Documenting Security Controls in the Security Design Plan (SDP Sample Clauses

Documenting Security Controls in the Security Design Plan (SDP. 6.2.1 When the SDP is Required
Sample 1Sample 2Sample 3See All (5)
AutoNDA by SimpleDocs
Documenting Security Controls in the Security Design Plan (SDP. 6.2.1 When the SDP and Risk Assessment are Required  EIEPs must submit an SDP and a security risk assessment (RA) for evaluation when one or more of the following circumstances apply. The RA must be in electronic format. It must include discussion of the measures planned or implemented to mitigate risks identified by the RA and (as applicable) risks associated with the circumstances below:  to obtain approval for requested access to SSA-provided information for an initial agreement  to obtain approval to reestablish previously terminated access to SSA-provided data  to obtain approval to implement a new operating or security platform that will involve SSA-provided information  to obtain approval for significant changes to the EIEP’s organizational structure, technical processes, operational environment, data recovery capabilities, or security implementations planned or made since approval of their most recent SDP or of their most recent successfully completed security review  to confirm compliance when one or more security breaches or incidents involving SSA-provided information occurred since approval of the EIEP’s most recent SDP or of their most recent successfully completed security review  to document descriptions and explanations of measures implemented as the result of a data breach or security incident  to document descriptions and explanations of measures implemented to resolve non-compliancy issue(s)  to obtain a new approval after SSA revoked approval of the most recent SDP SSA may require a new SDP if changes occurred (other than those listed above) that may affect the terms of the EIEP’s information sharing agreement with SSA. SSA will not approve the SDP or allow the initiation of transactions and/or access to SSA-provided information before the EIEP complies with the SSRs. An SDP must satisfactorily document the EIEP’s compliance with all of SSA’s SSRs in order to provide the minimum level of security acceptable to SSA for its EIEP’s access to SSA-provided information. EIEP’s must correct deficiencies identified through the evaluation of the SDP and submit a revised SDP that incorporates descriptions and explanations of the measures implemented to eliminate the deficiencies. SSA cannot grant access to SSA-provided information until the EIEP corrects the deficiencies, documents the SDP, and SSA approves the revisions. The EIEP will communicate the implementation of corrective actions to SSA on a regular basis. SSA will withhold final...
Sample 1

Related to Documenting Security Controls in the Security Design Plan (SDP

  • Implementation of and Reporting on the Project A. The Grantee shall implement and complete the Project in accordance with Exhibit A and with the plans and specifications contained in its Grant Application, which is on file with the State and is incorporated by reference. Modification of the Project shall require prior written approval of the State.

  • Security Controls for State Agency Data In accordance with Senate Bill 475, Acts 2021, 87th Leg., R.S., pursuant to Texas Government Code, Section 2054.138, Contractor understands, acknowledges, and agrees that if, pursuant to this Contract, Contractor is or will be authorized to access, transmit, use, or store data for System Agency, Contractor is required to meet the security controls the System Agency determines are proportionate with System Agency’s risk under the Contract based on the sensitivity of System Agency’s data and that Contractor must periodically provide to System Agency evidence that Contractor meets the security controls required under the Contract.

  • Personal Controls a. Employee Training. All workforce members who assist in the performance of functions or activities on behalf of COUNTY in connection with Agreement, or access or disclose PHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY, must complete information privacy and security training, at least annually, at CONTRACTOR’s expense. Each workforce member who receives information privacy and security training must sign a certification, indicating the member’s name and the date on which the training was completed. These certifications must be retained for a period of six (6) years following the termination of Agreement.

  • Security Controls Annually, upon Fund’s reasonable request, Transfer Agent shall provide Fund’s Chief Information Security Officer or his or her designee with a copy of its corporate information security controls that form the basis for Transfer Agent’s Security Policy and an opportunity to discuss Transfer Agent’s information security measures, and a high level summary of any vulnerability testing conducted by Transfer Agent on its information security controls, with a qualified member of Transfer Agent’s information technology management team. Transfer Agent shall review its Security Policy annually.

  • Technical Security Controls 35 a. Workstation/Laptop encryption. All workstations and laptops that store PHI COUNTY 36 discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of 37 COUNTY either directly or temporarily must be encrypted using a FIPS 140-2 certified algorithm which 1 is 128bit or higher, such as AES. The encryption solution must be full disk unless approved by the 2 COUNTY.

  • Financial Controls At all times, the Charter School shall maintain appropriate governance and managerial procedures and financial controls which procedures and controls shall include, but not be limited to: (1) commonly accepted accounting practices and the capacity to implement them (2) a checking account; (3) adequate payroll procedures; (4) procedures for the creation and review of monthly and quarterly financial reports, which procedures shall specifically identify the individual who will be responsible for preparing such financial reports in the following fiscal year; (5) internal control procedures for cash receipts, cash disbursements and purchases; and (6) maintenance of asset registers and financial procedures for grants in accordance with applicable state and federal law.

  • Program Requirements Provided At No Charge to the Judicial Council A. The Contractor shall provide the following items during the Program at no charge to the Judicial Council:

  • Expansive Controls Where the capability exists, originating or terminating traffic reroutes may be implemented by either Party to temporarily relieve network congestion due to facility failures or abnormal calling patterns. Reroutes will not be used to circumvent normal trunk servicing. Expansive controls will only be used when mutually agreed to by the Parties.

  • Administrative Controls The Contractor must have the following controls in place:

  • Accounting Controls The Company and its Subsidiaries maintain systems of “internal control over financial reporting” (as defined under Rules 13a-15 and 15d-15 under the Exchange Act Regulations) that comply with the requirements of the Exchange Act and have been designed by, or under the supervision of, their respective principal executive and principal financial officers, or persons performing similar functions, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP, including, but not limited to, internal accounting controls sufficient to provide reasonable assurance that (i) transactions are executed in accordance with management’s general or specific authorizations; (ii) transactions are recorded as necessary to permit preparation of financial statements in conformity with GAAP and to maintain asset accountability; (iii) access to assets is permitted only in accordance with management’s general or specific authorization; and (iv) the recorded accountability for assets is compared with the existing assets at reasonable intervals and appropriate action is taken with respect to any differences. Except as disclosed in the Registration Statement, the Pricing Disclosure Package and the Prospectus, the Company is not aware of any material weaknesses in its internal controls. The Company’s auditors and the Audit Committee of the Board of Directors of the Company have been advised of: (i) all significant deficiencies and material weaknesses in the design or operation of internal controls over financial reporting which are known to the Company’s management and that have adversely affected or are reasonably likely to adversely affect the Company’ ability to record, process, summarize and report financial information; and (ii) any fraud known to the Company’s management, whether or not material, that involves management or other employees who have a significant role in the Company’s internal controls over financial reporting.

Time is Money Join Law Insider Premium to draft better contracts faster.