Policy Requirements

Each Party must maintain effective information security policies which comply with: (i) applicable Statutory Requirements; (ii) Good Industry Practice; and (iii) any professional or industry information security certifications that a Party may state they hold (e.g. ISO27001).

Roles and Responsibilities

Each Party must ensure it has a named individual(s) who is assigned responsibility and accountability for information security as a minimum for:

• data and information security and governance;
• ensuring that all Personnel and Subcontractors receive training on data handling and information security awareness and how to report Security Incidents;
• assigning and revoking access to Systems for Personnel and Subcontractors who no longer have a legitimate need for it; and
• responding to and reporting Security Incidents in accordance with these Data Protection and Security Requirements.

Personnel and Subcontractors

Each Party must ensure Personnel and Subcontractors:

• are vetted in accordance with Good Industry Practice;
• have contractually committed themselves to complying with appropriate information security management practices;
• undertake regular and appropriate training on handling data and preventing, mitigating and reporting Security Incidents;
• do not have access to or process any personal data unless they are strictly required to do so for the purpose of the Agreement; and;
• are informed and understand that a Party’s Data is confidential information and are under a contractual obligation of confidentiality.

Each Party is responsible for procuring that all Personnel and Subcontractors comply with these Data Security Requirements.

Assets and Media Handling

Each Party must ensure all assets (both physical and logical) are managed effectively to prevent Security Incidents. As a minimum this includes:

• maintaining an accurate and up-to-date inventory of assets;
• ensuring all Personnel and Subcontractors return assets in their possession upon termination of their employment;
• removing access rights of Personnel and Subcontractors to all assets immediately upon termination of their employment;
• having in place appropriate access controls and access management systems and procedures (including password management); and
• securely and properly disposing of all assets in accordance with appropriate documented procedures.

A Party must not hold any data transferred to it on any removable media (e.g. CD, USB memory stick) without ensuring all data held on the removable media is encrypted and handled in accordance with these Data Protection and Security Requirements.

Data Handling and Encryption

Each Party must maintain data classification and handling policies in accordance with Good Industry Practice that ensure the adequate protection of any data transferred to it by the other Party.

Each Party must ensure that all transferred data is encrypted in transit (including on removable media) using algorithms, strong key lengths (at least 256-bit) and proper key-management practices that meet Good Industry Practice and as a minimum the National Institute for Standards and Technology cryptographic standards set out here:

https://csrc.nist.gov/Projects/Cryptographic-Standards-and-Guidelines.

Encryption keys must never be stored in clear text.

Physical and Operational Security

Each Party must ensure appropriate technical and organisational measures are in place and take such precautions as are necessary to:

• protect any data transferred to the other Party against unauthorised or unlawful access, processing, accidental loss, disclosure, improper use, damage or destruction;
• ensure its business practices, premises, Personnel, Subcontractors and System remain free from Vulnerabilities; and
• ensure that it nor any Personnel and Subcontractors introduce any Threats or Vulnerabilities into the other Party’s System and/or premises.

The technical and organisational measures a Party must have in place include as a minimum:

• using internationally recognised anti-malware software to detect and remove all known malware;
• ensuring any anti-malware solution is: (i) is centrally managed; (ii) automatically updates anti-malware definitions as they are made available by vendors; and (iii) runs scheduled anti-malware scans at the frequency recommended by the vendor on all endpoints connected to a System that stores processes or transmits any data transferred to the other Party;
• taking appropriate steps to ensure that availability and access to transferred data held on its System can be restored in a timely manner following an outage or Security Incident;
• ensuring the application of all security updates and patches to its System in accordance with the vendor’s instructions and at the recommended frequency for automatic updates;
• securing all networks and network services, including appropriate segregation; and
• performing robust and detailed due diligence on all Subcontractors, including review of their security measures and procedures.

Monitoring, Review and Improvement

Each Party must:

• continually monitor the effectiveness of its information security management practices and ensure its compliance with these Data Protection and Security Requirements;
• proactively make improvements to its information security management practices on a continuing basis; and
• conduct regular audits, tests and risk assessments (at least annually) of its information security management practices and promptly remediate any issues identified.

Hosting and Development

If a Party, or any Personnel or Subcontractor on its behalf, performs any coding, development, programming and/or hosting of any code, software, applications, APIs and/or websites transmitting or processing the transferred data, such Party must:

• Carry out such work in accordance with Good Industry Practice and secure coding principles, including those specified by the Open Web Application Security Project (OWASP);
• Ensure it adopts a secure development lifecycle the same as or equivalent to the OWASP Secure Software Development Lifecycle guidelines;
• Not use or host any code, software, applications, APIs and/or websites in a live or production environment until its use has been approved by the other Party;
• Ensure all relevant keys, passwords and tokens are encrypted using strong key lengths (at least 256-bit) and adopt proper key-management practices that meet Gr73 good Industry Practice and as a minimum the National Institute for Standards and Technology cryptographic standards set out here: https://csrc.nist.gov/Projects/Cryptographic-Standards-and- Guidelines;

• Perform rigorous security and penetration tests on all code, software, applications, APIs and/or websites prior to using it, and properly remediate all Vulnerabilities; and
• Submit (or provide access to) all code, software, applications, APIs and/or websites to the other Party along with the details and results of all security and penetration testing that have been carried out or evidence of any Vulnerability testing performed, upon reasonable request.

PCI-DSS

If a Party, or any of its Subcontractor processes, transmit or stores customers’ payment card data for the purposes of the Agreement, such Party must comply with the relevant Payment Card Industry Security Standards Council’s then current standards, including (as appropriate) PCI DSS, PA DSS, PCI PTS Security Requirements, PCI Card Security Requirements (together the “PCI Standards”). Such Party must also comply with any specific requirements of any card issuer regarding payment card data. Each Party must without undue delay notify the other Party when it becomes aware of any non-minor breach by it or any Subcontractor of the PCI Standards which are relevant to the provision of such Party’s obligations under the Agreement. On request, a Party will (if relevant) promptly evidence its compliance with the PCI Standards by submitting to the other Party a copy of its Attestation of Compliance (AoC) which is applicable to its obligations under the Agreement. This must meet the requirements and governance set by the PCI Security Standards Council.

Security Incident Management Incident Management

Each Party must maintain robust controls to ensure the proper notification and handling of Security Incidents to ensure they are notified to the other Party without undue delay and timely corrective action can be undertaken to mitigate the impact and resolve the Security Incident.

Notification

On occurrence of a Security Incident, a Party must without any undue delay, and in any event within 24 hours:

• notify the other Party that a Security Incident has occurred as follows: LT by telephone (07910 518195 in business hours or 07910 518195 out of hours) and by e-mail (info@leveltech.io)

Partner through the contact details provided to LT for such purposes;

• to the extent it is aware at the time, provide the other Party with details regarding the nature and potential severity of the Security Incident. It is acknowledged that details may not be known about the Security Incident without further investigation and the initial notification may be limited to the Security Incident having occurred.

Each Party must also comply with the Investigation and Mitigation requirements in the sub-section below and regularly (and upon the other Party’s reasonable request) update the other Party by telephone or e-mail regarding the Security Incident, providing details of:

• the extent that the data transferred to it by the other Party has been lost, corrupted or disclosed;
• where the Security Incident relates to any personal data transferred to it, the categories and approximate number of data subjects and data records that may be affected by the personal data breach;
• the likely consequences of the Security Incident and its anticipated duration; and
• the measures taken or to be taken to address the Security Incident and mitigate its effects.

A Party must not issue any communication to any Regulator or data subject regarding the Security Incident without the other Party’s prior approval (not to be unreasonably with-held or delayed), unless explicitly mandated to do so by a Regulator or Statutory Requirement.

Each Party must provide reasonable cooperation and assistance and such information as the other Party may require regarding the Security Incident which may include assisting such Party to notify the Regulator or affected data subjects in accordance with Data Protection Legislation.

Investigation and Mitigation

Each Party, in addition to notifying a Security Incident to the other Party, shall proactively and without delay:

• investigate the Security Incident;
• minimise the extent of any actual or potential harm caused by the Security Incident;
• take all reasonable steps to protect data and/or its System;
• comply with any of the other Party’s reasonable requests or instructions in relation to the Security Incident, including taking any remedial actions they reasonably require;
• carry out a root cause analysis of the Security Incident and undertake any necessary
  remediation to prevent an equivalent Security Incident in the future; and
• promptly report the conclusions of the root cause analysis including details of any issues, recommendations or risks identified to the other Party and confirm what remediation work has been undertaken.

System

In the event a Party’s System is in any way threatened or compromised by a Security Incident or any data transferred to the other Party is corrupted, lost or degraded on their System as a result of a Security Incident caused by such Party, that Party:

• undertake such steps as it considers necessary to mitigate the Security Incident;
• attempt to restore the data from the last available back-up and/or attempt to contain the Security Incident;
• assist without charge to restore the data transferred to it and/or mitigate the Security
  Incident; and
• reimburse the other Party for the reasonable costs it incurs to reconstitute the transferred data from the last available backup and to complete the effective recovery of its System.

Publicity

If a Security Incident impacts customers or adversely affects the reputation of a Party, that Party may without the approval of the other Party issue a factual statement to address the issues raised by the Security Incident and that names the other Party and its relevant Subcontractors and take such other steps as may be required to protect its name and reputation.

BCDR

In the event a Security Incident is or reasonably should be considered to be a BCDR Event, a Party must comply with the Business Continuity Section below.