Common use of Review of Security Standards and Information Security Program Clause in Contracts

Review of Security Standards and Information Security Program. To enable a party to assess another party’s compliance with the requirements in Section 8.9(h) above, a party may request from another party such information relating to its Security Standards and Information Security Program as the requesting party deems reasonably necessary. Such other party shall provide the requested information, or provide alternative information as may be reasonably suitable for assessing such other party’s Security Standards and Information Security Program (such as policies and procedures, internal or external audit reports or self-assessments), within thirty (30) days after receipt of the request. Such other party shall also cooperate with the requesting party in addressing any reasonable concerns relating to possible deficiencies in such other party’s Security Standards and Information Security Program. Each party shall cause its Affiliates to whom it has disclosed Protected Data to comply with the requirements of this Section 8.9(i).

Review of Security Standards and Information Security Program. To enable a party to assess another party’s compliance with the requirements in Section 8.9(h13(c) above, a party may request from another party such information relating to its Security Standards and Information Security Program as the requesting party deems reasonably necessary. Such other party shall provide the requested information, or provide alternative information as may be reasonably suitable for assessing such other party’s Security Standards and Information Security Program (such as policies and procedures, internal or external audit reports or self-assessments), within thirty (30) days after receipt of the request. Such other party shall also cooperate with the requesting party in addressing any reasonable concerns relating to possible deficiencies in such other party’s Security Standards and Information Security Program. Each party shall cause its Affiliates to whom it has disclosed Protected Data to comply with the requirements of this Section 8.9(i13(d).