Such data will be stored in a manner consistent with the NIST Cybersecurity Framework to mitigate against data security and privacy risks.</li> <li>8 CRR-NY § 121.3(c)(6) address how the data will be protected using encryption while in motion and at rest – Vocabulary.com will utilize a technology or methodology specified or permitted by the Secretary of the United States Department of Health and Human Services in guidance issued under section 13402(H)(2) of Public Law 111-5.</li> <li>8 CRR-NY § 121.6(a)(4) specify how officers or employees of the third-party contractor and its assignees who have access to student data, or teacher or principal data receive or will receive training on the Federal and State laws governing confidentiality of such data prior to receiving access – Vocabulary.com periodically provides training to its employees regarding data security and privacy obligations with respect to such data.</li> <li>8 CRR-NY § 121.6(a)(5) specify if the third-party contractor will utilize sub-contractors and how it will manage those relationships and contracts to ensure personally identifiable information is protected – While Vocabulary.com does not sub-contract portions of any particular contract with a customer, Vocabulary.com does utilize vendors in the course of providing the Vocabulary.com Service.