Data Security Assessments. Prior to being provided access to any Company Data, Provider will complete the Company data security assessment review process, and Provider will implement System and process improvements identified by the Company data security assessment review process within a reasonable period of time as mutually agreed upon by Provider and Company. Provider further agrees that Company may, through a duly licensed firm designated by Company, perform on-site and remote evaluations and assessments of Provider’s facilities and Systems to determine whether Provider’s measures for safeguarding Company Data conform to this Agreement.
Data Security Assessments. In accordance with Security Assessment Frequency attached hereto as Exhibit 7 - Security Assessment Frequency, Service Provider agrees that AXP may, through a duly licensed firm (“Agent”) designated by AXP, perform on-site and/or remote evaluations and assessments of Service Provider’s facilities and systems to determine whether Service Provider’s measures for safeguarding Customer Information conform to the SysTrust Principles and Criteria for Security and Confidentiality as then currently published by the American Institute of Certified Public Accountants (AICPA) and the Canadian Institute of Chartered Accountants (CICA). Service Provider agrees to implement systems and process improvements identified in a written report resulting from such assessment as necessary to bring its Customer Information safeguards process into conformity with SysTrust Security and Confidentiality Principles within a reasonable period of time as mutually agreed upon by Service Provider and AXP. (v)
