Documenting Security Controls in the Security Design Plan (SDP Sample Clauses

Documenting Security Controls in the Security Design Plan (SDP. 6.2.1 When the SDP is Required
AutoNDA by SimpleDocs
Documenting Security Controls in the Security Design Plan (SDP. ⮉ 6.2.1 When the SDP and Risk Assessment are Required ⮉ EIEPs must submit an SDP and a security risk assessment (RA) for evaluation when one or more of the following circumstances apply. The RA must be in electronic format. It must include discussion of the measures planned or implemented to mitigate risks identified by the RA and (as applicable) risks associated with the circumstances below: • to obtain approval for requested access to SSA-provided information for an initial agreement • to obtain approval to reestablish previously terminated access to SSA-provided data • to obtain approval to implement a new operating or security platform that will involve SSA-provided information • to obtain approval for significant changes to the EIEP’s organizational structure, technical processes, operational environment, data recovery capabilities, or security implementations planned or made since approval of their most recent SDP or of their most recent successfully completed security review • to confirm compliance when one or more security breaches or incidents involving SSA-provided information occurred since approval of the EIEP’s most recent SDP or of their most recent successfully completed security review • to document descriptions and explanations of measures implemented as the result of a data breach or security incident • to document descriptions and explanations of measures implemented to resolve non-compliancy issue(s) • to obtain a new approval after SSA revoked approval of the most recent SDP SSA may require a new SDP if changes occurred (other than those listed above) that may affect the terms of the EIEP’s information sharing agreement with SSA. An SDP must satisfactorily document the EIEP’s compliance with all of SSA’s SSRs in order to provide the minimum level of security acceptable to SSA for its EIEP’s access to SSA-provided information. EIEP’s must correct deficiencies identified through the evaluation of the SDP and submit a revised SDP that incorporates descriptions and explanations of the measures implemented to eliminate the deficiencies. SSA cannot grant access to SSA-provided information until the EIEP corrects the deficiencies, documents the SDP, and SSA approves the revisions. The EIEP will communicate the implementation of corrective actions to SSA on a regular basis. SSA will withhold final approval until the EIEP can rectify all deficiencies. SSA may revoke the approval of the EIEP’s SDP and its access to SSA-provided information if we...

Related to Documenting Security Controls in the Security Design Plan (SDP

  • Indenture Controls If and to the extent that any provision of the Notes limits, qualifies or conflicts with a provision of this Indenture, such provision of this Indenture shall control.

  • Implementation of and Reporting on the Project A. The Grantee shall implement and complete the Project in accordance with Exhibit A and with the plans and specifications contained in its Grant Application, which is on file with the State and is incorporated by reference. Modification of the Project shall require prior written approval of the State. B. The Grantee shall submit to the State written progress reports until the completion of the Project. These reports shall be submitted upon request by the State and shall contain such detail of progress or performance on the Project as is requested by the State.

  • Security Controls for State Agency Data In accordance with Senate Bill 475, Acts 2021, 87th Leg., R.S., pursuant to Texas Government Code, Section 2054.138, Contractor understands, acknowledges, and agrees that if, pursuant to this Contract, Contractor is or will be authorized to access, transmit, use, or store data for System Agency, Contractor is required to meet the security controls the System Agency determines are proportionate with System Agency’s risk under the Contract based on the sensitivity of System Agency’s data and that Contractor must periodically provide to System Agency evidence that Contractor meets the security controls required under the Contract.

  • Personal Controls a. Employee Training. All workforce members who assist in the performance of functions or activities on behalf of COUNTY in connection with Agreement, or access or disclose PHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY, must complete information privacy and security training, at least annually, at CONTRACTOR’s expense. Each workforce member who receives information privacy and security training must sign a certification, indicating the member’s name and the date on which the training was completed. These certifications must be retained for a period of six (6) years following the termination of Agreement.

  • Disclosure Controls and Procedures; Deficiencies in or Changes to Internal Control Over Financial Reporting The Company has established and maintains disclosure controls and procedures (as defined in Rules 13a-15 and 15d-15 under the Exchange Act), which (i) are designed to ensure that material information relating to the Company, including its consolidated subsidiaries, is made known to the Company’s principal executive officer and its principal financial officer by others within those entities, particularly during the periods in which the periodic reports required under the Exchange Act are being prepared; (ii) have been evaluated by management of the Company for effectiveness as of the end of the Company’s most recent fiscal quarter; and (iii) are effective in all material respects to perform the functions for which they were established. Since the end of the Company’s most recent audited fiscal year, there have been no significant deficiencies or material weakness in the Company’s internal control over financial reporting (whether or not remediated) and no change in the Company’s internal control over financial reporting that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting. The Company is not aware of any change in its internal control over financial reporting that has occurred during its most recent fiscal quarter that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting.

  • Accounting Controls and Disclosure Controls The Company and each of its subsidiaries maintain effective internal control over financial reporting (as defined under Rule 13-a15 and 15d-15 under the 1934 Act Regulations) and a system of internal accounting controls sufficient to provide reasonable assurances that (A) transactions are executed in accordance with management’s general or specific authorization; (B) transactions are recorded as necessary to permit preparation of financial statements in conformity with GAAP and to maintain accountability for assets; (C) access to assets is permitted only in accordance with management’s general or specific authorization; (D) the recorded accountability for assets is compared with the existing assets at reasonable intervals and appropriate action is taken with respect to any differences; and (E) the interactive data in eXtensible Business Reporting Language incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus fairly presents the information called for in all material respects and is prepared in accordance with the Commission’s rules and guidelines applicable thereto. Except as described in the Registration Statement, the General Disclosure Package and the Prospectus, since the end of the Company’s most recent audited fiscal year, there has been (1) no material weakness in the Company’s internal control over financial reporting (whether or not remediated) and (2) no change in the Company’s internal control over financial reporting that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting. The Company and each of its subsidiaries maintain an effective system of disclosure controls and procedures (as defined in Rule 13a-15 and Rule 15d-15 under the 1934 Act Regulations) that are designed to ensure that information required to be disclosed by the Company in the reports that it files or submits under the 1934 Act is recorded, processed, summarized and reported, within the time periods specified in the Commission’s rules and forms, and is accumulated and communicated to the Company’s management, including its principal executive officer or officers and principal financial officer or officers, as appropriate, to allow timely decisions regarding disclosure.

  • Security Controls Annually, upon Fund’s reasonable request, DST shall provide Fund’s Chief Information Security Officer or his or her designee with a summary of its corporate information security policy and an opportunity to discuss DST’s information security measures, and a high level and non-confidential summary of any penetration testing related to the provision of in-scope services . DST shall review its Security Policy annually.

  • CERTIFICATIONS; DISCLOSURE CONTROLS AND PROCEDURES The Adviser acknowledges that, in compliance with the Xxxxxxxx-Xxxxx Act of 2002 (the “Xxxxxxxx-Xxxxx Act”), and the implementing regulations promulgated thereunder, the Trust and the Fund are required to make certain certifications and have adopted disclosure controls and procedures. To the extent reasonably requested by the Trust, the Adviser agrees to use its best efforts to assist the Trust and the Fund in complying with the Xxxxxxxx-Xxxxx Act and implementing the Trust’s disclosure controls and procedures. The Adviser agrees to inform the Trust of any material development related to the Fund that the Adviser reasonably believes is relevant to the Fund’s certification obligations under the Xxxxxxxx-Xxxxx Act.

  • Internal Controls; Listing; Financial Statements (a) Except as not required in reliance on exemptions from various reporting requirements by virtue of Acquiror’s status as an “emerging growth company” within the meaning of the Securities Act, as modified by the JOBS Act or as otherwise set forth in the Acquiror SEC Filings, Acquiror has established and maintains disclosure controls and procedures (as defined in Rule 13a-15 under the Exchange Act). Such disclosure controls and procedures are designed to (i) ensure that material information relating to Acquiror, including its consolidated Subsidiaries, if any, is made known to Acquiror’s principal executive officer and its principal financial officer by others within those entities, particularly during the periods in which the periodic reports required under the Exchange Act are being prepared; and (ii) be effective in timely alerting Acquiror’s principal executive officer and principal financial officer to material information required to be included in Acquiror’s periodic reports required under the Exchange Act. Acquiror has established and maintained a system of internal controls over financial reporting (as defined in Rule 13a-15 under the Exchange Act) which is reasonably sufficient to provide reasonable assurance regarding the reliability of Acquiror’s financial reporting and the preparation of Acquiror Financial Statements for external purposes in accordance with GAAP. (b) To the knowledge of Acquiror, except as set forth in Section 6.6(b) of the Acquiror Disclosure Letter, each director and executive officer of Acquiror has filed with the SEC on a timely basis all statements required by Section 16(a) of the Exchange Act and the rules and regulations promulgated thereunder. (c) The Acquiror SEC Filings contain true and complete copies of the audited balance sheet as of May 17, 2022, and statement of operations, cash flow and shareholders’ equity of Acquiror for the period from February 25, 2021 (inception) through May 17, 2022, together with the auditor’s reports thereon (the “Acquiror Financial Statements”). Except as disclosed in the Acquiror SEC Filings, the Acquiror Financial Statements (i) fairly present in all material respects the financial position of Acquiror, as at the respective dates thereof, and the results of operations and consolidated cash flows for the respective periods then ended, (ii) were prepared in conformity with GAAP applied on a consistent basis during the periods involved (except as may be indicated therein or in the notes thereto), and (iii) comply in all material respects with the applicable accounting requirements and with the rules and regulations of the SEC, the Exchange Act and the Securities Act in effect as of the respective dates thereof. The books and records of Acquiror have been, and are being, maintained in all material respects in accordance with GAAP and any other applicable legal and accounting requirements. (d) There are no outstanding loans or other extensions of credit made by Acquiror to any executive officer (as defined in Rule 3b-7 under the Exchange Act) or director of Acquiror. Acquiror has not taken any action prohibited by Section 402 of the Xxxxxxxx-Xxxxx Act. (e) Neither Acquiror nor any director or officer of Acquiror nor, to the knowledge of Acquiror, any employee of Acquiror or Acquiror’s independent auditors has identified or been made aware of (i) any significant deficiency or material weakness in the system of internal accounting controls utilized by Acquiror, (ii) any fraud, whether or not material, that involves Acquiror’s management or other employees who have a role in the preparation of financial statements or the internal accounting controls utilized by Acquiror or (iii) any claim or allegation regarding any of the foregoing.

  • Technical Security Controls 35 a. Workstation/Laptop encryption. All workstations and laptops that store PHI COUNTY 36 discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of 37 COUNTY either directly or temporarily must be encrypted using a FIPS 140-2 certified algorithm which 1 is 128bit or higher, such as AES. The encryption solution must be full disk unless approved by the 2 COUNTY.

Draft better contracts in just 5 minutes Get the weekly Law Insider newsletter packed with expert videos, webinars, ebooks, and more!