Common use of Baseline Security Requirements For Verizon Suppliers Clause in Contracts

Baseline Security Requirements For Verizon Suppliers. Supplier must: a. Employ reasonable controls to secure source code, including version control, segregation of source code repositories, and least privilege access principles. b. Incorporate security vulnerability and malicious code assessments throughout the software development life cycle. c. Ensure the information system separates user functionality (including user interface services) from information system management functionality. d. Implement denial of service (DoS) detection and mitigation controls. e. Monitor and control communications at the external boundary of the system and at key internal boundaries within the system. f. Implement subnetworks for publicly accessible system components that are either physically or logically separated from internal, trusted Supplier networks. g. Connect to and allow connections from external networks only through managed interfaces consisting of boundary protection devices and security gateways. h. Implement appropriate cryptographic mechanisms to prevent unauthorized disclosure of information and detect changes to information during transmission. i. Encrypt (in Transit and at Rest) Verizon Highly Confidential information. j. Establish and manage cryptographic keys in accordance with established and industry accepted key management procedures for systems encrypting and or decrypting Verizon data. k. Ensure retention and restoral of electronic mail when directed by Verizon in connection with actual or anticipated legal proceedings. l. Adhere to the following requirements when connecting to a Verizon network: i. Assets used to connect to a Verizon network must either be provided by Verizon or must be owned/leased by the Supplier or permitted subcontractors. ii. Personally owned assets may not be used to perform work for Verizon.