HomeMy WebLinkAboutAppendix 2 - Voya Data Security Addendum 2026For plan sponsor use only. Not for use with
participants. CN5035600_0128
DATA SECURITY ADDENDUM
This Data Security Addendum (“Addendum”) is an addendum to the Agreement between Voya and Client
(together “Parties”) and sets forth the obligations of the Parties regarding the Data Security pursuant to
such Agreement.
1.Definitions.
“Agreement” means one or more contracts between Voya, or its affiliates, and Client, including any
exhibits or attachments thereto, that are applicable to the Services.
“Affected Persons” means Client’s and its Affiliate’s former and current employees whose Personal
Information (“PI”) may have been disclosed or compromised as a result of an Information Security
Incident.
“Affiliates” means any entities that, now or in the future, control, are controlled by, or are under common
control with Client. An entity will be deemed to control another entity if it has the power to direct or cause
the direction of the management or policies of such entity, whether through ownership, voting securities,
contract, or otherwise.
“Confidential Information” means (a) non-public information concerning the Disclosing Party, its
affiliates, and their respective businesses, products, processes, and services, including technical, marketing,
agent, customer, financial, personnel, and planning information; (b) PI; (c) trade secrets; and (d) any other
information that is marked confidential or which, under the circumstances surrounding disclosure, the Non-
Disclosing Party should know is treated as confidential by the Disclosing Party. Except with respect to PI,
which will be treated as Confidential Information, Confidential Information will not include (A)
information lawfully obtained or developed by the Non- Disclosing Party independently of the Disclosing
Party’s Confidential Information and without breach of any obligation of confidentiality; or (B) information
that enters the public domain without breach of any obligation of confidentiality. Confidential
Information will remain the property of the Disclosing Party.
“Information Security Incident” means any breach of security or cyber security incident impacting Voya
that has a reasonable likelihood of (a) resulting in the loss or unauthorized access, use or disclosure of
Client PI; or (b) materially affecting Voya’s ability to provide the Services to Client as defined in the
underlying Agreement.
“Law” means U.S. and non-U.S. laws, ordinances, rules, regulations, declarations, decrees, directives,
legislative enactments and governmental authority orders and subpoenas.
“Personal Information (PI)” means any information or data processed by Voya in performing the
Services that is considered “Personally Identifiable Information,” “Personal Information,” “Personal Data,”
or like terms under applicable Law, including, but not limited to, information regarding or reasonably
capable of being associated with an identified or identifiable individual, device, or household, or
information (including sensitive information) that can directly or indirectly identify a natural person or data
subject. For the avoidance of doubt, Personal Information shall not include anonymous, aggregated, or de-
identified data to the extent such data is exempt or excluded from regulation under applicable Law.
“Services” means the services that Voya provides to Client pursuant to an Agreement.
“Voya Personnel” means Voya’s employees and subcontractors engaged in the performance of Services.
20260128-5035600-16288636
For plan sponsor use only. Not for use with
participants. CN5035600_0128
2.Data Security.
2.1. Security Standards and Controls.
(a)Voya will establish and maintain:
(i)administrative, technical, and physical safeguards against the destruction, loss, or
alteration of confidential Information; and
(ii)Appropriate security measures to protect Confidential Information, which
measures meet or exceed the requirements of applicable Laws relating to PI security.
(b)In addition, Voya will implement and maintain the following information security controls:
(i)Privileged access rights will be restricted and controlled;
(ii)An inventory of assets relevant to the lifecycle of information will be maintained;
(iii)Network security controls will include, at a minimum, firewall, intrusion
detection, and intrusion prevention Services;
(iv)Detection, prevention and recovery controls to protect against malware will be
implemented;
(v)Information about technical vulnerabilities of Voya’s information systems will be
obtained and evaluated in a timely fashion and appropriate measures taken to
address the risk;
(vi)Detailed event logs recording user activities, exceptions, faults, access attempts,
operating system logs, and information security events will be produced, retained
and regularly reviewed as needed; and
(vii)Development, testing and operational environments will be separated to reduce
the risks of unauthorized access or changes to the operational environment.
2.2. Information Security Policies. Voya will implement and maintain written policies, standards or
procedures that address the following areas:
(a)Information security;
(b)Data governance and classification;
(c)Access controls and identity management;
(d)Asset management;
(e)Business continuity and disaster recovery planning and resources;
(f)Capacity and performance planning;
(g)Systems operations and availability concerns;
(h)Systems and network security;
(i)Systems and application development, quality assurance and change management;
(j)Physical security and environmental controls;
(k)Customer data privacy;
(l)Patch management;
(m)Maintenance, monitoring and analysis of security audit logs;
(n)Vendor and third-party service provider management; and
(o)Incident response, including clearly defined roles and decision-making authority and
a logging and monitoring framework to allow the isolation of an incident; and
(p)Data Loss Prevention
2.3. Subcontractors. Voya will implement and maintain policies and procedures to ensure the security
of Confidential Information and related systems that are accessible to, or held by, third party
service providers. Voya will not allow any third parties to access Voya’s systems or store or
process sensitive data, unless such third parties have entered into written contracts with Voya that
require, at a minimum, the following:
(a)The use of encryption to protect sensitive PI in transit, and the use of encryption or
other mitigating controls to protect sensitive PI at rest;
(b)Prompt notice to be provided in the event of an Information Security Incident;
20260128-5035600-16288636
For plan sponsor use only. Not for use with
participants. CN5035600_0128
(c)The ability of Voya or its agents to perform information security assessments; and
(d)Representations and warranties concerning adequate information security.
2.4. Encryption Standards, Multifactor Authentication and Protection of Confidential Information.
(a)Voya will implement and maintain cryptographic controls for the protection of
Confidential Information, including the following:
(i)Use of an encryption standard equal to or better than the industry standards
included in applicable National Institute for Standards and Technology Special
Publications (or such higher encryption standard required by applicable Law) to
protect Confidential Information at rest and in transit over un-trusted networks;
(ii)Use of cryptographic techniques to provide evidence of the occurrence or
nonoccurrence of an event or action;
(iii)Use of cryptographic techniques to authenticate users and other system entities
requesting access to or transacting with system users, entities and resources; and
(iv)Development and implementation of policies on the use, protection and lifetime of
cryptographic keys through their entire lifecycle.
(b)In addition to the controls described in clause (a) above, Voya will:
(i)Implement multi-factor authentication for remote access to Voya’s networks;
(ii)Ensure that no Client PI is (A) placed on unencrypted removable media, mobile
devices, computing equipment or laptops or (B) stored outside the United States;
and
(iii)Ensure that media containing Confidential Information is protected against
unauthorized access, misuse or corruption during transport.
2.5.
2.6.
2.7.
Information Security Roles and Responsibilities. Voya will employ personnel adequate to manage
Voya’s information security risks and perform the core cyber security functions of identify,
protect, detect, respond and recover. Voya will designate a qualified employee to serve as its Chief
Information Security Officer (“CISO”) responsible for overseeing and implementing its
information security program and enforcing its information security policies. Voya will define
roles and responsibilities with respect to information security, including by identifying
responsibilities for the protection of individual assets, for carrying out specific information security
processes, and for information security risk management activities, including acceptance of
residual risks. These responsibilities should be supplemented, where appropriate, with more
detailed guidance for specific sites and information processing facilities.
Segregation of Duties. Voya must segregate duties and areas of responsibility in order to reduce
opportunities for unauthorized modification or misuse of Voya’s assets and ensure that no single
person can access, modify or use assets without authorization or detection. Controls should be
designed to separate the initiation of an event from its authorization. If segregation is not
reasonably possible, other controls such as monitoring of activities, audit trails and management
supervision should be utilized. Development, testing, and operational environments should be
separated to reduce the risks of unauthorized access or changes to the operational environment.
Information Security Awareness, Education and Training. Voya will provide regular information
security education and training to Voya Personnel, as relevant for their job function. In addition,
Voya will provide mandatory training to information security personnel and require key
information security personnel to stay abreast of changing cyber security threats and
countermeasures.
2.8. Vulnerability Assessments. Voya will conduct monthly vulnerability assessments that meet the following
criteria:
(a) Production servers and network devices must be scanned at least monthly;
(b)Vulnerabilities must be rated;
20260128-5035600-16288636
For plan sponsor use only. Not for use with
participants. CN5035600_0128
(c)Vulnerability remediation must be prioritized based on risk;
(d)Tools used for scanning must have signatures updated at least monthly with the
latest vulnerability data; and,
(e)Voya will implement and maintain a formal process for tracking and resolving issues
in a timely fashion.
2.9. Penetration Testing. If any Services to be provided by Voya include the hosting or support of one
or more externally facing applications that can be used to access systems that store or process
Client data, the terms of this Section will apply.
(a)At least once every 12 months during the Term and prior to any major changes being
moved into production, Voya will conduct a Valid Penetration Test (as defined
below) on each internet facing application described above. As used herein, a “Valid
Penetration Test” means a series of tests performed by a team of certified
professionals, which tests mimic real-world attack scenarios on the information
system under test and include, without limitation, the following:
(i)Information-gathering steps and scanning for vulnerabilities;
(ii)Manual testing of the system for logical flaws, configuration flaws, or
programming flaws that impact the system’s ability to ensure the confidentiality,
integrity, or availability of Client’s information assets;
(iii)System-compromise steps;
(iv)Escalation-of-privilege steps; and
(v)Assignment of a rating for each issue based on the level of potential risk exposure
to Client’s brand or information assets.
(b)Upon Client’s request, Voya will provide to Client an executive summary of any
material issues or vulnerabilities identified by the most recent Valid Penetration Test
along with the scope of systems tested. The report may be redacted to ensure
confidentiality.
2.10. Physical and Environmental Security. Voya will ensure that sites are physically secure, including the
following:
(a)Sound perimeters with no gaps where a break-in could easily occur;
(b)Exterior roof, walls and flooring of solid construction and external doors suitable protected
against unauthorized access with control mechanisms such as locks, bars, alarms, etc.;
(c)Doors and windows to operational areas locked when unattended;
(d)Equipment protected from power failures and other disruptions caused by failures in
supporting utilities;
(e)Closed-circuit television cameras at site entry/ exit points; badge readings at site
entry points, or other means to prevent unauthorized access; and
(f)Visitor sign-in/ mandatory escort at site; and
(g)With respect to remote work environments, if the foregoing controls are not present, then
Voya will use commercially reasonable efforts to mitigate any increased risk associated with
such remote work environments, by, for example, limiting the types of access and functional
roles eligible for a remote work environment, restricting access to a virtual private network
(VPN) or virtual desktop infrastructure (VDI), providing formal guidance and standards for
workspace security, and enhancing data protection controls such as data masking, logging
and monitoring.
20260128-5035600-16288636
For plan sponsor use only. Not for use with
participants. CN5035600_0128
2.11. Information Security Incident Notification.
(a)In the event of any Information Security Incident, Voya will, at its sole expense
promptly (and in any event within 72 hours after Voya confirms an Information
Security Incident) report such Information Security Incident to Client by sending
an email to Client Contact Information, summarizing in reasonable detail the effect
on Client, if known, and designating a single point of contact at Voya who will be:
(i)Available to Client for information and assistance related to the Information
Security Incident; investigate such Information Security Incident, perform a root
cause analysis, develop a corrective action plan and take necessary corrective
actions;
(ii)Mitigate, as expeditiously as possible, any harmful effect of such Information
Security Incident and cooperate with Client in any reasonable and lawful efforts to
prevent, mitigate, rectify and remediate the effects of the Information Security
Incident;
(iii)Provide a written report to Client containing information necessary for Client to
determine compliance with applicable Laws, including the extent to which
notification to Affected Persons or to government or regulatory authorities is
required; and
(iv)Cooperate with Client in providing any filings, communications, notices, press
releases or reports related to such Information Security Incident.
(b)In addition to the other indemnification obligations of Voya set forth in this
Agreement, Voya will indemnify, defend and hold harmless Client from and against
any and all claims, suits, causes of action, liability, loss, costs and damages,
including reasonable attorneys’ fees, arising out of or relating to any Information
Security Incident, which may include, without limitation:
(i)Expenses incurred to provide notice to Affected Persons and to law-enforcement
agencies, regulatory bodies or other third parties as required to comply with Law;
(ii)Expenses related to any reasonably anticipated and commercially recognized
consumer data breach mitigation efforts, including, but not limited to, costs
associated with the offering of credit monitoring or a similar identify theft
protection or mitigation product for a period of at least twelve (12) months or
such longer time as is required by applicable Laws or any other similar
protective measures designed to mitigate any damages to the Affected Persons;
and
(iii)Fines or penalties that Client pays to any governmental or regulatory authority
under legal or regulatory order as a result of the Information Security Incident.
2.12. Risk Assessments. Upon Client’s request no more than once per year, Voya will complete an
industry standard information security questionnaire and provide relevant Service Organiza tion
Control (“SOC”) audit reports, when available.
2.13. Data Loss Prevention. Voya will use commercially available data loss prevention technology designed to
detect and prevent unauthorized transmission of electronic data obtained or created in connection with the
Services through various methods, including but not limited to ema il, network traffic, USB devices,
CDs/DVDs, and print. Voya will implement features of such technology that are designed to both detect
and prevent unauthorized transmission using rules within the technology that are reasonably related to the
specific type of data handled by Voya. Voya will:
(a)Investigate any evidence of a potential or actual unauthorized transmission detected by such
technology;
(b)Identify, prevent, and mitigate the effects of any such potential or unauthorized transmission ;
(c)Carry out any action necessary to remedy the cause of the potential or unauthorized
20260128-5035600-16288636
For plan sponsor use only. Not for use with
participants. CN5035600_0128
transmission and prevent a recurrence; and
(d)Notify Client of the progress and results of the foregoing.
Voya’s obligations under this section shall be in addition to any other obli gations Voya may have under the
Agreement with respect to an Information Security Incident.
3.Confidential Information.
3.1.
3.2.
3.3.
Confidential Information. Either Party (“Disclosing Party”) may disclose Confidential Information
to the other Party (“Non-Disclosing Party”) in connection with this Agreement.
Use and Disclosure of Confidential Information. The Non-Disclosing Party agrees that it will
disclose the Disclosing Party’s Confidential Information only to its employees, agents,
consultants, and contractors who have a need to know and are bound by obligations of
confidentiality no less restrictive than those contained in this Agreement. In addition, Voya agrees
that it will use the Disclosing Party’s Confidential Information only for the purposes of performing
its obligations under this Agreement. The Non-Disclosing Party will use reasonable care in
handling and securing the Disclosing Party’s Confidential Information and will employ security
measures used for its own proprietary information of similar nature. These confidentiality
obligations will not restrict any disclosure of Confidential Information required by Law or by
order of a court, regulatory authority or governmental agency; provided, that the Non-Disclosing
Party will limit any such disclosure to the information actually required to be disclosed.
Notwithstanding anything to the contrary, Client may fully comply with requests for information
from regulators of Client and the Client Affiliates.
Treatment of Confidential Information Following Termination. Promptly following the
termination or expiration of this Agreement, or earlier if requested by the Disclosing Party, the
Non-Disclosing Party will return to the Disclosing Party physical and electronic materials in
the Non-Disclosing Party’s possession or control containing the Disclosing Party’s Confidential
Information. The materials must be delivered via a secure method and upon such media as
may be reasonably required by the Disclosing Party.
Alternatively, with the Disclosing Party’s prior written consent, the Non-Disclosing Party may
permanently destroy or delete the Disclosing Party’s Confidential Information and, if requested,
will promptly certify the destruction or deletion in writing to the Disclosing Party.
Notwithstanding the foregoing, if the Non-Disclosing Party, due to requirements of applicable
Law, must retain any of the Disclosing Party’s Confidential Information, or is unable to
permanently destroy or delete the Disclosing Party’s Confidential Information as permitted above
within 60 days after termination of this Agreement, the Non-Disclosing Party will so notify the
Disclosing Party in writing, and the Parties will confirm any extended period needed for
permanent destruction or deletion of the Disclosing Party’s Confidential Information.
Confidential Information in the Non-Disclosing Party’s possession or control will continue to be
subject to the confidentiality provisions of this Agreement. The methods used to destroy and
delete the Confidential Information must ensure that no Confidential Information remains readable
and cannot be reconstructed so to be readable. Destruction and deletion must also comply with the
following specific requirements:
MEDIUM DESTRUCTION METHOD
Hard copy Shredding, pulverizing, burning, or other
permanent destruction method
Electronic tangible media, such as disks
and tapes
Destruction or erasure of the media
20260128-5035600-16288636
For plan sponsor use only. Not for use with
participants. CN5035600_0128
3.4. Period of Confidentiality. The restrictions on use, disclosure, and reproduction of Confidential
Information set forth in this Section will, with respect to PI and Confidential Information that
constitutes a “trade secret” (as that term is defined under applicable Law), be perpetu al, and will,
with respect to other Confidential Information, remain in full force and effect during the term of
this Agreement and for three years following the termination or expiration of this Agreement.
3.5. Injunctive Relief. The Parties agree that the breach, or threatened breach, of any of the
confidentiality provisions of this Agreement may cause irreparable harm without adequate remedy
at law. Upon any such breach or threatened breach, the Disclosing Party will be entitle d to
injunctive relief to prevent the Non-Disclosing Party from commencing or continuing any action
constituting such breach, without having to post a bond or other security and without having to
prove the inadequacy of other available remedies. Nothing in this Section will limit any other
remedy available to either Party.
4.Cyber Liability Insurance. During the Term, Voya will, at its own cost and expense, obtain and
maintain in full force and effect, with financially sound and reputable insurers, cyber lia bility
insurance to cover Voya’s obligations under this Addendum. Upon execution of the Agreement,
Voya will provide Client with a certificate of insurance evidencing the following coverage and
amount with such insurer:
Risk Covered: Network Security (a.k.a. Cyber/IT)
Limits: $50,000,000
5.Disaster Recovery and Business Continuity Plan. Voya maintains, and will continue to maintain
throughout the Term, (a) a written disaster recovery plan (“Disaster Recovery Plan”), which
Disaster Recovery Plan is designed to maintain Client’s access to Services and prevent the
unintended loss or destruction of Client data; and (b) a written business continuity plan (“BCP”)
that permits Voya to recover from a disaster and continue providing Services to customers,
including Client, within the recovery time objectives set forth in the BCP. Upon Client’s
reasonable request, Voya will provide Client with evidence of disaster recovery test date and result
outcome.
Hard drive or similar storage device Storage frame metadata removal to hide the
organizational structure that combines disks
into usable volumes and physical destruction of
the media with a Certificate of Destruction
(COD)
20260128-5035600-16288636