Data Security and Unauthorized Data Release The Requester and Approved Users, including the Requester’s IT Director, acknowledge NIH’s expectation that they have reviewed and agree to manage the requested controlled-access dataset(s) and any Data Derivatives of controlled-access datasets according to NIH’s expectations set forth in the current NIH Security Best Practices for Controlled-Access Data Subject to the GDS Policy and the Requester’s IT security requirements and policies. The Requester, including the Requester’s IT Director, agree that the Requester’s IT security requirements and policies are sufficient to protect the confidentiality and integrity of the NIH controlled-access data entrusted to the Requester. If approved by NIH to use cloud computing for the proposed research project, as outlined in the Research and Cloud Computing Use Statements of the Data Access Request, the Requester acknowledges that the IT Director has reviewed and understands the cloud computing guidelines in the NIH Security Best Practices for Controlled-Access Data Subject to the NIH GDS Policy. The Requester and PI agree to notify the appropriate DAC(s) of any unauthorized data sharing, breaches of data security, or inadvertent data releases that may compromise data confidentiality within 24 hours of when the incident is identified. As permitted by law, notifications should include any known information regarding the incident and a general description of the activities or process in place to define and remediate the situation fully. Within 3 business days of the DAC notification, the Requester agrees to submit to the DAC(s) a detailed written report including the date and nature of the event, actions taken or to be taken to remediate the issue(s), and plans or processes developed to prevent further problems, including specific information on timelines anticipated for action. The Requester agrees to provide documentation verifying that the remediation plans have been implemented. Repeated violations or unresponsiveness to NIH requests may result in further compliance measures affecting the Requester. NIH, or another entity designated by NIH may, as permitted by law, also investigate any data security incident or policy violation. Approved Users and their associates agree to support such investigations and provide information, within the limits of applicable local, state, tribal, and federal laws and regulations. In addition, Requester and Approved Users agree to work with the NIH to assure that plans and procedures that are developed to address identified problems are mutually acceptable and consistent with applicable law.
Notification of Claims (a) Except as otherwise provided in this Agreement, a Person that may be entitled to be indemnified under this Agreement (the “Indemnified Party”), shall promptly notify the party liable for such indemnification (the “Indemnifying Party”) in writing of any pending or threatened claim, demand or circumstance that the Indemnified Party has determined has given or would reasonably be expected to give rise to a right of indemnification under this Agreement (including a pending or threatened claim or demand asserted by a third party against the Indemnified Party, such claim being a “Third Party Claim”), describing in reasonable detail the facts and circumstances with respect to the subject matter of such claim, demand or circumstance (a “Claim Notice”); provided, however, that the failure to provide such notice shall not release the Indemnifying Party from any of its obligations under this Article XI except to the extent the Indemnifying Party is prejudiced by such failure, it being understood that notices for claims in respect of a breach or inaccuracy of a representation or warranty or breach of or default under any obligation or covenant must be delivered before the expiration of any applicable survival period specified in Section 11.4(a). (b) Upon receipt of a notice of a claim for indemnity from an Indemnified Party pursuant to Section 11.5(a) with respect to any Third Party Claim, the Indemnifying Party shall have the right (but not the obligation) to assume the defense and control of any Third Party Claim upon written notice to the Indemnified Party delivered within fifteen (15) Business Days of the Indemnifying Party’s receipt of the applicable Claim Notice and, in the event that the Indemnifying Party shall assume the defense of such claim, it shall allow the Indemnified Party a reasonable opportunity to participate in the defense of such Third Party Claim with its own counsel and at its own expense. The Person that shall control the defense of any such Third Party Claim (the “Controlling Party”) shall select counsel, contractors and consultants of recognized standing and competence after consultation with the other party and shall take all steps reasonably necessary in the defense or settlement of such Third Party Claim. (c) The Sellers or the Buyer, as the case may be, shall, and shall cause each of its Affiliates and representatives to, reasonably cooperate with the Controlling Party in the defense of any Third Party Claim. The Indemnifying Party shall be authorized to consent to a settlement of, or the entry of any judgment arising from, any Third Party Claim, without the consent of any Indemnified Party; provided that (i) such settlement shall not encumber any of the assets of the Indemnified Party or contain any restriction or condition that would apply to such Indemnified Party or to the conduct of the Indemnified Party’s business, (ii) the Indemnifying Party shall pay all amounts arising out of such settlement or judgment concurrently with the effectiveness of such settlement (subject to Section 11.3, if applicable), and (iii) the Indemnifying Party shall obtain, as a condition of any settlement or other resolution, a complete release of any Indemnified Party potentially affected by such Third Party Claim.
Unauthorized Access Notification ▇▇▇ shall notify Provider promptly of any known unauthorized access. ▇▇▇ will assist Provider in any efforts by Provider to investigate and respond to any unauthorized access.