Item 19 - Agreement with Empower Annuity Insurance Company for the Employee Deferred Compensation Plan

Home Browse Search

City of Santa Ana_Master Services Agreement_5.23.23 16 9.2 Personnel Controls. Empower completes appropriate pre-employment background checks and screening on its personnel, and requires personnel to complete initial security training at the time they are first employed with Empower and annually thereafter. All personnel attest annually to Empower’s Code of Business Conduct and Ethics, which enforces the tenets of Emp ower’s Information Security Policies and its privacy policies. Empower has disciplinary processes for violations of information security or privacy requirements, and promptly removes personnel access to Plan Data or Personal Data upon termination or applicable role change. 10. Physical and Environmental Safety. 10.1 Physical and Environmental Security Controls. Empower has appropriate physical and environmental controls to protect Empower’s equipment, assets, and facilities used to provision services. Physical Security includes, without limitation (i) physical security in the protection of valuable information assets of the business enterprise; and (ii) the provision of protection techniques for the entire facility, from the outside perimeter to the inside office space, including the datacenters and wiring closets. 10.2 Ongoing Operations. Empower protects its facilities and systems containing Data from failures of power, networks, telecommunications, water supply, sewage, heating, ventilation, and air - conditioning. 11. Communications and Operations Management. 11.1 Controls. Empower has policies and procedures in place for communications and operations management controls. Such controls address: hardening, change control, segregation of duties, separation of development and production environments, network security, virus protection, patch management, media controls, data in transit, encryption, audit logs, and time synchronization. 11.2 Operations Security. Empower’s Information Security Policies mandate ongoing Operations Security requirements, including but not limited to, installing or maintaining (i) security patches for operating systems and applications within standard timeframes based on severity ; (ii) industry standard versions of operating systems, software and firmware for system applications and components; and (iii) up- to-date system security agent software which includes updated malware and virus definitions. 12. Access Control. 12.1 Access Control. Empower utilizes access controls designed to ensure that only Empower personnel with the proper need and authority can access its internal recordkeeping system and associated data. Empower’s access controls include but are not limited to: limiting access to personnel with a requirement to view Personal Data; establishing least-privilege controls to protect systems and Personal Data; generation of audit trails; periodic review and approval of personnel who need to access the Empower recordkeeping system; and termination of personnel access promptly following severance from employment. 12.2 Authentication. Empower authenticates user identity through appropriate authentication controls such as strong passwords, token devices, or biometrics. Passwords must meet minimum length and complexity requirements. 12.3 Remote Access to Empower Systems. Empower uses multi-factor authentication for remote access to its systems. 13. Information Systems Acquisition, Development and Maintenance.