Service Integrity and Availability Control. 6.1 Acoustic will: a) ensure security and privacy risk assessments of its SaaS Products are carried out at least annually; b) ensure penetration testing and vulnerability assessments, including automated system and application security scanning and manual ethical hacking, are carried out before production release and annually thereafter; c) ensure a qualified independent third-party performs penetration testing at least annually; d) ensure automated management and routine verification of underlying Components' compliance with security-configuration requirements are carried out; and e) remediate identified vulnerabilities or noncompliance with its security configuration requirements based on associated risk, exploitability, and impact.
6.2 Acoustic will take reasonable steps to avoid SaaS Product disruption when performing tests, assessments, scans, and execution of remediation activities.
6.3 Acoustic will maintain policies and procedures designed to manage risks associated with the application of changes to its SaaS Products. Prior to implementation, material changes to a SaaS Product, including its systems, networks, and underlying Components, will be documented in a registered change request that includes a description and reason for the change, implementation details and schedule, a risk statement addressing impact to the SaaS Product and its Partners, expected outcome, rollback plan, and documented approval by authorized personnel.
6.4 Acoustic will maintain an inventory of all information-technology assets used in its operation of the SaaS Product. Acoustic will continuously monitor and manage the health, including capacity, and availability of the SaaS Product and underlying Components.
6.5 Each SaaS Product will be separately assessed for business-continuity and disaster-recovery requirements pursuant to documented risk-management guidelines. Each Acoustic SaaS Product will have, to the extent warranted by such risk assessment, separately defined, documented, maintained, and annually validated business-continuity and disaster-recovery plans consistent with industry-standard practices. Recovery-point and recovery-time objectives for the SaaS Product, if provided, will be established with consideration given to the SaaS Product's architecture and intended use, and will be described in the relevant Attachment. Partner’s Content on physical media intended for off-site storage, if any, such as media containing SaaS Product backup files, will be encrypte...
Service Integrity and Availability Control a. The Supplier will: (1) perform security and privacy risk assessments of the Supplier Services at least annually, (2) perform security testing and vulnerability assessments of the Supplier Services before production release and at least annually thereafter, (3) enlist a qualified independent third party, the Supplier X-Force™ or, if specified in the Supplier Services Document, another qualified testing service to perform penetration testing of the Supplier Cloud Services, at least annually, (4) perform automated vulnerability scanning of underlying Components of the Supplier Services against industry security configuration best practices, (5) remediate identified vulnerabilities from security testing and scanning, based on associated risk, exploitability, and impact, and (6) take reasonable steps to avoid disruption to the Supplier Services when performing its tests, assessments, scans, and execution of remediation activities.
b. The Supplier will maintain measures designed to assess, test, and apply security advisory patches to the Supplier Services and associated systems, networks, applications, and underlying Components within the scope of the Supplier Services. Upon determining that a security advisory patch is applicable and appropriate, the Supplier will implement the patch pursuant to documented severity and risk assessment guidelines, based on Common Vulnerability Scoring System ratings of patches, when available. Implementation of security advisory patches will be subject to the Supplier change management policy.
c. The Supplier will maintain policies and procedures designed to manage risks associated with the application of changes to the Supplier Services. Prior to implementation, changes to the Supplier Service, including its systems, networks, and underlying Components, will be documented in a registered change request that includes a description of and reason for the change, implementation details and schedule, a risk statement addressing impact to the Supplier Service and its clients, expected outcome, rollback plan, and documented approval by authorized personnel.
d. The Supplier will maintain an inventory of all information technology assets used in its operation of the Supplier Services. The Supplier will continuously monitor and manage the health, including capacity, and availability of the Supplier Services and underlying Components.
e. Each Supplier Service will be separately assessed for business continuity and disaster recovery req...
Service Integrity and Availability Control. With respect to Pindrop-Controlled Systems, Pindrop will:
(a) Perform security risk assessments at least annually;
(b) Perform security testing and vulnerability assessments on a periodic basis;
(c) Enlist a qualified testing service to perform penetration testing at least annually;
(d) Perform automated vulnerability scanning against configuration industry standards reasonably designed to identify publicly-known security vulnerabilities in Pindrop- Controlled Systems based on Pindrop’s risk assessment: (i) at least every six months;
Service Integrity and Availability Control. (a) U-Visit (i) performs penetration testing and vulnerability assessments, including automated system and application security scanning and manual ethical hacking, before production release and annually thereafter, (ii) enlists a qualified independent third-party to perform penetration testing at least annually, (iii) performs automated management and routine verification of underlying components’ compliance with security configuration requirements, and (iv) remediates identified vulnerabilities or noncompliance with its security configuration requirements based on associated risk, exploitability, and impact. U-Visit will take reasonable steps to avoid Service disruption when performing its tests, assessments, scans, and execution of remediation activities.
(b) U-Visit will maintain policies and procedures designed to manage risks associated with the application of changes to its Services. Prior to implementation, changes to a Service, including its systems, networks and underlying components, will be documented in a registered change request that includes a description and reason for the change, implementation details and schedule, a risk statement addressing impact to the Service and its clients, expected outcome, rollback plan, and documented approval by authorized personnel.
(c) U-Visit will maintain an inventory of all information technology assets used in its operation of the Service. U-Visit will continuously monitor the health and availability of the Service and underlying components.
(d) Each Service will be separately assessed for business continuity and disaster recovery requirements pursuant to documented risk management guidelines. Each U-Visit Service will have, to the extent warranted by such risk assessment, separately defined, documented, maintained and annually validated business continuity and disaster recovery plans consistent with industry standard practices. Recovery point and time objectives for the Service, if provided, will be established with consideration given to the Service’s architecture and intended use, and will be described in the relevant Agreement documents.
(e) U-Visit will (i) back up systems containing Customer Personal Data daily, (ii) ensure at least one backup destination is at a remote location, separate from production systems, (iii) encrypt backup data stored on portable backup media, and (iv) validate backup process integrity by regularly performing data restoration testing.
(f) U-Visit will maintain measures d...
Service Integrity and Availability Control
