Vulnerability Management and Patching. Contractor shall employ vulnerability management and regular application, operating system, and other infrastructure patching procedures and technologies designed to identify, assess, mitigate, and protect against new and existing security vulnerabilities and threats, including viruses, bots, and other malicious code.
Vulnerability Management and Patching. At least annually, Contractor shall perform at Contractor’s expense vulnerability tests and risk assessments of all systems that contain City Data. For Contractor’s internet perimeter network, and any of Contractor’s applications that process City Data, such testing must also include (i) penetration tests, including by use of intercept proxies to identify security vulnerabilities that cannot be discovered using automated tools, and (ii) code review or other manual verification. All tests must be performed by Contractor’s compliance team using industry recommended network security tools to identify vulnerability information. Upon written request from City, Contractor shall provide to City a Vulnerability Testing & Risk Assessment Report at the organization level including an executive summary of the results.
Vulnerability Management and Patching i) Vendor shall adhere to applicable standards governing the patch management criticality rankings and patching time frame requirements for all systems and applications including, but not limitedto, switches, routers, appliances, servers, workstation PC’s, commercial software, and open source software.
Vulnerability Management and Patching. 6.1. The Contractor shall conduct comprehensive scans for known vulnerabilities on all externally-facing systems not less than annually and should have a process in place for remediating identified vulnerabilities that is in accordance with Industry Standards.
