Physical Controls. Institute Members shall restrict access to paper and electronic records to prevent unauthorized access to information or records classified as confidential or proprietary or trade secrets; and limit access to only those employees who are duly approved, or cleared, to see them on a need-to-know basis. Institute Members shall implement protocols for proper labeling of records (e.g., with a stamp such as confidential or proprietary or trade secret) or using special colored folders (e.g., red or orange), and keep such marked records physically isolated or segregated in a secure area or in locked filing cabinets. In general, the labels should provide brief but clear direction to the user on how to handle the information. Proper access control through appropriate authorization and accountability and tracking system for employees provided access to confidential information is required. Other recommended physical controls may include (without limitation), defining where confidential proprietary information will be stored and avoiding moving such information from location to location; maintenance of access logs; and prohibiting cameras, phones with photographic capabilities, and/or other copying devices in the presence of such information.
Appears in 3 contracts