INFORMATION SECURITY ARCHITECTURE Sample Clauses

INFORMATION SECURITY ARCHITECTURE a. This section III.6 applies to the extent that Vendor Group owns, supports, or is otherwise responsible for host(s), network(s), environment(s), or technology products (including hardware or software) which may contain University Data. b. Vendor represents and warrants that the design and architecture of Vendor Group’s systems (including but not limited to applications and infrastructure) shall be informed by the principle of defense-depth; controls at multiple layers designed to protect the confidentiality, integrity and availability of data. c. Vendor shall cause Vendor Group to make appropriate personnel vetting/background checks, have appropriate separation of duties, and undertake other such workflow controls over personnel activities as necessary to safeguard University Data. d. Vendor shall cause Vendor Group to follow change management procedures designed to keep Vendor Group’s systems current on security patches, and prevent unintended or unauthorized system configuration changes that could expose system vulnerability or lead to a Data Breach. e. To the extent that the Work involves software that was developed, in whole or part, by any of Vendor Group, then Vendor represents and warrants that such portion of the Work was developed within a software development life cycle (SDLC) process that includes security and quality assurance roles and control process intended to eliminate existing and potential security vulnerabilities. f. Vendor Group shall have appropriate technical perimeter hardening. Vendor Group shall monitor its system and perimeter configurations and network traffic for vulnerabilities, indicators of activities by threat actors, and/or the presence of Malicious Code. g. Vendor Group shall have access, authorization, and authentication technology appropriate for protecting University Data from unauthorized access or modification, and capable of accounting for access to University Data. The overall access control model of Vendor Group systems shall follow the principal of least privileges. h. Vendor Group shall safeguard University Data with encryption controls over University Data both stored and in transit. Vendor Group shall discontinue use of encryption methods and communication protocols which become obsolete or have become compromised. i. Vendor Group shall maintain a process for backup and restoration of data. Vendor represents and warrants that within the context of the Work, the appropriate members within Vendor Group are inc...
Sample 1See All (6)
AutoNDA by SimpleDocs
INFORMATION SECURITY ARCHITECTURE. Castellan maintains information security architecture for the information systems that includes an architectural description, the placement/allocation of security functionality (including security controls), security-related information for external interfaces, information being exchanged across the interfaces, and the protection mechanisms associated with each interface. The information security architecture is reviewed and updated regularly to reflect updates in the enterprise architecture, external impacts, and industry practices. These changes are reflected in the security plan, the security Concept of Operations (CONOPS), and organizational procurements/acquisitions.
Sample 1

Related to INFORMATION SECURITY ARCHITECTURE

  • Information Security IET information security management practices, policies and regulatory compliance requirements are aimed at assuring the confidentiality, integrity and availability of Customer information. The UC Xxxxx Cyber-safety Policy, UC Xxxxx Security Standards Policy (PPM Section 310-22), is adopted by the campus and IET to define the responsibilities and key practices for assuring the security of UC Xxxxx computing systems and electronic data.

  • Information Security Program (1) DTI shall implement and maintain a comprehensive written information security program applicable to the Personal Information ("Information Security Program") which shall include commercially reasonable measures, including, as appropriate, policies and procedures and technical, physical, and administrative safeguards that are consistent with industry standards, providing for (i) the security and confidentiality of the Personal Information, (ii) protection of the Personal Information against reasonably foreseeable threats or hazards to the security or integrity of the Personal Information, (iii) protection against unauthorized access to or use of or loss or theft of the Personal Information, and (iv) appropriate disposal of the Personal Information. Without limiting the generality of the foregoing, the Information Security Program shall provide for (i) continual assessment and re-assessment of the risks to the security of Personal Information acquired or maintained by DTI and its agents, contractors and subcontractors in connection with the Services, including but not limited to (A) identification of internal and external threats that could result in unauthorized disclosure, alteration or destruction of Personal Information and systems used by DTI and its agents, contractors and subcontractors, (B) assessment of the likelihood and potential damage of such threats, taking into account the sensitivity of such Personal Information, and (C) assessment of the sufficiency of policies, procedures, information systems of DTI and its agents, contractors and subcontractors, and other arrangements in place, to control risks; and (ii) appropriate protection against such risks. (2) The Information Security Program shall require encryption of any Personal Information in electronic format while in transit or in storage, and enhanced controls and standards for transport and disposal of physical media containing Personal Information. DTI shall, and shall require its agents, contractors and subcontractors who access or use Personal Information or Confidential Information to, regularly test key controls, systems and procedures relating to the Information Security Program ("ISP Tests"). DTI shall advise the Funds of any material issues identified in the ISP Tests potentially affecting the Information Security Program. (3) DTI shall comply with its Information Security Program.

  • Information Technology Enterprise Architecture Requirements If this Contract involves information technology-related products or services, the Contractor agrees that all such products or services are compatible with any of the technology standards found at xxxxx://xxx.xx.xxx/iot/2394.htm that are applicable, including the assistive technology standard. The State may terminate this Contract for default if the terms of this paragraph are breached.

  • SERVICE MONITORING, ANALYSES AND ORACLE SOFTWARE 11.1 We continuously monitor the Services to facilitate Oracle’s operation of the Services; to help resolve Your service requests; to detect and address threats to the functionality, security, integrity, and availability of the Services as well as any content, data, or applications in the Services; and to detect and address illegal acts or violations of the Acceptable Use Policy. Oracle monitoring tools do not collect or store any of Your Content residing in the Services, except as needed for such purposes. Oracle does not monitor, and does not address issues with, non-Oracle software provided by You or any of Your Users that is stored in, or run on or through, the Services. Information collected by Oracle monitoring tools (excluding Your Content) may also be used to assist in managing Oracle’s product and service portfolio, to help Oracle address deficiencies in its product and service offerings, and for license management purposes. 11.2 We may (i) compile statistical and other information related to the performance, operation and use of the Services, and (ii) use data from the Services in aggregated form for security and operations management, to create statistical analyses, and for research and development purposes (clauses i and ii are collectively referred to as “Service Analyses”). We may make Service Analyses publicly available; however, Service Analyses will not incorporate Your Content, Personal Data or Confidential Information in a form that could serve to identify You or any individual. We retain all intellectual property rights in Service Analyses. 11.3 We may provide You with the ability to obtain certain Oracle Software (as defined below) for use with the Services. If we provide Oracle Software to You and do not specify separate terms for such software, then such Oracle Software is provided as part of the Services and You have the non-exclusive, worldwide, limited right to use such Oracle Software, subject to the terms of this Agreement and Your order (except for separately licensed elements of the Oracle Software, which separately licensed elements are governed by the applicable separate terms), solely to facilitate Your use of the Services. You may allow Your Users to use the Oracle Software for this purpose, and You are responsible for their compliance with the license terms. Your right to use any Oracle Software will terminate upon the earlier of our notice (by web posting or otherwise) or the end of the Services associated with the Oracle Software. Notwithstanding the foregoing, if Oracle Software is licensed to You under separate terms, then Your use of such software is governed by the separate terms. Your right to use any part of the Oracle Software that is licensed under the separate terms is not restricted in any way by this Agreement.

  • Personal Information security breach Supplier/Service Provider’s Obligations a) The Supplier/Service Provider shall notify the Information Officer of Transnet, in writing as soon as possible after it becomes aware of or suspects any loss, unauthorised access or unlawful use of any personal data and shall, at its own cost, take all necessary remedial steps to mitigate the extent of the loss or compromise of personal data and to restore the integrity of the affected Goods/Services as quickly as is possible. The Supplier/Service Provider shall also be required to provide Transnet with details of the persons affected by the compromise and the nature and extent of the compromise, including details of the identity of the unauthorised person who may have accessed or acquired the personal data. b) The Supplier/Service Provider shall provide on-going updates on its progress in resolving the compromise at reasonable intervals until such time as the compromise is resolved. c) Where required, the Supplier/Service Provider may be required to notify the South African Police Service; and/or the State Security Agency and where applicable, the relevant regulator and/or the affected persons of the security breach. Any such notification shall always include sufficient information to allow the persons to take protective measures against the potential consequences of the compromise. d) The Supplier/Service Provider undertakes to co‑operate in any investigation relating to security which is carried out by or on behalf of Transnet including providing any information or material in its possession or control and implementing new security measures.

  • Electronic and Information Resources Accessibility and Security Standards a. Applicability: The following Electronic and Information Resources (“EIR”) requirements apply to the Contract because the Grantee performs services that include EIR that the System Agency's employees are required or permitted to access or members of the public are required or permitted to access. This Section does not apply to incidental uses of EIR in the performance of the Agreement, unless the Parties agree that the EIR will become property of the State of Texas or will be used by HHSC’s clients or recipients after completion of the Agreement. Nothing in this section is intended to prescribe the use of particular designs or technologies or to prevent the use of alternative technologies, provided they result in substantially equivalent or greater access to and use of a Product.

  • Technical Documentation Prior to commencement of the Tests on Completion, the Contractor shall supply to the Engineer the technical documentation as specified in the Employer’s Requirements. The Works or Section shall not be considered to be completed for the purposes of taking- over under sub-clause 10.1 [Taking Over of the Works and Sections] until the Engineer has received the technical documentation as defined in this sub-clause 5.7, the "history file" including design calculations and certain certification as well as any other documents required to meet the CE Marking requirements.

  • Information Regarding Collateral (a) Level 3 and the Borrower will furnish to the Collateral Agent prompt written notice of any change (i) in any Loan Party’s corporate name or in any trade name used to identify it in the conduct of its business or in the ownership of its properties, (ii) in any Loan Party’s identity or corporate structure or (iii) in any Loan Party’s Federal Taxpayer Identification Number. Each of Level 3 and the Borrower agrees not to effect or permit any change referred to in the preceding sentence unless all filings (or arrangements therefor satisfactory to the Collateral Agent) have been made under the Uniform Commercial Code or otherwise that are required in order for the Collateral Agent to continue at all times following such change to have a valid, legal and perfected security interest in all the Collateral. Each of Level 3 and the Borrower also agrees promptly to notify the Collateral Agent if any material portion of the Collateral is damaged or destroyed. (b) Each year, at the time of delivery of the certificate pursuant to paragraph (c) of Section 5.01, Level 3 shall deliver to the Collateral Agent certificates of an authorized officer of Level 3 (i) setting forth the information required pursuant to (A) the Annual Perfection Certificate and (B) until such time as the Collateral Permit Condition is satisfied with respect to Level 3 LLC, the Annual Loan Proceeds Note Perfection Certificate, or confirming that there has been no change in such information since the dates of the Effective Date Perfection Certificate or the Effective Date Loan Proceeds Note Perfection Certificate, as the case may be, or the date of the most recent certificates delivered pursuant to this Section and (ii) certifying that all Uniform Commercial Code financing statements (excluding fixture filings) or other appropriate filings, recordings or registrations, including all refilings, rerecordings and reregistrations, containing a description of the Collateral required to be set forth therein have been filed of record in each United States governmental, municipal or other appropriate office in each jurisdiction identified pursuant to clause (i) above to the extent necessary to perfect and continue the perfection of the security interests under the applicable Security Documents for a period of not less than 18 months after the date of such certificate (except as noted therein with respect to any continuation statements to be filed within such period).

  • Information/Cooperation Executive shall, upon reasonable notice, furnish such information and assistance to the Bank as may be reasonably required by the Bank, in connection with any litigation in which it or any of its subsidiaries or affiliates is, or may become, a party; provided, however, that Executive shall not be required to provide information or assistance with respect to any litigation between Executive and the Bank or any other subsidiaries or affiliates.

  • CERTIFICATION REGARDING CERTAIN FOREIGN-OWNED COMPANIES IN CONNECTION WITH CRITICAL INFRASTRUCTURE (Texas law as of September 1, 2021) By submitting a proposal to this Solicitation, you certify that you agree to the following required by Texas law as of September 1, 2021: Proposing Company is prohibited from entering into a contract or other agreement relating to critical infrastructure that would grant to the company direct or remote access to or control of critical infrastructure in this state, excluding access specifically allowed by the Proposing Company for product warranty and support purposes. Company, certifies that neither it nor its parent company nor any affiliate of company or its parent company, is (1) owned by or the majority of stock or other ownership interest of the company is held or controlled by individuals who are citizens of China, Iran, North Korea, Russia, or a designated country; (2) a company or other entity, including governmental entity, that is owned or controlled by citizens of or is directly controlled by the government of China, Iran, North Korea, Russia, or a designated country; or (3) headquartered in China, Iran, North Korea, Russia, or a designated country. For purposes of this contract, “critical infrastructure” means “a communication infrastructure system, cybersecurity system, electric grid, hazardous waste treatment system, or water treatment facility.” See Tex. Gov’t Code § 2274.0101(2) of SB 1226 (87th leg.). The company verifies and certifies that company will not grant direct or remote access to or control of critical infrastructure, except for product warranty and support purposes, to prohibited individuals, companies, or entities, including governmental entities, owned, controlled, or headquartered in China, Iran, North Korea, Russia, or a designated country, as determined by the Governor.

Draft better contracts in just 5 minutes Get the weekly Law Insider newsletter packed with expert videos, webinars, ebooks, and more!