Security addendum

The terms of this Security Addendum (this “Addendum”) provide details of the information security program and policies and are incorporated into the Products and Services End User License Agreement and/or Evaluation Agreement between Customer and Precisely governing Customer’s license of Hosted Software (the “Agreement”) for the Term of the applicable Order. 

Modifications to this Agreement:

• Orders for Licensed Products and/or Services pursuant to an Agreement are governed by the version of this Addendum applicable on the Effective Date of the Order as indicated by the version date above.
• The terms of this Addendum may not be modified with respect to the Order to which they apply except by mutual agreement of Customer and Precisely.
• New versions of this Addendum will only apply to subsequent Orders.

This Addendum applies only to the extent Precisely obtains Customer Data as part of Customer’s license to Hosted Software pursuant to the Agreement and does not apply to any Customer license to Precisely On-Premises products or datasets.

1. DEFINITIONS

1.1 For the purposes of this Addendum, the following terms will have the corresponding definitions:

“Customer Data” has the meaning set forth in the Agreement.

“Data Subject” means an identified or identifiable natural person.  An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“DPA”, “Data Protection Addendum”, or “Data Processing Addendum” means terms binding on the parties governing the processing of personal data, including a signed written agreement between Precisely and Customer with such scope.

“Precisely Systems” mean the datacenter infrastructure owned or controlled by Precisely, including through agreements with the Hosting Services Provider(s) and other Precisely subcontractors.

“Security Incident” means, with respect to any Customer Data obtained by Precisely under the Agreement or this Addendum as part of Customer’s valid use of Hosted Software: any verified, actual: (a)  loss or misuse (by any means) of such Customer Data; (b)  accidental, inadvertent, unauthorized or unlawful destruction, alteration, disclosure of, access to, or corruption of such Customer Data; (c) compromise of the security, confidentiality or integrity of Customer Data, including but not limited to, a compromise of any physical, technical, administrative or organizational safeguards that relate to the protection of such Customer Data or (d) any unauthorized access to Precisely Systems containing Customer Data. Security Incidents do not include events which are either (a) caused by Customer, Customer Affiliates, Users or third parties operating under their direction, including failure to (i) control user access; (ii) secure or encrypt Customer Data which the Customer transmits to and from Precisely Systems during use of Hosted Software; and/or (iii) implement security configurations to protect Customer Data; or (b) unsuccessful attempts or activities that do not or are not reasonably likely to compromise the security of Customer Data, including unsuccessful login attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.

“Term” with respect to this Addendum and an associated Order, means the period beginning on the Commencement Date of such Order and continuing for the Term of such Order.

“User” has the meaning set forth in the Agreement.

1.2 In the event of any conflict or ambiguity between the provisions of this Addendum, the Agreement and any Order, the conflict or ambiguity shall be resolved in the following descending order of precedence: this Addendum; the Orders (with the most recent taking precedence); and the main body of the Agreement; provided that, to the extent a conflict or ambiguity concerns the Processing of Personal Data (as such terms are defined in the DPA), the DPA shall take precedence over this Addendum.

1.3 Other terms that have been capitalized but not defined in this Addendum shall have the same meaning as in the Agreement.

DATA SECURITY

2. OVERVIEW

2.1 Customer Data Access. Precisely acknowledges that, in the course of providing Hosted Software to Customer pursuant to the terms of the Agreement, it may have or be granted access to Customer Data. Precisely agrees to collect, process, transfer, disclose, store, and otherwise use Customer Data in the possession of Precisely consistent with the terms of this Addendum, unless otherwise required by law.

2.2 Data Security Programs. Precisely agrees to implement physical, technical, administrative or organizational safeguards that relate to the protection of such Customer Data against accidental or unlawful destruction, loss, access to or alteration of Customer Data in Precisely’s possession or control. Precisely shall maintain information security and privacy management systems that align and comply with applicable standards and shall review its systems regularly against ISO 27001, ISO 27701, and NIST frameworks. Solely for the specific Hosted Software offering identified in the applicable product documentation, Precisely shall maintain SOC 2 Type II attestation or another generally accepted industry standard attestation applicable to Precisely as a service provider.

2.3 Data Security Policies. Precisely shall maintain policies and standards for the protection of Customer Data that align with industry standard frameworks (such as ISO 27001 or the NIST CSF) and establish uniform security and privacy practices for Precisely’s operations.  Such policies shall be reviewed and updated regularly to reflect changes in threats, technology, and regulatory requirements.

2.4 Third Party Subcontractors. If Precisely engages nationally recognized providers including AWS, Google or Azure, it shall ensure that contractual terms are in place with each that are no less favorable than those offered by them generally. With respect to other providers, Precisely shall require its subcontractors and subprocessors engaged in connection with the Hosted Software and having access to Customer Data (including any Hosting Service Provider) to be bound by security, confidentiality, and data protection obligations that are at least equivalent to the level of protection set out in this Addendum. Precisely shall perform security due diligence before engaging such subcontractors and subprocessors and shall remain fully responsible for their acts and omissions in connection with the Hosted Software. Precisely shall maintain a risk management program focused on the identification, evaluation, and validation of a vendor’s security controls. Where such a subcontractor or subprocessor Processes personal data, notification of, and objection to, its appointment shall be governed exclusively by the DPA.

2.5 On Boarding Process. The following measures are undertaken at the commencement of an individual’s employment or engagement with Precisely:

(a) Background Checks. Each individual assigned to perform Professional Services under the Agreement will have been subjected to a background check in accordance with Precisely’s background checking policies and applicable Each candidate’s background check report is reviewed in determining whether employment of a candidate is consistent with the safe and efficient performance of Professional Services, taking into consideration any appropriate factors and applicable law.

(b) Training. Precisely has implemented and maintains a Data Privacy and Information Security awareness program.  Upon joining Precisely, employees with access to Customer Data will be given training on data security and privacy issues as part of their orientation, including on Precisely’s current Information Security and Data Privacy Policies. Employees further agree in writing to perform their work according to Precisely’s policies, standards, and procedures regarding information security and privacy requirements, and all personnel with access to Customer Data are bound by confidentiality obligations through contract or applicable law.  Subsequent annual training is required and is supplemented by numerous educational initiatives.  Depending upon job function, certain employees receive specialized training and/or receive training on a more frequent basis.

2.6 Ongoing Assessment. Precisely will regularly test and monitor the effectiveness of its safeguards, controls, systems, and procedures by appropriate internal or external assessors. Precisely will maintain an ongoing cyber risk management process to identify, assess, mitigate, and communicate material risks to the security, confidentiality and integrity of Customer Data, and will maintain a risk register.

2.7 Business Continuity and Disaster Recovery. Precisely reviews its business continuity policy and disaster recovery plans and tests its disaster recovery plans annually. Upon Customer’s request, but not more than once annually, Precisely may provide executive summaries of its business continuity program and disaster recovery testing. Precisely does not conduct joint disaster recovery testing with Customer.

3. SECURITY MEASURES

Precisely maintains appropriate data protection and security measures for Customer Data. Such measures shall include the following:

3.1 Physical Security. Precisely maintains physical and environmental security controls at its premises and obtains assurance of such controls for cloud hosting and third-party datacenters. Precisely takes precautions to ensure that all Precisely Systems hosting Customer Data are maintained in a physically secure environment to prevent unauthorized physical access, and that access restrictions at physical locations containing Customer Data, such as buildings, computer facilities, and records storage facilities, are designed and implemented to permit access only to authorized individuals, including through badge access at Precisely-managed locations, and to detect any unauthorized access that may occur, including without limitation 24 x 7 security personnel at all relevant locations. Set forth below are examples of such physical security controls:

(a) With respect to datacenter locations, all access is controlled and restricted by use of a defined security perimeter, appropriate security barriers, security cameras, entry and authentication controls, and access logs.

(b) Precisely implements and maintains appropriate security measures and procedures to protect and prevent the unauthorized viewing, copying, alteration or removal of any media containing Customer Data.

(c) Visitor logs are maintained, and visitors to Precisely premises are required to be escorted at all times.

3.2 Network Security Controls. Precisely maintains data loss prevention, firewalls, network segregation, and other network security controls and safeguards designed to prevent unauthorized access to Precisely Systems and network including:

(a) Defense-in-depth design with perimeter routers, network switches and firewall devices and default deny-all policy to protect its Internet presence;

(b) Internet- access controlled by proxies and logged;

(c) Intrusion detection system deployed to identify potential intrusions;

(d) Real-time network events are logged and investigated using a security information event management tool;

(e) Content filtering and website blocking using approved lists;

(f) All wireless network devices follow the same policies and standards as wired devices; and

(g) Rogue wireless access points are detected and disassociated with the corporate wireless network.

3.3 Platform Security Controls. Precisely maintains the following security controls and safeguards designed to protect and prevent unauthorized access to Customer Data on various computing platforms and operating systems:

(a)Configuration/Hardening standards are established, documented, reviewed and updated regularly;

(b)Changes are approved and follow Precisely’s internal change control process;

(c) Unauthorized hardware and software are prohibited from being installed in Precisely Systems; network access is limited to company-owned devices, and access from employee-owned devices is limited to a discrete set of applications protected by a mobile application management solution;

(d) Where technically feasible, a session is timed out after appropriate periods of inactivity;

(e) Any vendor-supplied defaults (accounts, passwords and roles) are removed during installation;

(f) Services and devices that are not required by valid business needs are removed; and

(g) An anti-virus program and other appropriate malware controls with timely updates actively run on all company-managed devices.

3.4 Application Security Controls. The following security controls and safeguards are designed to ensure the integrity and security of applications developed by Precisely and are implemented and maintained by Precisely:

(a) Defense-in-depth with the use of n-tier architecture provides separation and protection of data;

(b) Application development follows a secure software development life cycle (SSDLC) that includes annual developer security training, secure design and testing, and ongoing security assessments;

(c) All changes to such applications are documented, reviewed, tested and approved before being implemented into production;

(d) Application vulnerabilities are identified, tested and remediated/installed in a timely manner; and

(e) Development and testing environments must not contain any production data.

3.5 Access Control and Management. Precisely maintains appropriate security measures and procedures to ensure that access to all Precisely Systems hosting Customer Data shall be protected through the use of access control systems that uniquely identify each individual requiring access, grant user and system access only to authorized individuals based on least privilege, need-to-know, and segregation of duties, prevent unauthorized persons from gaining access to Customer Data, appropriately limit and control the scope of access granted to any authorized person, and log all relevant access events. Precisely shall maintain strong authentication controls, including multifactor authentication for systems containing confidential or regulated data, and password protection standards, including encryption of stored credentials and protections against brute-force or automated attacks.

3.6 Annual Penetration Testing. Precisely may perform penetration tests, no more than annually, on applicable Precisely environments, including perimeter vulnerability testing, internal infrastructure vulnerability testing, and application testing.  Upon Customer’s request, but no more than once annually and subject to a non-disclosure agreement, Precisely may provide a redacted executive summary of its vulnerability program to the extent applicable to the Hosted Software used by Customer. Precisely maintains a vulnerability remediation policy under which vulnerabilities are identified, assessed and remediated according to the risk they present.

3.7 Encryption. Customer Data held by Precisely is encrypted in transit and at rest using industry standard encryption algorithms and key management practices.

4. SECURITY QUESTIONNAIRES

Upon Customer’s written request to confirm compliance with the above Data Security requirements of this Addendum, Precisely shall complete a written information security questionnaire provided by Customer or a third party on Customer’s behalf regarding Precisely’s business practices and information technology environment in relation to Customer Data being handled and/or the Hosted Software being made available by Precisely to Customer pursuant to the Agreement. Such requests shall be (a) not more often than once annually, (b) upon not less than thirty days prior written notice, and (c) subject to a written confidentiality undertaking. Where the request relates to the Processing of Personal Data, the audit provisions of the DPA shall govern.

5. SECURITY INCIDENTS

5.1 Notice. Precisely’s security incident response team is staffed by the office of the Chief Information Security Officer and is responsible for investigating and responding to information-security related events. Upon validation that a Security Incident has actually impacted Customer Data held by Precisely, Precisely shall notify Customer without undue delay, but in no event later than 48 hours thereafter, and provide Customer with information about the Security Incident including, where possible, (i) the categories and approximate number of affected Customer Data records and, if applicable, the categories and approximate number of affected Data Subjects, (ii) the impact and likely consequences of the Security Incident to Customer and, if applicable, the affected Data Subjects, and (iii) the corrective action or remediation efforts taken or to be taken by Precisely. 

5.2 Remediation. Following any Security Incident, Precisely shall consult in good faith with Customer regarding remediation efforts that may be necessary and reasonable.  Precisely shall (i)  undertake reasonable remediation efforts at Precisely’s sole expense and reimburse Customer for Customer’s reasonable and documented out-of-pocket expenses in connection with any remediation efforts undertaken by Customer that Precisely has approved in writing in advance and that are directly arising from the Security Incident, (ii) ensure that such remediation efforts provide for, without limitation, prevention of the recurrence of the same type of Security Incident and (iii) reasonably cooperate with any remediation efforts undertaken by Customer directly arising from the Security Incident. 

5.3 Incident Notification. Any notifications to customers or employees of Customer regarding Security Incidents will be handled exclusively by Customer, unless otherwise directed by Customer. Precisely shall reasonably cooperate in connection with notices to customers and employees of Customer regarding a Security Incident. Unless Precisely is legally prohibited, Precisely shall notify Customer promptly in the event that Precisely is required by law, court order, warrant, subpoena, or other legal or judicial process to disclose any Customer Data to any person other than Customer or persons expressly approved by Customer to receive such information.

GENERAL TERMS

6. ENTIRE AGREEMENT

This Addendum and the Agreement, where referenced, contain the entire agreement regarding the data security of the Hosted Software and supersede any other data security agreements and communications between the parties concerning the access to or use by Precisely of Customer Data in connection with the Hosted Software.

7. LIMITATION OF LIABILITY AND INDEMNITY

The total combined liability of either party towards the other party, whether in contract, tort or under any other theory of liability, shall be limited as set forth in the Agreement and references to the liability of a party shall apply to liability arising under or in connection with this Addendum in the aggregate with the Agreement.

8. CHOICE OF LAW

This Addendum and the rights and obligations contained in it or otherwise arising between the Parties will be governed by and construed in accordance with the laws of the State of New York, without regard to any choice of law or conflicts of law principles.  

9. TERMINATION

Customer shall have the right to terminate this Addendum upon written notice to Precisely.