NATIONAL INSURANCE CRIME BUREAU - Laserfiche WebLink

4 applicable federal, state and local laws, rules, and regulations. At a minimum, Agency’s safeguards for the protection of Confidential Information shall include: i. limiting access of Confidential Information to authorized employees; ii. maintaining an adequate network firewall; iii. securing business facilities, data centers, paper files, servers, backup systems, and computing equipment, including but not limited to devices with information storage capability; iv. implementing secure storage and disposal of Confidential Information; v. implementing authentication, and access controls within operating systems and equipment; and vi. implementing appropriate personnel security and integrity procedures and practices, including conducting background checks consistent with applicable law and providing appropriate privacy and information security training to Agency employees. 5. Audits. NICB may issue a security assessment questionnaire and conduct independent onsite security assessments of Agency related to Agency’s compliance this Agreement. For any onsite inspection, NICB will provide at least 30 days prior written notice. Such assessments shall not occur more than once per calendar year, at a time that minimizes operational interruptions to Agency. Agency’s failure to adequately respond in a timely manner to a security assessment questionnaire, timely submit to an onsite inspection, or timely or adequately, in NICB’s sole determination, remedy any compliance or security concern raised by NICB, may result in immediate suspension of Agency’s ISO ClaimSearch access pursuant to Section 10 of the MOU. 6. Security Breach. A. Notification. Agency shall promptly, but in no case later than 48 hours, notify NICB of any significant risk, whether confirmed or based upon a good faith determination, to Confidential Information, to include unauthorized or improper access to, or use or disclosure of, Confidential Information while in the possession or control of Agency, its Administrator, or its Designees (“Security Breach”). B. Mitigation and Cooperation. Agency shall promptly implement steps to remediate and mitigate the effects of any Security Breach. Agency shall cooperate with reasonable requests for information from NICB or its representatives regarding the Security Breach. To the extent possible, Agency shall promptly provide a written description of the number of individuals' data involved, the location (i.e., State) of the individuals, the amount of data involved, the type of data involved and any other relevant information Docusign Envelope ID: 329281D2-142C-8B83-837A-7CD218C257C4