NATIONAL INSURANCE CRIME BUREAU - Laserfiche WebLink

21 2 . ISO ClaimSearch Participating Organizations and Other Claims Database Organizations ISO has the option to conduct audits with its own personnel, jointly with National Insurance Crime Bureau (NICB) personnel, jointly with Participating Organization personnel, or with Participating Organization personnel acting according to ISO instructions. ISO will coordinate such audits with the Participating Organization home office liaison or designee and will work with Participating Organization personnel. • NICB — ISO and/or the NICB may periodically conduct audits of the NICB’s operational and administrative procedures relating to use of the database. ISO has the option to conduct such audits with its own personnel, jointly with NICB personnel, or with NICB personnel acting according to ISO instructions. The purpose of such audits is to ensure compliance with policies and procedures as they relate to querying the ISO database. • NICB Participating Organizations (law enforcement, criminal justice, and certain regulatory agencies) — To the extent not prohibited by law, the NICB and/or ISO in conjunction with the NICB may periodically conduct audits of law enforcement agencies that have direct online or query access to ISO ClaimSearch or access to queries through Nlets (National Law Enforcement Telecommunications System). The audits will review operational and administrative procedures relating to use of the database. These audits may be conducted solely by or in conjunction with NICB personnel and law enforcement liaisons or designees. The purposes of such audits are to (1) ensure compliance with regard to querying the data- base; (2) verify the authorization process for system users; and (3) verify compliance with the ISO ClaimSearch Privacy and Security Policies. • ISO ClaimSearch Participating Organizations — For ISO ClaimSearch Participating Organizations that wish to audit ISO ClaimSearch, ISO ClaimSearch will, in response, produce a Service Organization Control Report (SOC Type II) completed by a third-party auditing firm. Because the ISO ClaimSearch database contains data submitted by multiple parties within the property/casualty and health markets, as well as law enforcement data, ISO will not produce reports, summaries, or redacted summaries of vulnerability scans or assessments. 3 . Audit Procedures When conducting an audit, ISO may perform procedures similar to: • a random selection of claim reports and query transactions from the Participating Organization office • a review of the selection with the designated Participating Organization representative The ISO system may continually audit system use, such as: • built-in red flags to identify instances of possible misuse or noncompliance with policy • flag Authorized Users requesting and/or downloading potentially inappropriate amounts of data • identify claims inquiries with no apparent associated claim reported to the database The auditors may: • notify the Participating Organization or law enforcement liaison of upcoming audits • outline the audit scope and objectives • supply a copy of the random claims reporting and/or query transactions Docusign Envelope ID: 329281D2-142C-8B83-837A-7CD218C257C4