ESRB Privacy Certified C25-312.8b: Written children's information security program (312.8(b) and (c))

The operator must set up, apply and keep a written information security program whose safeguards match how sensitive the children's personal information is and to how large and complex the operator is and what it does: designating one or more employees to coordinate it; identifying, and at least annually reassessing, internal and external risks and the sufficiency of safeguards; designing, implementing and maintaining safeguards proportionate to the volume and sensitivity of the data and the likelihood of compromise; regularly testing and monitoring the safeguards; and at least annually evaluating and modifying the program. Before allowing third parties, service providers or other operators to collect or maintain children's personal information on its behalf, or releasing it to them, the operator is required to take reasonable steps to establish that they are able of protecting it and obtain written assurances that they will. This goes beyond the reasonable procedures of Kids Seal VII.B and VII.C.