and Affected Persons regarding any security breach without the express written consent of Bank of America. Supplier shall maintain for a mutually agreed-upon length of time, and afford Bank of America reasonable access to, all records and logs of that portion of Supplier's network that stores or processes Confidential Information. Bank of America may review and Inspect any record of system activity or Confidential Information handling upon reasonable prior notice. Supplier acknowledges and agrees that records of system activity and of Confidential Information handling may be evidence (subject to appropriate chain of custody procedures) in the event of a Security Breach or other inappropriate activity. Upon the Bank of America, Supplier shall deliver the original copies of such records to Bank of America for use in any legal, investigatory or regulatory proceeding. Supplier shall monitor industry-standard information channels (bugtraq, CERT, OEMs, etc.) for newly identified system vulnerabilities regarding the technologies and services provided to Bank of America and fix or patch any identified security problem in an adequate and timely manner. Unless otherwise expressly agreed in writing, "timely" shall mean that Supplier shall Introduce such fix or patch as soon as commercially reasonable after Supplier becomes aware of the security problem. This obligation extends to all devices that comprise Supplier's system, e.g., application software, databases, servers, firewalls, routers and switches, hubs, etc., and to all of Supplier's other Confidential Information handling practices. Bank of America may perform vulnerability testing of Supplier's system to test the remediation measures implemented after a security incident or event to protect Confidential Information. SECURITY PROGRAM FEATURES At the request of Bank of America, Supplier shall meet with the Bank of America information security team to discuss information security issues In much greater detail at mutually agreeable times and locations. Proprietary to Bank of America E-2