Xxxxxxxx and Testing Sample Clauses

Xxxxxxxx and Testing. 1. Tests to determine conformance with all requirements of this Specification for quality and properties of all Design-Builder-secured materials, including borrow materials proposed for use, shall be performed by an independent, accredited, commercial laboratory retained and compensated by Design-Builder.

Xxxxxxxx and Testing. At least once per month, Vendor will perform internal system and application vulnerability assessments and external web (and other, if applicable) application and infrastructure vulnerability assessments (including penetration testing, if applicable) on all Vendor Systems used to perform Vendor’s obligations under the Agreement. In addition to meeting the requirements of routine updates to systems defined in Section IV(F), Vendor will promptly correct any vulnerabilities or security issues discovered as part that are categorized as “High”, “Critical”, or “Urgent” (as defined in the PCI Standards). If the vulnerability discovered is rated “Level 4” or “Level 5” (as defined in the PCI Standards), Vendor will remediate such vulnerability within twenty-four (24) hours. If the vulnerability discovered is rated “Level 3” (as defined in the PCI Standards), Vendor will remediate such vulnerability within seven (7) days. “Level 2” and “Level 1” vulnerabilities (as defined in the PCI Standards) will be remediated within a reasonable time. Vendor will as part of the Information Security Program: (i) implement an audit program to test and, if necessary, remediate all security controls at least annually or whenever there is a material change in business practices that may reasonably implicate the security or integrity of records containing SPE Data, (ii) conduct, in line with ISO27001 or similar standards, an annual risk assessment that assesses the threats and vulnerabilities associated with Vendor Systems, or Vendor’s other processes, facilities, and system components collecting, storing, processing, transmitting, accessing or using SPE Data, and (iii) produce (pursuant to the results of (i) and (ii)) a documented risk assessment and, where appropriate, risk remediation plan. Vendor will provide SPE with the results of all such tests, assessments and plans and any other audit, review or examination relating to its Information Security Program. Vendor will maintain appropriate and complete documentation describing the Information Security Program it maintains in accordance with the terms herein, and will provide such documentation to SPE upon request.