1. Computer equipment supplied:

• preferred standard of the server, desktop computer, laptop or other computer equipment compatible with the current configuration in place for UTC (information currently available for review in IT PWK);
• preferred operating system compatible with UTC policy (information currently available for review in IT PWK);
• Supplier shall provide acknowledgement of legality (license certificate, invoice) for each type of software installed;
• Supplier shall set forth terms of warranty and service for the computer hardware supplied;
• PWK does not allow the Supplier to take hard disks and other information carriers used for testing and/or production purposes (in the system provided) out of the company premises.

• precisely set forth the purpose of using such modem and its preferred configuration;
• precisely set forth the purpose of using such network card and its preferred configuration.

• Supplier’s employees’ access to the computer configuration is limited to the fewest possible access rights enabling repairing a defect, setting configuration during implementation etc. in case such items are part of the order, contract and are set forth therein;
• during the final acceptance of the equipment/design etc., the Supplier agrees to provide all rights, access passwords to the systems and applications provided under the service, order etc.;
• the rights should be provided in writing in a sealed envelope to PWK IT representative receipt acknowledged;
• access rights are subject to verification by PWK (IT, W74) employees;
• Supplier may not be granted a privileged user rights (administrator, root etc.) to the computer equipment provided while it is used in the production process

• Supplier shall present a written acceptance of the Non-Disclosure Agreement which is required prior to any cooperation;
• Supplier states, warrants, agrees and expresses its consent that access to PWK computer systems is granted for the period not longer than the term of this Agreement;
• Supplier agrees to meet the export control terms on data transfer (if required).

• Contents on WWW are protected by copyright owned by PWK. Implementation and use of tools applied to search for contents must comply with UTC policy. In case the tools used to search for contents make copies of reference data, such copies are subject to the same protection as such reference data;
• Supplier shall regularly update WWW sites containing PWK data through an electronic interface. PWIK is responsible for defining the range of data and frequency of updating.

11. All applications must use standard authorization and access control tools (current tools: SiteMinder by Netegrity, Inc) or such applications need to have features implemented to ensure security and compliance with UTC policy, including, but not limited to the following:

• passwords of the computer system users must be difficult to guess, any dictionary words or words similar to individual ID, sequential strings of characters from the keyboard, e.g. 123456, asdfgh, personal data (e.g. date of birth), commonly used acronyms, proper names of locations etc. are prohibited;
• passwords must be at least 6 character long and be changed at least once every 90 days
• IDs connected with work automation are subject to the following restrictions for passwords:
  • a) passwords must be longer that 14 characters;
  • b) passwords must be complicated (applying at least 3 rules, such as special characters, upper and lower case and alphanumeric characters);
• minimum password life is 1 day; passwords can be reused after 6 months;
• passwords may not be displayed or kept in an open file (without encoding);
• IDs of those users who have not used their account for 3 months, must be blocked, and removed after 6 months of the user’s account  inactivity;
• where possible, there must UTC approved information (banner) before access to the system is granted.

12. Supplier is responsible for ensuring compliance of Goods and/or Services with UTC security policy in place.

13. Supplier must provide a copy of the current security policy on data storage and processing and of the policy of physical access to equipment where PWK data are stored and/or processed. Supplier should annually provide current PWK security policy and present a plan including dates of planned updates.

14. PWK or a designated third party is allowed to conduct a security audit in the Supplier’s premises without notification. In case PWK data are stored in a shared environment, PWK may appoint a third party to conduct such audit. The audit must take all facilities and equipment into consideration, where PWK data are stored including their backup, and may verify whether all necessary controls were implemented in compliance with UTC security policy.

• Supplier states that UTC policies and practices regarding security shall be referred to when performing Purchase Order/Agreement/Service etc.;
• Supplier agrees to act in compliance with export control requirements;
• Supplier agrees to verify the past  of individuals involved in communication with PWK;
• Supplier ensures it has necessary procedures of controlling and monitoring information functions;
• Supplier ensures it is able top detect intrusion or an attempt to intrude the computer systems;
• Supplier confirms authorization of users when granting remote access to PWK equipment;
• Supplier ensures software integrity procedures;
• Supplier confirms it is protected against malicious procedures (e.g. viruses, intrusion detection);
• Supplier confirms its participation in security alert services;
• Supplier confirms its use of secure communication channels in case of remote connection;
• Supplier ensures protection from significant known information attacks;
• Supplier ensures physical and logical segregation of access to PWK/UTC information;
• Supplier ensures proper physical safety;
• Supplier ensures corrective actions regarding any defects and procedures once such defects appear.