policy? How are customers notified of 9.2 system updates? What is the process for 9.3 applying critical updates, e.g. Heartbleed? Is the vendor application 9.4 vulnerability tested by a third party? 10.0 INCIDENT MANAGEMENT Score Additional # Question Response from Vendor Information/Clarification Required from Vendor Does the vendor have an 10.1 incident response policy and can SAWS get a copy? What is the vendor’s timeline 10.2 to notify customer of a potential breach? --------------------------------------------------- End Of Document --------------------------------------------------
policy? 9.2 How are customers notified of system updates? 9.3 What is the process for applying critical updates, e.g. Heartbleed? 9.4 Is the vendor application vulnerability tested by a third party? 10.0 INCIDENT MANAGEMENT # Question Response from Vendor Score Additional Information/Clarification Required from Vendor 10.1 Does the vendor have an incident response policy and can SAWS get a copy? 10.2 What is the vendor’s timeline to notify customer of a potential breach? --------------------------------------------------- End Of Document --------------------------------------------------
Exhibit%20H%20SaaS%20SecPrivAssessmentQuestv2.docx