Ellucian will authorize access to the Cloud Environment only for employees and third parties with a legitimate business need. Controls and mechanisms to authenticate access and monitor and prevent unauthorized access to Client's Systems will also be in place. Ellucian will also maintain appropriate onboarding and termination processes to manage revocation of access to Client's Systems.

Ellucian will maintain security controls to safeguard Client's Systems from unauthorized access, modification, disclosure or destruction, or become inaccessible to authorized users. Data protection methods will include restricting and monitoring access to information systems, encrypting data in transit and while at rest when necessary or required, maintaining backups of Client's Systems, and securely returning data to the Client, or disposing or destroying data in a secure manner using techniques consistent with NIST 800-88 ("Guidelines for Media Sanitization").

Ellucian will protect the confidentiality, integrity and availability of Client's Systems. Ellucian will maintain safeguards for the security of electronic communications networks. Ellucian will also maintain a change management process to control planned and unplanned changes and the installation of software, manage mechanisms to detect threats such as malware, and recording and monitoring security events to identify anomalous or unauthorized activity.

Ellucian will maintain a process and supporting tools to evaluate and resolve technical vulnerabilities within Client's Systems within reasonable timeframes to address the risk of potential exploitation, or system or data compromise.

Ellucian will maintain a process to identify risks to Client's Systems that are accessible to third parties. The process will ensure that relevant information security requirements are incorporated into business agreements with third parties and that relevant third party risks are addressed within reasonable timeframes.

Ellucian will maintain an information security incident management program to respond to security incidents within the Cloud Environment. Ellucian will provide timely notification to the Client in the event that Client's Systems or data is known to have suffered an Information Security Breach. Timely notification is defined as providing notice to the Client as soon as reasonably practicable and without undue delay after Ellucian became aware of the Information Security Breach. An "Information Security Breach" is defined as an event(s) that is known to have resulted in unauthorized access to a Client's System, or use or disclosure of Client data. Ellucian will further maintain a process to capture and apply knowledge gained from such events to address the likelihood of reoccurrence.

Ellucian will implement controls designed to maintain the continued availability of Client's Systems. Controls will include maintaining a defined business continuity management plan relevant to the Hosting Services that, if interrupted, may result in significant downtime or data loss.