NIST CSF 2.0, GovernGV.SC-05

Keep personal data confidential wherever an employee or processor has access to it for professional reasons, bind that confidentiality into every processor contract and employment contract, and continue it after the contract or employment ends.

Implement technical and organisational measures appropriate to the risk, and choose a processor only for the sufficiency of its own security guarantees, governed by a written contract.

Take practical security steps against loss, misuse, unauthorised or accidental access, disclosure, alteration or destruction of personal data, having regard to its sensitivity, where it is stored, and the reliability of personnel with access, and secure the same guarantees from any data processor you engage.

Choose a processor offering sufficient security and confidentiality guarantees, fix the processor's obligations in a written contract, and ensure the processor acts only on your documented instructions.

Before using a processor, choose one that offers sufficient guarantees of protection, and sign a written agreement with it fixing the processing operations it may carry out and what happens to the data when the contract ends.

Implement technical and organizational measures adequate to the risks and the nature of the data to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and choose a processor offering sufficient guarantees about those measures.

Confine a sub processor to your instructions under a contract addressing security and confidentiality, without relieving yourself of the duty to see those measures respected.

Govern any processor's engagement by a written contract confining it to your documented instructions, and require the processor not to engage a sub-processor without your prior written authorization.

Take appropriate, reasonable technical and administrative measures to secure the integrity of personal information in your possession or under your control against loss, modification, damage, unauthorised destruction or unlawful access, and govern any data processor who processes information on your behalf by a written contract that requires the same measures.

Keep processing confidential, bind everyone who processes the data under your authority to a signed written undertaking, and impose the same security and confidentiality guarantees on any processor by contract.

Where personal identifying information is disclosed to a third-party service provider, require that provider to implement and maintain its own reasonable security procedures and practices, unless the covered entity retains primary responsibility and implements technical controls that protect the information from unauthorized access or effectively eliminate the third party's ability to access it.

If you disclose a District resident's personal information to a nonaffiliated third-party service provider, require by written agreement that the third party implement and maintain its own reasonable security procedures and practices over that information.

Require, by contract, that any party to whom personal information is disclosed also implement and maintain reasonable security measures over it.

Where an external service provider is given access to the database, agree in writing on the data and systems it may access, its reporting and data-destruction duties, and monitor its compliance.

Where a nonaffiliated third-party service provider will receive personal information under a written contract entered into on or after January 1, 2009, require by that contract that the provider also implement and maintain reasonable security procedures and practices appropriate to the information disclosed.

Designate one or more employees to maintain the WISP; identify and assess foreseeable internal and external risks to personal information and evaluate whether your safeguards limit them; train employees; discipline violations; cut off a terminated employee's access to records; restrict and secure physical access to records; review the WISP's scope at least annually or after a material change in business practice; document your response to any security-breach incident; and select only third-party service providers capable of maintaining appropriate security measures, requiring those measures by contract.

As passed by the Senate, a person (any private entity) or agency (a Michigan state government unit) that owns, possesses, collects, or accesses personal information must implement and maintain reasonable security procedures: designate a security coordinator, identify internal and external risks, include appropriate safeguards addressing those risks, assess the safeguards' effectiveness, contractually require every service provider to maintain safeguards conforming to the NIST Cybersecurity Framework 2.0 or another industry-standard framework, and evaluate and adjust the procedures for changed circumstances.

Where personal information is disclosed to a nonaffiliated third-party service provider, require by contract that the provider implement and maintain reasonable security procedures and practices of its own, appropriate to the nature of the information disclosed and reasonably designed to protect it from unauthorized access, acquisition, destruction, use, modification, or disclosure.

Require, by contract, any person to whom you disclose a Nevada resident's personal information to implement and maintain the same reasonable security measures.

Where personal identifying information is disclosed to a service provider under a contract, require by that contract that the service provider also implement and maintain reasonable security procedures and practices appropriate to the nature of the information.

Enter into written arrangements that set out the rights and responsibilities of each party, and make sure the arrangements give you timely access to accurate and comprehensive information to oversee the third party's performance and risks, including a right to conduct or commission an independent audit of the third party.

Establish and maintain measures with the third party to protect the confidentiality, integrity and availability of records and data throughout the arrangement.

Where a supplier implements a security measure on your behalf, select that supplier consistent with the measure's requirements and write those requirements into your contract with the supplier.

Establish a supply chain security policy that governs your relations with your direct suppliers and service providers, and ensure, where appropriate, that your contracts with them specify an obligation to notify you without undue delay of incidents that present a risk to the security of your network and information systems (points 5.1.1 and 5.1.4(d)).

Ensure that contracts with external testers require a sound management of the TLPT results and that any data processing, including generation, storage, aggregation, drafting, reporting, communication or destruction, does not create risks to you (Article 27(3)).

Put every ICT services contract in writing in one document, covering at minimum the functions and locations involved, data-protection and access-on-termination provisions, service levels, the provider's duty to assist you on an incident and to cooperate with your regulators, termination rights, and your security-awareness programme.

For a contract supporting a critical or important function, add quantitative service level targets, an unrestricted right to monitor, inspect and audit the provider, the provider's cooperation in your threat-led penetration testing, and an exit strategy with a mandatory transition period. If you are a microenterprise, you and the provider may agree that your access, inspection and audit rights are delegated to an independent third party the provider appoints.

Where the system or application processes data of particular sensitivity (data protected as secrets by law, or data needed for the State's essential missions) and a breach could harm public order, public security, health or life, or intellectual property protection, see that the cloud service applies security and data-protection criteria that protect the data against access by the public authorities of third States not authorized by Union or Member State law (Article 31, I and II).

Draw up, document and implement an information security policy and set the ICT security measures that follow from it, including those your ICT service providers must apply (points 8 and 9).

The Department says your third-party service provider policies should include due diligence guidelines before you use a provider with access to your information systems or nonpublic information, strongly recommends that you consider the threats AI poses to those providers, and says you should require providers to give timely notice of any cybersecurity event that directly impacts your information systems or the nonpublic information they hold, and should consider additional representations and warranties where providers use AI.

Include in those policies relevant guidelines for due diligence or contractual protections, addressing to the extent applicable each provider's access controls (including its use of multi-factor authentication), its use of encryption to protect nonpublic information in transit and at rest, notice to you of a cybersecurity event directly impacting your information systems or your nonpublic information the provider holds, and representations and warranties about its cybersecurity policies and procedures.

Where an organization or individual provides you network-security or system-operation-and-maintenance services under contract, require that provider by contract to promptly report to you any cybersecurity incident it discovers through monitoring, and to assist your own reporting under these Measures; this is the paragraph that reaches a cloud host, managed-security vendor, or AI operator serving you as its customer.

Where you delegate the administration of your system to another person or host it with another person, make sure that person notifies you within 24 hours of becoming aware of a cyber incident that has, or could reasonably be expected to have, a significant effect on your system's security or your service's continuity (Section 8, subsection 1-1).

Include this clause, unaltered except to identify the parties, in every subcontract or similar contractual instrument that involves covered defense information or operationally critical support, including a subcontract for a commercial product or service.

Where an external cloud service provider stores, processes, or transmits covered defense information for you, require that provider by contract to meet security requirements equivalent to the FedRAMP Moderate baseline and to carry out the same incident reporting, malicious software, media preservation, forensic access, and damage assessment duties this clause places on you.

Engage a data processor only where it gives sufficient guarantees as to the reporting of security breaches to you, under a written contract binding it to obligations equivalent to your own.

Before any transfer of personal data outside Burkina Faso, obtain the CIL's authorization, sign a data confidentiality and reversibility clause with the receiving party letting data migrate back fully at the end of the contract, and put in place technical and organizational security measures covering encryption, availability, confidentiality, integrity and resilience.

Disclose covered information only as Section 22584(b)(4) permits, and when you disclose it to a service provider, bind the provider by contract not to use it for any other purpose, not to disclose it to later third parties, and to maintain reasonable security procedures and practices (Section 22584(b)(4)(E)).