Item 15 - Enterprise Land Management System Online Payment Services System

Home Browse Search

and who agree to comply with use and non-disclosure restrictions similar to those contained within this Agreement. 6. Security of Consumer Information. Each Party shall implement and maintain a Security Program that includes appropriate administrative, technical and physical safeguards reasonably designed to: (1) ensure the security and confidentiality of Consumer Information within its systems; (11) protect against any anticipated threats or hazards to the security or integrity of Consumer Information within its systems;and (iii)protect against unauthorized access to or use of Consumer Information stored on its systems;and(iv) dispose of Consumer Information in a secure manner per applicable Rules and Laws. a. In order to comply with safeguard obligations generally described in the preceding paragraph, each Party shall (1) designate an employee or employees to coordinate its Security Program, (2) identify reasonably foreseeable internal and external risks to the security, confidentiality and integrity of Consumer Information located on its systems that could result in the unauthorized disclosure,misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such risk assessment should include consideration of risks in each relevant area of a Party's operations, including: (i) employee training and management; (ii) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (iii) detecting, preventing and responding to attacks, intrusions, or other systems failures, which shall include the use of commercially reasonable efforts to establish procedures and logging mechanisms for FORTE systems and networks that will allow tracking and analysis in the event there is a compromise of its systems, and maintain an audit trail history for at least three (3) months for review by AGENCY upon reasonable request; (3) design and implement information safeguards to control the risks identified through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures; and (4) use commercially reasonable efforts to assure data security when disposing of any Consumer Information. 7. Disclosures. Neither Party shall have an obligation to maintain the confidentiality of any Consumer Information which: (1) has been received by it from a third party without restriction on disclosure and without breach of agreement or other wrongful act by the receiving party; or (ii) is independently developed by it without reference to any Consumer Information. If required by any court of competent jurisdiction or other governmental authority,each Party may disclose to such authority,data,information or materials involving or pertaining to Consumer Information to the extent required by such order or authority. FORTE shall, if not otherwise prohibited, give the other Party as much advance notice of the possibility of such disclosure as is practical so that it may, at its own expense, attempt to stop such disclosure or obtain a protective order concerning such disclosure. 8. Breach Notification. In the event of an actual or validated breach of security of a Party's system,website, database, equipment or storage medium or facility that results in unauthorized access to Consumer Information on a Party's system by any third party(including any consultant or subcontractor of the Party that is not authorized to access such information), the Party that experienced the breach shall notify the other Party within a commercially reasonable time after taking any appropriate measures necessary to prevent further access, and shall take commercially reasonable efforts to resecure its systems as soon as possible. The Party that experienced the breach shall provide any information that the other Party reasonably requests pertaining to the incident,unless prohibited from doing so by applicable Rule or Law and shall provide reasonable cooperation to investigate any such incident. In addition, in the event of an actual or validated breach of security to a Party's system regarding PCI data related to AGENCY's account with FORTE, the Party that experienced the breach shall, to the extent reasonably practicable, cooperate with the investigative actions of the appropriate forensic unit and/or law enforcement agency and agrees to provide the other Party with a copy of the final Incident Report,if any,upon request. 22.11.30 Page 20 CSG165915.0 03-19 26