Security Certification and Compliance Review Programs Sample Clauses

Security Certification and Compliance Review Programs. The primary statutory authority that supports the information contained in this document is the Federal Information Security Management Act (FISMA). FISMA became law as part of the Electronic Government Act of 2002. FISMA is the United States legislation that defines a comprehensive framework to protect government information, operations, and assets against natural or manufactured threats. FISMA assigned the National Institute of Standards and Technology (NIST), a branch of the U.S. Department of Commerce, the responsibility to outline and define compliance with FISMA. Unless otherwise stated, all of SSA’s requirements mirror the NIST- defined management, operational, and technical controls listed in the various NIST Special Publications (SP) libraries of technical guidance documents. To gain electronic access to SSA-provided information, under the auspices of a data exchange agreement, EIEP’s must comply with SSA’s most current Technical System Security Requirements (hereafter referred to as TSSRs) to gain access to SSA-provided information. This document is synonymous with the Electronic Information Exchange Security Requirements and Procedures for State and Local Agencies Exchanging Electronic Information with the Social Security Administration in the agreements. The TSSR specifies minimally acceptable levels of security standards and controls to protect SSA-provided information. SSA maintains the TSSR as a living document—subject to change--that addresses emerging threats, new attack methods and the development of new technology that potentially places SSA-provided information at risk. EIEPs may proactively ensure their ongoing compliance to the TSSR by periodically requesting the most current version from SSA. SSA will work with EIEPs to resolve deficiencies, which result from updates to the TSSRs. SSA refers to this process as Gap Analysis. EIEPs may proactively ensure their ongoing compliance with the TSSRs by periodically requesting the most current TSSR package from their SSA Point of Contact (POC) from the data exchange agreement. SSA’s standard for categorization of information (Moderate) and information systems is to provide appropriate levels of security according to risk level. Additions, deletions, or modification of security controls directly affect the level of security and due diligence SSA requires EIEPs use to mitigate risks. The emergence of new threats, attack methods, and the development of new technology warrants frequent reviews an...
Sample 1Sample 2Sample 3See All (6)
AutoNDA by SimpleDocs
Security Certification and Compliance Review Programs. (NIST SP 800-18 – System Security Plans and Planning (PL) Family, NIST SP 800-53 rev. 4) SSA’s security certification and compliance review programs are distinct processes. The certification program is a unique episodic process when an EIEP initially requests electronic access to SSA-provided information or makes substantive changes to existing exchange protocol, delivery method, infrastructure, or platform. The certification process entails two stages (refer to 6.1 for details) intended to ensure that management, operational, and technical security measures work as designed. SSA must ensure that the EIEPs fully conform to SSA’s security requirements at the time of certification and satisfy both stages of the certification process before SSA will permit online access to its data in a production environment. The compliance review program entails cyclical security review of the EIEP performed by, or on behalf of SSA. The purpose of the review is to to assess an EIEP’s conformance to SSA’s current security requirements at the time of the review engagement. The compliance review program applies to both online and batch access to SSA-provided information. Under the compliance review program, EIEPs are subject to ongoing and periodic security reviews by SSA. (THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Sample 1Sample 2Sample 3See All (5)

Related to Security Certification and Compliance Review Programs

  • Documentation and compliance (a) The data importer shall promptly and adequately deal with enquiries from the data exporter that relate to the processing under these Clauses.

  • Compliance Review During the Term, Developer agrees to permit the GLO, HUD, and/or a designated representative of the GLO or HUD to access the Property for the purpose of performing Compliance-Monitoring Procedures. In accordance with GLO Compliance-Monitoring Procedures, the GLO or HUD will periodically monitor and audit Developer’s compliance with the requirements of this Agreement, the CDBG-DR Regulations, the CDBG Multifamily Rental Housing Guidelines, and any and all other Governmental Requirements during the Term. In conducting any compliance reviews, the GLO or HUD will rely primarily on information obtained from Developer’s records and reports, on-site monitoring, and audit reports. The GLO or HUD may also consider other relevant information gained from other sources, including litigation and citizen complaints. Attachment G GLO Contract No. 19-097-041-B662 5.04 HAZARDOUS MATERIALS: INDEMNIFICATION

  • Monitoring and Compliance Every year during the term of this Agreement on the anniversary date of the effective date of the Agreement, the Restaurant shall provide to the United States a narrative report of the actions taken during the reporting period to remove any barriers to access and otherwise enhance accessibility for individuals with disabilities at the Restaurant and any plans for action concerning ADA compliance in the coming year. The report shall include as an exhibit copies of any complaint, whether formal or informal, received during the reporting period alleging that the Restaurant was not being operated in compliance with the ADA or otherwise discriminated against any person on account of disability. The Owner and Operator of the Restaurant shall cooperate in good faith with any and all reasonable requests by the United States for access to the Restaurant and for information and documents concerning the Restaurant's compliance with this Agreement and the ADA. The United States shall have the right to verify compliance with this Agreement and the ADA, both as set forth in this Agreement and through any means available to the general public, including visits to the public areas of the Restaurant and communications with Restaurant staff. The United States shall have the right to inspect the facility at any time, and counsel for the United States need not identify themselves in the course of visits to the public areas.

  • Compliance Reviews The Department may conduct a compliance review of the Contractor’s security procedures before and during the Contract term to protect Confidential Information.

  • Program Compliance The School Board shall be responsible for monitoring the program to provide technical assistance and to ensure program compliance.

  • Monitoring Compliance Upon the request of the Lender, but without incurring any liability beyond the Guaranteed Obligations, from time to time, Guarantor shall promptly provide to the Lender such documents, certificates and other information as may be deemed reasonably necessary to enable the Lender to perform its functions under the Servicing Agreement as the same relates to the Guarantor.

  • County Review and Approval of Insurance Requirements The County reserves the right to review and adjust the Required Insurance provisions, conditioned upon County’s determination of changes in risk exposures.

  • Non-compliance Penalty Certificate h) If any Non-compliance Penalty arises, the Supplier Development Manager shall issue a Non- compliance Penalty Certificate on the last day of each month during such Non-compliance indicating the Non-compliance Penalties which have accrued during that period.

  • STATEMENT OF COMPLIANCE Contractor has, unless exempted, complied with the nondiscrimination program requirements. (Gov. Code §12990 (a-f) and CCR, Title 2, Section 11102) (Not applicable to public entities.)

  • Compliance Reports The Subadvisor at its expense will provide the Advisor with such compliance reports relating to its duties under this Agreement as may be agreed upon by such parties from time to time.

Time is Money Join Law Insider Premium to draft better contracts faster.