of the ECDC itself under Regulation 2018/1725. The audit shall aim at checking compliance of the processing of data entrusted by the ECDC to the Contractor with the contractual obligations and with the applicable data protection rules and principles. 

The Contractor shall duly co-operate in those inspections, free of cost. 

## N - Security measures 

The Contractor shall ensure that it has a proper IT Security Risk Management framework in place and has implemented the relevant technical and security measures set out under the relevant framework as well as those measures specified in the Contract and/or in the SLA before processing the data on behalf of the ECDC and that it will properly maintain the framework and manage the risks for the duration of the Contract. 

In assessing the appropriate level of security the Contractor shall take account in particular of the risks that are presented by the processing, in particular those deriving from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed. 

The Contractor shall maintain documentation regarding the framework and the security and technical measures in place and shall provide the ECDC with adequate access to it, to enable it to comply with the requirements of the Regulation 2018/1725. 

## O - Data breach notification 

The Contractor shall implement appropriate mechanisms to deal promptly and effectively with security incidents and personal data breaches. These shall include reporting mechanisms ensuring that the ECDC is notified of any possible personal data breaches  (security incidents affecting personal data processed on behalf of the EU institution). 

The Contractor shall notify relevant personal data breaches to the ECDC without undue delay and in any case no later than 24 hours after the discovery, for the ECDC to be able to notify, if needed based on the requirements of Regulation 2018/1725, the impacted data subjects without undue delay and the EDPS within 72 hours after the Contractor becomes aware of the breach. 

The Contractor shall provide the ECDC with at least the following information: 

- Nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned. 

- Likely consequences of the personal data breach. 

- Measures taken or proposed to be taken to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. 

The Contractor shall collaborate with the ECDC institutions to enable it to comply with all relevant obligations set out by Regulation 2018/1725 on personal data breaches. 

