Control of Licensor. For Data and Confidential Information in the possession, custody, and control of the Licensor or its employees, agents, and/or subcontractors: The Licensor shall report unauthorized access, acquisition, use, release, loss, destruction or disclosure of Data or Confidential Information (“Incident”) to the Agency within one (1) hour of when the Licensor knows of or reasonably suspects such Incident, and the Licensor must immediately take all reasonable steps to mitigate any potential harm or further access, acquisition, use, release, loss, destruction or disclosure of such Data or Confidential Information. The Licensor shall provide timely notice to all individuals that may require notice under any applicable law or regulation as a result of an Incident. The notice must be pre-approved by the Agency. At the Agency’s request, the Licensor shall, at its sole expense, provide credit monitoring services to all individuals that may be impacted by any Incident requiring notice. The Licensor shall be solely responsible for any costs, losses, fines, or damages incurred by the Agency or Commonwealth due to Incidents, which shall be reimbursed upon invoice received from the Agency. The Licensor shall indemnify the Agency against any third party claims arising out of an Incident.
Control of Licensor. For Data and Confidential Information in the possession, custody, and control of the Licensor or its employees, agents, and/or subcontractors:
Control of Licensor. For Data and Confidential Information in the possession, custody, and control of the Licensor or its employees, agents, and/or subcontractors: The Licensor shall report unauthorized access, acquisition, use, release, loss, destruction or disclosure of Data or Confidential Information (“Incident”) to the Commonwealth within one (1) hour of when the Licensor knows of or reasonably suspects such Incident, and the Licensor must immediately take all reasonable steps to mitigate any potential harm or further access, acquisition, use, release, loss, destruction or disclosure of such Data or Confidential Information. The Licensor shall provide timely notice to all individuals that may require notice under any applicable law or regulation as a result of an Incident. The notice must be pre-approved by the Commonwealth. At the Commonwealth’s request, the Licensor shall, at its sole expense, provide credit monitoring services to all individuals that may be impacted by any Incident requiring notice. The Licensor shall be solely responsible for any costs, losses, fines, or damages incurred by the Commonwealth due to Incidents, which shall be reimbursed upon invoice received from the Commonwealth. The Licensor shall indemnify the Commonwealth against any third party claims arising out of an Incident.
