Common use of Incidents Clause in Contracts

Incidents. 36.1. If Agency becomes aware of an Incident involving Data by either Agency or any of Agency’s Subcontractors, Agency shall notify USBE within one (1) calendar day and cooperate with USBE regarding recovery, remediation, and the necessity to involve law enforcement, if any. 36.2. Agency shall produce a written remediation plan that includes information about the cause and extent of the Incident and the actions Agency will take to remediate the Incident and to reduce the risk of incurring a similar type of Incident in the future. Agency shall present its analysis and remediation plan to USBE within ten (10) calendar days of notifying USBE of an Incident. USBE reserves the right to adjust this plan, in its sole discretion. If Agency cannot produce its analysis and plan within the allotted time, USBE, in its sole discretion, may perform such analysis and produce a remediation plan, and Agency shall reimburse USBE for the reasonable costs thereof.‌ 36.3. In the event of an Incident, Agency shall provide USBE or its designated representatives with access seven (7) days a week, twenty-four (24) hours a day, for the purpose of evaluating, mitigating, or resolving the Incident. 36.4. Unless Agency can establish that Agency or any of its Subcontractors is not the cause or source of the Incident, Agency shall be responsible for the cost of notifying each person whose personal information may have been compromised by the Incident. ATTACHMENT B SCOPE OF DATA SHARING

Incidents. 36.1. If Agency becomes aware of an Incident involving Data by either Agency or any of Agency’s Subcontractors, Agency shall notify USBE within one (1) calendar day and cooperate with USBE regarding recovery, remediation, and the necessity to involve law enforcement, if any. 36.2. Agency shall produce a written remediation plan that includes information about the cause and extent of the Incident and the actions Agency will take to remediate the Incident and to reduce the risk of incurring a similar type of Incident in the future. Agency shall present its analysis and remediation plan to USBE within ten (10) calendar days of notifying USBE of an Incident. USBE reserves the right to adjust this plan, in its sole discretion. If Agency cannot produce its analysis and plan within the allotted time, USBE, in its sole discretion, may perform such analysis and produce a remediation plan, and Agency shall reimburse USBE for the reasonable costs thereof.‌thereof. 36.3. In the event of an Incident, Agency shall provide USBE or its designated representatives with access seven (7) days a week, twenty-four (24) hours a day, for the purpose of evaluating, mitigating, or resolving the Incident. 36.4. Unless Agency can establish that Agency or any of its Subcontractors is not the cause or source of the Incident, Agency shall be responsible for the cost of notifying each person whose personal information may have been compromised by the Incident. ATTACHMENT B SCOPE OF DATA SHARING

Incidents. 36.1. If Agency becomes aware of an Incident involving Data by either Agency or any of Agency’s Subcontractors, Agency shall notify USBE within one three (13) calendar day days and cooperate with USBE regarding recovery, remediation, and the necessity to involve law enforcement, if any. 36.2. Agency shall produce a written remediation plan that includes information about the cause and extent of the Incident and the actions Agency will take to remediate the Incident and to reduce the risk of incurring a similar type of Incident in the future. Agency shall present its analysis and remediation plan to USBE within ten (10) calendar days of notifying USBE of an Incident. USBE reserves the right to adjust this plan, in its sole discretion. If Agency cannot produce its analysis and plan within the allotted time, USBE, in its sole discretion, may perform such analysis and produce a remediation plan, and Agency shall reimburse USBE for the reasonable costs thereof.‌thereof. 36.3. In the event of an Incident, Agency shall provide USBE or its designated representatives with access seven (7) days a week, twenty-four (24) hours a day, for the purpose of evaluating, mitigating, or resolving the Incident. 36.4. Unless Agency can establish that Agency or any of its Subcontractors is not the cause or source of the Incident, Agency shall be responsible for the cost of notifying each person whose personal information may have been compromised by the Incident. ATTACHMENT B SCOPE OF DATA SHARING.