Mondelez 2012 Annual Report Download - page 246

at a Kraft Site, subject to Kraft’s responsibility for maintaining physical security at such Kraft Site; (iii) no less rigorous than accepted
security standards in the industry (such as ISO 17799), and (iv) adequate to permit Supplier to meet its obligations under
Section 13.3 . Within 90 days following the Effective Date, Supplier shall evaluate the then-current Kraft security policy and shall
prepare and submit for Kraft review and approval recommendations with respect to changes or modifications to such policy. Supplier
shall maintain and enforce the then-current Kraft security policy until any changes or modifications are approved by Kraft in writing
for implementation. The Parties acknowledge and agree that modifications or additions to the Kraft security or other policies or the
information security requested by Kraft after the Effective Date may result in Supplier performing New Services to comply with such
modifications or additions if such services meet the definition of New Services. Kraft shall have the right to establish backup security
for Kraft Data and to keep backup copies of the Kraft Data in Kraft’s possession at Kraft’s expense if Kraft so chooses. Supplier shall
provide Kraft with downloads of Kraft Data, as requested by Kraft, to enable Kraft to maintain such backup security or backup copies
of Kraft Data. Supplier shall remove all Kraft Data from any media taken out of service and shall destroy or securely erase such media
in accordance with the Policy and Procedures Manual. No media on which Kraft Data is stored may be used or re-used to store data of
any other customer of Supplier or to deliver data to a third party, including another Supplier customer, unless securely erased in
accordance with the Policy and Procedures Manual. In the event Supplier discovers or is notified of a breach or potential breach of
security relating to Kraft Data in the possession or control of Supplier or its Affiliates or Subcontractors or System that Supplier is
supporting, Supplier shall (i) expeditiously notify Kraft of such breach or potential breach, (ii) investigate such breach or potential
breach and perform a Root Cause Analysis thereon, (iii) remediate the effects of such breach or potential breach of security to the
extent possible, (iv) provide Kraft with such assurances as Kraft shall request that such breach or potential breach will not recur and
(v) provide periodic updates during the investigation to Kraft and provide Kraft the Root Cause Analysis reports. If the Root Cause
Analysis indicates that Supplier was not responsible for the cause of the breach or potential breach and Supplier is unable to perform
remediation efforts without adding substantial additional Supplier resources or third party contractors (beyond the Subcontractor
personnel then assigned to perform Services for Kraft), Kraft may elect to either (i) reprioritize the Services, in which event Supplier
will perform the remediation at no additional charge, or (ii) authorize Supplier to perform the remediation as a Project.
CONFIDENTIAL TREATMENT HAS BEEN REQUESTED FOR PORTIONS OF THIS EXHIBIT. THE COPY FILED HEREWITH OMITS
THE INFORMATION SUBJECT TO A CONFIDENTIALITY REQUEST. OMISSIONS ARE DESIGNATED [ * * * ]. A COMPLETE
VERSION OF THIS EXHIBIT HAS BEEN FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION.
97
13.2.2 Reconstruction Procedures . As part of the Services, Supplier shall be responsible for developing and maintaining procedures for the
reconstruction of lost Kraft Data which are (i) no less rigorous than those maintained by Kraft as of the Effective Date (or
implemented by Kraft in the future to the extent deemed necessary by Kraft), and (ii) no less rigorous than those maintained by
Supplier for its own information of a similar nature.
13.2.3
Corrections
. Supplier shall restore all destroyed, lost or altered Kraft Data using generally accepted data restoration techniques
consistent with the requirements of the applicable Supplement, where applicable. In addition, if Supplier or its Affiliates or
Subcontractors has caused the destruction, loss or alteration of any Kraft Data, Supplier shall be responsible for the cost of restoring
such data. If Supplier or its Affiliates or Subcontractors have not caused the destruction, loss or alteration of any Kraft Data, and
Supplier is unable to perform the restoration efforts without either adding substantial additional Supplier resources or third party
contractors (beyond the Subcontractor personnel then assigned to perform Services for Kraft), Supplier will so notify Kraft. Kraft may
elect to either (i) reprioritize the Services, in which event Supplier will perform the restoration at no additional charge, or (ii) authorize
Supplier to perform the