confidentiality, or integrity of nonpublic personal information of any current or former Bank of America employee or customer (''Affected Persons") or otherwise provided to Supplier by Bank of America under this agreement through the defined security escalation channel of Bank of America, the Bank of America Incident Response Team ("InfoSafe") by calling (800) 207-2322, option 1. Callers will be asked to identify themselves as Supplier. Such notification to Bank of America shall precede notifications to any other party. Supplier shall cooperate fully with all Bank of America security investigation activities consistent with the lnfoSafe guidelines for escalation and control of significant security incidents. Bank of America reserves the right in its sole discretion to make appropriate privacy breach notifications to Affected Persons and regulators pursuant to federal or state guidelines, including but not limited to the Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice. To assist Bank of America in such notifications, Supplier shall include a brief summary of the available facts, the status of any investigation, and, if known, the potential number of Affected Persons. Supplier agrees to provide at no charge, to Affected Persons appropriate credit monitoring services for two years. All costs associated with any security breach, including but not limited to, the costs of the notices to, and credit monitoring for, Affected Persons shall be the sole responsibility of Supplier. Supplier agrees that it shall not communicate with any third party, including, but not limited to the media, vendors, consumers. and Affected Persons regarding any security breach without the express written consent of Bank of America. Supplier shall maintain for a mutually agreed-upon length of time, and afford Bank of America reasonable access to, all records and logs of that portion of Supplier's network that stores or processes Confidential Information.