OpenAir Data Security Addendum (US - English) (PDF)

OPENAIR SERVICE DATA SECURITY ADDENDUM

For the Cloud Service procured on the applicable Estimate/Order Form (the 'OpenAir Service'), Oracle shall maintain commercially reasonable administrative Safeguards designed for the protection, confidentiality, and integrity of Customer Data. All such Safeguards shall be commensurate with the importance of the Customer Data being protected, but in no event less protective than safeguards that Oracle uses to protect its own information or data of similar importance, or as required by applicable law. As of the effective date of the applicable Estimate/Order Form, such Safeguards are described below in this Addendum 1 ; provided, however, that Customer acknowledges and agrees that such Safeguards described in this Addendum are not comprehensive and such Safeguards may change during the term of the applicable Estimate/Order Form, as applicable third party security audits, compliance standards and/or certifications evolve/change over time, provided that any such changes to Safeguards will not materially decrease the overall security of the OpenAir Service during the term of the applicable Estimate/Order Form. For the term of the Agreement, Oracle shall comply with all obligations regarding Customer Data under the applicable Estimate/Order Form, including, without limitation, Oracle's obligations to maintain commercially reasonable Safeguards as provided herein.

1. Security Policy. Oracle has, and will maintain, a security policy for its security organization that requires security training and privacy training as part of the training package for Oracle security personnel, as documented in its ISO 27001 certification.
2. Oracle Security Organization. Oracle has, and will continue to have, a dedicated security organization that is responsible for the ongoing monitoring of Oracle's security infrastructure, the review of Oracle products and services, and for responding to Security Incidents.
3. Data Storage and Handling. Storage medium or any equipment with storage capability, including mobile media, used to store Customer Data will be secured and hardened in accordance with industry standard practices. Oracle will maintain a reasonable asset management policy to manage the life cycle (commissioning, operating, maintaining, repairing, modifying, replacing and decommissioning/disposal) of such media. Decommissioned media containing Customer Data will be destroyed in accordance with NIST 800-88 (or similar data destruction standard) at the Moderate level of sensitivity.
4. Data Transmission. Oracle will use strong cryptography and security protocols consistent with industry standards, as documented in the User Guides for the Service.
5. Change Management. Oracle maintains a change management policy to ensure changes to the organization, business processes, information processing facilities and systems that affect information security are controlled.
6. Server Operating Systems. Oracle servers will use a hardened operating system implementation customized for the Service. Oracle will maintain a risk-based prioritized patch management policy.
7. Access Control and Privilege Management. Oracle employs systems and processes to limit physical and logical access based on least privileges and segregation of duties to ensure critical data can only be accessed by authorized Oracle personnel.
8. User Accounts. Customer will have control over the creation, deletion, and suspension of User roles within the Service, as documented in the Service User Guides.