2022-204 - Laserfiche WebLink

Home Browse Search

(2) Security Breach and Notice. Lincoln will promptly notify Employer after Lincoln has confirmed an incident involving the unauthorized access to or acquisition of any Employer Confidential Information ("Security Breach"). Lincoln shall: (i) commence all reasonable efforts to investigate the Security Breach, mitigate and correct its causes, and remediate its results; and (ii) provide to Employer written notice thereof. Thereafter, Lincoln shall, and shall cause any third parties acting on Lincoln's behalf, that are in possession or control of any affected Confidential Information, to use commercially reasonable efforts to prevent a recurrence of any Security Breach and cooperate with any similar efforts Employer or its affiliates may undertake. Lincoln will reasonably consult with Employer, in order to provide advance notice and review regarding any communication or notice Lincoln determines necessary with any third party, including but not limited to the media, consumers and affected individuals regarding any Security Breach without the express written consent of Employer, provided such consultation not be unreasonably withheld. Lincoln's notification of or response to the Security Breach under this Section will not be construed as an acknowledgement by Lincoln of any fault or liability with respect to the Security Breach. Lincoln will provide a credit monitoring service to any impacted consumers as required by applicable federal and state privacy laws. (3) Audit Review. Employer, or an independent third party selected by Employer, may perform security assessments, via questionnaire, of Lincoln's compliance with the terms in this section regarding securing Employer Confidential Information up to once per year; provided, however, that the security assessments will not apply to any Lincoln affiliates, subsidiaries, and parents or discrete business units of Lincoln that do not receive Employer Confidential Information. Employer may not apportion its security assessments with respect to different subject matters into separate security assessments; however, if Employer has shown good cause for concern regarding the sufficiency of Lincoln's information security program, Employer shall have the right to an additional security assessment to address such concern. If Employer selects a third party to conduct the security assessment, the third party must be agreed to by Employer and Lincoln and must execute a written confidentiality agreement acceptable to Lincoln before conducting such security assessment. The security assessment must be conducted during regular business hours, subject to Lincoln policies, and may not unreasonably interfere with Lincoln activities. Lincoln will reasonably cooperate with Employer on any assessment that Employer conducts in accordance with the provisions of this section. Lincoln is not and will not be obligated to provide to Employer or any independent third party any access or information that Lincoln determines, in its sole discretion, to present undue risk to the confidentiality, integrity, or availability of Lincoln's data, information systems, facilities, or other resources belonging to Lincoln or which Lincoln is otherwise obligated to protect. Employer will provide Lincoln any security assessment reports generated in connection with any security assessment under this section, unless prohibited by law. Employer may use the security assessments only for the purposes of meeting its regulatory audit requirements or confirming compliance with the requirements of this section. The information security assessments are Indian River County BOCC 457(b) INDR-001 1423269 Page 6 of 20