Risk Assessments a. Risk Assessment - DST shall, at least annually, perform risk assessments that are designed to identify material threats (both internal and external) against Fund Data, the likelihood of those threats Schedule 10.2 p.2 occurring and the impact of those threats upon DST organization to evaluate and analyze the appropriate level of information security safeguards (“Risk Assessments”). b. Risk Mitigation - DST shall use commercially reasonable efforts to manage, control and remediate threats identified in the Risk Assessments that it believes are likely to result in material unauthorized access, copying, use, processing, disclosure, alteration, transfer, loss or destruction of Fund Data, consistent with the Objective, and commensurate with the sensitivity of the Fund Data and the complexity and scope of the activities of DST pursuant to the Agreement. c. Security Controls Testing - DST shall, on approximately an annual basis, engage an independent external party to conduct a review (including information security) of DST’s systems that are related to the provision of services. DST shall have a process to review and evaluate high risk findings resulting from this testing.
Safeguarding requirements and procedures (1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls: (i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems). (ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute. (iii) Verify and control/limit connections to and use of external information systems. (iv) Control information posted or processed on publicly accessible information systems. (v) Identify information system users, processes acting on behalf of users, or devices. (vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems. (vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse. (viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals. (ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices. (x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems. (xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. (xii) Identify, report, and correct information and information system flaws in a timely manner. (xiii) Provide protection from malicious code at appropriate locations within organizational information systems. (xiv) Update malicious code protection mechanisms when new releases are available. (xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.
Policies and Procedures i) The policies and procedures of the designated employer apply to the employee while working at both sites. ii) Only the designated employer shall have exclusive authority over the employee in regard to discipline, reporting to the College of Nurses of Ontario and/or investigations of family/resident complaints. iii) The designated employer will ensure that the employee is covered by WSIB at all times, regardless of worksite, while in the employ of either home. iv) The designated employer will ensure that the employee is covered by liability insurance at all times, regardless of worksite, while in the employ of either home. v) The designated employer shall have exclusive authority over the employee’s personnel files and health records. These files will be maintained on the site of the designated employer.
Administrative Claims Requirements and Procedures No suit or arbitration shall be brought arising out of this Agreement against City unless a claim has first been presented in writing and filed with City and acted upon by City in accordance with the procedures set forth in Chapter 1.34 of the Chula Vista Municipal Code, as same may be amended, the provisions of which, including such policies and procedures used by City in the implementation of same, are incorporated herein by this reference. Upon request by City, Consultant shall meet and confer in good faith with City for the purpose of resolving any dispute over the terms of this Agreement.