accepting Confidential Information and (ii) promptly return to Bank of America or destroy according to the Information Destruction Requirements described within SCHEDULE E, "Information Security," at Bank of America's election, all Bank of America Confidential Information in the possession of Supplier or Suppliers Subcontractors, subject to and in accordance with the terms and provisions of this Agreement. 27.10 As a condition of access to the Confidential Information of Bank of America, Supplier shall make available to Bank of America a copy of its written Information Security Program for evaluation. The program shall be designed to: A. Ensure the security, integrity and confidentiality of Confidential Information; B. Protect against any anticipated threats or hazards to the security or integrity of such Confidential Information; C. Protect against unauthorized access to or use of such Confidential Information that could result in substantial harm orinconvenience to the person or entity that is the subject of such Confidential Information; and D. Ensure the proper disposal of such Confidential Information. 27.11 At the request of Bank of America, Supplier shall make commercially reasonable modifications to its Information Security Program or to the procedures and practices thereunder to conform at least to the Bank Security Requirements. Supplier shall require any Subcontractors and other persons or entities who provide services to Supplier for delivery to Bank of America directly or indirectly or who hold Confidential Information to implement and administer an information protection program and plan that complies with Bank Security Requirements. Supplier shall include or shall cause to be included in written agreements with such Subcontractors or other persons or entities substantially the terms of this Section and the provisions of SCHEDULE E. 27.12 One aspect of the determination of Supplier compliance with Bank Security Requirements is a review of Supplier Security Controls. As a condition precedent