Security and Privacy Control Assessment Methodology Sample Clauses

Security and Privacy Control Assessment Methodology. 6 4.1 Security and Privacy Control Technical Testing 6 4.2 Network and Component Scanning 7 4.3 Configuration Assessment 7 4.4 Documentation Review 7 4.5 Personnel Interviews 9 4.6 Penetration Testing 9 5.1 SAR Content 10 Table 1. Core Security and Privacy Documentation 8 Centers for Medicare & Medicaid Services
AutoNDA by SimpleDocs
Security and Privacy Control Assessment Methodology. The SCA methodology described in this guidance originates from the standard CMS methodology used in the assessment of all CMS internal and business partner applications or systems. Assessment procedures for testing each security and privacy control should be consistent with the methodology documented in the most current version of the NIST SP 800-53A5, Assessing Security and Privacy Controls in Federal Information Systems and Organizations. The assessor should prepare a detailed assessment plan using these security and privacy control assessment procedures, the main testing points for the CIS critical controls, and detailed directions for addressing the penetration testing procedures for the OWASP Top 10 vulnerabilities. The assessor should modify or supplement the procedures to evaluate the application’s or system’s vulnerability to different types of threats, including those from insiders, the Internet, or the network. The assessment methods should include examination of documentation, logs and configurations, interviews of personnel, and testing of technical controls. Control assessment procedures and associated test results provide information to identify the following: • Application or system vulnerabilities, the associated business and system risks, and potential impact; • Weaknesses in the configuration management process, such as weak system configuration settings that may compromise the Confidentiality, Integrity, and Availability (CIA) of the system; • State and/or federal policies not followed; and • Major documentation omissions and/or discrepancies.

Related to Security and Privacy Control Assessment Methodology

  • Data Security and Privacy Plan As more fully described herein, throughout the term of the Subscription Agreement, Vendor will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data it receives from the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with the terms of the District’s Bill of Rights for Data Security and Privacy, a copy of which is set forth below and has been signed by the Vendor. Additional components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Subscription Agreement are as follows: (a) Vendor will implement all state, federal, and local data security and privacy requirements including those contained within the Subscription Agreement and this Data Sharing and Confidentiality Agreement, consistent with the District’s data security and privacy policy. (b) Vendor will have specific administrative, operational and technical safeguards and practices in place to protect Protected Data that it receives from the District under the Subscription Agreement. (c) Vendor will comply with all obligations contained within the section set forth in this Exhibit below entitled “Supplemental Information about a Subscription Agreement between [Xxxxx-Fultonville Central School District] and [Vendor Name].” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the data protection obligations imposed on Vendor by state and federal law and the Subscription Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Subscription Agreement. (d) Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, prior to their receiving access. (e) Vendor will manage data security and privacy incidents that implicate Protected Data and will develop and implement plans to identify breaches and unauthorized disclosures. Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 5 of this Data Sharing and Confidentiality Agreement.

  • Data Security and Privacy (a) Each Group Member is, and at all times, has been, in compliance in all material respects with (i) all applicable Data Protection Laws, including, to the extent applicable, but not limited to the GDPR and those relating to cross-border transfers; (ii) all applicable contractual obligations of each Loan Party and its Subsidiaries concerning data privacy and security relating to Personal Data in the possession or control of any Group Member or maintained by third parties on behalf of such Group Member and having access to such information under contracts (or portions thereof) to which a Group Member is a party; and (iii) all applicable data transfer agreements and data processing agreements, including the EU standard contractual clauses, to which a Group Member is a party (collectively, “Privacy Agreements”): (b) Each Group Member is, and has been, in compliance in all material respects with all applicable prior and current written internal and public-facing privacy policies and notices of the Group Members regarding the collection, retention, use, processing, disclosure and distribution of Personal Data by the Group Members or their respective agents (collectively, the “Privacy Policies”), and the Privacy Policies have been maintained to be consistent in all material respects with the actual practices of each Group Member. The Privacy Policies contemplate the Group Members’ current uses of the Personal Data, and to the extent required under applicable Data Protection Laws, each Group Member has sought and obtained the appropriate consent from the applicable data subject for such uses. The Privacy Policies have made all material disclosures to users, customers, employees, or other individuals required by Data Protection Laws. (c) Each Group Member has implemented and maintains a commercially reasonable security program (“Security Program”) that (i) complies in all material respects with all applicable Data Protection Laws, applicable Privacy Policies, and applicable Privacy Agreements, and (ii) includes commercially reasonable administrative, technical, organization, and physical security procedures and measures designed to preserve the security and integrity of all Personal Data and any other sensitive or confidential information or data related to each Group Member (collectively, “Company Sensitive Information”) in such Group Member’s possession or control and to protect such Company Sensitive Information against unauthorized or unlawful processing, access, acquisition, use, theft, interruption, modification, disclosure, loss, destruction or damage. (d) Except as disclosed on Schedule 4.23(d), there has been (i) no actual, suspected or alleged (in writing) incidents of unauthorized access, use, intrusion, disclosure or breach of the security of any information technology systems owned or controlled by a Group Member or any of their contractors and used by such contractors on behalf of a Group Member, and (ii) no actual, suspected or alleged (in writing) incidents of unauthorized acquisition, destruction, damage, disclosure, loss, corruption, alteration, or use of any Company Sensitive Information, in each case that could reasonably be expected to cause a Material Adverse Effect. (e) Each Group Member has a valid and legal right (whether contractually, by applicable law or otherwise) to access or use all Personal Data that is accessed and used by or on behalf of a Group Member in connection with the sale, use and/or operation of their products, services and businesses. (f) Except as would not reasonably be expected to have a Material Adverse Effect, there is no pending or to the knowledge of any Loan Party, threatened in writing, complaints, claims, demands, inquiries, proceedings, or other notices, including any notices of any investigation or other legal proceedings, regarding a Group Member, initiated by (i) any Governmental Authority, including the United States Federal Trade Commission, a state attorney general, data protection authority or similar state official, or a supervisory authority; (ii) any counterparty to, or subject of, a Privacy Agreement; or (iii) any self-regulatory authority or entity, alleging that any activity of a Group Member: (1) is in violation of any applicable Data Protection Laws, (2) is in violation of any Privacy Agreements, (3) is in violation of any Privacy Policies or (4) is otherwise in violation of any person’s privacy, personal or confidentiality rights.

  • Data Privacy Consent In order to administer the Plan and this Agreement and to implement or structure future equity grants, the Company, its subsidiaries and affiliates and certain agents thereof (together, the “Relevant Companies”) may process any and all personal or professional data, including but not limited to Social Security or other identification number, home address and telephone number, date of birth and other information that is necessary or desirable for the administration of the Plan and/or this Agreement (the “Relevant Information”). By entering into this Agreement, the Grantee (i) authorizes the Company to collect, process, register and transfer to the Relevant Companies all Relevant Information; (ii) waives any privacy rights the Grantee may have with respect to the Relevant Information; (iii) authorizes the Relevant Companies to store and transmit such information in electronic form; and (iv) authorizes the transfer of the Relevant Information to any jurisdiction in which the Relevant Companies consider appropriate. The Grantee shall have access to, and the right to change, the Relevant Information. Relevant Information will only be used in accordance with applicable law.

  • IDENTIFYING INFORMATION AND PRIVACY NOTIFICATION (a) FEDERAL EMPLOYER IDENTIFICATION NUMBER and/or FEDERAL SOCIAL SECURITY NUMBER. As a condition to NYSERDA’s obligation to pay any invoices submitted by Contractor pursuant to this Agreement, Contractor shall provide to NYSERDA its Federal employer identification number or Federal social security number, or both such numbers when the Contractor has both such numbers. Where the Contractor does not have such number or numbers, the Contractor must give the reason or reasons why the payee does not have such number or numbers.

  • Contractor Sales Reporting Vendor Management Fee Contractor Reports Master Contract Sales Reporting. Contractor shall report total Master Contract sales quarterly to Enterprise Services, as set forth below. Master Contract Sales Reporting System. Contractor shall report quarterly Master Contract sales in Enterprise Services’ Master Contract Sales Reporting System. Enterprise Services will provide Contractor with a login password and a vendor number. The password and vendor number will be provided to the Sales Reporting Representative(s) listed on Contractor’s Bidder Profile. Data. Each sales report must identify every authorized Purchaser by name as it is known to Enterprise Services and its total combined sales amount invoiced during the reporting period (i.e., sales of an entire agency or political subdivision, not its individual subsections). The “Miscellaneous” option may be used only with prior approval by Enterprise Services. Upon request, Contractor shall provide contact information for all authorized purchasers specified herein during the term of the Master Contract. If there are no Master Contract sales during the reporting period, Contractor must report zero sales. Due dates for Master Contract Sales Reporting. Quarterly Master Contract Sales Reports must be submitted electronically by the following deadlines for all sales invoiced during the applicable calendar quarter: March 31: April 30 June 30: July 31 September 30: October 31 December 31: January 31 Vendor Management Fee. Contractor shall pay to Enterprise Services a vendor management fee (“VMF”) of 1.50 percent on the purchase price for all Master Contract sales (the purchase price is the total invoice price less applicable sales tax). The sum owed by Contractor to Enterprise Services as a result of the VMF is calculated as follows: Amount owed to Enterprise Services = Total Master Contract sales invoiced (not including sales tax) x .0150. The VMF must be rolled into Contractor’s current pricing. The VMF must not be shown as a separate line item on any invoice unless specifically requested and approved by Enterprise Services. Enterprise Services will invoice Contractor quarterly based on Master Contract sales reported by Contractor. Contractors are not to remit payment until they receive an invoice from Enterprise Services. Contractor’s VMF payment to Enterprise Services must reference this Master Contract number, work request number (if applicable), the year and quarter for which the VMF is being remitted, and the Contractor’s name as set forth in this Master Contract, if not already included on the face of the check. Failure to accurately report total net sales, to submit a timely usage report, or remit timely payment of the VMF, may be cause for Master Contract termination or the exercise of other remedies provided by law. Without limiting any other available remedies, the Parties agree that Contractor’s failure to remit to Enterprise Services timely payment of the VMF shall obligate Contractor to pay to Enterprise Services, to offset the administrative and transaction costs incurred by the State to identify, process, and collect such sums. The sum of $200.00 or twenty-five percent (25%) of the outstanding amount, whichever is greater, or the maximum allowed by law, if less. Enterprise Services reserves the right, upon thirty (30) days advance written notice, to increase, reduce, or eliminate the VMF for subsequent purchases, and reserves the right to renegotiate Master Contract pricing with Contractor when any subsequent adjustment of the VMF might justify a change in pricing. Annual Master Contract Sales Report. Upon request, Contractor shall provide to Enterprise Services a detailed annual Master Contract sales report. Such report shall include, at a minimum: Product description, part number or other Product identifier, per unit quantities sold, and Master Contract price. This report must be provided in an electronic format that can be read by compatible with MS Excel. Small Business Inclusion. Upon Request by Enterprise Services, Contractor shall provide, within thirty (30) days, an Affidavit of Amounts Paid. Such Affidavit of Amounts Paid either shall state, if applicable, that Contractor still maintains its MWBE certification or state that its subcontractor(s) still maintain(s) its/their MWBE certification(s) and specify the amounts paid to each certified MWBE subcontractor under this Master Contract. Contractor shall maintain records supporting the Affidavit of Amounts Paid in accordance with this Master Contract’s records retention requirements.

  • Security and Privacy Security and privacy policies for the Genesys Cloud Service addressing use of Customer Data, which are incorporated by reference and may be updated from time to time in accordance with Section 10.12 of the Agreement, are located at xxxxx://xxxx.xxxxxxxxxxx.xxx/articles/purecloud-security-compliance/.

  • PERSONAL INFORMATION PRIVACY AND SECURITY CONTRACT 11 Any reference to statutory, regulatory, or contractual language herein shall be to such language as in 12 effect or as amended. 13 A. DEFINITIONS

  • Foreign Assets/Account Reporting Information Italian residents who, during the fiscal year, hold investments abroad or foreign financial assets (e.g., cash, Shares and RSUs) which may generate income taxable in Italy are required to report such on their annual tax returns (UNICO Form, RW Schedule) or on a special form if no tax return is due. The same reporting obligations apply to Italian residents who, even if they do not directly hold investments abroad or foreign financial assets (e.g., cash, Shares and RSUs), are beneficial owners of the investment pursuant to Italian money laundering provisions.

  • Minimum Site Requirements for TIPS Sales (when applicable to TIPS Sale). Cleanup: When performing work on site at a TIPS Member’s property, Vendor shall clean up and remove all debris and rubbish resulting from their work as required or directed by the TIPS Member or as agreed by the parties. Upon completion of work, the premises shall be left in good repair and an orderly, neat, clean and unobstructed condition. Preparation: Vendor shall not begin a project for which a TIPS Member has not prepared the site, unless Vendor does the preparation work at no cost, or until TIPS Member includes the cost of site preparation in the TIPS Sale Site preparation includes, but is not limited to: moving furniture, installing wiring for networks or power, and similar pre‐installation requirements. Registered Sex Offender Restrictions: For work to be performed at schools, Vendor agrees that no employee of Vendor or a subcontractor who has been adjudicated to be a registered sex offender will perform work at any time when students are, or reasonably expected to be, present unless otherwise agreed by the TIPS Member. Vendor agrees that a violation of this condition shall be considered a material breach and may result in the cancellation of the TIPS Sale at the TIPS Member’s discretion. Vendor must identify any additional costs associated with compliance of this term. If no costs are specified, compliance with this term will be provided at no additional charge. Safety Measures: Vendor shall take all reasonable precautions for the safety of employees on the worksite, and shall erect and properly maintain all necessary safeguards for protection of workers and the public. Vendor shall post warning signs against all hazards created by the operation and work in progress. Proper precautions shall be taken pursuant to state law and standard practices to protect workers, general public and existing structures from injury or damage. Smoking: Persons working under Agreement shall adhere to the TIPS Member’s or local smoking statutes, codes, ordinances, and policies.

  • Insurance and Fingerprint Requirements Information Insurance If applicable and your staff will be on TIPS member premises for delivery, training or installation etc. and/or with an automobile, you must carry automobile insurance as required by law. You may be asked to provide proof of insurance. Fingerprint It is possible that a vendor may be subject to Chapter 22 of the Texas Education Code. The Texas Education Code, Chapter 22, Section 22.0834. Statutory language may be found at: xxxx://xxx.xxxxxxxx.xxxxx.xxxxx.xx.xx/ If the vendor has staff that meet both of these criterion: (1) will have continuing duties related to the contracted services; and (2) has or will have direct contact with students Then you have ”covered” employees for purposes of completing the attached form. TIPS recommends all vendors consult their legal counsel for guidance in compliance with this law. If you have questions on how to comply, see below. If you have questions on compliance with this code section, contact the Texas Department of Public Safety Non-Criminal Justice Unit, Access and Dissemination Bureau, FAST-FACT at XXXX@xxxxx.xxxxx.xx.xx and you should send an email identifying you as a contractor to a Texas Independent School District or ESC Region 8 and TIPS. Texas DPS phone number is (000) 000-0000. See form in the next attribute to complete entitled: Texas Education Code Chapter 22 Contractor Certification for Contractor Employees

Draft better contracts in just 5 minutes Get the weekly Law Insider newsletter packed with expert videos, webinars, ebooks, and more!