Access to Vendor Systems Sample Clauses

Access to Vendor Systems. If Contract Personnel is granted Access to Vendor Systems, the Vendor shall: ensure each individual has a unique user identification and password known only to such individual for his/her sole use. promptly provide to TSP such reports as TSP shall from time to time require,, concerning the Vendor’s use and security of access to Vendor Systems. allow Access only to the minimum extent required to enable the Contract Personnel perform their duties. allow Access using a secure login process. establish and implement formal procedures to control the allocation and de-allocation of Access rights. ensure that the allocation and use of enhanced privileges and access to sensitive tools and facilities in Vendor Systems are controlled and limited to only those users who have a business need. ensure that the allocation of user passwords to Vendor Systems that hold or access TSP Information is controlled through a formal auditable management process. conduct regular reviews of user ids and their Access rights. provide processes to demonstrate that remote and home working activities are only permitted where Authorised by TSP and subject to appropriate security controls within the Vendor’s organisation including but not limited to remote Access by users being subject to strong authentication. demonstrate that users follow security best practice in the management of their passwords. implement a password management system which provides a secure and effective interactive facility that ensures quality passwords. ensure that user sessions are terminated after a defined period of inactivity. ensure that audit logs are generated to record user activity and security-relevant events and securely managed and retained with nil ability on the part of the Vendor to allow any un-authorised access or amendment to the audit logs. Such audit logs must be maintained for future reference for a period of at least one year. ensure that monitoring of audit and event logs and analysis reports for anomalous behaviour and/or attempted unauthorised access are performed by Vendor’s staff independent of those users being monitored. make available audit logs where required by TSP for review. ensure all systems holding, processing or accessing TSP Information shall be hardened to TSP standards (Note to Buyer: If in doubt, please contact TSP Security). ensure that to the extent possible, development, test and live environments are segregated from each other and the other work areas in Vendor buildings...

Access to Vendor Systems. 6.1 If Contract Personnel is granted Access to Vendor Systems, the Vendor shall: a) ensure each individual has a unique user identification and password known only to such individual for his/her sole use. b) promptly provide to TSP such reports as TSP shall from time to time require,, concerning the Vendor’s use and security of access to Vendor Systems. c) allow Access only to the minimum extent required to enable the Contract Personnel perform their duties. d) allow Access using a secure login process. e) establish and implement formal procedures to control the allocation and de-allocation of Access rights. f) ensure that the allocation and use of enhanced privileges and access to sensitive tools and facilities in Vendor Systems are controlled and limited to only those users who have a business need. g) ensure that the allocation of user passwords to Vendor Systems that hold or access TSP Information is controlled through a formal auditable management process. h) conduct regular reviews of user ids and their Access rights. i) provide processes to demonstrate that remote and home working activities are only permitted where Authorised by TSP and subject to appropriate security controls within the Vendor’s organisation including but not limited to remote Access by users being subject to strong authentication. j) demonstrate that users follow security best practice in the management of their passwords. k) implement a password management system which provides a secure and effective interactive facility that ensures quality passwords. l) ensure that user sessions are terminated after a defined period of inactivity. m) ensure that audit logs are generated to record user activity and security-relevant events and securely managed and retained with nil ability on the part of the Vendor to allow any un-authorised access or amendment to the audit logs. Such audit logs must be maintained for future reference for a period of at least one year. n) ensure that monitoring of audit and event logs and analysis reports for anomalous behaviour and/or attempted unauthorised access are performed by Vendor’s staff independent of those users being monitored. o) make available audit logs where required by TSP for review. p) ensure all systems holding, processing or accessing TSP Information shall be hardened to TSP standards (Note to Buyer: If in doubt, please contact TSP Security). q) ensure that to the extent possible, development, test and live environments are segregated from ...