Incident Response Program. (i) Without limiting Section 5.2(a), EVERTEC represents and warrants to COMPANY and BPPR that it has implemented, and hereby undertakes to maintain and update, a comprehensive response program that includes processes and procedures (including notification procedures to Affected Persons) designed to address incidents of unauthorized access involving Personal Data in accordance with applicable Legal Requirements and Industry Standards.
Incident Response Program. An incident response program that complies with Legal Requirements to address any actual or suspected information security incident (as defined in applicable Legal Requirements) involving unauthorized access to the parties’ physical or electronic systems that either compromises or could compromise sensitive information. A Security Incident includes but is not limited to physical trespass on a secure facility, computing systems intrusion/hacking, loss/theft of a PC (laptop or desktop), loss/theft of printed materials, etc. To the extent not prohibited by law or an enforcement agency, the party that becomes aware of the Security Incident will notify the other party in writing within 24 hours (or within the time required by law, whichever is sooner) following its discovery of any Security Incident that involves Subscriber’s customers’ consumer information. The party that originates the Security Incident will take all reasonable steps to immediately mitigate and/or remedy such Security Incident and prevent any further breach in accordance with applicable Legal Requirements. Any notification to the other party must include periodic meetings to discuss and report the available facts, the status of the investigation, the estimated effects on Subscriber’s customer’s, and, if applicable, the potential number of affected customers. The Parties agree to cooperate fully with each other on any investigation, corrective action and response or affected customers notice requirements. Except as strictly required by applicable law, Security Software Solutions will not communicate with any third party, including but not limited to the media, vendors, and affected customers, regarding the Security Incident, as it relates to Subscriber, without Subscriber’s express consent, The parties will mutually agree on the content of the communication, which will abide by Subscriber’s regulatory requirements. To the extent a party is the source of the Security Incident it shall assume the costs related to responding to, and mitigating damages caused by any Security Incident, including all regulatory fines and costs of investigation, notification and/or remediation. Such party shall also defend, indemnify and hold harmless Subscriber and its subsidiaries, affiliates, and respective officers, directors, employees, agents, successors and permitted assigns from and against all losses, damages, liabilities, deficiencies, actions, judgments, interest, awards, penalties, fines, costs or expense...
Incident Response Program. Combination of incident response policy, plan, and procedures.
Incident Response Program. As part of its security program, the security staff has established a computer security incident response program so Alert Logic can recognize, analyze, and handle information security incidents and threats. Incidents or events impacting Alert Logic are processed utilizing Incident Management and Handling processes which cover Alert Logic's computing, network, data, physical and human resources components of the system. The incident handling plan includes preparation, identification, containment, eradication, recovery and lessons learned phases. Incident handling plans, processes and procedures are reviewed and tested at least annually. ANNEX 4 Description of Processing Data subjects Data Exporter may submit Customer Data to the Services, the extent of which is determined and controlled by the Data Exporter in its sole discretion, and which may include, but is not limited to Customer Data relating to the following categories of data subjects: ▪ Customers, business partners, and vendors of the Data Exporter (who are natural persons) ▪ Employees or contact persons of Data Exporter customers, business partners, and vendors ▪ Employees, agents, advisors, contractors, or any user authorized by the Data Exporter to use the Service (who are natural persons) Categories of data Data Exporter may submit Customer Data, the extent of which is determined and controlled by the Data Exporter in its sole discretion, and which may include, but is not limited to the following categories of Customer Data: ▪ First and last name ▪ Business contact information (company, email, phone, physical business address) ▪ Personal contact information (email, cell phone) ▪ Title ▪ Position ▪ Employer ▪ ID data ▪ Professional life data ▪ Personal life data (in the form of security questions and answers) ▪ Connection data ▪ Localization data ▪ Network data (including source and destination IP addresses) ▪ Log data Processing operations / Purpose of processing The Customer Data transferred will be subject to the following basic processing activities (please specify):
Incident Response Program. Xxxxxxxxx maintains a written incident response program that addresses cybersecurity event preparation, detection, analysis, containment, eradication, and recovery. This program includes procedures that describe: (i) roles and responsibilities of the incident response team; (ii) communication requirements with internal and external partners; (iii) plans to detect, respond to, and contain common incident categories; (iv) methods to preserve evidence, maintain chain of custody, and perform forensic analysis; (v) coordination of recovery processes; (vi) follow-up processes; and (vii) reporting to ensure critical details of incidents are tracked and lessons learned are incorporated into ongoing response procedures, training, and testing. The incident response program includes coordinating incident handling activities involving supply chain events with other organizations involved in the supply chain. The incident response program is reviewed and updated at least annually.
