Item 19 - Agreement with Empower Annuity Insurance Company for the Employee Deferred Compensation Plan

Home Browse Search

City of Santa Ana_Master Services Agreement_5.23.23 17 13.1 Systems Development Security. Empower addresses security as part of information systems development and operations and follows secure coding methodologies based on application development security best practices. 13.2 Software Security Management. Empower’s information systems (including operating systems, infrastructure, business applications, off-the-shelf products, services and user-developed applications) adheres to the information security standards set forth in Empower’s Information Security Policies. 13.3 Vulnerability Assessments/Ethical Hacking. Empower performs vulnerability assessments and penetration testing against Internet-facing points of presence. Empower corrects vulnerabilities or security issues discovered through such assessments in a manner and time frame consistent with established standards set forth in Empower’s Information Security Policies. 13.4 Cryptography. Empower uses cryptography techniques that assist Empower with preventing the unauthorized capture, modification of or access to data or information . Empower uses standard encryption algorithms that follow up-to-date encryption standards and industry practices. Such cryptography techniques may include but are not limited to: encryption of sensitive data sent across external communication lines; requirement of minimum 128-bit encryption TLS encryption for web browsers; and encryption of Personal Data while stored on laptops, mobile devices, and in recordkeeping databases. 14. Information Security Breach Management. 14.1 Incident Management Program. Empower maintains investigative measures and techniques for incident handling, including but not limited to: a formalized, enterprise-wide Computer Security Incident Response Team (“CSIRT”), and CSIRT processes which are tested at least annually. 14.2 Information Security Breach Response. Empower will notify Plan Sponsor after becoming aware of any Information Security Breach in accordance with all applicable Data Protection Laws. For the avoidance of doubt, Empower will (i) keep the Plan Sponsor informed of significant developments in connection with the investigation of such incident; (ii) investigate and assist any regulator or other governmental body with oversight over the Information Security Breach in investigating, remedying and taking any other action regarding the Information Security Breach as appropriate or required by law; and iii) provide Plan Sponsor with information about remedial measures that have been undertaken to prevent such Information Security Breach from reoccurring. In the event that individual or regulatory notifications are required under applicable Data Protection Laws, the parties will cooperate with respect to notifications. To the extent the Information Security Breach is caused by Empower’s failure to abide by its obligations as set forth in this Data Security Addendum, Empower shall bear the costs of such notifications and provision of credit monitoring services to affected individuals to the extent required by law or otherwise appropriate in Plan Sponsor’s and Empower’s reasonable judgment. 15. Plan Sponsor Assessment Rights. 15.1 Assessment via Security Assurance Package. Within the secure Plan Sponsor website provided by Empower, Empower provides documentation that supports and informs the reader about Empower’s current security program and practices. These documents are referred to as the Security Assurance Package (“SAP”), which currently consists of the following items: Security Program Overview document, SOC 1 report, SOC 2 report, available IT certification reports (e.g. Verizon CRP), and a completed SIG questionnaire with related supporting materials. (The SIG is a standardized document template created by the Shared Assessments Program, a consortium of leading financial institutions, the Big 4 accounting firms, and companies from a wide array of industries.) 15.2 Regulatory Assessment. If Plan Sponsor’s governmental regulators require that Plan Sponsor perform an on-site audit of Empower’s network security, as supported by evidence provided by