Successor Servicer Information Security Requirements Sample Clauses

Successor Servicer Information Security Requirements. The following information security requirements (the "Requirements") are generally applicable to any successor Servicer appointed under the terms and conditions of the Transfer and Servicing Agreement (the "Servicer"). Capitalized terms used herein are defined as set forth below or if not defined herein as set forth in Appendix A to the Transfer and Servicing Agreement.

Successor Servicer Information Security Requirements. 6. Access Control Servicer must utilize logical access controls for all access to Cellco Confidential Information, as follows:

Successor Servicer Information Security Requirements occurrence to any person affected or potentially affected thereby and domestic and international, is necessary, authorities (collectively, "Notifications"); and (b) with respect to any Security Incident that poses a risk of identity theft, including without limitation a Security Incident involving a social security number, driver's license or similar personal identification number, the provision of daily credit monitoring, access to credit reports and identity theft insurance for a period of two (2) years (collectively, "Credit Monitoring") to any person affected or potentially affected as a result of a Security Breach.

Successor Servicer Information Security Requirements verification at collection/pick-up location (owner/end user), driver name, date and time stamp, and receipt at Servicer's location (date and time stamp).

Successor Servicer Information Security Requirements occurrence to any person affected or potentially affected thereby and domestic and international, is necessary, authorities (collectively, "Notifications"); and (b) with respect to any Security Incident that poses a risk of identity theft, including without limitation a Security Incident involving a social security number, driver's license or similar personal identification number, the provision of daily credit monitoring, access to credit reports and identity theft insurance for a period of two (2) years (collectively, "Credit Monitoring") to any person affected or potentially affected as a result of a Security Breach. e. Servicer agrees that it shall assume or reimburse Cellco for all reasonable and documented remediation costs, including, but not limited to, any governmental fees or fines, costs for Notifications, costs for Credit Monitoring, and customer reimbursements incurred by Cellco or any of its affiliates in connection with a Security Incident.

Successor Servicer Information Security Requirements. Desctruction makes recovery of such information impossible, consistent with Guidelines for Media Sanitization, National Institute of Standards and Technology, NIST Special Publication 800-88 (NIST 800-88). Incineration, shredding and pulverizing are all permissible physical destruction methods in accordance with minimum standards specified in NIST 800-88. Media that have been subject to such destruction are "Destroyed" and have achieved "Sanitization" under these Requirements.

Successor Servicer Information Security Requirements. 6. Access Control Servicer must utilize logical access controls for all access to Cellco Confidential Information, as follows: a. Use of PLP, such that Servicer enables access to only such information as are necessary to perform a legitimate business function for the role assigned to an authorized user. Servicer must also employ a secure and reliable method of enforcing authorization controls to limit access consistent with PLP. Compliance with PLP also requires a process which will promptly terminate access by an employee or contractor who no longer requires access to perform under the Transfer and Servicing Agreement (e.g., a terminated or reassigned employee/contractor). b. A process of controlling User Ds and other identifiers to ensure they are unique among users and are not shared. c. Servicer Staff or Cellco SPI must not be used as an authentication or authorization mechanism. d. Industry Standard password selection and aging procedures to limit opportunities for compromise of password security must be utilized. Such password procedures must substantially align with NIST SP 800-63: e. Administrative or elevated privileged access to servers must be encrypted in accordance with Transport Encryption. f. Shared or elevated privileged account activity must be monitored, including recordation of failed access attempts and changes to user rights. g. Shared or elevated privileged accounts shall not be used unless the usage can be reliably tracked back to an individual Servicer Staff person. h. When any user's access privileges are removed or disabled, all related privileges must be purged from the application to avoid inheritance of privileges. i. When an error occurs during logon, it must not allow circumvention or breaking out of login process and access must be denied.