The ISMS and Security Management Plan shall be fully reviewed and updated by the Supplier prior to any Service Instances (other than those Service Instances identified on the first Implementation Plan produced under this Call Off Contract) going into Live Operation and at least annually to reflect: emerging changes in Good Industry Practice; any change or proposed change to the Supplier System, the Services and/or associated processes; any new perceived or changed security threats; and any reasonable request by the Customer. The Supplier shall provide the Customer with the results of such reviews as soon as reasonably practicable after their completion and amend the ISMS and Security Management Plan at no additional cost to the Customer. The results of the review shall include, without limitation: suggested improvements to the effectiveness of the ISMS; updates to the risk assessments; proposed modifications to the procedures and controls that effect information security to respond to events that may impact on the ISMS; and suggested improvements in measuring the effectiveness of controls. Subject to paragraph 5.4 of this Call Off Schedule, any change or amendment which the Supplier proposes to make to the ISMS or Security Management Plan (as a result of a review carried out pursuant to paragraph 5.1 of this Call Off Schedule, a Customer request, change to Annex 1 (Security Policy) or otherwise) shall be subject to the Variation Procedure and shall not be implemented until Approved in writing by the Customer. The Customer may, where it is reasonable to do so, Approve and require changes or amendments to the ISMS or Security Management Plan to be implemented on timescales faster than set out in the Variation Procedure but, without prejudice to their effectiveness, all such changes and amendments shall thereafter be subject to the Variation Procedure for the purposes of formalising and documenting the relevant change or amendment for the purposes of this Call Off Contract. TESTING OF THE ISMS The Supplier shall conduct tests of the ISMS (“Security Tests”) from time to time and at least annually and additionally after any change or amendment to the ISMS or the Security Management Plan. Security Tests shall be designed and implemented by the Supplier so as to minimise the impact on the delivery of the Services and the date, timing, content and conduct of such Security Tests shall be agreed in advance with the Customer. Subject to compliance by the Supplier with the foregoing requirements, if any Security Tests adversely affect the Supplier’s ability to deliver the Services so as to meet the Service Level Targets, the Supplier shall be granted relief against any resultant for the period of the Security Tests.
The ISMS and Security Management Plan shall be fully reviewed and updated by the Supplier prior to any Service Instances (other than those Service Instances identified on the first Implementation Plan produced under this Call Off Contract) going into Live Operation and at least annually to reflect: emerging changes in Good Industry Practice; any change or proposed change to the Supplier System, the Services and/or associated processes; any new perceived or changed security threats; and any reasonable request by the Customer. The Supplier shall provide the Customer with the results of such reviews as soon as reasonably practicable after their completion and amend the ISMS and Security Management Plan at no additional cost to the Customer. The results of the review shall include, without limitation: suggested improvements to the effectiveness of the ISMS; updates to the risk assessments; proposed modifications to the procedures and controls that effect information security to respond to events that may impact on the ISMS; and suggested improvements in measuring the effectiveness of controls. Subject to paragraph 5.4 of this Call Off Schedule, any change or amendment which the Supplier proposes to make to the ISMS or Security Management Plan (as a result of a review carried out pursuant to paragraph 5.1 of this Call Off Schedule, a Customer request, change to Annex 1 (Security Policy) or otherwise) shall be subject to the Variation Procedure and shall not be implemented until Approved in writing by the Customer. The Customer may, where it is reasonable to do so, Approve and require changes or amendments to the ISMS or Security Management Plan to be implemented on timescales faster than set out in the Variation Procedure but, without prejudice to their effectiveness, all such changes and amendments shall thereafter be subject to the Variation Procedure for the purposes of formalising and documenting the relevant change or amendment for the purposes of this Call Off Contract. TESTING OF THE ISMS The Supplier shall conduct tests of the ISMS (“Security Tests”) from time to time and at least annually and additionally after any change or amendment to the ISMS or the Security Management Plan. Security Tests shall be designed and implemented by the Supplier so as to minimise the impact on the delivery of the Services and the date, timing, content and conduct of such Security Tests shall be agreed in advance with the Customer. Subject to compliance by the Supplier with the foregoing requirements, if any Security Tests adversely affect the Supplier’s ability to deliver the Services so as to meet the Service Level Targets, the Supplier shall be granted relief against any resultant for the period of the Security Tests.
RM3825%20DPS%20Call%20Off%20Terms%20v6.1_1.docx