Common use of Data Protection and Data Security Clause in Contracts

Data Protection and Data Security. In addition to the requirements of paragraph 7, Professional shall have in place information security safeguards designed to conform to or exceed industry best practices regarding the protection of the confidentiality, integrity and availability of utility and customer information and shall have written agreements requiring any subcontractor to meet those standards. These information security safeguards (the “Information Security Program”) shall be materially consistent with, or more stringent than, the safeguards described in this Exhibit. a) Professional’s information security safeguards shall address the following elements:  Data Storage, Backups and Disposal  Logical Access Control (e.g., Role-Based)  Information Classification and Handling  Secure Data Transfer (SFTP and Data Transfer Specification)  Secure Web Communications  Network and Security Monitoring  Application Development Security  Application Security Controls and Procedures (User Authentication, Security Controls, and Security Procedures, Policies and Logging)  Incident Response  Vulnerability Assessments  Hosted Services  Personnel Security

Data Protection and Data Security. In addition to the requirements of paragraph 7, Professional shall have in place information security safeguards designed to conform to or exceed industry best practices regarding the protection of the confidentiality, integrity and availability of utility and customer information and shall have written agreements requiring any subcontractor to meet those standards. These information security safeguards (the “Information Security Program”) shall be materially consistent with, or more stringent than, the safeguards described in this Exhibit. a) Professional’s information security safeguards shall address the following elements:  • Data Storage, Backups and Disposal  • Logical Access Control (e.g., Role-Based)  • Information Classification and Handling  • Secure Data Transfer (SFTP and Data Transfer Specification)  • Secure Web Communications  • Network and Security Monitoring  • Application Development Security  • Application Security Controls and Procedures (User Authentication, Security Controls, and Security Procedures, Policies and Logging)  • Incident Response  • Vulnerability Assessments  • Hosted Services  • Personnel Security