5.4  Virus protection and control

(a)  The Service Provider shall:

(i)  purchase, install and configure the workstation anti-virus software for Users;

(ii)  ensure that anti-virus definitions for all the Service Provider supported systems are updated and available for distribution to network connected assets and ensure that this is done within 30 minutes of release by the anti-virus software supplier;

(iii)  when an identified virus attack occurs, allocate the same a Severity 1 Service Failure categorisation for the purposes of managing the virus eradication process with all associated Tickets; and

(iv)  [as soon as is practicable enter notification of the virus type, number of Users affected and source, if known, into the Authority Security Incidents Database.]23

__________________________________________________________________________________
23  Usage to be confirmed on a case-by-case basis