Security: [Select short form security requirements] [or] [Select long form security requirements] [AND] [Security Policy] Guidance Note: See Call Off Schedule 7 (Security); and the definition of “Security Policy” in Call Off Schedule 1 (Definitions). Consider and select short form (paragraphs 1 to 5 of Schedule 7 (Security)) or long form terms (paragraphs 1 to of Schedule 7); insert in Annex 1 any additional security requirements of the Customer that should form the “Security Policy” under this Call Off Contract., as appropriate to your security requirements. ICT Policy: [Not applied] [OR] [To be provided by the Customer before the Commencement Date] Guidance Note: if the Customer wants the Supplier to comply with its ICT Policy, ensure it is handed over to the Supplier before the Commencement Date. Testing: Not applied Not applicable.Not applicable. Business Continuity & Disaster Recovery: [Not applied] [OR] [In Call Off Schedule 8 (Business Continuity and Disaster Recovery)] [OR] [Call Off Schedule (Business Continuity and Disaster Recovery shall be amended as follows:[ ]] Disaster Period: For the purpose of the definition of “Disaster” in Call Off Schedule 1 (Definitions) the “Disaster Period” shall be [insert period of time] Guidance Note: see Clause 16 of the Call Off and Call Off Schedule 8 (Business Continuity and Disaster Recovery). Select the third option of you have any specific Business Continuity and Disaster Recovery requirements in addition to, modification or substitution of the default provisions in Call Off Schedule 8 (Business Continuity and Disaster Recovery). See the definition of Disaster in Call Off Schedule 1 (Definitions). Note that the definition of Disaster will not be made out unless the Services are (or reasonably
administrator is appointed, or notice of intention to appoint an administrator is given; or it is or becomes insolvent within the meaning of section 123 of the Insolvency Act 1986; or being a "small company" within the meaning of section 382(3) of the Companies Act 2006, a moratorium comes into force pursuant to Schedule A1 of the Insolvency Act 1986; or where the Supplier or Framework Guarantor or Call Off Guarantor is an individual or partnership, any event analogous to those listed in limbs (a) to (g) (inclusive) occurs in relation to that individual or partnership; or any event analogous to those listed in limbs (a) to (h) (inclusive) occurs under the law of any other jurisdiction; "Intellectual Property Rights" or "IPR" means copyright, rights related to or affording protection similar to copyright, rights in databases, patents and rights in inventions, semi-conductor topography rights, trade marks, rights in internet domain names and website addresses and other rights in trade or business names, designs, Know-How, trade secrets and other rights in Confidential Information; applications for registration, and the to apply for registration, for any of the rights listed at (a) that are capable of being registered in any country or jurisdiction; and all other rights having equivalent or similar effect in any country or jurisdiction; "IPR means any claim of infringement or alleged infringement (including the defence of such infringement or alleged infringement) of any IPR, used to provide the Services or as otherwise provided and/or licensed by the Supplier (or to which the Supplier has provided access) to the Customer (including any claims arising from the publication of the Project Specific IPRs as Open Source) in the fulfilment of its obligations under this Call Off Contract; "Key Performance Indicators" or "KPIs" means the performance measurements and targets in respect of the Supplier’s performance of the Framework Agreement set out in Part B of Framework Schedule 2 (Services and Key Performance Indicators); "Key Personnel" means the individuals (if any) identified as such in the Call Off Order Form; "Key Role(s) " has the meaning given to it in Clause 27.1 (Key Personnel); "Key Sub-Contract" means each Sub-Contract with a Key Sub-Contractor;
is Approved it will be adopted immediately and will replace the previous version of the Security Management Plan and thereafter operated and maintained in accordance with this Call Off Schedule 7. If the Security Management Plan is not Approved, the Supplier shall amend it within ten (10) Working Days or such other period as the Parties may agree in writing of a notice of non-approval from the Customer and re-submit to the Customer for Approval. The parties will use all reasonable endeavours to ensure that the approval process takes as little time as possible and in any event no longer than fifteen (15) Working Days (or such other period as the parties may agree in writing) from the date of its first submission to the Customer. If the Customer does not approve the Security Management Plan following its resubmission, the matter will be resolved in accordance with the Dispute Resolution Procedure. The Customer shall not unreasonably withhold or delay its decision to Approve or not the Security Management Plan pursuant to paragraph 4.3.2. However a refusal by the Customer to Approve the Security Management Plan on the grounds that it does not comply with the requirements set out in paragraph 4.2 shall be deemed to be reasonable. Approval by the Customer of the Security Management Plan pursuant to paragraph 4.3.2 of this Call Off Schedule 7 or of any change to the Security Management Plan in accordance with paragraph 4.4 shall not relieve the Supplier of its obligations under this Call Off Schedule 7. Amendment and Revision of the Security Management Plan The Security Management Plan be fully reviewed and updated by the Supplier at least annually to reflect: emerging changes in Good Industry Practice; any change or proposed change to the Services and/or associated processes; any change to the Security Policy; any new perceived or changed security threats; and any reasonable change in requirements requested by the Customer. The Supplier shall provide the Customer with the results of such reviews as soon as reasonably practicable after their completion and amendment of the Security Management Plan at no additional cost to the Customer. The results of the review shall include, without limitation: suggested improvements to the effectiveness of the Security Management Plan; updates to the risk assessments; and suggested improvements in measuring the effectiveness of controls. Subject to paragraph 4.4.4, any change or amendment which the Supplier proposes to make to the Security Management Plan (as a result of a review carried out in accordance with paragraph 4.4.1, a request by the Customer or
providing such reasonable assistance which is not already in the scope of the Termination Assistance or the Exit Plan shall be subject to the Variation Procedure. Not used. TERMINATION OBLIGATIONS The Supplier shall comply with all of its obligations contained in the Exit Plan. Upon termination or expiry (as the case may be) or at the end of the Termination Assistance Period (or earlier if this does not adversely affect the Supplier's performance of the Services and the Termination Assistance and its compliance with the other provisions of this Call Off Schedule 9), the Supplier shall: to use the Customer Data; provide the Customer and/or the Replacement Supplier with a complete and uncorrupted version of the Customer Data in electronic form (or such other format as reasonably required by the Customer); erase from any computers, storage devices and storage media that are to be retained by the Supplier after the end of the Termination Assistance Period all Customer Data and promptly certify to the Customer that it has completed such deletion; return to the Customer such of the following as is in the Supplier's possession or control: all materials created by the Supplier under this Call Off Contract in which the IPRs are owned by the Customer; any equipment which belongs to the Customer; any that have been on-charged to the Customer, such as consumables; and all Customer Property issued to the Supplier Clause 32 of this Call Off Contract (Customer Property). Such Customer Property shall be handed back to the Customer in good working order (allowance shall be made only for reasonable wear and tear); any sums prepaid by the Customer in respect of Services not Delivered by the Call Off Expiry Date; vacate any Customer Premises; remove the Supplier Equipment together with any other materials used by the Supplier to supply the Services and shall leave the Sites in a clean, safe and tidy condition. The Supplier is solely responsible for making good any damage to the Sites or any objects contained thereon, other than fair wear and tear, which is caused by the Supplier and/or any Supplier Personnel; provide access during normal working to the Customer and/or the Replacement Supplier for up to twelve (12) months after expiry or termination to: such information relating to the Services as remains in the possession or control of the Supplier; and