18 CAR § 21-603 – Expertise and duties

(a) A contract auditor shall collectively possess sufficient training and experience to adequately perform unclaimed property examinations.
(b) A contract auditor shall not engage in any unclaimed property examination without written authorization from the Auditor of State.
(c) A contract auditor shall report in writing to the Auditor of State at least monthly on the status of all unclaimed property examinations the contract auditor has been authorized to perform.
(d)
1. (1) A contract auditor shall have in place data security practices, policies, and procedures reasonably required to prevent any security breach or loss as well as protect:
  1. (A) User privacy;
  2. (B) Computer security; and
  3. (C) Network security.
2. (2) A contract auditor shall also have a cyber-incident response plan in the event of a security breach or loss as well as cybersecurity training programs on:
  1. (A) New user awareness;
  2. (B) Annual user awareness; and
  3. (C) Post-incident refresher training.