Common use of Penetration and Vulnerability Testing Clause in Contracts

Penetration and Vulnerability Testing. Unless Broker-Dealer conducts continuous monitoring of its Information Systems to detect, on an ongoing basis, changes in such Information Systems that may create or indicate vulnerabilities, Broker-Dealer shall conduct: (a) Penetration Testing of its Information Systems at least annually; and (b) vulnerability assessments at least bi-annually, including any systematic scans or reviews of its Information Systems reasonably designed to identify publicly known cybersecurity vulnerabilities.