Common use of Vulnerability & Patch Management Clause in Contracts

Vulnerability & Patch Management. Supplier will, as applicable to the Services provided: a. Conduct periodic vulnerability scanning and penetration tests on information systems and applications to identify security vulnerabilities. b. Subscribe to an industry standard vulnerability service (e.g. Common Vulnerabilities and Exposures) and maintain alert status regarding any vulnerabilities contained in Supplier’s information systems and products. c. Maintain procedures to evaluate, prioritize, and track the vulnerabilities based on a variety of factors such as: i. The severity rating assigned to the vulnerability by an industry standards body; ii. The criticality of the assets impacted by the vulnerability and their likelihood of exploitation; and iii. The classification and quantity of information which the vulnerability places at risk. d. Patch or take other corrective actions to remediate known or discovered vulnerabilities in a commercially reasonable timeframe, giving greater priority to vulnerabilities with a higher severity rating based on the criteria outlined in Section 11(c).

Vulnerability & Patch Management. Supplier will, as applicable to the Services providedmust: a. Conduct periodic vulnerability scanning and penetration tests on information systems and applications to identify security vulnerabilities. b. Subscribe to an industry standard Industry Standard vulnerability service (e.g. Common Vulnerabilities and Exposures) and maintain alert status regarding any vulnerabilities contained in Supplier’s information systems and products. c. Maintain procedures to evaluate, prioritize, and track the vulnerabilities based on a variety of factors such as: i. The severity rating assigned to the vulnerability by an industry standards Industry Standards body; ii. The criticality of the assets impacted by the vulnerability and their likelihood of exploitation; and iii. The classification and quantity of information which the vulnerability places at risk. d. Patch or take other corrective actions to remediate known or discovered vulnerabilities in a commercially reasonable timeframe, giving greater priority to vulnerabilities with a higher severity rating based on the criteria outlined in Section 11(c).