Common use of INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES Clause in Contracts

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS is responsible only for breaches associated with DSS systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA X. XXXXX defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS the VA agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS the VA experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS the VA agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS the VA is responsible only for breaches associated with DSS the VA systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS DHS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS DHS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS DHS agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS DHS is responsible only for breaches associated with DSS DHS systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS HUD agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS HUD experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS HUD agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS HUD is responsible only for breaches associated with DSS HUD systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS the Department agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below:the C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS the Department experiences a loss of PII provided under this Agreement, the Party that who caused the loss or whose system experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017).Identifiable E. USAC and DSS the Department agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. USAC and the Department have a responsibility to notify individual data subjects of data breach or suspected data breach, and, will work to mutually agree upon the notice to individual data subjects. The Party that experienced the incident will also be responsible for following its internal established procedures, including::  Notifying the proper organizations (e.g., United States Computer Emergency Readiness Team (US-CERT), the Information Systems Security Officers (ISSOs), and other contacts listed in this document);  Conducting a breach and risk analysis, and making a determination of the need for notice and/or remediation to individuals affected by the loss; and  Providing such notice and credit monitoring at no cost to the other Party, if the analysis conducted by the Party having experienced the loss incident indicates that individual notice and credit monitoring are appropriate. F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS the Department is responsible only for breaches associated with DSS Department systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS FSSA/DFR agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS FSSA/DFR experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS FSSA/DFR agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS FSSA/DFR is responsible only for breaches associated with DSS FSSA/DFR systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.”imminently B. USAC and DSS DHHS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS DHHS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS DHHS agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS DHHS is responsible only for breaches associated with DSS DHHS systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA X. XXXXX defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS PDHS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS PDHS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS PDHS agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS PDHS is responsible only for breaches associated with DSS PDHS systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” Subject to the limitations set forth in Section VIII.A of this Agreement, DWSS will work in good faith with USAC to report and track incidents in accordance with the most current, final version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. For the purpose of this Agreement, an incident is defined as “an An occurrence that (A1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; , or (B2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. ” Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named Party as provided below: C. B. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. C. If either USAC or DSS experiences a loss of PII USAC Data provided under this Agreement, the Party that experienced the loss incident USAC will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017).OMB E. D. USAC and DSS DWSS agree to notify all the Security Contact(s) named listed in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PIIUSAC Data. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. E. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS is responsible only for breaches associated with DSS systems.breaches

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS the Department agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS the Department experiences a loss of PII data provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017)) and the Department will comply with Xxxx. Stat. §§ 13.05 and 13.055. E. USAC and DSS the Department agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including:procedures effective at the time of the incident. F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS the Department is responsible only for breaches associated with DSS the Department systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS agree The Grantee agrees to report and track incidents in accordance with the most current current, final version of Department of Homeland Security and the United States Computer Emergency Readiness Team (USNIST Special Publication 800-CERT) guidelines61. Upon detection of an incident related to this interconnection, the Party experiencing the incident Grantee will promptly notify HUD’s System Security Contacts below. 1. The Grantee will promptly notify the other Party’s System Security Contact(s) named below:following contact at HUD simultaneously: HUD National Help Desk 0-000-000-0000. C. B. If the Party Grantee experiencing the incident cannot is unable to speak with the other PartyHUD’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., for example: outside of normal business hours), then this the following contact information shall will be used:. 1. HUD Help Desk: (000) 000-0000 C. Neither HUD nor the Grantee will be liable for any cause of action arising from the possession, control, or use of survivor/registrant PII by an entity other than HUD or the Grantee, or for any loss, claim, damage, or liability, of whatsoever kind or nature, which may arise from or in connection with this Agreement or the use of survivor/registrant PII. D. If either USAC or DSS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS agree The Grantee agrees to notify all the System Security Contact(s) Contacts named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a suspected or confirmed breach (or suspected breach) involving PII. The Party that experienced If the incident Grantee experiences an incident, it will also be responsible for following its internal established procedures, procedures including: F. 1. Notifying the proper organizations such as the United States Computer Emergency Readiness Team (US-CERT), the ISSOs, and other contacts listed in this document, 2. Conducting a breach and risk analysis and determining the need for notice and/or remediation to individuals affected by the loss, and 3. Providing such notice and credit monitoring to the affected individuals at no cost to HUD if the analysis, conducted by the Grantee having experienced the incident, indicates that individual notice and credit monitoring are appropriate. E. In the event of any incident arising from or in connection with this Agreement, each Party party will be responsible only for costs and/or and litigation arising from a breach of the Partyparty’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS is responsible only for breaches associated with DSS systemssystems or data.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA X. XXXXX defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS the Department agree to report and track incidents in accordance with the most current version of the Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS the Department experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS the Department agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including:this F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS the Department is responsible only for breaches associated with DSS the Department systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA X. XXXXX defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS OIT agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below:this C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used:practical D. If either USAC or DSS OIT experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS OIT agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS OIT is responsible only for breaches associated with DSS OIT systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.”threat B. USAC and DSS DWS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below:this C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used:: Department of Workforce Services, Information, Security and Facilities Director, Xxxxxxx Xxxxxxxx: (000) 000-0000; xxxxxx@xxxx.xxx. D. If either USAC or DSS DWS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017).M-17- E. USAC and DSS DWS agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS DWS is responsible only for breaches associated with DSS DWS systems. USAC and the FCC shall not be liable to DWS or to any third person for any cause of action arising from the possession, control, or use by DWS of applicant or subscriber PII, or for any loss, claim, damage or liability, of whatever kind or nature, which may arise from or in connection with this Agreement or using applicant or subscriber PII. DWS shall not be liable to USAC or to any third person for any cause of action arising from the possession, control, or use by USAC of applicant or subscriber PII, or for any loss, claim, damage or liability, of whatever kind or nature, which may arise from or in connection with this Agreement or using applicant or subscriber PII. Nothing in this section shall be construed as a waiver of sovereign immunity against suits by third persons.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA X. XXXXX defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS Agencies agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS Agencies experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS Agencies agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS is Agencies are responsible only for breaches associated with DSS Agencies systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS DSHS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used:practical D. If either USAC or DSS DSHS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS DSHS agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including:procedures effective at the time of the incident. F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS DSHS is responsible only for breaches associated with DSS DSHS systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA X. XXXXX defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS DES agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS DES experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS DES agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS DES is responsible only for breaches associated with DSS DES systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA X. XXXXX defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS DWSS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS DWSS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS DWSS agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS DWSS is responsible only for breaches associated with DSS DWSS systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS HSD agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS HSD experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS HSD agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS HSD is responsible only for breaches associated with DSS HSD systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA X. XXXXX defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS CHFS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below:this C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS CHFS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS CHFS agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS CHFS is responsible only for breaches associated with DSS CHFS systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS the VA agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS the VA experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS the VA agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS the VA is responsible only for breaches associated with DSS the VA systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA X. XXXXX defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS HUD agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS HUD experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS HUD agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including:procedures effective at the time of the incident. F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS is responsible only for breaches associated with DSS systems.and

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA X. XXXXX defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS Department agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used:practical D. If either USAC or DSS Department experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS Department agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS Department is responsible only for breaches associated with DSS Department systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA X. XXXXX defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS FSSA/DFR agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS FSSA/DFR experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS FSSA/DFR agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS FSSA/DFR is responsible only for breaches associated with DSS FSSA/DFR systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS CHFS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS CHFS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS CHFS agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including:procedures effective at the time of the incident. F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS CHFS is responsible only for breaches associated with DSS CHFS systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.”imminently B. USAC and DSS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS is responsible only for breaches associated with DSS systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS MDHS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS MDHS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS MDHS agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS MDHS is responsible only for breaches associated with DSS MDHS systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA X. XXXXX defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS TN DHS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS TN DHS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS TN DHS agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS TN DHS is responsible only for breaches associated with DSS TN DHS systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA X. XXXXX defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS MDHS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below:this C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS MDHS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS MDHS agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS MDHS is responsible only for breaches associated with DSS MDHS systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS the Department agree to report and track incidents in accordance with the most current version of The Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS the Department experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS the Department agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS the Department is responsible only for breaches associated with DSS the Department’s systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS VDSS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS VDSS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS VDSS agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including:procedures effective at the time of the incident. F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS VDSS is responsible only for breaches associated with DSS VDSS systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS the Department agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS the Department experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS the Department agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including:will F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS the Department is responsible only for breaches associated with DSS the Department systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA X. XXXXX defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS DHHS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS DHHS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS DHHS agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS DHHS is responsible only for breaches associated with DSS DHHS systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS DCF agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used:practical D. If either USAC or DSS DCF experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS DCF agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS DCF is responsible only for breaches associated with DSS DCF systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.”of B. USAC and DSS TN DHS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS TN DHS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS TN DHS agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS TN DHS is responsible only for breaches associated with DSS TN DHS systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA X. XXXXX defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS DSHS agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS DSHS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017).reporting E. USAC and DSS DSHS agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including: F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS DSHS is responsible only for breaches associated with DSS DSHS systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS HSD agree to report and track incidents in accordance with the most current version of Department of Homeland Security and the United States Computer Emergency Readiness Team (US-CERT) guidelines. Upon detection of an incident related to this interconnection, the Party experiencing the incident will promptly notify the other Party’s System Security Contact(s) named below: C. If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then this contact information shall be used: D. If either USAC or DSS HSD experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS HSD agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving PII. The Party that experienced the incident will also be responsible for following its internal established procedures, including:procedures effective at the time of the incident. F. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS HSD is responsible only for breaches associated with DSS HSD systems.

INCIDENT REPORTING AND NOTIFICATION RESPONSIBILITIES. A. FISMA defines “incident” as “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” B. USAC and DSS agree The Grantee agrees to report and track incidents in accordance with the most current current, final version of Department of Homeland Security and the United States Computer Emergency Readiness Team (USNIST Special Publication 800-CERT) guidelines61. Upon detection of an incident related to this interconnection, the Party experiencing the incident Grantee will promptly notify HUD’s System Security Contacts below. 1. The Grantee will promptly notify the other Party’s System Security Contact(s) named below:following contact at HUD simultaneously: HUD National Help Desk 0-000-000-0000. C. B. If the Party Grantee experiencing the incident cannot is unable to speak with the other PartyHUD’s System Security Contacts within one (1) hour, or if contacting the System Security Contact is not practical (e.g., for example: outside of normal business hours), then this the following contact information shall will be used:. 1. HUD Help Desk: (000) 000-0000 C. Neither HUD nor the Grantee will be liable for any cause of action arising from the possession, control, or use of survivor/registrant PII by an entity other than HUD or the Grantee, or for any loss, claim, damage, or liability, of whatsoever kind or nature, which may arise from or in connection with this Agreement or the use of survivor/registrant PII. D. If either USAC or DSS experiences a loss of PII provided under this Agreement, the Party that experienced the loss incident will also comply with the PII breach reporting and security requirements set forth by OMB M-17-12, “Preparing and Responding to a Breach of Personally Identifiable Information” (January 3, 2017). E. USAC and DSS agree The Grantee agrees to notify all the System Security Contact(s) Contacts named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a suspected or confirmed breach (or suspected breach) involving PII. The Party that If the Grantee experienced the incident an incident, it will also be responsible for following its internal established procedures, procedures including: F. 1. Notifying the proper organizations such as the United States Computer Emergency Readiness Team (US-CERT), the ISSOs, and other contacts listed in this document, 2. Conducting a breach and risk analysis and determining the need for notice and/or remediation to individuals affected by the loss, and 3. Providing such notice and credit monitoring to the affected individuals at no cost to HUD if the analysis, conducted by the Grantee having experienced the incident, indicates that individual notice and credit monitoring are appropriate. E. In the event of any incident arising from or in connection with this Agreement, each Party party will be responsible only for costs and/or and litigation arising from a breach of the Partyparty’s own systems; USAC is responsible only for costs and litigation associated with breaches to USAC systems, and DSS is responsible only for breaches associated with DSS systemssystems or data.