Information and Documents (a) From and after the date of this Agreement and to the earlier of the Closing Date and the date on which this Agreement is terminated pursuant to Section 9.1, to the extent permitted by applicable Law and upon reasonable advance notice, and solely for purposes of integration planning or in furtherance of the transactions contemplated by this Agreement and the Ancillary Agreements, (1) Seller Parent shall, and shall cause its Subsidiaries to, permit Purchaser Parent and its Representatives to have reasonable access, during normal business hours, to the books and records that constitute Purchased Assets, and to such personnel, offices and other facilities and properties that constitute Purchased Assets, and to provide such other information in respect of the Business as may be reasonably requested by Purchaser Parent for such purposes and (2) Purchaser Parent shall, and shall cause its Subsidiaries to, permit Seller Parent and its Representatives to have reasonable access, during normal business hours, to the books and records of Purchaser and its Subsidiaries or that are related to the Purchaser Business (provided that Purchaser Parent may redact any information in any such record not related to the Purchaser Business), and to such personnel, offices and other facilities and properties of Purchaser and its Subsidiaries or that are related to the Purchaser Business, and to provide such other information in respect of the Purchaser Business as may be reasonably requested by Seller Parent for such purposes; provided that all requests for access pursuant to this Section 6.1 shall be directed to and coordinated with a person or persons designated by Seller Parent or Purchaser Parent, as applicable, in writing; provided, further, that each Parent and its Subsidiaries may restrict the foregoing access or the provision of such information to the extent that, in the reasonable judgment of such Parent, (i) applicable Law requires such Parent or any of its Subsidiaries to restrict or prohibit such access or the provision of such information, (ii) providing such access would unreasonably interfere with the operation of such Parent’s and its Subsidiaries’ respective businesses, including the Business and the Purchaser Business, as applicable, (iii) providing such access or information would breach a confidentiality obligation to a third party, (iv) providing such access or information would result in disclosure of any information that is competitively or commercially sensitive, (v) in the case of access or information provided by Seller Parent, the information relates to the Strategic Process, or in the case of access or information provided by Purchaser Parent, the information relates to review of strategic alternatives with respect to the Purchaser Business, or (vi) providing such access or disclosure of any such information would reasonably be expected to result in the loss or waiver of the attorney-client or other applicable privilege or protection. In the event that a Parent or its Subsidiaries restricts access or withholds information on the basis of the foregoing clauses (i) through (vi), such Parent shall, if permitted, inform the other Parent as to the general nature of what is being restricted or withheld and the reason therefor, and such Parent shall, and shall cause its Subsidiaries to, use its commercially reasonable efforts to make appropriate substitute arrangements to permit disclosure of the relevant information in a manner that does not suffer from such impediments. Notwithstanding the foregoing, (A) prior to the Closing, neither Parent, nor any of its Affiliates and Representatives, shall conduct any phase II environmental site assessment or conduct any invasive testing or any sampling of soil, sediment, surface water, groundwater or building material at, on, under or within any property of the other Parent or its Subsidiaries and (B) prior to Closing, none of Seller Parent or any of its Affiliates, including the Conveyed Subsidiaries (and their Subsidiaries), shall provide Business Employee personnel files to Purchaser Parent or its Affiliates or Representatives and none of Purchaser Parent or any of its Affiliates, including Purchaser (and its Subsidiaries), shall provide Purchaser Business Employee personnel files to Seller Parent or its Affiliates or Representatives. Notwithstanding the foregoing, following Closing (x) to the extent permitted by Law, Seller Parent shall, and shall cause its Affiliates to, provide Purchaser and its Subsidiaries access to personnel records and other personnel information related to the Business Employees and Former Business Employees reasonably requested by Purchaser and its Subsidiaries and (y) Seller Parent shall, and shall cause its Affiliates to, retain all material records related to the Business Employees and Former Business Employees in accordance with Seller Parent’s records retention policies and, in no event, for less than such period of time required by applicable Law. It is further agreed that, prior to the Closing, each Parent and its Affiliates and Representatives shall not contact any of the directors, officers, employees, agents, customers, suppliers, licensors, licensees, distributors or other business partners of the other Parent or any of its Affiliates (including, with respect to Seller Parent, the Conveyed Subsidiaries (or their Subsidiaries) and, with respect to Purchaser Parent, Purchaser and its Subsidiaries) in connection with the transactions contemplated by this Agreement, whether in person or by telephone, mail or other means of communication, without the specific prior authorization by the other Parent (not to be unreasonably withheld, conditioned or delayed); provided that the foregoing shall not prevent any Parent or its Affiliates from operating in the ordinary course of business and communicating with such parties on matters unrelated to the Business or the Purchaser Business, as applicable, and the transactions contemplated by this Agreement. Notwithstanding anything to the contrary contained herein, in no event shall Seller Parent or any of its Affiliates, including the Conveyed Subsidiaries (and their Subsidiaries), be required to provide any information as and to the extent it relates to any Retained Businesses, any Excluded Assets or any Retained Liabilities, or be required to provide a copy of, or otherwise disclose the contents of, any Seller Combined Tax Return, and in no event shall Purchaser Parent or any of its Affiliates, including Purchaser and its Subsidiaries, be required to provide any information as and to the extent it relates to any Purchaser Parent Retained Businesses or any Purchaser Parent Retained Liabilities. The Parties agree that, with respect to any matters that are the subject of both this Section 6.1(a) and Section 6.5(i), the provisions of Section 6.5(i) (and not this Section 6.1(a)) shall control.
(b) Subject to Section 6.12, all information received or otherwise obtained by either Parent or its Affiliates or Representatives from, by or on behalf of the other Parent or any of its Affiliates or Representatives, in connection with the negotiation, execution, performance or consummation of this Agreement and the transactions contemplated hereby, whether prior to, on or following the date of this Agreement, will be held by such Parent and its Affiliates and Representatives pursuant to the terms of the Confidentiality Agreement and Section 6.12. Subject to Section 6.12(d), the Confidentiality Agreement and the Clean Team Agreement shall remain in full force and effect in accordance with their terms (subject to Section 9.2(d)) notwithstanding any termination of this Agreement.
(c) From and after the date of this Agreement until the earlier of the Closing Date and the date on which this Agreement is terminated pursuant to Section 9.1, Seller Parent and its Subsidiaries shall consult with and provide material updates to Purchaser Parent regarding the matters disclosed on Section 6.1(c) of the Purchaser Disclosure Letter.
New Hampshire Specific Data Security Requirements The Provider agrees to the following privacy and security standards from “the Minimum Standards for Privacy and Security of Student and Employee Data” from the New Hampshire Department of Education. Specifically, the Provider agrees to:
(1) Limit system access to the types of transactions and functions that authorized users, such as students, parents, and LEA are permitted to execute;
(2) Limit unsuccessful logon attempts;
(3) Employ cryptographic mechanisms to protect the confidentiality of remote access sessions;
(4) Authorize wireless access prior to allowing such connections;
(5) Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity;
(6) Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions;
(7) Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles;
(8) Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services;
(9) Enforce a minimum password complexity and change of characters when new passwords are created;
(10) Perform maintenance on organizational systems;
(11) Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance;
(12) Ensure equipment removed for off-site maintenance is sanitized of any Student Data in accordance with NIST SP 800-88 Revision 1;
(13) Protect (i.e., physically control and securely store) system media containing Student Data, both paper and digital;
(14) Sanitize or destroy system media containing Student Data in accordance with NIST SP 800-88 Revision 1 before disposal or release for reuse;
(15) Control access to media containing Student Data and maintain accountability for media during transport outside of controlled areas;
(16) Periodically assess the security controls in organizational systems to determine if the controls are effective in their application and develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems;
(17) Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems;
(18) Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception);
(19) Protect the confidentiality of Student Data at rest;
(20) Identify, report, and correct system flaws in a timely manner;
(21) Provide protection from malicious code (i.e. Antivirus and Antimalware) at designated locations within organizational systems;
(22) Monitor system security alerts and advisories and take action in response; and
(23) Update malicious code protection mechanisms when new releases are available.
