This Schedule D to Exhibit 1 contains terms governing information security to which Ellucian will adhere during the Hosting Services Term. Ellucian may modify specific security protections from time to time, but will continue to provide at least the same level of security as on the date this Schedule D became part of the Agreement.
Ellucian will maintain a global Information Security Program aligned with ISO 27001 that will plan, implement and manage processes on an ongoing basis to meet information security objectives and requirements applicable to the Hosting Services delivered worldwide. The Information Security Program will include demonstrable oversight and commitment from Ellucian senior management. The Information Security Program will also include performing information security risk assessments and implementing treatment plans at appropriate intervals, such as when significant changes to the Hosting Services occur.
Ellucian will design and maintain a control environment for the Hosting Services aligned with global information security practices and standards such as ISO 27001 and third party attestation frameworks such as SSAE 16 / SOC 1 and SOC 2.
Ellucian will maintain an Information Security Policy that is approved by senior management and communicated to employees and applicable third parties. The Information Security Policy will identify roles and responsibilities as well as governing principles and control objectives for information security across Ellucian's global business operations. The Information Security Policy and will be reviewed annually and supporting standards, guidelines and procedures will be adjusted as appropriate.
Ellucian will maintain an employee awareness program to allow employees to understand and fulfill their responsibilities for information security, including requirements for personal data privacy, confidentiality, and non-disclosure of information.
Employees will be screened in accordance with relevant laws and such screening will be proportional to employee roles and responsibilities. Employees and applicable third parties will agree to requirements for confidentiality and non-disclosure of information prior to employment or prior to providing services to Ellucian.
Ellucian currently uses Amazon Web Services (AWS) who is responsible for protecting the global infrastructure upon which the Hosting Services are delivered. AWS will maintain controls to manage and monitor physical access at both the data center perimeter and building ingress points using security staff, or electronic access control validation.