277-22 Exhibit(s)-Low Income Household Water Assistance Program.pdf

The Utility Company’s representative is _______________________________________. The Department and the Utility Company’s representatives may agree to designate specific employee(s) as a contact person responsible to produce/receive the customer information. V. DATA BREACH OR INCIDENT NOTIFICATION A. The Parties agree to immediately, by telephone and email, notify the other Party upon the discovery of: a data breach or incident (suspected or actual) related to the Customer Data or participation in the LIHWAP Program, or a data breach or incident (suspected or actual) of a program having confidential Customer Data that has resulted in the disclosure of confidential Customer Data. Each Party reserves the right to conduct an assessment of and/or bring in a third party to work with the Utility Company or Department on any incident (suspected or actual), data breach, intrusion, loss or unauthorized use or disclosure of the Customer Data in violation of this Agreement. The Utility Company shall submit such notification to the Department of Community Affairs at __________________________. The Department shall submit such notification to the Utility Company at _______________________. B. Ensure that the initial notification includes contact and component information; a description of the incident and/or data breach, loss with scope, numbers of files or records, type of equipment or media, approximate time and location of incident and/or data breach or loss; description of how the data was physically stored, contained, or packaged (e.g., password protected, encrypted, locked briefcase, etc.); whether any individuals or external organizations have been contacted; and whether any other reports have been filed. C. Take prompt corrective action to mitigate any risks or damages involved with the incident and to protect the operating environment. D. Investigate the incident (suspected or actual) and produce a written incident report within two (2) business days of the incident, detailing what data elements were involved; a description of the unauthorized persons known or reasonably believed to have improperly used or disclosed customer information; a description of where the customer information and their participation in the LIHWAP is believed

sons known or reasonably believed to have improperly used or disclosed customer information; a description of where the customer information and their participation in the LIHWAP is believed to have been improperly transmitted, sent, or used; a description of the probable cause of the incident; a detailed corrective action plan including measures that were taken to halt and/or contain the incident. The Utility Company shall submit the incident report to the Department of Community Affairs at ___________________. The Department shall submit the incident report to the Utility Company at _______________________. The Party suffering from the breach will notify individuals of the incident (suspected or actual), data breach or unauthorized use or disclosure of the customer’s participation in the LIHWAP Program, when applicable state or federal law requires notification. The Utility Page 4 of 7