Security of Data a. Each of the parties shall: i. ensure as far as reasonably practicable, that Data is properly stored, is not accessible to unauthorised persons, is not altered, lost or destroyed and is capable of being retrieved only by properly authorised persons; ii. subject to the provisions of Sub-Clause 8.a. ensure that, in addition to any security, proprietary and other information disclosure provision contained in the Contract, Messages and Associated Data are maintained in confidence, are not disclosed or transmitted to any unauthorised person and are not used for any purpose other than that communicated by the sending party or permitted by the Contract; and iii. protect further transmission to the same degree as the originally transmitted Message and Associated Data when further transmissions of Messages and Associated Data are permitted by the Contract or expressly authorised by the sending party. b. The sending party shall ensure that Messages are marked in accordance with the requirements of the Contract. If a further transmission is made pursuant to Sub-Clause 3. a. iii. the sender shall ensure that such markings are repeated in the further transmission. c. The parties may apply special protection to Messages by encryption or by other agreed means, and may apply designations to the Messages for protective Interchange, handling and storage procedures. Unless the parties otherwise agree, the party receiving a Message so protected or designated shall use at least the same level of protection and protective procedures for any further transmission of the Message and its Associated Data for all responses to the Message and for all other communications by Interchange or otherwise to any other person relating to the Message. d. If either party becomes aware of a security breach or breach of confidence in relation to any Message or in relation to its procedures or systems (including, without limitation, unauthorised access to their systems for generation, authentication, authorisation, processing, transmission, storage, protection and file management of Messages) then it shall immediately inform the other party of such breach. On being informed or becoming aware of a breach the party concerned shall: i. immediately investigate the cause, effect and extent of such breach; ii. report the results of the investigation to the other party; and iii. use all reasonable endeavours to rectify the cause of such breach. e. Each party shall ensure that the contents of Messages that are sent or received are not inconsistent with the law, the application of which could restrict the content of a Message or limit its use, and shall take all necessary measures to inform without delay the other party if such an inconsistency arises.
Protection of Data The Contractor agrees to store Data on one or more of the following media and protect the Data as described: a. Hard disk drives. For Data stored on local workstation hard disks, access to the Data will be restricted to Authorized User(s) by requiring logon to the local workstation using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. b. Network server disks. For Data stored on hard disks mounted on network servers and made available through shared folders, access to the Data will be restricted to Authorized Users through the use of access control lists which will grant access only after the Authorized User has authenticated to the network using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. Data on disks mounted to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. For DSHS Confidential Information stored on these disks, deleting unneeded Data is sufficient as long as the disks remain in a Secure Area and otherwise meet the requirements listed in the above paragraph. Destruction of the Data, as outlined below in Section 8 Data Disposition, may be deferred until the disks are retired, replaced, or otherwise taken out of the Secure Area. c. Optical discs (CDs or DVDs) in local workstation optical disc drives. Data provided by DSHS on optical discs which will be used in local workstation optical disc drives and which will not be transported out of a Secure Area. When not in use for the contracted purpose, such discs must be Stored in a Secure Area. Workstations which access DSHS Data on optical discs must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. d. Optical discs (CDs or DVDs) in drives or jukeboxes attached to servers. Data provided by DSHS on optical discs which will be attached to network servers and which will not be transported out of a Secure Area. Access to Data on these discs will be restricted to Authorized Users through the use of access control lists which will grant access only after the Authorized User has authenticated to the network using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. Data on discs attached to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism.
Information and Data Upon request of the Union, the Employer agrees to furnish the Union with the following information: budgets for the Board of Regents; budgets for each College; public information used in the preparation of budgets as provided by law such as salaries; minutes of meetings of the Board; policies of the Board of Regents which apply to faculty members. Voluminous information shall be made available for inspection or will be provided at reproduction cost.
Source of Data A description of (1) the process used to identify claims in the Population, and (2) the specific documentation relied upon by the IRO when performing the Quarterly Claims Review (e.g., medical records, physician orders, certificates of medical necessity, requisition forms, local medical review policies (including title and policy number), CMS program memoranda (including title and issuance number), Medicare contractor manual or bulletins (including issue and date), other policies, regulations, or directives).
Accessibility of Information Technology Contractor represents and warrants that any software/ hardware/ communications system/ equipment (collectively “technology”), if any, provided under this Agreement adheres to the standards and/or specifications as may be set forth in the Section 508 of the Rehabilitation Act of 1973 standards guide and is fully compliant with WCAG 2.0 AA standards for accessibility and compliant with any applicable FCC regulations. Technology that will be used on a mobile device must also be navigable with Voiceover on iOS devices in addition to meeting WCAG 2.0 level AA. If portions of the technology or user experience are alleged to be non-compliant or non- accessible at any point, District will provide Contractor with notice of such allegation and Contractor shall use its best efforts to make the technology compliant and accessible. If a state or federal department, office or regulatory agency, or if any other third party administrative agency or organization (“Claimants”), make a claim, allegation, initiates legal or regulatory process, or if a court finds or otherwise determines that technology is non-compliant or non-accessible, Contractor shall indemnify, defend and hold harmless the District from and against any and all such claims, allegations, liabilities, damages, penalties, fees, costs (including but not limited to reasonable attorneys’ fees), arising out of or related to Xxxxxxxxx’ claims. Contractor shall also fully indemnify District for the full cost of any user accommodation that is found to be necessary due to an identifiable lack of accessibility in the Contractor’s technology. If necessary, an independent 3rd party accessibility firm using POUR standards (Perceivable, Operable, Understandable and Robust) may be used to validate the accessibility of the technology.
Security of Confidential Information Each party possessing Confidential Information of the other party will maintain all such Confidential Information under secure conditions, using reasonable security measures and in any event not less than the same security procedures used by such party for the protection of its own Confidential Information of a similar kind.
Security of Information Unless otherwise specifically authorized by the DOH Chief Information Security Officer, Contractor receiving confidential information under this contract assures that: • Encryption is selected and applied using industry standard algorithms validated by the National Institute of Standards and Technology (NIST) Cryptographic Algorithm Validation Program against all information stored locally and off-site. Information must be encrypted both in-transit and at rest and applied in such a way that it renders data unusable to anyone but authorized personnel, and the confidential process, encryption key or other means to decipher the information is protected from unauthorized access. • It is compliant with the applicable provisions of the Washington State Office of the Chief Information Officer (OCIO) policy 141, Securing Information Technology Assets, available at: xxxxx://xxxx.xx.xxx/policy/securing-information-technology-assets. • It will provide DOH copies of its IT security policies, practices and procedures upon the request of the DOH Chief Information Security Officer. • DOH may at any time conduct an audit of the Contractor’s security practices and/or infrastructure to assure compliance with the security requirements of this contract. • It has implemented physical, electronic and administrative safeguards that are consistent with OCIO security standard 141.10 and ISB IT guidelines to prevent unauthorized access, use, modification or disclosure of DOH Confidential Information in any form. This includes, but is not limited to, restricting access to specifically authorized individuals and services through the use of: o Documented access authorization and change control procedures; o Card key systems that restrict, monitor and log access; o Locked racks for the storage of servers that contain Confidential Information or use AES encryption (key lengths of 256 bits or greater) to protect confidential data at rest, standard algorithms validated by the National Institute of Standards and Technology (NIST) Cryptographic Algorithm Validation Program (CMVP); o Documented patch management practices that assure all network systems are running critical security updates within 6 days of release when the exploit is in the wild, and within 30 days of release for all others; o Documented anti-virus strategies that assure all systems are running the most current anti-virus signatures within 1 day of release; o Complex passwords that are systematically enforced and password expiration not to exceed 120 days, dependent user authentication types as defined in OCIO security standards; o Strong multi-factor authentication mechanisms that assure the identity of individuals who access Confidential Information; o Account lock-out after 5 failed authentication attempts for a minimum of 15 minutes, or for Confidential Information, until administrator reset; o AES encryption (using key lengths 128 bits or greater) session for all data transmissions, standard algorithms validated by NIST CMVP; o Firewall rules and network address translation that isolate database servers from web servers and public networks; o Regular review of firewall rules and configurations to assure compliance with authorization and change control procedures; o Log management and intrusion detection/prevention systems; o A documented and tested incident response plan Any breach of this clause may result in termination of the contract and the demand for return of all personal information.
Removal of Data County PHI or PI must not be removed from the premises of the Contractor except with express written permission of County.
CONFIDENTIALITY OF DATA 23.1 All financial, statistical, personal, technical, or other data and information relative to the Department’s operations, which is designated confidential by the Department and made available to the Construction Manager in order to carry out this Preconstruction Services Contract, shall be protected by the Construction Manager from unauthorized use and disclosure. 23.2 Permission to disclose information on one occasion or public hearing held by the Department relating to this Preconstruction Services Contract shall not authorize the Construction Manager to further disclose such information or disseminate the same on any other occasion. 23.3 The Construction Manager shall not comment publicly to the press or any other media regarding this Preconstruction Services Contract or the Department’s actions on the same, except to the Department’s staff, Construction Manager’s own personnel involved in the performance of this Preconstruction Services Contract, at public hearings, or in response to questions from a Legislative committee. 23.4 The Construction Manager shall not issue any news release or public relations item of any nature whatsoever regarding work performed or to be performed under this Preconstruction Services Contract without prior review of the contents thereof by the Department and receipt of the Department’s written permission. 23.5 All information related to the construction estimate is confidential and shall not be disclosed by the Construction Manager to any entity, other than the Department. 23.6 Subject to the California Records Act (California Government Code §§ 6250 et seq.), the Department has taken measures to protect the confidentiality of the negotiations related to the construction estimate. Every person involved in the process shall sign a confidentiality and nondisclosure agreement. However, under no circumstances will the Department be responsible or liable to the Construction Manager or any other party as a result of disclosing any materials, whether the disclosure is deemed required by law, by an order of court, or occurs through inadvertence, mistake, or negligence on the part of Department or its respective officers, employees, contractors, or consultants. 23.7 In the event Department is requested to disclose any of the materials identified by the Construction Manager as confidential, Department will promptly notify the Construction Manager so that Proposer may seek a protective order or other appropriate remedy. If the Construction Manager wishes to protect the materials from disclosure, the Construction Manager shall seek court protection immediately on an emergency basis. In the event that such protective order or other remedy is not sought by the Construction Manager within seven (7) days after the Construction Manager receives notice from Department, Department will be free to release the requested information. Department will consider the Construction Manager to have waived any claim of confidentiality and exemption from public disclosure for any materials not identified as confidential. Construction Managers are advised to consult with their legal counsel regarding the scope and provisions of the Public Records Act.
Identification of Data a. All Background, Third Party Proprietary and Controlled Government Data provided by Disclosing Party shall be identified in the Annex under which it will be provided. b. NASA software and related Data provided to Partner shall be identified in the Annex under which it will be used. Notwithstanding H.4., Software and related Data will be provided to Partner under a separate Software Usage Agreement (SUA). Partner shall use and protect the related Data in accordance with this Article. Unless the SUA authorizes retention, or Partner enters into a license under 37 C.F.R. Part 404, the related Data shall be disposed of as instructed by NASA.