Service and Systems Integrity and Availability Control a. Cellulant will 1) perform security and privacy risk assessments at least annually; 2) perform penetration testing and assess vulnerabilities, including automated system and application security scanning and manual ethical hacking, before production release and annually thereafter, 3) enlist a qualified independent third-party to perform penetration testing at least annually, 4) perform automated management and routine verification of compliance with security configuration requirements for each component of the Contracted Services, and 5) remediate identified vulnerabilities or noncompliance with its security configuration requirements based on associated risk, exploitability, and impact. Cellulant will take reasonable steps to avoid disruption of Contracted Services when performing its tests, assessments, scans, and execution of remediation activities. Upon Customer’s request, Cellulant will provide Customer with a written summary of Cellulant’s then-most recent penetration testing activities, which report must at a minimum include the name of the offerings covered by the testing, the number of systems or applications in-scope for the testing, the dates of the testing, the methodology used in the testing, and a high-level summary of findings.
Service and Systems Integrity and Availability Control a. Supplier will 1) perform security and privacy risk assessments at least annually; 2) perform penetration testing and assess vulnerabilities, including automated system and application security scanning and manual ethical hacking, before production release and annually thereafter, 3) enlist a qualified independent third-party to perform penetration testing at least annually, 4) perform automated management and routine verification of compliance with security configuration requirements for each component of the Contracted Services, and 5) remediate identified vulnerabilities or noncompliance with its security configuration requirements based on associated risk, exploitability, and impact. Supplier will take reasonable steps to avoid disruption of Contracted Services when performing its tests, assessments, scans, and execution of remediation activities. Upon Cellulant’s request, Supplier will provide Cellulant with a written summary of Supplier’s then-most recent penetration testing activities, which report must at a minimum include the name of the offerings covered by the testing, the number of systems or applications in-scope for the testing, the dates of the testing, the methodology used in the testing, and a high-level summary of findings.
