Common use of Penetration Testing Clause in Contracts

Penetration Testing. At least ***, Acxiom will engage *** a third party security services provider to perform perimeter vulnerability and penetration testing of Acxiom’s external systems and databases. Acxiom will provide to D&B the “Statement of Opinion” issued to Acxiom by such third party provider following each such vulnerability and/or penetration test series, which shall be provided to D&B promptly upon its receipt by Acxiom. Additionally, Acxiom will itself perform regular vulnerability testing on external and internal devices connected to the Acxiom network supporting D&B. At least once each calendar quarter, or more frequently as D&B may reasonably request, the parties will include in the agenda for the meetings described in Section 11.2(b)(iii) above: (a) discussion of testing methodologies used by Acxiom, (b) identification of any requirements to modify such testing methodologies, in order to meet industry standards for testing, along with associated timeline(s) for inclusion of such modifications into the testing, and (c) a summary of the most current *** vulnerability scanning results, including but not limited to discussing scan results for portions of Acxiom systems that are dedicated to supporting only D&B. ***

Penetration Testing. At least ***, Acxiom Ensono will engage *** a third party security services provider to perform perimeter vulnerability and penetration testing of AcxiomEnsono’s external systems and databases. Acxiom Ensono will provide to D&B the “Statement of Opinion” issued to Acxiom Ensono by such third party provider following each such vulnerability and/or penetration test series, which shall be provided to D&B promptly upon its receipt by AcxiomEnsono. Additionally, Acxiom Ensono will itself perform regular vulnerability testing on external and internal devices connected to the Acxiom Ensono network supporting D&B. At least once each calendar quarter***, or more frequently as D&B may reasonably request, the parties will include in the agenda for the meetings described in Section 11.2(b)(iii) above: (a) discussion of testing methodologies used by AcxiomEnsono, (b) identification of any requirements to modify such testing methodologies, in order to meet industry standards for testing, along with associated timeline(s) for inclusion of such modifications into the testing, and (c) a summary of the most current *** vulnerability scanning results, including but not limited to discussing scan results for portions of Acxiom Ensono systems that are dedicated to supporting only D&B. ***.