Compliance and Certifications. AWS maintains rigorous compliance with industry standards and data protection certifications, including ISO/IEC 27001:2022, 27017:2015, 27018:2019, 27701:2019, 22301:2019, 20000-1:2018, 9001:2015, and CSA STAR CCM v4.0. These certifications demonstrate AWS's commitment to maintaining the highest standards of data security and privacy. A full list of AWS services covered under these certifications can be found at the provided AWS compliance link xxxxx://xxx.xxxxxx.xxx/compliance/iso-certified/
Compliance and Certifications. Bio-ITech will maintain a comprehensive written information security program according to ISO-27001 that complies with applicable Privacy Laws, including mandatory training to Bio-ITech’s Personnel who have access to Personal Information regarding the privacy, confidentiality and information security requirements set forth in the Agreement. Bio-ITech’s information security program and the information security programs of its Affiliates and all Subcontractors will include appropriate administrative, technical, physical, organizational and operational safeguards and other security measures designed to: (i) ensure the security and confidentiality of Personal Information; (ii) protect against any anticipated threats or hazards to the security and integrity of Personal Information; (iii) protect against any Information Security Incident; and (iv) protect against the use of the Services or Bio-ITech’s System as a portal to give unauthorized access to any other systems of Client.
Compliance and Certifications. Compliance and certification requirements will depend on the type of service provided by the Contractor.
Compliance and Certifications. Compliance and certification requirements will depend on the type of service provided by the Contractor. For Cloud Services, the Contractor must at all times satisfy at least one of the following security standards: compliance requirements identified for a Cloud Service Provider, in the Government of Canada Security Control Profile for Cloud-Based GC IT Services for Protected B, Medium Integrity and Medium Availability (PBMM); or compliance requirements identified for a Cloud Service Provider, in the US Federal Risk and Authorization Management Program (FedRAMP) for moderate impact information systems; or certification with ISO/IEC 27001 based on requirements for a Cloud Service Provider controls in ISO/IEC 27017:2015; or certification with Cloud Security Alliance (CSA) – Level 2 CSA STAR; For all other Services that are not cloud services, the Contractor must satisfy: certification with ISO/IEC 27001 based on requirements for Information Technology controls in ISO/IEC 27002:2013; or applicable Province IM/IT standards accessible at xxxxx://xxx0.xxx.xx.xx/gov/content/governments/services-for-government/policies-procedures/im-it-standards Attestation of Compliance and Certification of Services To verify compliance with, as applicable, section 4(a) (with respect to Cloud Services) or 4(b) (with respect to non-Cloud Services), the Contractor must provide the Province with satisfactory evidence, by way of independent third-party attestation from a reputable information systems auditor, that any Services provided by the Contractor or used by the Contractor in connection with the Services satisfy and comply with at least one of the security standards set forth in, as applicable, section 4(a) (with respect to Cloud Services) or 4(b) (with respect to non-Cloud Services). Access Control With respect to the access, by any Contractor personnel, to any part of the Contractor’s Systems that may contain Province Information, the Contractor must: implement access control policies and procedures that address onboarding, off- boarding, transition between roles, regular access reviews, limitations and usage control of administrator privileges, and inactivity timeouts; identify and segregate conflicting duties and areas of responsibility, such as separation of duties; maintain a current and accurate inventory of computer accounts; review the inventory of computer accounts on a regular basis to identify dormant, fictitious or unused accounts; enforce principles of “least priv...
Compliance and Certifications
