§ 1017.53 - Commission representatives’ safe-guards.

A representative of the Commission, whether another governmental entity or a private contractor, when collecting or processing proprietary information for the Commission, shall be subject to the procedures of this section. Before any entity may act as the Commission's representative for collecting or processing proprietary information, the following requirements must be met:

(a) Facilities and other measures. The Team Leader, Chronic Hazard Program, HIEA and/or the Division Document Control Custodian and the Commission Security Officer shall inspect and approve in writing the proposed representative's facilities and control measures to insure that they are adequate to safeguard the confidentiality of the proprietary information.

(b) Computer processing. The Team Leader, Chronic Hazard Program, HIEA and the Division Document Control Custodian shall inspect and approve the computer processing methods of the proposed representative to insure that they are adequate to safeguard the confidentiality of the proprietary information. Approval shall not be given unless the methods meet the standards described in § 1017.52(c)(1).

(c) Personnel. The Team Leader, Chronic Hazard Program, HIEA, and the Division Document Control Custodian shall take steps to insure that any access to information by employees of a Commission representative is strictly controlled. If the representative is a private contractor, these steps shall include requiring each employee who is permitted to have access to the proprietary information to first execute an affidavit of nondisclosure. The Commission Security Officer shall review affidavits of nondisclosure executed by Commission representatives to insure that the forms are completed accurately and completely.

(d) Subcontractors. Use of a subcontractor by a Commission representative must have the approval, in writing, of the Team Leader, Chronic Hazard Program, HIEA, if the subcontractor will handle proprietary information. The Team Leader, in concert with the Commission Security Officer, shall insure that the requirement of paragraphs (a), (b), and (c) of this section are met by each subcontractor.

(e) Agreements. Every agreement between the Commission and its representative and between the representative and a subcontractor which will handle proprietary information shall include provisions to insure that measures adequate to safeguard proprietary information are maintained.

Pt. 1017, App. I