Common use of Operations Security Clause in Contracts

Operations Security. To the extent the Contractor or its subcontractors, affiliates or agents handles, collects, stores, disseminates or otherwise deals with State Data, the Contractor shall cause an SSAE 18 SOC 2 Type 2 audit report to be conducted annually. Upon the State’s request and the execution of an appropriate non-disclosure agreement, Contractor will share the audit results and the Contractor’s plan for addressing or resolution of the audit results. shall be shared with the State within sixty (60) days of the Contractor's receipt of the audit

Operations Security. To the extent the Contractor or its subcontractors, affiliates or agents handles, collects, stores, disseminates or otherwise deals with State Data, the Contractor shall cause an SSAE 18 SOC 2 Type 2 audit report to be conducted annually. Upon the State’s request and the execution of an appropriate non-disclosure agreement, Contractor will share the The audit results and the Contractor’s plan for addressing or resolution of the audit results. shall be shared with the State within sixty (60) days of the Contractor's receipt of audit committee report. Contractor’s financial statements are contained in the auditannual report which can be found at xxxxx://xxxxxxx.xxxx.xxx/index_about.htm. .

Operations Security. To the extent the Contractor or its subcontractors, affiliates or agents handlesprovide systems that process, collectstransmit, stores, disseminates or otherwise deals with and store State Data, the Contractor shall cause an SSAE 18 SOC 2 Type 2 audit report to be conducted annually. Upon the State’s request and the execution of an appropriate non-disclosure agreement, Contractor will share the The audit results and the Contractor’s plan for addressing or resolution of the audit results. results shall be shared with the State within sixty (60) days of the Contractor's receipt of the auditaudit results. Further, on an annual basis, within 90 days of the end of the Contractor’s fiscal year, the Contractor shall transmit its annual audited financial statements to the State.

Operations Security. To the extent the Contractor or its subcontractors, affiliates or agents handlesprocess, collectstransmit, stores, disseminates or otherwise deals with and store State Data, the Contractor shall cause an SSAE 18 SOC 2 Type 2 audit report to be conducted annually. Upon the State’s request and the execution of an appropriate non-disclosure agreement, Contractor will share the The audit results and the Contractor’s plan for addressing or resolution of the audit results. results shall be shared with the State within sixty (60) days of the Contractor's receipt of the auditaudit results. Further, on an annual basis, within 90 days of the end of the Contractor’s fiscal year, the Contractor shall transmit its annual audited financial statements to the State.

Operations Security. To the extent the Contractor or its subcontractors, affiliates or agents handlesprovide systems that process, collectstransmit, stores, disseminates or otherwise deals with and store State Data, the Contractor shall cause an SSAE 18 SOC 2 Type 2 audit report to be conducted annually. Upon the State’s request and the execution of an appropriate non-disclosure agreement, Contractor will share the The audit results and the Contractor’s plan for addressing or resolution of the audit results. results shall be shared with the State within sixty (60) days of the Contractor's receipt of the auditaudit results. Further, on an STATE OF VERMONT CONTRACT # 45815 DEPARTMENT OF VERMONT HEALTH ACCESS PAGE 57 of 87 VERMONT INFORMATION TECHNOLOGY LEADERS, INC.

Operations Security. To the extent the Contractor or its subcontractors, affiliates or agents handles, collects, stores, disseminates or otherwise deals with State Data, the Contractor shall cause an SSAE 18 16 SOC 2 Type 2 audit report to be conducted annually. Upon the State’s request and the execution of an appropriate non-disclosure agreement, Contractor will share the The audit results summary and the Contractor’s plan for addressing or resolution of the audit results. results shall be shared with the State within sixty (60) days of the Contractor's receipt of the auditaudit results.