Application and System Security. Supplier agrees at all times to provide, maintain and support its software release and subsequent updates, upgrades, and bug fixes such that the software is, and remains secure from those vulnerabilities using applicable and recognized industry practices or standards including:
i. The Open Web Application Security Project’s (OWASP) “Top Ten Project” - see xxxx://xxx.xxxxx.xxx;
ii. The CWE/SANS Top 25 Programming Errors – see xxxx://xxx.xxxxx.xxx/top25/ or xxxx://xxx.xxxx.xxx/top25-programming-errors/; or
iii. Other generally recognized and comparable industry practices or standards. Additionally, Supplier agrees to maintain a secure processing environment, including but not limited to, the timely application of patches, fixes and updates to operating systems and applications as provided by Supplier or open source support.
Application and System Security. Supplier agrees to engage in, at a minimum annually, external application penetration testing and/or Service Organization Control audits. Supplier agrees to provide, maintain and support software releases and subsequent updates, upgrades, and bug fixes free from known vulnerabilities applicable to the products utilized by the Supplier by adhering to generally recognized industry best practices and standards in Section C.16.a. of this Addendum.
