Security Certification and Compliance Review Programs Sample Clauses

The Security Certification and Compliance Review Programs clause establishes requirements for maintaining and demonstrating adherence to specific security standards and regulatory compliance. It typically obligates a party to obtain and maintain relevant security certifications, such as ISO 27001 or SOC 2, and to participate in periodic compliance reviews or audits as requested by the other party. This clause ensures that sensitive data and systems are protected according to industry best practices, thereby reducing the risk of security breaches and ensuring ongoing trust between contractual parties.
Security Certification and Compliance Review Programs. (NIST SP 800-18 – System Security Plans and Planning (PL) Family, NIST SP 800-53 rev. 4)
View SourceView Similar (6)
Security Certification and Compliance Review Programs. The primary statutory authority that supports the information contained in this document is the Federal Information Security Management Act (FISMA). FISMA became law as part of the Electronic Government Act of 2002. FISMA is the United States legislation that defines a comprehensive framework to protect government information, operations, and assets against natural or manufactured threats. ▇▇▇▇▇ assigned the National Institute of Standards and Technology (NIST), a branch of the U.S. Department of Commerce, the responsibility to outline and define compliance with FISMA. Unless otherwise stated, all of SSA’s requirements mirror the NIST- defined management, operational, and technical controls listed in the various NIST Special Publications (SP) libraries of technical guidance documents. To gain electronic access to SSA-provided information, under the auspices of a data exchange agreement, EIEP’s must comply with SSA’s most current Technical System Security Requirements (hereafter referred to as TSSRs) to gain access to SSA-provided information. This document is synonymous with the Electronic Information Exchange Security Requirements and Procedures for State and Local Agencies Exchanging Electronic Information with the Social Security Administration in the agreements. The TSSR specifies minimally acceptable levels of security standards and controls to protect SSA-provided information. SSA maintains the TSSR as a living document—subject to change--that addresses emerging threats, new attack methods and the development of new technology that potentially places SSA-provided information at risk. EIEPs may proactively ensure their ongoing compliance to the TSSR by periodically requesting the most current version from SSA. SSA will work with EIEPs to resolve deficiencies, which result from updates to the TSSRs. SSA refers to this process as Gap Analysis. EIEPs may proactively ensure their ongoing compliance with the TSSRs by periodically requesting the most current TSSR package from their SSA Point of Contact (POC) from the data exchange agreement. SSA’s standard for categorization of information (Moderate) and information systems is to provide appropriate levels of security according to risk level. Additions, deletions, or modification of security controls directly affect the level of security and due diligence SSA requires EIEPs use to mitigate risks. The emergence of new threats, attack methods, and the development of new technology warrants frequent reviews an...
View SourceView Similar (6)

Related to Security Certification and Compliance Review Programs

  • Documentation and compliance (a) The data importer shall promptly and adequately deal with enquiries from the data exporter that relate to the processing under these Clauses. (b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the data exporter. (c) The data importer shall make available to the data exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and at the data exporter’s request, allow for and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or audit, the data exporter may take into account relevant certifications held by the data importer.

  • Compliance Review During the Term, Developer agrees to permit the GLO, HUD, and/or a designated representative of the GLO or HUD to access the Property for the purpose of performing Compliance-Monitoring Procedures. In accordance with GLO Compliance-Monitoring Procedures, the GLO or HUD will periodically monitor and audit Developer’s compliance with the requirements of this Agreement, the CDBG-DR Regulations, the CDBG Multifamily Rental Housing Guidelines, and any and all other Governmental Requirements during the Term. In conducting any compliance reviews, the GLO or HUD will rely primarily on information obtained from Developer’s records and reports, on-site monitoring, and audit reports. The GLO or HUD may also consider other relevant information gained from other sources, including litigation and citizen complaints. 5.04 HAZARDOUS MATERIALS: INDEMNIFICATION

  • Monitoring and Compliance Every year during the term of this Agreement on the anniversary date of the effective date of the Agreement, the Restaurant shall provide to the United States a narrative report of the actions taken during the reporting period to remove any barriers to access and otherwise enhance accessibility for individuals with disabilities at the Restaurant and any plans for action concerning ADA compliance in the coming year. The report shall include as an exhibit copies of any complaint, whether formal or informal, received during the reporting period alleging that the Restaurant was not being operated in compliance with the ADA or otherwise discriminated against any person on account of disability. The Owner and Operator of the Restaurant shall cooperate in good faith with any and all reasonable requests by the United States for access to the Restaurant and for information and documents concerning the Restaurant's compliance with this Agreement and the ADA. The United States shall have the right to verify compliance with this Agreement and the ADA, both as set forth in this Agreement and through any means available to the general public, including visits to the public areas of the Restaurant and communications with Restaurant staff. The United States shall have the right to inspect the facility at any time, and counsel for the United States need not identify themselves in the course of visits to the public areas.

  • Annual Reports on Assessment of Compliance with Servicing Criteria (a) On or before March 1 of each year commencing in March 2018, the Master Servicer, the Special Servicer, the Certificate Administrator, the Custodian, the Operating Advisor and, if it has made (or is required to make) an Advance during the applicable calendar year, the Trustee, each at its own expense, shall furnish (and each of the preceding parties, as applicable, (i) with respect to any Servicing Function Participant of such party that is a Mortgage Loan Seller Sub-Servicer, shall use commercially reasonable efforts to cause such Servicing Function Participant to furnish, and (ii) with respect to any other Servicing Function Participant of such party (other than any party to this Agreement), shall cause such Servicing Function Participant to furnish) (each Master Servicer, the Special Servicer, the Certificate Administrator, the Custodian, the Operating Advisor, any Servicing Function Participant and, if it has made (or is required to make) an Advance during the applicable calendar year, the Trustee, as the case may be, a “Reporting Servicer”) to the Certificate Administrator, the Trustee, the Serviced Companion Loan Holders (or, in the case of a Serviced Companion Loan that is part of an Other Securitization Trust, the applicable Other Depositor and Other Exchange Act Reporting Party), the Operating Advisor (only in the case of a report furnished by the Special Servicer) and the Depositor, a report on an assessment of compliance with the Relevant Servicing Criteria (together with a copy thereof in ▇▇▇▇▇-Compatible Format, or in such other format as otherwise agreed upon by the Depositor, the Certificate Administrator, the applicable Other Depositor, the applicable Other Exchange Act Reporting Party and the applicable Certifying Servicer) that complies in all material respects with the requirements of Item 1122 of Regulation AB and contains (A) a statement by such Reporting Servicer of its responsibility for assessing compliance with the Relevant Servicing Criteria, (B) a statement that such Reporting Servicer used the Servicing Criteria to assess compliance with the Relevant Servicing Criteria, (C) such Reporting Servicer’s assessment of compliance with the Relevant Servicing Criteria as of the end of and for the preceding calendar year, including, if there has been any material instance of noncompliance with the Relevant Servicing Criteria, a discussion of each such failure and the nature and status thereof and (D) a statement that a registered public accounting firm has issued an attestation report on such Reporting Servicer’s assessment of compliance with the Relevant Servicing Criteria as of and for such period. Copies of all compliance reports delivered pursuant to this Section 10.09 shall be provided to any Certificateholder, upon the written request thereof, by the Certificate Administrator. Each such report shall be addressed to the Depositor and each Other Depositor (if addressed) and signed by an authorized officer of the applicable company, and shall address each of the Relevant Servicing Criteria specified on a certification substantially in the form of Exhibit O to this Agreement delivered to the Depositor on the Closing Date. Promptly after receipt of each such report, (i) the Depositor and each Other Depositor may review each such report and, if applicable, consult with the each Reporting Servicer as to the nature of any material instance of noncompliance with the Relevant Servicing Criteria, and (ii) the Certificate Administrator shall confirm that the assessments, taken individually address the Relevant Servicing Criteria for each party as set forth on Exhibit O to this Agreement and notify the Depositor of any exceptions. For the avoidance of doubt, the Trustee shall have no obligation or duty to determine whether any such report (other than any such report furnished by the Trustee or any Servicing Function Participant of the Trustee) is in form and substance in compliance with the requirements of Regulation AB. (b) On the Closing Date, the Master Servicer, the Special Servicer, the Certificate Administrator, the Custodian, the Trustee and the Operating Advisor each acknowledge and agree that Exhibit O to this Agreement sets forth the Relevant Servicing Criteria for such party. (c) No later than the end of each fiscal year for the Trust, the Master Servicer, the Special Servicer, the Certificate Administrator, the Custodian, the Operating Advisor and, if it has made (or is required to make) an Advance during such fiscal year, the Trustee shall notify the Certificate Administrator, the Depositor, each Other Exchange Act Reporting Party and each Other Depositor as to the name of each Servicing Function Participant utilized by it, and the Certificate Administrator shall notify the Depositor and each Other Depositor as to the name of each Servicing Function Participant utilized by it, during such fiscal year, and each such notice will specify what specific Servicing Criteria will be addressed in the report on assessment of compliance prepared by such Servicing Function Participant. When the Master Servicer, the Special Servicer, the Certificate Administrator, the Custodian, the Trustee (if applicable), the Operating Advisor and any Servicing Function Participant submit their assessments pursuant to Section 10.09(a) of this Agreement, such parties will also at such time include the assessment (and related attestation pursuant to Section 10.10 of this Agreement) of each Servicing Function Participant engaged by it. The fiscal year for the Trust shall be January 1 through and including December 31 of each calendar year. (d) In the event the Master Servicer, the Special Servicer, the Certificate Administrator, the Custodian, the Trustee (if it has made, or is required to make, an Advance during the applicable period) or the Operating Advisor is terminated or resigns pursuant to the terms of this Agreement, such party shall provide, and each such party shall cause (or, if the Servicing Function Participant is a Mortgage Loan Seller Sub-Servicer, shall use commercially reasonable efforts to cause) any Servicing Function Participant of such party to provide (and the Master Servicer, the Special Servicer and the Certificate Administrator shall, with respect to any Servicing Function Participant that resigns or is terminated under any applicable servicing agreement, cause such Servicing Function Participant (or, in the case of each Servicing Function Participant that is a Mortgage Loan Seller Sub-Servicer, shall use commercially reasonable efforts to cause such Servicing Function Participant) to provide) an annual assessment of compliance pursuant to this Section 10.09, coupled with an attestation as required in Section 10.10 of this Agreement with respect to the period of time that the Master Servicer, the Special Servicer, the Certificate Administrator, the Custodian, the Trustee (if it has made, or is required to make, an Advance during such period of time) or the Operating Advisor was subject to this Agreement or the period of time that the applicable Servicing Function Participant was subject to such other servicing agreement. With respect to each Outside Serviced Mortgage Loan serviced under the applicable Outside Servicing Agreement, the Certificate Administrator shall use commercially reasonable efforts to obtain, and upon receipt deliver to the Depositor, an annual report on assessment of compliance as described in this Section and an attestation as described in Section 10.10 from the related Outside Servicer, Outside Special Servicer, Outside Custodian, Outside Trustee and Outside Paying Agent or Outside Certificate Administrator and in form and substance similar to the annual report on assessment of compliance described in this Section 10.09 and the attestation described in Section 10.10.

  • Implementation Report Within 150 days after the Effective Date, Ensign Group shall submit a written report to OIG summarizing the status of its implementation of the requirements of this CIA (Implementation Report). The Implementation Report shall, at a minimum, include: 1. the name, address, phone number, and position description of the Compliance Officer required by Section III.A, and a summary of other noncompliance job responsibilities the Compliance Officer may have; 2. the names and positions of the members of the Compliance Committee required by Section III.A; 3. the names and positions of the members of the Board of Directors who are responsible for satisfying the Board of Directors compliance obligations described in Section III.A.3; 4. a copy of Ensign Group’s Code of Conduct required by Section III.B.1; 5. the number of individuals required to complete the Code of Conduct certification required by Section III.B.1, the percentage of individuals who have completed such certification, and an explanation of any exceptions (the documentation supporting this information shall be available to OIG upon request); 6. a summary of all Policies and Procedures required by Section III.B (copies of the Policies and Procedures shall be made available to OIG upon request); 7. the following information regarding each type of training required by Section III.C: a. a description of such training, including a summary of the topics covered, the length of sessions, and a schedule of training sessions; b. the number of individuals required to be trained, percentage of individuals actually trained, and an explanation of any exceptions. A copy of all training materials and the documentation supporting this information shall be made available to OIG upon request. 8. a description of the Disclosure Program required by Section III.E; 9. the following information regarding the IRO(s): (a) identity, address, and phone number; (b) a copy of the engagement letter; (c) information to demonstrate that the IRO has the qualifications outlined in Appendix A to this CIA; (d) a summary and description of any and all current and prior engagements and agreements between Ensign Group and the IRO; and (e) a certification from the IRO regarding its professional independence and objectivity with respect to Ensign Group; 10. a description of the process by which Ensign Group fulfills the requirements of Section III.F regarding Ineligible Persons; 11. a list of all of Ensign Group’s locations (including locations and mailing addresses); the corresponding name under which each location is doing business; the corresponding phone numbers and fax numbers; each location’s Medicare and state Medicaid program provider number and/or supplier number(s); and the name and address of each Medicare and state Medicaid program contractor to which Ensign Group currently submits claims; 12. a description of Ensign Group’s corporate structure, including identification of any parent and sister companies, subsidiaries, and their respective lines of business; and