20B - AA - AGMT SCE ENERGY EFFICIENCY

Home Browse Search

16.1.3 Notwithstanding any other provision in the Contract or Contract, Implementer's nondisclosure obligations with respect to SCE Personal Information shall survive any expiration or termination of the Contract in perpetuity. Upon the expiration or termination of the Contract, or at any time upon request of SCE, all SCE Personal Information in any medium, including all copies or parts thereof, shall be returned to SCE or destroyed, except that Implementer may retain one copy of any materials prepared by Implementer containing or reflecting SCE Personal Information if necessary for compliance with its internal record-keeping or quality assurance requirements only. If destroyed, such destruction shall be certified in writing by Implementer. 16.2 Security Incidents. This section shall apply only to the extent Implementer is in possession or control of SCE Personal Information or SCE Confidential Customer Information. 16.2.1 Security Incident Response Plan. Implementer shall develop, implement and maintain a written plan and process for preventing, detecting, identifying, reporting, tracking and remediating Security Incidents ("Security Incident Response Plan" or "SIRP"). A Security Incident shall mean an event or set of circumstances that results in a reasonable expectation of a compromise of the security, confidentiality or integrity of SCE data or information under the Implementer's control. Examples of Security Incidents include are but not limited to: (i) Security breaches to Implementer's network perimeter or to internal applications resulting in potential compromise of SCE data or information. (ii) Loss of physical devices or media, e.g., laptops, portable media, paper files, etc., containing SCE data. (iii) Lapses in, or degradation of, Implementer's security controls, methods, processes or procedures. (iv) The unauthorized disclosure of SCE data or information. (v) Any and all incidents adversely affecting SCE's or its affiliates', as the case may be, information assets. 16.2.2 SIRP General Requirements. Implementer's SIRP will include Security Incident handling and response procedures, specific contacts in an event of a Security Incident, the contacts' roles and responsibilities, and their plans to notify SCE or its affiliates, as the case may be, concerning the Security Incident. The SIRP must be based on and meet all requirements of the following: 16.2.2.1 Federal and applicable state laws, statutes and regulations concerning the custody, care and integrity of data and information. In particular and without limitation, Implementer shall ensure that its SIRP and its business practices in performing work on behalf of SCE comply with California's Information Practices Act of 1977, California Civil Code §§ 1798.80 et seq., which addresses among other things the provision of notice to SCE or its affiliates, as the case may be, of any breach of the security of SCE Personal Information if it is reasonably believed to have been acquired by an unauthorized person. 20B-20