of Liability), Section 10 (Representations and Warranties), and Section 12 (General Provisions), and any right, obligation or condition

6 that, by its express terms or nature and context is intended to survive the termination or expiration of this Agreement, shall survive any such termination or expiration hereof. 6. Fees and Expenses. 6.1 Fees. Subject to the terms and conditions of this Agreement and any applicable Service Order, including the provisions of this Section 6, Customer shall pay the fees set forth in the applicable Service Order (attached as Schedule A), which shall be determined and invoiced by Peak, subject to such increases and adjustments as may be permitted pursuant to this Agreement including but not limited to agreed upon enhancements or customization. 6.2 Taxes. All Fees and amounts set forth this Agreement or any Service Order are exclusive of any applicable taxes. To the extent that a sales tax applies to the Services, Peak will separately itemize the sales tax amount on any invoices issued for the Services. 6.3 Invoices. Peak shall invoice Customer for all applicable costs, fees, or expenses in accordance with Schedule A upon delivery of the Service to Customer. If more than one Service Order is in effect, Peak shall provide an aggregate invoice for all amounts invoiced. 6.4 Payment Terms. (a) Customer shall pay amounts payable and due hereunder within thirty (30) days after receipt of invoice therefor. Any amounts not paid within thirty days will accrue interest charges at the prime rate as published in the Wall Street Journal plus 200 basis points. (b) All payments hereunder shall be in US dollars and made by check or wire transfer. Payments shall be made to the address or account specified by Peak or such other address or account as is specified by Peak in writing from time to time. 7. Indemnification. 7.1 General Indemnification. To the maximum extent allowed by law, including any applicable anti-deficiency statutes, each party (the "Indemnifying Party") shall defend, indemnify and hold harmless the other party and each of the foregoing Persons' respective officers, directors, employees, agents, successors and assigns, (each of the foregoing Persons, a "Indemnitee") from and against all Losses arising out of or resulting from any third party claim, suit, action or proceeding (each, an "Action") to the extent that such Action does or is alleged to arise out of or result from: (a) the Indemnifying Party's breach of any representation, warranty, covenant or obligation of the Indemnifying Party under this Agreement; or

7 (b) any action or failure to take a required action or more culpable act or omission (including recklessness or willful misconduct) in connection with the performance or nonperformance of any Services or other activity actually or required to be performed by or on behalf of the Indemnifying Party under this Agreement, 8. No Reliability Standard Compliance Responsibility and Disclaimer. 8.1 Peak expressly disclaims any and all responsibility for demonstrating compliance with any laws or rules to which Customer is subject including but not limited to Customer s compliance with any applicable NERC or regional Reliability Standards. Except as provided for herein, Peak will not generate or make available to Customer any documents, data, or other material in any form for purposes of Customer s demonstration of compliance with such laws, rules, or NERC or regional reliability standards. 8.2 In addition, Peak bears no responsibility to identify or communicate significant deficiencies or material weaknesses in any analysis used to conduct Customer s physical risk assessments. Customer is responsible for developing and evaluating internal facts, analyses, and assumptions. 8.3 EXCEPT FOR THE EXPRESS WARRANTIES IN THIS AGREEMENT, PEAK HEREBY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE UNDER OR IN CONNECTION WITH THIS AGREEMENT OR ANY SUBJECT MATTER HEREOF 9. Confidentiality and Legally Compelled Disclosure 9.1 Except where written permission to do so has been provided by Customer or if disclosure is required pursuant to any legally compelled disclosure, Peak shall keep the Study Report provided by Customer in strict confidence and shall not otherwise make it, or any portion of it, available in any form or manner to any person or entity other than the its individual employees, consultants, delegees, agents and lawyers, all of whom shall be bound by this Agreement or terms substantially similar. 9.2 Except when a written waiver for the protection thereof has been granted as specified herein, Peak shall exercise due diligence and make all reasonable efforts, as permitted by law, to oppose or prevent legally compelled disclosure of the Study Report. However, prior to disclosing the Study Report in response to any legally compelled disclosure, Peak shall take appropriate actions prior to complying with the disclosure order, which include but may not be limited to providing immediate notice to Customer of any such request, so as to permit sufficient time to oppose or challenge such disclosure. Notwithstanding the preceding, the foregoing notice provisions shall not apply if the Study Report is requested by FERC, an applicable governmental authority, NERC, or Peak s Compliance Enforcement Authority, and where notice is prohibited by confidentially requirements.

8 10. Limitations of Liability. IN NO EVENT WILL EITHER PARTY BE LIABLE TO THE OTHER PARTY OR TO ANY THIRD PARTY FOR (A) ANY CLAIMS ASSERTING OR BASED ON THE USE, INABILITY TO USE, LOSS, INTERRUPTION OR DELAY OF THE SERVICES, LOSS OF USE OF FACILITY OR EQUIPMENT, LOST BUSINESS, REVENUES OR PROFITS, LOSS OF GOODWILL, FAILURE TO ACHIEVE COST SAVINGS, FAILURE OR INCREASED COST OF OPERATIONS, OR PROVIDE CORRECT INFORMATION OR BREACHES IN SYSTEM SECURITY, OR (B) FOR ANY CONSEQUENTIAL, INDIRECT, INCIDENTAL, EXEMPLARY, SPECIAL, PUNITIVE OR ENHANCED DAMAGES, ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT OR ITS SUBJECT MATTER EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR SUCH DAMAGES ARE OTHERWISE FORESEEABLE, REGARDLESS OF THE LEGAL OR EQUITABLE THEORY (CONTRACT, TORT, STRICT LIABILITY OR OTHERWISE) UPON WHICH THE CLAIM IS BASED, AND NOTWITHSTANDING THE FAILURE OF ANY AGREED OR OTHER REMEDY OF ITS ESSENTIAL PURPOSE IN NO EVENT SHALL EITHER PARTY'S LIABILITY UNDER THIS AGREEMENT EXCEED THE AGGREGATE FEES AND REIMBURSABLE EXPENSES UNDER THIS AGREEMENT (INCLUDING AMOUNTS ALREADY PAID AND AMOUNTS THAT HAVE ACCRUED BUT NOT YET BEEN PAID). 11. Representations and Warranties Mutual Representations and Warranties. Each party represents and warrants to the other party that: (a) it is duly organized, validly existing and in good standing as a corporation or other entity as represented herein under the laws and regulations of its jurisdiction of incorporation, organization or chartering; (b) it has, and throughout the Term and any additional periods during which it does or is required to perform the Services will retain, the full right, power and authority to enter into this Agreement and perform its obligations hereunder; (c) the execution of this Agreement by its representative whose signature is set forth at the end hereof has been duly authorized by all necessary corporate action of the party; and (d) when executed and delivered by such party, this Agreement will constitute the legal, valid and binding obligation of such party, enforceable against such party in accordance with its terms except as the enforceability thereof may be limited by bankruptcy and similar Laws affecting creditors' rights generally and by general equitable principles.

9 11.2 Customer Representations and Warranties. Customer represents that, unless otherwise agreed to with Peak as memorialized in a Service Order attached to this Agreement, Customer has performed its risk assessment in accordance with Peak s Peak Reliability Guideline: CIP document as may be amended from time to time. At a minimum, Customer s risk assessment must have identified the impact to the Bulk-Power System of the total loss of applicable Stations including: (a) Those Stations with voltage 500kV and above. (b) Those Stations identified by applying the weighted aggregation value calculation using the table in the CIP (c) Those Stations identified by Peak (as the Reliability Coordinator), the Planning Coordinator or the Transmission Planner as a critical facility to the derivation of an IROL. (i) In the event that an IROL has been defined as an import or a like quantity, at a minimum the critical facilities will be defined as the point of interconnection that defines the import or a like quantities value for lines that exceed 200kV. (d) Those Stations that have been added by an applicable governmental authority, federal jurisdiction entity, or appropriate overseeing entities 12. Force Majeure. Neither party shall be liable or responsible to the other party, or be deemed to have defaulted under or breached this Agreement, for any failure or delay in fulfilling or performing any term hereof, when and to the extent such failure or delay is caused by: natural disasters, flood, fire or explosion, war, terrorism, invasion, riot or other civil unrest, embargoes or blockades in effect on or after the date of this Agreement, national or regional emergency, strikes, labor stoppages or slowdowns or other industrial disturbances,or any passage of law or governmental order, rule, regulation or direction, or any action taken by a governmental or public authority, including imposing an embargo, export or import restriction, quota or other restriction or prohibition, or national or regional shortage of adequate power or telecommunications or transportation facilities (each of the foregoing, a "Force Majeure Event"), in each case provided that such event is outside the reasonable control of the affected party and the affected party uses diligent efforts to end the failure or delay and minimize the effects of such Force Majeure Event. 13. General Provisions Further Assurances. Each party shall, upon the reasonable request of the other party, execute such documents and perform such acts as may be necessary to give full effect to the terms of this Agreement.

10 13.2 Relationship of the Parties. The relationship between the parties is that of independent contractors. Nothing contained in this Agreement shall be construed as creating any agency, partnership, joint venture or other form of joint enterprise, employment or fiduciary relationship between the parties, and neither party shall have authority to contract for or bind the other party in any manner whatsoever Public Announcements. Neither party shall issue or release any announcement, statement, press release or other publicity or marketing materials relating to this Agreement or, unless expressly permitted under this Agreement, otherwise use the other party's trademarks, service marks, trade names, logos, domain names or other indicia of source, association or sponsorship, in each case, without the prior written consent of the other Party Notices. All notices, requests, consents, claims, demands, waivers and other communications hereunder shall be in writing and addressed to the parties as follows (or as otherwise specified by a party in a notice given in accordance with this Section): If to Peak: Peak Reliability myates@peakrc.com Attention: Matthew Yates Title: Associate General Counsel If to Customer: [CUSTOMER NAME] Facsimile: [FAX NUMBER] [ [ ADDRESS]] Attention: [NAME OF OFFICER TO RECEIVE NOTICES] Title: [TITLE OF OFFICER TO RECEIVE NOTICES] Notices sent in accordance with this section shall be deemed effectively given: (a) when received, if delivered by hand (with written confirmation of receipt); (b) when received, if sent by a nationally recognized overnight courier (receipt requested); (c) on the date sent by if sent during normal business hours of the recipient, and on the next business day, if sent after normal business hours of the recipient; or (d) on the 3rd

11 day after the date mailed, by certified or registered mail, return receipt requested, postage prepaid Headings. The headings in this Agreement are for reference only and shall not affect the interpretation of this Agreement Entire Agreement. This Agreement, including all Service Orders and other Schedules and Exhibits and any other documents, agreements or instruments incorporated by reference herein, constitutes the sole and entire agreement of the parties to this Agreement with respect to the subject matter contained herein, and supersedes all prior and contemporaneous understandings and agreements, both written and oral, with respect to such subject matter Assignment. Neither party shall assign or otherwise transfer any of its rights, or delegate or otherwise transfer any of its obligations or performance, under this Agreement, by operation of law or otherwise, without the other party's prior written consent, which consent shall not unreasonably be withheld or delayed No Third-party Beneficiaries. This Agreement is for the sole benefit of the parties hereto and their respective permitted successors and permitted assigns and nothing herein, express or implied, is intended to or shall confer on any other person or entity any legal or equitable right, benefit or remedy of any nature whatsoever under or by reason of this Agreement Amendment and Modification; Waiver. This Agreement may only be amended, modified or supplemented by an agreement in writing signed by each party hereto. No waiver by any party of any of the provisions hereof shall be effective unless explicitly set forth in writing and signed by the party so waiving. Except as otherwise set forth in this Agreement, no failure to exercise, or delay in exercising, any right, remedy, power or privilege arising from this Agreement shall operate or be construed as a waiver thereof; nor shall any single or partial exercise of any right, remedy, power or privilege hereunder preclude any other or further exercise thereof or the exercise of any other right, remedy, power or privilege Severability. If any term or provision of this Agreement is invalid, illegal or unenforceable in any jurisdiction, such invalidity, illegality or unenforceability shall not affect any other term or provision of this Agreement or invalidate or render unenforceable such term or provision in any other jurisdiction. Upon such determination that any term or other provision is invalid, illegal or unenforceable, the parties hereto shall negotiate in good faith to modify this Agreement so as to effect the original intent of the parties as closely as possible in a mutually acceptable manner in order that the transactions contemplated hereby be consummated as originally contemplated to the greatest extent possible.

12 13.11 Governing Law; Submission to Jurisdiction. This Agreement, and all related documents and all matters arising out of or relating to this Agreement, shall be governed by the laws of the state of Washington. The forum and venue for all disputes shall be in Clark County, WA; Customer hereby consents and waives any objections to personal jurisdiction Clark County, WA The following Schedules and Exhibits are attached hereto and incorporated herein: Schedule A Service Orders and Pricing Counterparts. This Agreement may be executed in counterparts, each of which shall be deemed an original, but all of which together shall be deemed to be one and the same agreement and will become effective and binding upon the parties as of the Effective Date at such time as all the signatories hereto have signed a counterpart of this Agreement. A signed copy of this Agreement delivered by or other means of electronic transmission (to which a signed PDF copy is attached) shall be deemed to have the same legal effect as delivery of an original signed copy of this Agreement. [SIGNATURE PAGE FOLLOWS]

13 IN WITNESS WHEREOF, the parties hereto have caused this Agreement to be executed as of the Effective Date by their duly authorized representatives. Peak Customer By: _ Name: Title: Date: By: _ Name: Title: Date:

14 SCHEDULE A SERVICE ORDERS AND PRICING With this Service Order, Customer notifies Peak that it requests the Services described in the Agreement. Customer agrees to pay the Fees and Expenses listed below in order to obtain access to the Services. All payments shall be in US dollars and made at Customer's option by check or wire transfer to Peak Reliability, 7600 NE 41 st Street, Suite 15 Vancouver, WA or Key Bank, ABA# , ACCT# SERVICE ORDER NO. (PEAK TO PROVIDE) This Service Order, effective as of the last signature date set forth below, is a part of and incorporated into the Physical Security Risk Assessment Verification Agreement between [NAME OF ORGANIZATION] as Customer and Peak as Vendor, dated, ("Agreement"). Capitalized terms not defined in this Service Order are as defined in the Agreement. In the event of any conflict between the body of the Agreement and this Service Order, the body of the Agreement shall govern. Payment Schedule: Flat Fee: A payment of $2000 is due upon execution of this contract prior to the start of Peak provision of Services. Hourly Rate: In addition to the Flat Fee, Peak will charge for the Services, and Customer accepts, an hourly rate as recorded by Peak of $ per hour. Peak will invoice Customer on a monthly basis not to exceed 31 days from the end of the month following performance of the work. Peak By: _ Name: Title: Date: Customer By: _ Name: Title: Date: