Item 26 - Agreement with Allied Network Solutions, Inc. for Adobe Software and Subscription

Home Browse Search

SOLICITATION # CH16012 ServiceNow's customer support portal. ServiceNow shall take reasonable measures to promptly mitigate the cause of the Breach and shall take reasonable corrective measures to prevent future Breaches. As information is collected or otherwise becomes available to ServiceNow and unless prohibited by law, ServiceNow shall provide information regarding the nature and consequences of the Breach that are reasonably requested to allow Customer to notify affected individuals, government agencies and/or credit bureaus. Customer is solely responsible for determining whether to notify impacted Data Subjects and for providing such notice, and for determining if regulatory bodies or enforcement commissions applicable to Customer or Customer Data need to be notified of a Breach. See the "Data Security Guide" contained within the "Subscription Service Guide" included with this response for additional information. QTS Security Incident handling capability and process is outlined in the following Incident Response related procedures and plans: -FED _PLN_01_Incident _Response —Plan (v1.2 — 4/09/14) -IT — PRO —29—QTS-FC—Incident—Response—Procedure (v1.0—1/17/14) -IT _ PRO _18_ISSO_IRT_Incident_Response_Guidelines_Procedure (v1.2—12/11/13) •OPS—PRO-77—OSC—New— Incident — Creation _ Procedure (v1.0-1/23/14) •OPS— PRO —62— Best —Practices—for—Incident—Handling—Procedure (0.0—12/10/13) •OPS_PRO _72_BPG_OSC_Working_and_Resolving_Incidents_Procedure (v1.0—1/22/14) •OPS— PRO —84—BPG—OSC—Major— Incident —Management—Procedure (v1.0—1/27/14) As outlined in QTS's IT-FC_Incident_Response_Procedure (0.0-1/17/14) and FED —PLN-01—Incident—Response—Plan (v1.2 — 4/09/14): -Preparation activities, to include: -Ensuring the security of systems, networks, and applications through periodic risk assessments of systems and applications to prevent incidents. -Increasing user awareness of policies and procedures regarding appropriate use of networks, systems, and applications. -Sharing applicable lessons learned from previous incidents (particularly those involving malicious code and violations of acceptable use policies) with users so they can see how their actions could affect the organization. -Training Federal Cloud System Administrators to maintain their networks, systems, and applications in accordance with the organization's security standards. -Detecting activities, to include: -As referenced in QTS's IT—PRO-29—QTS-FC—Incident—Response—Procedure (0.0-1/17/14), review and analysis of continuous monitoring tools and related log file(s). -3rd Party monitoring services (Alert Logic): help detect and alert on changes in certain resources (e.g., Web pages) or publicly accessible services, such as Web, Domain Name System (DNS) and FTP servers. -File Integrity Checking Software: help detect any changes to important files caused by incident -IDS are set up for scanning and detection. Detection is achieved either by log analysis, packet capture review or image acquisition and analysis. -Analysis Activities, to include: -QTS IR Team is activated and incident identification is performed -Continued and targeted review and analysis of continuous monitoring tools, related log file, and corresponding applications would be performed. -If an Incident Response Team is required then at least one member of IT Security along with one or more members of QTS's IT Operations organization responsible for the affected system, as well as any necessary re resentatives from Network SAP Ariba We can provide a general overview but our full documentation is confidential. All of our security processes and procedures are audited by a third party every six months for ISAE 3402 assurance. We also hold PCI DSS certification. The carahsoft 81 carahsoft