Data Security and Disaster Recovery Sample Clauses

Open Split View

Download

Share

Cite

Data Security and Disaster Recovery. 1. Describe how your company will meet the requirements outlined in 2.11 Data Security and Disaster Recovery.

Sample 1

Save

Copy

Related to Data Security and Disaster Recovery

• Business Continuity and Disaster Recovery Bank shall maintain and update from time to time business continuation and disaster recovery procedures with respect to its global custody business, which are designed, in the event of a significant business disruption affecting Bank, to be sufficient to enable Bank to resume and continue to perform its duties and obligations under this Agreement without undue delay or disruption. Bank shall test the operability of such procedures at least annually. Bank shall enter into and shall maintain in effect at all times during the term of this Agreement reasonable provision for (i) periodic back-up of the computer files and data with respect to Customer and (ii) use of alternative electronic data processing equipment to provide services under this Agreement. Upon reasonable request, Bank shall discuss with Customer any business continuation and disaster recovery procedures of Bank. Bank represents that its business continuation and disaster recovery procedures are appropriate for its business as a global custodian to investment companies registered under the 1940 Act.

• Archival Back-Up and Disaster Recovery Licensee may use and copy the Product and related Documentation in connection with: i) reproducing a reasonable number of copies of the Product for archival backup and disaster recovery procedures in the event of destruction or corruption of the Product or disasters or emergencies which require Licensee to restore backup(s) or to initiate disaster recovery procedures for its platform or operating systems; ii) reproducing a reasonable number of copies of the Product and related Documentation for cold site storage. “Cold Site” storage shall be defined as a restorable back-up copy of the Product not to be installed until and after the declaration by the Licensee of a disaster; iii) reproducing a back-up copy of the Product to run for a reasonable period of time in conjunction with a documented consolidation or transfer otherwise allowed herein. “Disaster Recovery” shall be defined as the installation and storage of Product in ready-to-execute, back-up computer systems prior to disaster or breakdown which is not used for active production or development.

• System Security and Data Safeguards When SAP is given access to Licensee’s systems and data, SAP shall comply with Licensee’s reasonable administrative, technical, and physical safeguards to protect such data and guard against unauthorized access. In connection with such access, Licensee shall be responsible for providing Consultants with user authorizations and passwords to access its systems and revoking such authorizations and terminating such access, as Licensee deems appropriate from time to time. Licensee shall not grant SAP access to Licensee systems or personal information (of Licensee or any third party) unless such access is essential for the performance of Services under the Agreement. The parties agree that no breach of this provision shall be deemed to have occurred in the event of SAP non-conformance with the aforementioned safeguard but where no personal information has been compromised.

• Data Security and Privacy Plan As more fully described herein, throughout the term of the Master Agreement, Vendor will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data it receives from the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with the terms of the District’s Bill of Rights for Data Security and Privacy, a copy of which is set forth below and has been signed by the Vendor. Additional components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows:

• Data Security The Provider agrees to utilize administrative, physical, and technical safeguards designed to protect Student Data from unauthorized access, disclosure, acquisition, destruction, use, or modification. The Provider shall adhere to any applicable law relating to data security. The provider shall implement an adequate Cybersecurity Framework based on one of the nationally recognized standards set forth set forth in Exhibit “F”. Exclusions, variations, or exemptions to the identified Cybersecurity Framework must be detailed in an attachment to Exhibit “H”. Additionally, Provider may choose to further detail its security programs and measures that augment or are in addition to the Cybersecurity Framework in Exhibit “F”. Provider shall provide, in the Standard Schedule to the DPA, contact information of an employee who XXX may contact if there are any data security concerns or questions.

• Disaster Recovery PFPC shall enter into and shall maintain in effect with appropriate parties one or more agreements making reasonable provisions for emergency use of electronic data processing equipment to the extent appropriate equipment is available. In the event of equipment failures, PFPC shall, at no additional expense to the Fund, take reasonable steps to minimize service interruptions. PFPC shall have no liability with respect to the loss of data or service interruptions caused by equipment failure, provided such loss or interruption is not caused by PFPC's own willful misfeasance, bad faith, gross negligence or reckless disregard of its duties or obligations under this Agreement.

• Data Security and Privacy 12.1 SERVICE PROVIDER acknowledges the importance of Data Security and agrees to adhere to the Terms and Conditions of the Data Security Policy of IIMC.

• Security and Data Privacy Each party will comply with applicable data privacy laws governing the protection of personal data in relation to their respective obligations under this Agreement. Where Siemens acts as Customer’s processor of personal data provided by Customer, the Data Privacy Terms available at xxxxx://xxx.xxxxxxx.xxx/dpt/sw, including the technical and organizational measures described therein, apply to the use of the relevant Learning Services and are incorporated herein by reference.

• Data Security and Unauthorized Data Release The Requester and Approved Users, including the Requester’s IT Director, acknowledge NIH’s expectation that they have reviewed and agree to manage the requested controlled-access dataset(s) and any Data Derivatives of controlled-access datasets according to NIH’s expectations set forth in the current NIH Security Best Practices for Controlled-Access Data Subject to the GDS Policy and the Requester’s IT security requirements and policies. The Requester, including the Requester’s IT Director, agree that the Requester’s IT security requirements and policies are sufficient to protect the confidentiality and integrity of the NIH controlled-access data entrusted to the Requester. If approved by NIH to use cloud computing for the proposed research project, as outlined in the Research and Cloud Computing Use Statements of the Data Access Request, the Requester acknowledges that the IT Director has reviewed and understands the cloud computing guidelines in the NIH Security Best Practices for Controlled-Access Data Subject to the NIH GDS Policy. The Requester and PI agree to notify the appropriate DAC(s) of any unauthorized data sharing, breaches of data security, or inadvertent data releases that may compromise data confidentiality within 24 hours of when the incident is identified. As permitted by law, notifications should include any known information regarding the incident and a general description of the activities or process in place to define and remediate the situation fully. Within 3 business days of the DAC notification, the Requester agrees to submit to the DAC(s) a detailed written report including the date and nature of the event, actions taken or to be taken to remediate the issue(s), and plans or processes developed to prevent further problems, including specific information on timelines anticipated for action. The Requester agrees to provide documentation verifying that the remediation plans have been implemented. Repeated violations or unresponsiveness to NIH requests may result in further compliance measures affecting the Requester. All notifications and written reports of data security incidents and policy compliance violations should be sent to the DAC(s) indicated in the Addendum to this Agreement. NIH, or another entity designated by NIH may, as permitted by law, also investigate any data security incident or policy violation. Approved Users and their associates agree to support such investigations and provide information, within the limits of applicable local, state, tribal, and federal laws and regulations. In addition, Requester and Approved Users agree to work with the NIH to assure that plans and procedures that are developed to address identified problems are mutually acceptable and consistent with applicable law.

• COMPLIANCE WITH BREACH NOTIFICATION AND DATA SECURITY LAWS Contractor shall comply with the provisions of the New York State Information Security Breach and Notification Act (General Business Law § 899-aa and State Technology Law § 208) and commencing March 21, 2020 shall also comply with General Business Law § 899-bb.