Common use of Software Development and Maintenance Clause in Contracts

Software Development and Maintenance. A. Secure Development Lifecycle i. Applies secure development lifecycle practices, including, during design, development, and test cycles. ii. Ensures that products are subject to security design review including threat considerations and data handling practices. iii. Ensures that Services are subject to a secure release review prior to promotion to production. B. Security Testing i. Performs rigorous security testing, including, as technically feasible: a. static code analysis. b. source code peer reviews . c. dynamic and interactive security testing. d. security logic, or security “QA” testing. ii. Ensures that Internet-facing applications are subject to application security assessment reviews and testing to identify common security vulnerabilities as identified by industry-recognized organizations (e.g., OWASP Top 10 Vulnerabilities, CWE/SANS Top 25 vulnerabilities). iii. For all mobile applications (i.e. running on Android, Blackberry, iOS, Windows Phone) that collect, transmit or display Protected Data, conducts an application security assessment review to identify and remediate industry-recognized vulnerabilities specific to mobile applications. iv. Does NOT use Protected Data for testing. v. Makes all reasonable effort to identify and remediate software vulnerabilities prior to release . C. Annual Penetration Testing i. Engages qualified, independent third-party penetration testers to perform annual penetration test against its Products and environments where Protected Data is hosted. ii. Requires sub-processors to perform similar penetration testing against their systems, environments, and networks. iii. Ensures remediation of all findings in a commercially reasonable period of time. D. Product Vulnerability Management i. Uses commercially reasonable efforts to regularly identify software security vulnerabilities in RingCentral Services. ii. Provides relevant updates, upgrades, and bug fixes for known software security vulnerabilities, for any software provided or in which any Protected Data is processed. iii. Ensures that all findings resulting from internal and external testing are evaluated according to industry best practices, including CVSS score and assessment of impact, likelihood and severity and are remediated following industry standard timelines.

Software Development and Maintenance. A. Secure Development Lifecycle i. Applies secure development lifecycle practices, including, during design, development, and test cycles. ii. Ensures that products are subject to security design review including threat considerations and data handling practices. iii. Ensures that Services are subject to a secure release review prior to promotion to production. B. Security Testing i. Performs rigorous security testing, including, as technically feasible: a. static code analysis. b. source code peer reviews reviews. c. dynamic and interactive security testing. d. security logic, or security “QA” testing. ii. Ensures that Internet-facing applications are subject to application security assessment reviews and testing to identify common security vulnerabilities as identified by industry-recognized organizations (e.g., OWASP Top 10 Vulnerabilities, CWE/SANS Top 25 vulnerabilities). iii. For all mobile applications (i.e. running on Android, Blackberry, iOS, Windows Phone) that collect, transmit or display Protected Data, conducts an application security assessment review to identify and remediate industry-recognized vulnerabilities specific to mobile applications. iv. Does NOT use Protected Data for testing. v. Makes all reasonable effort to identify and remediate software vulnerabilities prior to release release. C. Annual Penetration Testing i. Engages qualified, independent third-party penetration testers to perform annual penetration test against its Products and environments where Protected Data is hosted. ii. Requires sub-processors to perform similar penetration testing against their systems, environments, and networks. iii. Ensures remediation of all findings in a commercially reasonable period of time. D. Product Vulnerability Management i. Uses commercially reasonable efforts to regularly identify software security vulnerabilities in RingCentral Services. ii. Provides relevant updates, upgrades, and bug fixes for known software security vulnerabilities, for any software provided or in which any Protected Data is processed. iii. Ensures that all findings resulting from internal and external testing are evaluated according to industry best practices, including CVSS score and assessment of impact, likelihood and severity and are remediated following industry standard timelines. E. Open Source and Third-Party Software i. Maintains an asset registry of all third-party software (TPS) and open-source software (OSS) incorporated into the Services. ii. Uses commercially reasonable efforts to ensure the secure development and security of open-source software and third- party software used by RingCentral. iii. Uses commercially reasonable efforts to evaluate, track and remediate vulnerabilities of open-source software (OSS) and other third-party libraries that are incorporated into the Services.

Software Development and Maintenance. A. Secure Development Lifecycle i. Applies secure development lifecycle practices, including, during design, development, and test cycles. ii. Ensures that products are subject to security design review including threat considerations and data handling practices. iii. Ensures that Services are subject to a secure release review prior to promotion to production. B. Security Testing i. Performs rigorous security testing, including, as technically feasible: a. static code analysis. b. source code peer reviews reviews. c. dynamic and interactive security testing. d. security logic, or security “QA” testing. ii. Ensures that Internet-facing applications are subject to application security assessment reviews and testing to identify common security vulnerabilities as identified by industry-recognized organizations (e.g., OWASP Top 10 Vulnerabilities, CWE/SANS Top 25 vulnerabilities). iii. For all mobile applications (i.e. running on Android, Blackberry, iOS, Windows Phone) that collect, transmit or display Protected Data, conducts an application security assessment review to identify and remediate industry-recognized vulnerabilities specific to mobile applications. iv. Does NOT use Protected Data for testing. v. Makes all reasonable effort to identify and remediate software vulnerabilities prior to release release. C. Annual Penetration Testing i. Engages qualified, independent third-party penetration testers to perform annual penetration test against its Products and environments where Protected Data is hosted. ii. Requires sub-processors to perform similar penetration testing against their systems, environments, and networks. iii. Ensures remediation of all findings in a commercially reasonable period of time. D. Product Vulnerability Management i. Uses commercially reasonable efforts to regularly identify software security vulnerabilities in RingCentral Services. ii. Provides relevant updates, upgrades, and bug fixes for known software security vulnerabilities, for any software provided or in which any Protected Data is processed. iii. Ensures that all findings resulting from internal and external testing are evaluated according to industry best practices, including CVSS score and assessment of impact, likelihood and severity and are remediated following industry standard timelines.