Personnel Controls The County Department/Agency agrees to advise County Workers who have access to Pll, of the confidentiality of the information, the safeguards required to protect the information, and the civil and criminal sanctions for non- compliance contained in applicable federal and state laws. For that purpose, the County Department/Agency shall implement the following personnel controls:
Administrative Controls The Contractor must have the following controls in place:
Data Input Control It will be possible to retrospectively examine and establish whether and by whom Personal Data have been entered, modified or removed from SAP data processing systems. Measures: • SAP only allows authorized personnel to access Personal Data as required in the course of their duty. • SAP has implemented a logging system for input, modification and deletion, or blocking of Personal Data by SAP or its subprocessors within the Cloud Service to the extent technically possible.
Personal Controls a. Employee Training. All workforce members who assist in the performance of functions or activities on behalf of COUNTY in connection with Agreement, or access or disclose PHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY, must complete information privacy and security training, at least annually, at CONTRACTOR’s expense. Each workforce member who receives information privacy and security training must sign a certification, indicating the member’s name and the date on which the training was completed. These certifications must be retained for a period of six (6) years following the termination of Agreement.
Access Controls a. Authorized Access - DST shall have controls that are designed to maintain the logical separation such that access to systems hosting Fund Data and/or being used to provide services to Fund will uniquely identify each individual requiring access, grant access only to authorized personnel based on the principle of least privileges, and prevent unauthorized access to Fund Data.
Technical Security Controls 35 a. Workstation/Laptop encryption. All workstations and laptops that store PHI COUNTY 36 discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of 37 COUNTY either directly or temporarily must be encrypted using a FIPS 140-2 certified algorithm which 1 is 128bit or higher, such as AES. The encryption solution must be full disk unless approved by the 2 COUNTY.
Restrictive Controls Either Party may use protective network traffic management controls such as 7-digit and 10-digit code gaps set at appropriate levels on traffic toward each other's network, when required, to protect the public switched network from congestion due to facility failures, switch congestion, or failure or focused overload. CLEC and CenturyLink will immediately notify each other of any protective control action planned or executed.
Security Controls Annually, upon Fund’s reasonable request, Transfer Agent shall provide Fund’s Chief Information Security Officer or his or her designee with a copy of its corporate information security controls that form the basis for Transfer Agent’s Security Policy and an opportunity to discuss Transfer Agent’s information security measures, and a high level summary of any vulnerability testing conducted by Transfer Agent on its information security controls, with a qualified member of Transfer Agent’s information technology management team. Transfer Agent shall review its Security Policy annually.
Supervisory Control and Data Acquisition (SCADA) Capability The wind plant shall provide SCADA capability to transmit data and receive instructions from the ISO and/or the Connecting Transmission Owner for the Transmission District to which the wind generating plant will be interconnected, as applicable, to protect system reliability. The Connecting Transmission Owner for the Transmission District to which the wind generating plant will be interconnected and the wind plant Developer shall determine what SCADA information is essential for the proposed wind plant, taking into account the size of the plant and its characteristics, location, and importance in maintaining generation resource adequacy and transmission system reliability in its area.
Control Area Notification At least three months before Initial Synchronization Date, Interconnection Customer shall notify Distribution Provider in writing of the Control Area in which the Generating Facility will be located. If Interconnection Customer elects to locate the Generating Facility in a Control Area other than the Control Area in which the Generating Facility is physically located, and if permitted to do so by the relevant transmission tariffs, all necessary arrangements, including but not limited to those set forth in Article 7 and Article 8 of this GIA, and remote Control Area generator interchange agreements, if applicable, and the appropriate measures under such agreements, shall be executed and implemented prior to the placement of the Generating Facility in the other Control Area.
