EULA

1. LICENSE. Subject to the terms and conditions of this End User License Agreement (this "Agreement") and subject to the payment of the applicable license fees (the “License Fee”), Design Interactive, Inc., a Florida corporation (“DI” or the “Company”), grants to you (“User” or “You”) a limited, non-exclusive and non-transferable license, for your internal business purposes only, for access to and utilization of DI’s License-based software, mobile application(s), head-mounted display application(s), website, and/or documentation provided by DI for Service described in section 2 below (collectively, the “Software” or the “Service”)) during the set License period (the “License Period”) for the number of Users for which the corresponding fee has been paid (the “Permitted Number”). This Agreement will also govern any upgrades to the Software provided by DI that replace and/or supplement the original Software, unless such upgrades are accompanied by a separate license, in which case the terms of that license will govern. “Users” are defined herein as Users and/or anyone who uses the free aspects of the Site or Service and does not pay Fees.

1.1. LICENSE PERIOD. The License Period for the Software is as described in your signed Product Services Agreement. You agree to pay the License Fee for the License Period. DI reserves the right to change the License Fee for any renewal License Periods by providing 90 days’ notice from the end of the License Period. Each new License Period will be subject to the same terms and conditions set forth in this Agreement.

1.2. END OF LICENSE PERIOD. You agree that DI may disable the Software, either by operation of the software or by a remote command from DI, at the end of the License Period Unless User has renewed your License to the Software.

1.3. MAINTENANCE. Maintenance and support are included with your License Fee. DI will make reasonable efforts to notify you when updates to the software are available on the app stores (including, but not limited to: iOS AppStore, Google PlayStore, and Microsoft Marketplace). It is your responsibility to maintain the most current version of the software available. Support will be provided according to the terms issued by DI which may be modified by DI from time to time. To the extent that the User requires any customer support service outside of normal business hours (i.e., 8am – 5pm EST), this may be provided for such additional fees as shall be agreed with the User.

2. DESCRIPTION OF SERVICE. The Service offered by DI hereunder is centered on the XRMENTOR® program, an instructor led training and self-guided procedure platform enhanced by augmented reality to provide businesses and individuals access to the proprietary XRMENTOR® program. Subject to the User paying the License Fee and subject to the obligations and restrictions set out in this Agreement, DI hereby grants to the User a non-exclusive, non-transferable right to use the Service during the License Period and any subsequent renewal term.

3. OWNERSHIP AND RESTRICTIONS. The Software is the intellectual property of and is owned by DI. You agree and acknowledge that the structure, organization and code of the Software are the valuable trade secrets and confidential information of DI. The Software is protected by U.S. Patent No. 11222478, copyright, including, without limitation, by United States Copyright Law, international treaty provisions and applicable laws in the country in which it is being used. You agree not to modify, adapt or translate the Software. You also agree not to reverse engineer, decompile, disassemble or otherwise attempt to discover the source code of the Software. If it is necessary to decompile in order to achieve operability of the Software with another software program, you must request that DI provide the information necessary to achieve such operability. DI has the right to impose reasonable conditions and to request a reasonable fee before providing such information. Any information supplied by DI or obtained by you, as permitted hereunder, may only be used by you for the purpose described herein and may not be disclosed to any third party or used to create any software that is similar to the Software. The license granted to the Software is personal to you and may not be shared, sublicensed or used on behalf of third parties. Trade names and or trademarks (hereinafter, “Trademarks") shall be used in accordance with accepted trademark practice, including identification of the trademark owners' names. Trademarks can only be used to identify printed output produced by the Software and such use of any trademark does not give you any rights of ownership in that Trademark. Except as expressly stated herein, this Agreement does not grant you any intellectual property rights in the Software.

Any procedures, images, data or other User created content is the property of the User. Any content created by DI under a separate work for hire agreement with the User is also the property of the User. Any content provided by DI as part of this license or as a service attached to this license is the sole and exclusive property of DI and/or any Third-Party DI may use to create such content. This content remains the property of DI and the Third Party and is only for the use of the User during the Term of the License and any extensions thereof. User may not copy, alter or distribute this content and the content is only for use under the terms of this License.

User shall comply with all applicable laws and regulations with respect to its activities under these Terms of Use and the use of the Service. User shall ensure that their network and systems comply with the relevant specifications provided by the Company in order to make use of the Service. Users shall be solely responsible for procuring and maintaining their network connections and telecommunications links from their systems to the Site and for all problems, conditions, delays, delivery failures and all other loss or damage arising from or relating to the User’s network connections or telecommunications links or caused by the internet.

User agrees to inform the Company immediately upon learning of a security breach that relates to their account or a third party’s improper use of the Site or the Service in connection with their account. The Company reserves the right to monitor User activity.

User shall not:

a. Use the Site and/or Service in a way which affects the performance and availability of a public website which the User does not own.

b. Breach or infringe any third-party rights.

c. Process or collect any personal data without the prior consent of the individual in question.

d. Use the Site and/or the Service to deliver unsolicited or unauthorized advertising or promotional material or any junk mail, spam, or chain letters.

e. Use the Company’s name, logo, trademark or branding without the Company’s consent or impersonate any person or entity, including any employee or representative of the Company.

f. Access, tamper with or use private areas of, the Site, the Service or the Company’s systems.

g. Break or circumvent the Company’s security measures or otherwise test the vulnerability of the Site, the Service or the Company’s systems or networks.

h. Copy, modify, duplicate, create derivative works from, frame, mirror, republish, download, display, transmit, reverse compile, disassemble, or distribute all or any portion of the Service or the Site.

i. Deliberately or knowingly interfere with or disrupt the proper functioning of the Site or the Service; or

j. License, sell, rent, lease, transfer, assign, distribute, display, disclose, or otherwise commercially exploit the Service or make the Service available to the general public or any third party (except for the purpose of providing the results of reports to authorized third parties).

k. Infringe upon copywritten material shared with you (the User) from other Users, including but not limited to procedures, troubleshooting guides, images, audio, notes, videos, 3D holograms (GLBs), or information shared within a remote collaboration session.

l. DI reserves the right to monetize, disseminate, sell, or otherwise transmit the Software, or portion thereof, at DI’s sole and exclusive discretion to any 3rd party DI may select, either independently or in conjunction with a User, upon such terms and conditions as DI may choose. In the event DI elects to monetize, disseminate, sell, or otherwise transmit the Software in conjunction with a User, the terms and conditions of such joint transmittal shall be memorialized in an addendum to this Agreement with such User.

4. THIRD PARTY CONTENT AND LINKS. User may add content to the Service generated by a third-party, or links to third-party content, websites and online services that are not owned or controlled by DI. DI has no control over, and assumes no liability or responsibility for, such websites and online services. Be aware when you leave the Service; it is your responsibility to read the terms and privacy policy of each third-party website and online service that you visit. No license or ownership in third party content, websites, or services is conveyed under this license, and User explicitly agrees to abide by the individual license and terms of any third-party website or service visited.

5. LIMITED WARRANTY. User’s use of the Software or Site, its content and any services or items obtained through the site is at User’s own risk. The site, its content, the service and any additional services (including the beta features, as applicable) or items obtained through the site are provided “as is” without any warranty whatsoever. DI will take reasonable measures to scan modules it provides through the Site to ensure they are free from viruses or malicious code. DI does not guarantee or warrant that files uploaded to the Site by a third party will be free of viruses or other destructive code. User is responsible for implementing sufficient procedures and checkpoints to satisfy User’s particular requirements for anti-virus protection and accuracy of data input and output, and for maintaining a means external to the Site or software for any reconstruction of any lost data. To the extent permissible by local law, DI disclaims all other warranties, express, implied, or statutory, regarding the software and services, including any warranties of merchantability, fitness for a particular purpose, completeness, security, reliability, quality, accuracy or availability of the site, title, and noninfringement. No representation or other affirmation of fact, including, without limitation, statements regarding capacity, suitability for use, or performance of the software or services shall be deemed a warranty for any purpose or give rise to any liability of DI whatsoever. DI will not be liable for any loss or damage caused by a distributed denial-of-service attack, viruses or other technologically harmful material that may infect User’s computer equipment, computer programs, data or other proprietary material due to User’s use of the Software or any services or items obtained from DI or to User’s downloading of any materials related to this Agreement. User hereby acknowledges that User has relied on no warranties other than the express warranties in this agreement. User’s exclusive remedy and DI’s entire liability under this limited warranty shall be limited to either the repair or replacement of the Software, and damage caused to User’s software and systems caused by DI’s failure to use industry standard anti-malware detection software and implement all other reasonable security measures, including those set forth in Exhibit A hereof, or the refund of the License Fee for the then current License Period.

6. LIMITATION OF LIABILITY. In no event will DI be liable for any indirect, consequential, special, exemplary or incidental damages (including but not limited to lost profits, loss of goodwill or labor costs, or lost savings) even if a DI representative has been advised of the possibility of such loss, damages, claims or costs or for any claim by any third party. except for liability or damage arising out of or in connection with DI’s (a) gross negligence, willful misconduct or fraud, (b) DI’s violation of its confidentiality obligations hereunder or its obligations under exhibit a hereof, and (c) DI’s indemnification obligations hereunder, DI's aggregate liability in connection with this agreement shall be limited to the amount paid for the software or services hereunder, if any.

7. CONDITIONS GOVERNING USER. Fees. The User shall pay the Company for the Services, fees and expenses specified in the Accompanied proposal document. All amounts and Fees stated are exclusive of sales tax, which shall be added to any invoice(s) at the appropriate rate. Payment Terms. Unless otherwise agreed in the relevant Order Form, all invoices must be paid by the User within 30 (days) days after the date of receipt of such invoice (Net 30). Users agree that if the Company has not received payment within this period, and without prejudice to any other rights or remedies of the Company, the Company may (a) without liability to the User, cancel the User’s License and disable the User’s account upon 30 days’ notice which may lead to the loss of any data associated with their License (b) charge interest, calculated on a daily basis, on any outstanding Fees at a rate of 5% per annum and (c) charge the User for legal fees and reasonable collection costs arising from the Company’s efforts to collect any outstanding Fees. Termination. These Terms of Use will remain in effect during the initial License Term and any subsequent Renewal Term. Upon termination or expiration of the License Term or any subsequent Renewal Term, the Terms of Use will expire. Company may terminate these Terms of Use with 60 days’ notice in cases of insolvency or if the software is discontinued, transferred or sold to a third party. If Terms of Use is terminated by Company, User will be entitled to a pro-rated refund of the fees paid. Either party may terminate these Terms of Use with immediate effect by giving written notice to the other if the other party commits a material breach of any of its obligations under these Terms of Use and, in the case of a remediable breach, the other party fails to remedy it within 30 (thirty) days of the date of receipt of notice specifying the breach and requiring it to be remedied. Without prejudice to any other of the Company’s rights or remedies, the Company may terminate these Terms of Use or terminate or suspend the Service (in whole or in part) and/or access to the Site or the User’s account with 30 days’ written notice to the User if the User is in breach of any provision of Section 4 or any of the payment terms in this Section 8 of these Terms of Use. On termination of these Terms of Use for any reason (a) all licenses granted under these Terms of Use shall immediately terminate, (b) the User’s shall make no further use of the Service, (c) the Company will destroy or otherwise dispose of any User Data or other data relating to a User in its possession and (d) any rights remedies obligations or liabilities of the parties that have accrued up to the date of termination, including the right to claim damages in respect of any breach of the agreement which existed at or before the date of termination shall not be affected or prejudiced. Reactivation. Where any Users’ accounts are suspended or terminated and a User subsequently wishes to reactivate such accounts, this reactivation may be done at Company’s discretion and shall be subject to additional Fees as may be charged by the Company. No Refunds. The Company is not obligated to return or refund any Fees paid at any time except as set out in this “No Refunds” subsection or expressly referenced in these Terms of Use. If the User chooses to cancel their account and terminate these Terms of Use during the Initial License Term or any subsequent renewal term for any reason other than a material breach committed by the Company which has not been remedied (as set out in the “Termination” subsection of this Section 6 above) or in accordance with Section 10, the User will not be refunded in whole or in part. In the event that these Terms of Use are terminated by the User due to a material breach committed by the Company (as set out in the “Termination” subsection of this Section 6 above) or in accordance with Section 10, the Company shall refund the User a pro-rated amount of the Fees paid for the remaining portion of the term following the effective date of termination. 8. INDEMNITY. The User shall defend, indemnify and hold harmless the Company and its respective officers, directors and employees against all third-party claims, fines, actions, proceedings, losses, damages, expenses and costs (including without limitation court costs and reasonable legal fees) (collectively “Claims”) arising out of or in connection with the User’s use of the Service. The Company shall defend, indemnify and hold the User from and against any third-party Claims that the software or services provided hereunder infringe the intellectual property rights of said third party.

9. DISPUTES. This Agreement and the obligations of the parties hereunder will be interpreted, construed and enforced in accordance with the laws of the United States of America, the State of Florida, without regard to its choice of law rules. Upon execution of this Agreement as set forth above, the parties accept and consent to, the jurisdiction of and venue in Orange County, Florida, and hereby waive any and all objections to such jurisdiction and venue.

10. DATA RETENTION. We hold the data in your account for as long as you choose to use the Product and have paid your License fees. Upon the end of your license, or termination earlier hereunder as provided, your data will eventually get deleted from active database during the next clean-up that occurs once in 6 months. The data deleted from active database will be deleted from backups after 3 months. We will delete your data immediately if requested in writing upon termination of your license.   EXHIBIT A Privacy and Security Requirements For the purposes of this agreement:

1. The term “Personal Data” shall mean any data, information or record that directly or indirectly identifies a natural person or relates to an identifiable natural person or is otherwise subject to any Privacy Law (as defined below), including, but not limited to, name, home address, telephone number, personal e-mail address, payment/credit card information, Social Security Number, driver’s license number, national ID number, bank account data, passport number, combination of online user name and password, medical and health-related information and any other personally identifiable information that DI or any third party acting on DI’s behalf processes in connection with the services provided to User by DI. 2. The term “Information Security Incident” means actual or suspected: (i) loss or theft of Personal Data; (ii) unauthorized use, disclosure, acquisition, transmission of or access to, or other unauthorized processing of Personal Data that reasonably may compromise the privacy or confidentiality of the data; or (iii) unauthorized access to or use of, inability to access, or malicious infection of, DI systems that reasonably may compromise the privacy or confidentiality of Personal Data. 3. The terms “process,” “processing” or “processed” in relation to Personal Data include, without limitation, receipt, collection, creation, recording, organization, storage, retrieval, consultation, use, manipulation, amendment, transmission, disclosure, discarding, destruction and/or erasure.

DI agrees, covenants, and warrants to User that at all times during which it processes Personal Data pursuant to the Agreement, DI will: a. Take all appropriate and commercially reasonable measures, including, without limitation, the administrative, physical, technical (including electronic), and procedural safeguards set forth in the Data Privacy and Security Addendum, including but not limited to encryption that meets storage industry standards of data at rest and in transit, to protect the Personal Data against any Information Security Incident. For information processed in electronic form, DI agrees that such safeguards must include, without limitation, electronic barriers (e.g., “firewalls” or similar barriers) and password-protected access to Personal Data. For information in written or other tangible form, DI agrees that such safeguards must include secured storage and secure destruction of Personal Data in accordance with applicable law and privacy standards. b. Maintain or cause to be maintained a reasonable and commercially feasible information security program that complies with all applicable laws and is designed to reasonably ensure the security and confidentiality of all Personal Data. c. Comply with all applicable laws and industry standards that relate in any way to the privacy, data protection, electronic storage, confidentiality, processing or security of Personal Data and apply to DI or User – including without limitation (i) state security breach notification laws; laws imposing minimum security requirements; laws requiring the secure disposal of records containing certain Personal Data; and all other similar federal, state, local and/or international requirements; (ii) electronic storage industry standards concerning privacy, data protection, confidentiality or information security; and (iii) U.S. state data protection laws.; d. Not transfer Personal Data outside the United States of America for processing without the prior express written consent of User. e. Not sell, share, or otherwise transfer or disclose any Personal Data, to any other party, without prior express written consent from User, except as specifically permitted under the Data Privacy and Security Addendum or required by law. f. Not use Personal Data in any manner not specifically permitted under this Agreement without prior express written consent from User. g. Not send or provide any marketing or promotional communications to User employees or consumers without User’s explicit written consent. h. Not aggregate or combine Personal Data with any other data without prior express written consent from User. i. Not subcontract or assign any of its rights or obligations under this Data Privacy and Security Addendum without the prior express written consent of User. Where DI, with the consent of User, subcontracts its obligations under this Data Privacy and Security Addendum, it shall do so only by way of a written agreement with its subcontractor that imposes the same privacy and security obligations on the subcontractor. Whenever DI employs the services of a third-party service to assist it in performing its obligations under this Data Privacy and Security Addendum, DI warrants that such services are capable of maintaining appropriate safeguards for User’s Personal Data and that DI has contractually obligated such services to maintain appropriate safeguards designed to comply with applicable law and privacy standards. Where the subcontractor fails to fulfill its obligations under any sub-processing agreement, DI shall remain fully liable to User for the fulfillment of its obligations under this Data Privacy and Security Addendum. j. Ensure that Personal Data are only available to DI personnel who have a legitimate business need to access the Personal Data, who are bound by legally enforceable confidentiality obligations, and who have received training in applicable data protection laws, procedures and industry standards. k. Not retain Personal Data any longer than is reasonably necessary, in accordance with User record retention policies, to accomplish the intended purposes for which the data was processed pursuant to this Data Privacy and Security Addendum. When Personal Data are no longer necessary for the purposes set forth in the Data Privacy and Security Addendum, or promptly upon the expiration or termination of the Agreement, whichever is earlier, or at an earlier time as User requests in writing, DI shall take reasonable steps to return, destroy (e.g., by secure shredding), or arrange for the secure destruction of each and every original and copy in every media of all Personal Data in DI’s possession, custody or control. Promptly following any return or alternate action taken to comply with this paragraph, DI shall certify in writing to User that such return or alternate action occurred with a description as to the method used for such destruction. In the event that applicable law does not permit DI to comply with the delivery or destruction of the Personal Data, DI warrants that it shall ensure the confidentiality of the Personal Data and that it shall not use or disclose any Personal Data at or after the termination or expiration of the Agreement. l. Where DI uses a third party for disaster recovery or other services, DI shall: (i) disclose this to User in writing, including the name of the DI, purpose of the services (e.g., disaster recovery), steps taken with third party to address confidentiality, privacy and security, and (ii) cause each such third party to agree in writing to be bound by terms and conditions substantially similar to those in (a) – (k) above and (m). Additionally, DI agrees to audit the procedural, administrative, physical and technical measures used by each such third party, at least once a year, which may include or consist of, at User’s option, a SSAE 16 audit of such third party, if available. m. Monitor DI’s information systems for unauthorized access and implement an incident response policy that specifies actions to be taken when DI detects or becomes aware of such unauthorized access to its information systems. DI shall provide a copy of such incident response policy to User upon request. n. If requested by User, within five business days from the date upon which the request was made by User, either: (i) update, correct or delete Personal Data or modify the individual’s choices with respect to the permitted use by User of such Personal Data; or (ii) provide access to User to enable it to perform the activities described in clause (i) itself. o. Immediately notify the Company Chief Compliance Officer if DI receives notice from any governmental or regulatory authority alleging that User or DI has failed to comply with Privacy Laws in connection with the performance of this Agreement, or if DI otherwise becomes aware and reasonably believes that DI or User may have failed or may in the future fail to comply with Privacy Laws in connection with the performance of this Agreement; and p. At User’s direction, cooperate and comply with any requests or instructions issued by any privacy or data protection authority, including any governmental or regulatory authority applicable to User or Personal Data.

DI shall promptly notify User in writing of any Information Security Incident of which DI becomes aware and of any request for access to any Personal Data from any third person or any government official, including any data protection or law enforcement agency; and of any and all complaints or other communications received from any individual pertaining to DI’s confidentiality policies or procedures applied to Personal Data and/or the processing of either. In the event of an Information Security Incident, such notice shall summarize in reasonable detail the nature of the Information Security Incident, the suspected data that is lost, stolen or compromised, if known, and the corrective action taken or to be taken by DI. DI shall promptly take all necessary steps to robustly investigate and remediate, including, but not limited to, conducting a third-party forensic analysis. DI shall cooperate fully with User in all reasonable and lawful efforts to prevent, mitigate or rectify such Information Security Incident or necessitate the disclosure of Personal Data to a government official. All information relating to each Information Security Incident must be retained by DI until User has specifically consented in writing to its destruction. If requested by User and subject to User’s confidentiality obligations, DI shall permit User and its agents to access DI’s facilities and/or the affected hardware or software, as applicable, to conduct a forensic analysis of each such Information Security Incident.

In the event of an Information Security Incident, DI shall: (i) promptly, after becoming aware of such Information Security Incident, notify the Company Chief Compliance Officer by telephone and in writing at the address below of all known facts thereof, and (ii) at User’s option and at the direction of User, whether or not required by applicable law, provide written notice to the individuals whose Personal Data was reasonably connected to the Information Security Incident.

User shall have the right to verify DI’s compliance with the terms of this Data Privacy and Security Addendum or to appoint a third party under reasonable covenants of confidentiality to verify the same on User’s behalf at User’s sole expense. DI shall grant User or User’s agents unimpeded access to the extent necessary to accomplish the inspection and review of all data processing facilities, data files and other documentation used by DI for processing of Personal Data in relation to this Data Privacy and Security Addendum. DI agrees to provide reasonable assistance to User in facilitating this inspection function. Upon request, DI shall provide User with a list of DI personnel entrusted with processing Personal Data transferred by DI, together with a description of their access rights. An inspection performed pursuant to this section shall not unreasonably interfere with the normal conduct of DI’s business.

DI agrees to the following with respect to insurance coverage: a. Throughout the term of this Agreement, DI shall, at its own cost and expense, procure and maintain in full force and effect during the term of the Agreement, policies of insurance, for Professional Liability to include Errors and Omissions with a minimum of coverage of $1,000,000 limit per occurrence and Cyber Liability with a minimum of coverage of $2,000,000 limit per occurrence, with responsible insurance carriers duly qualified in those states where their services are to be performed, covering the operations of DI, pursuant to this Agreement. b. Company shall be named as an additional insured in such policies as required, which shall contain standard cross liability clauses and, if necessary, DI shall cause such policies to be endorsed to provide contractual liability coverage covering this Agreement as an insured contract. Such policies as required above shall be endorsed to waive any right of subrogation against Company. All policies required shall be primary and non-contributory without right of contribution from any insurance carried by Company and shall require that Company be given not less than thirty (30) days prior written notice of cancellation, or any material change therein. c. Prior to the commencement of services hereunder, DI shall provide Company with certificates of insurance evidencing all of the above coverage, including all special requirements specifically noted above, and shall provide Company, when requested in writing, with certificates of insurance evidencing renewal or substitution of such insurance at least thirty (30) days prior to the effective date of such renewal or substitution. d. Provisions of this section as to maintenance of insurance shall not be construed as limiting in any way the extent to which either party may be held responsible for payment for damages to persons or property resulting from its activities or the activities of any it its employees or other person(s) for which the other party is otherwise responsible.



Data Security Controls

The security controls set forth below apply to DI’s processing of Personal Data.

Information Security Program: 1. Assign to an individual or a group of individuals the responsibility for developing, implementing, and managing the organization’s written information security program 2. The relevant Personnel must be sufficiently trained, qualified and experienced to be able to fulfill these functions and any other functions that might reasonably be expected to be carried out by the Personnel responsible for safeguarding personal information 3. Develop, maintain and document reasonable technological, physical, administrative and procedural safeguards, including without limitation, policies, procedures, guidelines, practices, standards and controls that: 3a. Ensure the privacy, confidentiality, security, integrity and availability of personal information (including, without limitation, Personal Data) 3b. Protect against any anticipated threats or hazards to the security and integrity of personal information. 3c. Protect against any Information Security Incident 4. Regularly test, monitor and evaluate the sufficiency and effectiveness of the information security program, including Information Security Incident response procedures

Risk Assessment 1.Conduct information security risk assessments at least annually and whenever there is a material change in the organization’s business or technology practices that may impact the privacy, confidentiality, security, integrity, or availability of personal information.

Data Collection, Retention and Disposal 1. Collect only as much personal information as needed to accomplish the purpose for which the information is collected 2. Refrain from storing personal information on media connected to external networks unless necessary for business purposes 3. Securely dispose of records containing personal information so that the information cannot be read or reconstructed after it is no longer needed to comply with business purposes or legal obligations 4. Securely erase media containing personal information before reuse Data Inventory 1. Track and periodically inventory personal information the organization collects, uses, maintains, discloses, disposes of or otherwise processes 2. Periodically inventory the organization’s information systems and assets that contain personal information

Personnel Background Checks 1. Conduct reasonable background checks (including criminal background checks) of any Personnel who will have access to personal information or relevant information systems, and repeat the checks at appropriate and adequate intervals

Personnel Training and Education 1. Train Personnel who have access to personal information or relevant information systems concerning: 1a. The organization’s information security program 1b. The importance of the security, confidentiality and privacy of personal information 1c. The risks to the organization and its customers associated with Information Security Incidents

Vendor Management and Oversight 1. Take reasonable steps and conduct due diligence to select and retain subcontractors that are capable of maintaining the privacy, confidentiality, security, integrity or availability of personal information consistent with the organization’s contractual and other legal obligations 2. Regularly assess subcontractors to confirm their compliance with the applicable privacy and information security requirements

Segregation of Duties 1. Duties and areas of responsibility of the organization’s Personnel should be segregated to reduce opportunities for unauthorized or unintentional modification or misuse of personal information or the organization’s information systems

Access Controls 1. Identify Personnel and classes of Personnel whose documented business functions and responsibilities require access to personal information, relevant information systems and the organization’s premises 2. Permit access to personal information, relevant information systems and the organization’s premises only to such authorized Personnel 3. Maintain a current record of Personnel who are authorized to access personal information, relevant information systems and the organization’s premises, and the purposes of such access 4. Maintain physical access controls, secure user authentication protocols, secure access control methods, and firewall protection 5. Prevent terminated Personnel from accessing personal information and information systems by immediately terminating their physical and electronic access to personal information and relevant information systems

Secure User Authentication 1. To manage access to personal information and relevant information systems: 1a. Maintain secure control over user IDs, passwords and other authentication identifiers. 1b. Maintain a secure method for selecting and assigning passwords and use reasonable authentication technologies. 1c. Assign unique user identifications and passwords that are not vendor supplied default passwords. 1d. Require Personnel to change passwords at regular intervals or based on the number of access attempts, and whenever there is any indication of possible system or password compromise. 1e. Avoid reusing or recycling old passwords. 1f. Restrict access to personal information and relevant information systems to only active users and accounts. 1g. Block user access after multiple unsuccessful attempts to login or otherwise gain access to personal information or relevant information systems. 1h. Terminate user access after a predetermined period of inactivity.

Intrusion Detection and Response 1. Maintain policies and procedures to detect, monitor, document and respond to actual or reasonably suspected Information Security Incidents, and encourage the reporting of such incidents, including through: 1a. Training Personnel with access to personal information to recognize actual or potential Information Security Incidents and to escalate and notify senior management of such incidents. 1b. Post-Information Security Incident review of events and actions taken concerning the security of personal information. 1c. Policies governing the reporting of Information Security Incidents to regulators and law enforcement agencies.

Encryption 1. To the extent technically feasible, ensure strong encryption of personal information: 1a. Stored on laptops or mobile devices. 1b. Stored outside of the organization’s physical controls. 1c. Transmitted across any public network (such as the Internet) or wirelessly. 1d. In transit outside of the organization’s information systems

Firewalls Implement up-to-date firewalls between the organization’s information systems, the Internet (including internal networks connected to the Internet) and other public networks, and internal networks that are not necessary for processing personal information; the firewalls must be reasonably designed to maintain the security of personal information and relevant information systems.

Malicious Code Detection 1. Implement software that detects, prevents, removes and remedies malicious code designed to perform an unauthorized function on, or permit unauthorized access to, any information system, including without limitation, computer viruses, Trojan horses, worms, and time or logic bombs

Change Controls 1. Prior to implementing changes to the organization’s information systems, assess the potential impact of such changes on privacy, confidentiality, security, integrity and availability of personal information, and determine whether such changes are consistent with the organization’s information security program 2. No changes should be made to the organization’s information systems or information security program that increase the risk of an Information Security Incident or fail to comply with the organization’s contractual or other legal obligations

Off-Premises Information Security 1. Maintain policies governing the security of the storage, access, transportation and destruction of records or media containing personal information outside of the organization’s business premises 2. Monitor and document movement of records or media containing personal information 3. Create copies of personal information before movement of records or media containing the information

Physical Security 1. Maintain reasonable restrictions on physical access to personal information and relevant information systems (e.g., clean desk policy) 2. Maintain physical protection against damage from fire, flood, earthquake, explosion, civil unrest, and other forms of natural or man-made disaster 3. Lock workstations with access to personal information when unattended 4. Document repairs and modifications to information security-related physical components of the organization’s information systems

Contingency Planning 1. Maintain policies and procedures for responding to an emergency or other occurrence that can compromise the privacy, confidentiality, integrity or availability of personal information or damage the organization’s information systems; such policies and procedures should provide for: 1a. Creating and maintaining retrievable copies of personal information. 1b. Restoring any loss of personal information. 1c. Enabling continuation of critical business processes involving personal information in emergency mode. 1d. Assessing relative criticality of specific applications and personal information in support of other contingency plan components.