Common use of Penetration Testing Clause in Contracts

Penetration Testing. If any Services to be provided by Administrator include the hosting or support of one or more externally facing applications that can be used to access systems that store or process Confidential Information, the terms of this Section will apply. (a) At least once every 12 months during the term and promptly after any major changes being moved into production, Administrator will conduct a Valid Penetration Test (as defined below) on each application described above. As used herein, a “Valid Penetration Test” means a series of tests performed by third-party certified testing professional or a team of thirdparty certified professionals, which tests mimic real-world attack scenarios on the information system under test and include, without limitation, the following: (i) information-gathering steps and scanning for vulnerabilities; (ii) manual testing of the system for logical flaws, configuration flaws, or programming flaws that impact the system's ability to ensure the confidentiality, integrity, or availability of Service Recipient's information assets; (iii) system-compromise steps; (iv) escalation-of-privilege steps; and (v) assignment of a risk rating for each finding based on the level of potential risk exposure to Service Recipient's brand or information assets. (b) Upon Service Recipient's request, Administrator will review the results of the most recent Valid Penetration Test with Service Recipient and provide the following for Service Recipient's review: (i) the penetration test report (which may be redacted to ensure confidentiality of the technical details of the flaws in the system under test) showing the testing methodology used for performing the testing, which report will include information-gathering steps, vulnerability scanning, manual testing, system compromise, and escalation of privilege steps; and (ii) upon request, oral updates regarding timelines for remediation of any issues identified in the report and for other penetration-testing activity until the next annual review.