R2024-78 Resolution Authorizing the Execution of a Three-Year Agreement and Payment to Lexis Nexis for their Desk Officer Reporting System

Home Browse Search

EXHIBIT A-SECURITY AND NOTIFICATION REQUIREMENTS 1. Data Protection.Agency shall take appropriate measures to protect against the misuse and unauthorized access through or to Agency's (i) credentials("Account IDs") used to access the Services; or(ii) corresponding passwords,whether by Agency or any third party;or(iii)the Services and/or information derived therefrom. Agency shall manage identification,use,and access control to all Account IDs in an appropriately secure manner and shall promptly deactivate any Account IDs when no longer needed or where access presents a security risk. Agency shall implement its own appropriate program for Account ID management and shall use commercially reasonable efforts to follow the policies and procedures for account maintenance as may be communicated to Agency by Provider from time to time in writing. 2. Agency's Information Security Program.Agency shall implement and document appropriate policies and procedures covering the administrative, physical and technical safeguards in place and relevant to the access, use, storage, destruction, and control of information which are measured against objective standards and controls("Agency's Information Security Program"). Agency's Information Security Program shall: (1)account for known and reasonably anticipated threats and Agency shall monitor for new threats on an ongoing basis; and (2) meet or exceed industry best practices. Agency will promptly remediate any deficiencies identified in Agency's Information Security Program.Agency shall not allow the transfer of any personally identifiable information received from Provider across any national borders outside the United States without the prior written consent of Provider. 3. Agency Security Event. In the event Agency learns or has reason to believe that Account IDs, the Services, or any information related thereto have been misused,disclosed,or accessed in an unauthorized manner or by an unauthorized person(an"Agency Security Event")Agency shall: (a) provide immediate written notice to: (i) the Information Security and Compliance Organization at 1000 Alderman Drive,Alpharetta,Georgia 30005;or (ii) via email to(security.investigations@ lexisnexis.com);or (iii) by phone at(1-888-872-5375)with a written notification to follow within twenty-four(24)hours;and (b) promptly investigate the situation;and (c) obtain written consent from Provider, not to be unreasonably withheld,prior to disclosing Provider or the Services to any third party in connection with the Agency Security Event;and (d) if required by law,or in Provider'discretion,Agency shall: (i) notify the individuals whose information was disclosed that an Agency Security Event has occurred;and (ii) be responsible for all legal and regulatory obligations including any associated costs which may arise in connection with the Agency Security Event;and (e) remain solely liable for all costs and claims that may arise from the Agency Security Event, including,but not limited to: litigation (including attorney's fees); reimbursement sought by individuals(including costs for credit monitoring and other losses alleged to be in connection with such Agency Security Event);and (f) provide all proposed third party notification materials to Provider for review and approval prior to distribution. In the event of an Agency Security Event, Provider may, in its sole discretion, take immediate action, including suspension or termination of Agency's account,without further obligation or liability of any kind. Confidential—Law Enforcement Agreement(Q3.23.V3) Page 9 of 9