Common use of Physical and Technical Security Clause in Contracts

Physical and Technical Security. Provider will provide appropriate and adequate physical and technical security for the Application Services, including, but without limitation, the following: 1. Provider will have Representatives capable of identifying, categorizing, and responding to a security incident. 2. Provider will implement a security fix across the infrastructure in accordance with Provider’s regular updateprocess. 3. Provider will promptly shut down ALL access to the System, or any component of it associated with the Application Services, responding to a request by Company’s securitymanager. 4. Provider will not directly or indirectly subcontract, assign, or transfer, permit, or allow any portion of the Services, related support, or other activities under the Agreement offshore, meaning outside the continental United States, Canada or the United Kingdom, without the express prior written consent of the Company. 5. Provider will require all permitted subcontractors and/or third party service providers utilized either directly or indirectly by Provider in the performance of Services ("Third Party Service Provider") to adhere to, and with all requirements of the Agreement, including, but not limited to, the Company security requirements set forth in the Agreement. 6. Provider will conduct annual independent security reviews and audits by a reputable and nationally known independent third party audit firm to ensure that Provider is meeting all of the physical and technical security requirements of the Agreement. Provider’s audit agency will prepare a written audit report detailing audit findings. Provider will not store or transmit Company Data as clear text. Provider will store and transmit Company Data only in a secure and encrypted mode. 7. Provider will institute and maintain a separation of duties between application development, quality assurance, testing, and production environments.

Physical and Technical Security. Provider will provide appropriate and adequate physical and technical security for the Application Services, including, but without limitation, the following: 1. Provider will have Representatives capable of identifying, categorizing, and responding to a security incident. 2. Provider will implement a security fix across the infrastructure in accordance with Provider’s regular updateprocessupdate process. 3. Provider will promptly shut down ALL access to the System, or any component of it associated with the Application Services, responding to a request by Company’s securitymanagersecurity manager. 4. Provider will not directly or indirectly subcontract, assign, or transfer, permit, or allow any portion of the Services, related support, or other activities under the Agreement offshore, meaning outside the continental United States, Canada or the United Kingdom, without the express prior written consent of the Company. 5. Provider will require all permitted subcontractors and/or third party service providers utilized either directly or indirectly by Provider in the performance of Services ("Third Party Service Provider") to adhere to, and with all requirements of the Agreement, including, but not limited to, the Company security requirements set forth in the Agreement. 6. Provider will conduct annual independent security reviews and audits by a reputable and nationally known independent third party audit firm to ensure that Provider is meeting all of the physical and technical security requirements of the Agreement. Provider’s audit agency will prepare a written audit report detailing audit findings. Provider will not store or transmit Company Data as clear text. Provider will store and transmit Company Data only in a secure and encrypted mode. 7. Provider will institute and maintain a separation of duties between application development, quality assurance, testing, and production environments.

Physical and Technical Security. Provider will provide appropriate and adequate physical and technical security for the Application Services, including, but without limitation, the followingthefollowing: 1. Provider will have Representatives capable of identifying, categorizing, and responding to a security incident. 2. Provider will implement a security fix across the infrastructure in accordance with Provider’s regular updateprocess. 3. Provider will promptly shut down ALL access to the System, or any component of it associated with the Application Services, responding to a request by Company’s securitymanager. 4. Provider will not directly or indirectly subcontract, assign, or transfer, permit, or allow any portion of the Services, related support, or other activities under the Agreement offshore, meaning outside the continental United States, Canada or the United Kingdom, without the express prior written consent of the Company. 5. Provider will require all permitted subcontractors and/or third party service providers utilized either directly or indirectly by Provider in the performance of Services ("Third Party Service Provider") to adhere to, and with all requirements of the Agreement, including, but not limited to, the Company security requirements set forth in the Agreement. 6. Provider will conduct annual independent security reviews and audits by a reputable and nationally known independent third party audit firm to ensure that Provider is meeting all of the physical and technical security requirements of the Agreement. Provider’s audit agency will prepare a written audit report detailing audit findings. Provider will not store or transmit Company Data as clear text. Provider will store and transmit Company Data only in a secure and encrypted mode. 7. Provider will institute and maintain a separation of duties between application development, quality assurance, testing, and production environments.

Physical and Technical Security. Provider will provide appropriate and adequate physical and technical security for the Application Services, including, but without limitation, the followingthefollowing: 1. Provider will have Representatives capable of identifying, categorizing, and responding to a security incident. 2. Provider will implement a security fix across the infrastructure in accordance with Provider’s regular updateprocessregularupdateprocess. 3. Provider will promptly shut down ALL access to the System, or any component of it associated with the Application Services, responding to a request by Company’s securitymanager. 4. Provider will not directly or indirectly subcontract, assign, or transfer, permit, or allow any portion of the Services, related support, or other activities under the Agreement offshore, meaning outside the continental United States, Canada or the United Kingdom, without the express prior written consent of the Company. 5. Provider will require all permitted subcontractors and/or third party service providers utilized either directly or indirectly by Provider in the performance of Services ("Third Party Service Provider") to adhere to, and with all requirements of the Agreement, including, but not limited to, the Company security requirements set forth in the Agreement. 6. Provider will conduct annual independent security reviews and audits by a reputable and nationally known independent third party audit firm to ensure that Provider is meeting all of the physical and technical security requirements of the Agreement. Provider’s audit agency will prepare a written audit report detailing audit findings. Provider will not store or transmit Company Data as clear text. Provider will store and transmit Company Data only in a secure and encrypted mode. 7. Provider will institute and maintain a separation of duties between application development, quality assurance, testing, and production environments.

Physical and Technical Security. Provider will provide appropriate and adequate physical and technical security for the Application Services, including, but without limitation, the following: 1. Provider will have Representatives capable of identifying, categorizing, and responding to a security incidentincident on duty 24X365. 2. Provider will implement a security fix across the infrastructure in accordance with Provider’s regular updateprocessupdate process. 3. Provider will promptly shut down ALL access to the System, or any component of it associated with the Application Services, within sixty (60) minutes of responding to a request by Company’s securitymanagersecurity manager. 4. Provider will not directly or indirectly subcontract, assign, or transfer, permit, or allow any portion of the Services, related support, or other activities under the Agreement offshore, meaning outside the continental United States, Canada or the United Kingdom, without the express prior written consent of the Company. 5. Provider will require all permitted subcontractors and/or third party service providers utilized either directly or indirectly by Provider in the performance of Services ("“Third Party Service Provider"”) to adhere to, and with all requirements of the Agreement, including, but not limited to, the Company security requirements set forth in the Agreement. 6. Provider will conduct annual independent security reviews and audits by a reputable and nationally known independent third party audit firm agency to ensure that Provider is meeting all of the physical and technical security requirements of the Agreement. Provider’s audit agency will prepare a written audit report detailing audit findings. Provider will not store or transmit Company Data as clear text. Provider will store and transmit Company Data only in a secure and encrypted mode. 7. Provider will institute and maintain a separation of duties between application development, quality assurance, testing, and production environments.

Physical and Technical Security. Provider will provide appropriate and adequate physical and technical security for the Application Services, including, but without limitation, the following: 1. Provider will have Representatives capable of identifying, categorizing, and responding to a security incident. 2. Provider will implement a security fix across the infrastructure in accordance with Provider’s regular updateprocessupdate process. 3. Provider will promptly shut down ALL access to the System, or any component of it associated with the Application Services, responding to a request by Company’s securitymanager. 4. Provider will not directly or indirectly subcontract, assign, or transfer, permit, or allow any portion of the Services, related support, or other activities under the Agreement offshore, meaning outside the continental United States, Canada or the United Kingdom, without the express prior written consent of the Company. 5. Provider will require all permitted subcontractors and/or third party service providers utilized either directly or indirectly by Provider in the performance of Services ("Third Party Service Provider") to adhere to, and with all requirements of the Agreement, including, but not limited to, the Company security requirements set forth in the Agreement. 6. Provider will conduct annual independent security reviews and audits by a reputable and nationally known independent third party audit firm to ensure that Provider is meeting all of the physical and technical security requirements of the Agreement. Provider’s audit agency will prepare a written audit report detailing audit findings. Provider will not store or transmit Company Data as clear text. Provider will store and transmit Company Data only in a secure and encrypted mode. 7. Provider will institute and maintain a separation of duties between application development, quality assurance, testing, and production environments.