From time to time, State Street may subcontract services performed under the Agreement (to the extent provided for under the Agreement) or provide access to Client Data or its network to a subcontractor or other third party; provided, that, such subcontractor or third party implements and maintains security measures State Street believes are at least as stringent as those described in this Security Schedule.
The objective of State Street’s Security Policy and related Information Security Program is to implement data security measures consistent in all material respects with applicable prevailing industry practices and standards (“Objective”). In order to meet such Objective, State Street uses commercially reasonable efforts to:
a. Protect the privacy, confidentiality, integrity, and availability of all confidential data and information disclosed by or on behalf of Client to, or otherwise comes into the possession of State Street, in connection with the provision of services under the Agreement and to the extent the same is deemed confidential information under the terms of the Agreement (collectively, “Client Data”);
b. protect against accidental, unauthorized, unauthenticated or unlawful access, copying, use, processing, disclosure, alteration, transfer, loss or destruction of the Client Data;
c. comply with applicable governmental laws, rules and regulations that are relevant to the handling, processing and use of Client Data by State Street in accordance with the Agreement; and
d. implement customary administrative, physical, technical, procedural and organizational safeguards.
a. Risk Assessment—State Street shall, at least annually, perform risk assessments that are designed to identify material threats (both internal and external) against Client Data, the likelihood of those threats occurring and the impact of those threats upon the State Street organization to evaluate and analyze the appropriate level of information security safeguards (“Risk Assessments”).
b. Risk Mitigation—State Street shall use commercially reasonable efforts to manage, control and remediate any threats identified in the Risk Assessments that it believes are likely to result in material unauthorized access, copying, use, processing, disclosure, alteration, transfer, loss or destruction of Client Data, consistent with the Objective, and commensurate with the sensitivity of the Client Data and the complexity and scope of the activities of State Street pursuant to the Agreement.
c. Security Controls Testing—State Street shall, on approximately an annual basis, engage an independent external party to conduct periodic reviews of State Street’s Information Security practices. State Street shall have a process to review and evaluate high risk findings resulting from this testing.
3. Security Controls. Annually, upon Client’s reasonable request, State Street shall provide Client’s Chief Information Security Officer or his or her designee with a copy of its Corporate Information Security Controls that form the basis for State Street’s Security Policy and an opportunity to discuss State Street’s Information Security measures with a qualified member of State Street’s Information Technology management team. State Street shall review its Security Policy annually.
4. | Organizational Security. |
a. Responsibility—State Street shall assign responsibility for information security management to senior personnel only.