Audit / Security Reviews. (i) Periodic audits or assessments, including testing of the system of controls, shall be performed by an independent audit function on a periodic basis. The audits shall also include testing of CSG’s information security procedures as well. Assessments shall include the following elements where applicable: Application Code Review and Binary Analysis of pre-compiled content delivery binaries on server or mobile delivery platforms; provided however, such review and analysis shall be (i) scheduled at a mutually agreeable time (x) no more than once per calendar year and (y) upon no less than ten (10) business days advance written notice, (ii) be conducted by independent third party assessors that have executed a confidentiality agreement with CSG in form and substance satisfactory to CSG, (iii) conducted at CSG’s principal offices in Chicago, IL and (iv) performed at Customer’s sole and exclusive cost. Application Threat Modeling which includes all systems that will be processing Customer Content, Third Party Customer Content, Consumer Information, and/or Consumer Usage Data. Social engineering discovery and assessment: meaning implementing the practice of testing CSG’s ability to appropriately deal with attacks from external threat actors who will use techniques to attempt to extract information about the internal workings of systems. Surveillance and alarm system assessment at CSG’s principal corporate offices (but specifically excluding CSG’s third party datacenters)
