Item 19 - Agreement with Empower Annuity Insurance Company for the Employee Deferred Compensation Plan

Home Browse Search

City of Santa Ana_Master Services Agreement_5.23.23 15 7. Data Security. Empower’s Information Security Policies and related policies address the management of information security, the security controls employed by the organization. T hese policies include, without limitation: 7.1 An Information Security Board that is responsible for the development, implementation, and ongoing maintenance of Empower’s data security. 7.2 Documented policies (“Information Security Policies”) that Empower formally approves, internally publishes, communicates to appropriate personnel and reviews at least annually. Empower’s Information Security Policies shall (i) mandate the secure protection and handling of confidential data, (ii) comply with applicable laws, (iii) conform to or exceed applicable industry standards for the retirement plan services industry, and (iv) documented, clear assignment of responsibility and authority for data security- related activities. 7.3 Policies covering acceptable computer use, record retention/destruction, information classification, cryptographic controls, access control, network security, removable media, remote access, mobile computing and wireless access. 7.4 Regular testing of the key controls, systems and procedures, including (i) testing of information technology general controls (ITGC) at least annually or whenever there is a material change in business practices, and (ii) infrastructure penetration tests and scans against internet -facing points of presence. Empower will correct vulnerabilities or security issues discovered through such assessments in a manner and time frame consistent with established standards. 7.5 Policies and procedures designed to protect the security of Plan Data and Personal Data that is accessible to, or held by, Empower’s third party suppliers. Such policies shall be based on Empower’s Information Security Policies, and shall address, as applicable: (i) the identification and risk assessment of such supplier; (ii) minimum cybersecurity standards required to be met by such suppliers; (iii) due diligence processes used to evaluate the adequacy of cybersecurity practices of such suppliers; and (iv) periodic assessment of such suppliers based on the risk they present and the continued adequacy of their cybersecurity practices. 7.6 Use of appropriate administrative, technical and operational measures designed to ensure Personal Data and Plan Data is secure. 7.7 Monitoring, evaluating and adjusting, as appropriate, its data security protocols summarized herein, in light of relevant changes in Data Protection Laws, Services, technology or industry security standards, the sensitivity of data collected or processed by Empower in the provision of its Services , and evolving internal or external risks. Empower may make such updates to its data security protocols and the terms hereof at any time without notice so long as such updates maintain a comparable or better level of security. Individual measures may be replaced by new measures that serve the same purpose without diminishing the security level protecting Personal Data or Plan Data. 8. Risk Management. Empower has a risk assessment program that includes regular risk assessments and management for risk identification, analysis, monitoring and reporting. 9. Human Resources. 9.1 Acknowledgements. Empower shall provide training on its information security practices to its personnel at least annually. Empower personnel shall acknowledge their information security and privacy responsibilities under Empower’s policies.