Common use of Information Security Incident Management Clause in Contracts

Information Security Incident Management. a. Contractor communicates information security events and weaknesses associated with information systems in a manner allowing timely corrective action to be taken; b. All Contractor’s employees, contractors and third-party users of information systems and services are provided awareness training on reporting an observed or suspected incident; and c. Management of information security incidents and improvements i. The responsibilities and procedures of Contractor’s management have been established to ensure timely, effective, and orderly response to information security incidents; ii. Contractor has mechanisms in place to enable the security incidents to be quantified and monitored; and iii. Where a follow-up action against a person or organization after an information security incident involves legal action (either civil or criminal), Contractor shall collect, retain and present evidence in conformance with the rules for evidence established in the relevant jurisdiction(s).

Information Security Incident Management. a. Contractor communicates information security events and weaknesses associated with information systems in a manner allowing timely corrective action to be taken; b. All Contractor’s employees, contractors contractors, and third-party users of information systems and services are provided awareness training on reporting an observed or suspected incident; and c. Management of information security incidents and improvements i. The responsibilities and procedures of Contractor’s management have been established to ensure timely, effective, and orderly response to information security incidents; ii. Contractor has mechanisms in place to enable the security incidents to be quantified and monitored; and iii. Where a follow-up action against a person or organization after an information security incident involves legal action (either civil or criminal), Contractor shall collect, retain and present evidence in conformance with the rules for evidence established in the relevant jurisdiction(s).