Fiserv has implemented and shall maintain an information security program that is designed to meet the following objectives as required by the GLB Interagency Guidelines Establishing Information Security Standards designed to meet the following objectives: (i) protect the security and confidentiality of customer information (as defined in GLB) ; (ii) protect against any reasonably foreseeable threats or hazards to the security or integrity of such information; (iii) protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer; and (iv) ensure the proper disposal of “consumer information” (information obtained from “consumer reports” as defined in the Fair Credit Reporting Act). Fiserv shall make available upon Client’s written request or electronically (collectively, “ Delivery Mechanism ”) to allow Client to review any associated audit reports as described in Section 10.(d) and (e) of this Agreement to assess whether its information security program meets the foregoing objectives, summaries of test results as described in Sections 4.(f) and 6.(c) of the ASP Services Exhibit to this Agreement, summary business continuity plan framework for all relevant Fiserv business units, an annual copy of Fiserv’s overview of risk management procedures with subcontractors, and any follow up reports or tracking of information security issues. Fiserv shall also take appropriate actions to address incidents of unauthorized access (“ Security Incident ”) to Client’s “sensitive customer information” (as defined in GLB), including notification to Client as soon as possible, but in any event not later than 48 hours of any such Security Incident. Fiserv agrees to provide Client with all reasonable assistance required to comply with applicable laws that require the notification of individuals in the event of a Security Incident. In the event of a Security Incident, Client will assume responsibility for informing all such individuals in accordance with applicable law. Fiserv will make no notification except as authorized by Client or required by law. As required by PCI-SSC or the applicable regulatory agency having jurisdiction over Client, Fiserv may disclose information regarding any such Security Incident involving cardholder data to PCI-SSC and such agency.