Colorado Springs approves cybersecurity research framework with U.S. Cyber Command
The framework allows research ranging from audits to hands-on testing, but each research plan requires written approval from both parties.
Published at
Colorado Springs City Council voted 8-0 on Nov. 10, with Councilmember Rainey recusing himself, to approve a resolution authorizing Colorado Springs Utilities’ chief executive to enter a cooperative cybersecurity research agreement with U.S. Cyber Command, the council meeting record shows. Any research plan must receive advance written approval from authorized officials of both parties.
The agreement’s potential scope includes research on Utilities’ information-technology and operational-technology networks, equipment and software, including industrial control systems, supervisory control and data acquisition systems, internet-connected devices and remote-access systems. Possible activities include site inspections, network assessments, penetration testing, exercises and sharing network packet-capture data, the agreement’s joint work plan says.
At the meeting, Utilities enterprise-security general manager Jessica Reignsmith described expected initial work as audits and site surveys, and said Cyber Command would not operate or change utility systems. The agreement also permits hands-on research, subject to the required approvals. Cyber Command must receive prior written approval to access Utilities facilities, and Utilities can limit or revoke access or suspend or end work it considers unacceptably risky.
The agreement bars Cyber Command from retaining or disclosing customer or employee data obtained through the research and requires it to sanitize media containing Utilities data. The work plan estimates Utilities’ contribution at $250,000 in staff time, facilities and equipment, with no cash contribution listed.
The agreement describes the intended benefit as stronger cybersecurity capacity, resilience and reliability for the utility and community, as well as protection for military installations Utilities serves. It calls for interim and annual reports on work completed, objectives met, technology developed and benefits received. The agreement provides for a 60-month term, and either party may terminate it for any reason with at least 30 days’ written notice.
The council resolution authorizes Utilities’ chief executive to enter an agreement in substantially similar form; the publicly posted copy has blank signature and effective-date fields, the resolution says.