[caption id="attachment_10235" align="alignleft" width="372"]
Leonard Deutchman[/caption] As discussed in last week's column, the European Union's General Data Protection Regulation (GDPR) is affecting e-discovery vendor agreements in the United States. Parties are adding a separate set of provisions: obligations arising from the EU’s GDPR, a regulation in EU law that took effect on May 25, and which addresses both data protection and privacy for all individuals within the European Union and the export of personal data outside the EU. In this week’s article, I will discuss how the requirements of the GDPR have resulted in changes to client/vendor e-discovery agreements.
Vulnerabilities
Upon discovering any security vulnerabilities within the VIS, the vendor shall promptly perform, at its sole cost, remedial actions to mitigate any such security vulnerabilities and complete appropriate testing to verify that the risk associated with the vulnerabilities have been effectively mitigated.
SOC Audits
The vendor will cause, at least annually for each facility at or from which services are provided, a full-scope service organization control 2 type II report audit (or industry-standard successor report) to be conducted (SOC audit). The entity conducting the SOC audit shall be subject to the client’s approval, with such approval not to be unreasonably withheld or delayed. The vendor will promptly provide the client with a copy of the resulting audit reports (redacted solely to the extent necessary to protect confidential information of other vendor customers contained therein), including documentation describing the controls against which the review was performed (if not described in the report).
Additional Security Requirements
Security requirements are far lengthier than what has already been discussed. There are many more of them, the specifics are described in detail, and virtually all of the specifics are ways of putting in place the requirements of the GDPR. The specifics pertain to:
-
Network security;
-
Business continuity;
-
IT continuity;
-
VIS configuration;
-
A formal written software development lifecycle that provides for effective change control, configuration management and verifies that all security configurations are in place prior to the use of any component of the VIS in a production environment. Within the software development lifecycle, production data will not be used in testing.
-
Secure backups, stored on the VIS, of client data, maintained for at least 30 days.
-
Encryption of client data.
-
Sanitizing of devices prior to recycling, resale, reassignment or disposal, or following such a computer or mobile device’s loss or theft, or destruction of devices which cannot be sanitized.
-
General access control requirements, i.e., the limitation of confidential Information to authorized persons or roles, based on the principle of least privilege, which limits users to the lowest permission levels that they can be assigned that does not prevent the relevant vendor personnel from completing their assigned tasks.
-
The vendor will encrypt all passwords, passphrases, and PINs using solutions that are certified against the industry best practices and standards, and verify that the encryption keys and any keying material are not stored with any associated data.
-
The vendor will disable user accounts after invalid authentication attempts (usually nine consecutive) and lock users’ computer screens after inactivity in accordance with industry best practices and standards (usually when there has been no activity for a period of at most 15 minutes).
-
The vendor must manage account passwords and require minimum password standards in accordance with industry best practices and standards.