Managed Services HP will provide the services as described in a Statement of Work (“SOW”) attached to this Agreement or incorporating it by reference. Each party will appoint a single point of contact as set forth in the SOW who will serve as their primary representative, have overall responsibility for managing performance, and meet with the other party’s representative to review progress. Change requests are governed by the change management procedures as set forth in the SOW.
Configuration Management The Contractor shall maintain a configuration management program, which shall provide for the administrative and functional systems necessary for configuration identification, control, status accounting and reporting, to ensure configuration identity with the UCEU and associated cables produced by the Contractor. The Contractor shall maintain a Contractor approved Configuration Management Plan that complies with ANSI/EIA-649 2011. Notwithstanding ANSI/EIA-649 2011, the Contractor’s configuration management program shall comply with the VLS Configuration Management Plans, TL130-AD-PLN-010-VLS, and shall comply with the following:
Vulnerability Management BNY Mellon will maintain a documented process to identify and remediate security vulnerabilities affecting its systems used to provide the services. BNY Mellon will classify security vulnerabilities using industry recognized standards and conduct continuous monitoring and testing of its networks, hardware and software including regular penetration testing and ethical hack assessments. BNY Mellon will remediate identified security vulnerabilities in accordance with its process.
Program Management 1.1.01 Implement and operate an Immunization Program as a Responsible Entity 1.1.02 Identify at least one individual to act as the program contact in the following areas: 1. Immunization Program Manager;
Infrastructure Vulnerability Scanning Supplier will scan its internal environments (e.g., servers, network devices, etc.) related to Deliverables monthly and external environments related to Deliverables weekly. Supplier will have a defined process to address any findings but will ensure that any high-risk vulnerabilities are addressed within 30 days.