20B - AA - AGMT SCE ENERGY EFFICIENCY

Home Browse Search

16.2.2.2 SCE information management and information security policies and procedures as made available to Implementer from time to time ("SCE Policies and Procedures"), including without limitation ITS-445 "Standards for Information Security Response - Third Parties." 16.2.3 Implementer Response to Security Incident. The following will apply in the event of a Security Incident: 16.2.3.1 Implementer will submit a Security Incident Report (SIR) to SCE's or its affiliates', as the case may be, IT Help Desk or IT Operations Center ("ITOC") in accordance with SCE Policies and Procedures including ITS-445, and applicable law. The SIR shall be given promptly upon discovery of an SI and in any event not more than four (4) hours after discovery of a suspected SI, or sooner if required by law, statute or regulation. If additional time is required under the circumstances of the SI to ascertain the nature or extent of the SI, to stabilize the Computing System or to ensure the integrity of SCE's or its affiliates', as the case may be, data and information, then Implementer shall promptly notify SCE or its affiliates, as the case may be, in writing of the existence of an SI initially, and keep SCE or its affiliates, as the case may be, informed of developments and new information. 16.2.3.2 At SCE's or its affiliates', as the case may be, request, Implementer will meet with SCE or its affiliates, as the case may be, to discuss the cause of the Security Incident, Implementer's response, lessons learned and potential improvements to Implementer's system security processes and procedures. 16.2.4 Compromise of SCE Personal Information. 16.2.4.1 Additional SIRP Requirements for Personal Information. With respect to any SCE Personal Information in the possession or under the control of Implementer, to protect SCE Personal Information from unauthorized access, destruction, use, modification or disclosure, Implementer shall: (a) Develop, implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect SCE Personal Information from unauthorized access, destruction, use, modification, or disclosure. (b) Develop, implement and maintain data privacy and security programs with administrative, technical, and physical safeguards appropriate to the size and complexity of the Implementer's business and the nature and scope of Implementer's activities to protect SCE Personal Information from unauthorized access, destruction, use, modification, or disclosure. 16.2.4.2 Notice Requirements for Personal Information. In the event of a Security Incident where SCE Personal Information was, or is reasonably believed to have been, acquired by an unauthorized person, Implementer shall immediately provide the SIR required by Section 16.2.3. Such SIR shall state that SCE Personal Information may be involved, and shall describe the suspected nature of such SCE Personal Information. 20B-21