Breach of Security Reporting and Remediation Sample Clauses

Breach of Security Reporting and Remediation. In the event of a Breach of Security that applies to Protected Purchasing Entity Information, Provider shall within twenty-four (24) hours of Provider’s confirmation of a Breach of Security to the Purchasing Entity at: Xxxxx.Xxxxxxx@xxxxxx.xxx. Provider will keep Purchasing Entity regularly informed of its investigation. Provider will reasonably cooperate closely with the Purchasing Entity in the investigation, reporting, remediation and resolution of the Breach of Security. Provider will reasonably cooperate with Purchasing Entity in the breach reporting obligations of the Oregon Consumer Information Protection Act and all applicable federal or state privacy or data protection statutes, rules, or regulations governing the Purchasing Entity and the Services; provided, however, that, unless otherwise prohibited by applicable law or regulation, prior to giving notice under the Oregon Consumer Information Protection Act or any other applicable reporting requirement, Provider shall first notify the Purchasing Entity’s point of contact under a Contract, and in any event, Provider’s notice to the Purchasing Entity shall occur within 24 hours of Provider’s confirmation of the breach. The Purchasing Entity must approve the form of any notices sent by the Provider to affected individuals or to the public, if such notices identify the Purchasing Entity.

Breach of Security Reporting and Remediation i. In the event of a Breach of Security that applies to Protected Authorized Purchaser Information, Provider shall immediately report the Breach of Security to the Authorized Purchaser project manager and cooperate closely with the Authorized Purchaser in the investigation, reporting, remediation and resolution of the Breach of Security. Provider shall comply with the breach reporting obligations of the Oregon ID Theft Act and all applicable federal or state privacy or data protection statutes, rules, or regulations governing the Authorized Purchaser and the Services; provided, however, that prior to giving notice under the Oregon ID Theft Act or any other applicable reporting requirement, Provider shall first notify the Authorized Purchaser’s point of contact under this Contract, and in any event, Provider’s notice to the Authorized Purchaser shall occur within 24 hours of Provider’s discovery of the breach. The Authorized Purchaser must approve the form of any notices sent by the Provider to affected individuals or to the public. ii. Provider will also promptly report to the Authorized Purchaser project manager (but in no event more than twenty-four (24) hours after the occurrence) any Breach of Security or unauthorized access to Provider’s systems that Provider detects or becomes aware of, whether or not such breach rises to a reportable level under the Oregon ID Theft Act or any other applicable reporting requirement, and whether or not the breach resulted in the loss of Protected Authorized Purchaser Information. Reportable incidents under this subsection include, without limitation, instances in which an individual accesses Provider’s systems in excess of the individual’s user rights, or uses the systems inappropriately. iii. Reports under this subsection (e) must be made by telephone and subsequently via e-mail and any other delivery requirement for giving notices under the Contract. The report shall include the approximate date and time of the occurrence and a summary of the relevant facts, including a description of measures being taken to address the occurrence. iv. Provider will use diligent efforts to remedy any Breach of Security that applies to Protected Authorized Purchaser Information or other breach of security or unauthorized access in a timely manner, and will deliver to the Authorized Purchaser a root cause assessment and future incident mitigation plan with regard to any such breaches or unauthorized access.