Common use of Security Audit Clause in Contracts

Security Audit. A Customer employee or an independent third party auditor mutually acceptable to both parties (“Auditor”) may conduct, at Customer’s expense, one (1) postal or on-site audit during the Term of an Order Form to verify that EIS is in compliance with its security and data protection obligations under the Agreement (“Security Audit”). Customer will conduct on-site Security Audits at SAS’ corporate headquarters in Cary, North Carolina, USA during SAS’ normal business hours. Neither EIS nor SAS will be required during such Security Audit to disclose any information relating to other customers or to third parties. Customer must provide EIS and SAS with at least thirty (30) days’ written notice prior to conducting an on-site Security Audit. On-site Security Audits must not interfere with SAS’ normal business operations and will not exceed three (3) SAS Business Days. The Auditor must sign a confidentiality agreement with SAS prior to conducting the Security Audit and will comply at all times with SAS’ security rules, policies and procedures. SAS will cooperate with the Auditor by: (a) making applicable records available; (b) providing copies of such records as requested for review by the Auditor on SAS’ premises; and (c) directing SAS employees to reasonably cooperate. Customer may request additional Security Audits during the Term of an Order Form provided, however, that Customer may not conduct more than one (1) Security Audit during any twelve (12) month period. Notwithstanding the foregoing, exceptionally, and subject to the other conditions of this Section, Customer may conduct a Security Audit more than one (1) time in a twelve (12) month period if required by applicable law, an order of a regulatory authority, or as otherwise agreed by SAS.