Discovery and Notification of Breach of Confidential Information. In addition to the requirements set forth in any applicable Business Associate Agreement as may be attached to this Contract, in the event of a breach of security or suspected security incident, intrusion, unauthorized use or disclosure involving Confidential Information, the Vendor shall notify OIT by telephone call (000-000-0000) and email to the OIT information security team (Xxxxxxxx.Xxxxxxxxxxxxxx@xxxxx.xxx) within the following timeframes:
A. Upon the discovery of a breach of security or suspected security incident involving Confidential Information in electronic, or any other medium if the information was, or is reasonably believed to have been, acquired by an unauthorized person; or
B. Within twenty-four (24) hours of the discovery of any suspected security incident, intrusion, unauthorized use or disclosure of Confidential Information in violation of this Agreement, or potential loss of Confidential Information affecting this Agreement. Notification shall also be provided to the OIT Contract Manager and the OIT Information Security Officer. The Vendor shall provide a written report of all information known at the time. The Vendor shall take:
A. Prompt corrective action to mitigate any risks or damages involved with the breach and to protect the operating environment; and
B. Any action pertaining to such unauthorized disclosure required by applicable federal and state laws and regulations.
