Common use of Security Testing Clause in Contracts

Security Testing. Implement a repeatable and documented set of security tests for hardware, software and services – including but not limited to the production environment, releases of Software-as-a-Service (SaaS), other Cloud-based “as-a- Services” (PaaS, IaaS, DRaaS, etc.), containers and application program interfaces (APIs) used to deliver services of the Agreement or host City data within the scope of the Agreement. Determine the objectives of each security test, and tailor the approach accordingly. Analyze findings, and develop mitigation techniques to address (i) poor testing effectiveness metrics and (ii) any weaknesses discovered through the tests. At the City's request, cooperate with City and its contracted resources to conduct security quality assurance and penetration tests on a mutually agreeable schedule.

Security Testing. Implement a repeatable and documented set of security tests for hardware, software and services – including but not limited to the production environment, releases of Software-as-a-Service (SaaS), other Cloud-based “as-a- a-Services” (PaaS, IaaS, DRaaS, etc.), containers and application program interfaces (APIs) used to deliver services of the Agreement or host City data within the scope of the Agreement. Determine the objectives of each security test, and tailor the approach accordingly. Analyze findings, and develop mitigation techniques to address (i) poor testing effectiveness metrics and (ii) any weaknesses discovered through the tests. At the City's request, cooperate with City and its contracted resources to conduct security quality assurance and penetration tests on a mutually agreeable schedule. Record Retention.

Security Testing. Implement a repeatable and documented set of security tests for hardware, software and services – including but not limited to the production environment, releases of Software-as-a-Service (SaaS), other Cloud-based “as-a- a-Services” (PaaS, IaaS, DRaaS, etc.), containers and application program interfaces (APIs) used to deliver services of the Agreement or host City data within the scope of the Agreement. Determine the objectives of each security test, and tailor the approach accordingly. Analyze findings, and develop mitigation techniques to address (i) poor testing effectiveness metrics and (ii) any weaknesses discovered through the tests. At the City's request, cooperate with City and its contracted resources to conduct security quality assurance and penetration tests on a mutually agreeable schedule.. Record Retention