security incident or event to protect Confidential Information. SECURITY PROGRAM FEATURES At the request of Bank of America, Supplier shall meet with the Bank of America information security team to discuss information security issues In much greater detail at mutually agreeable times and locations. Proprietary to Bank of America E-2 vTIP2010 Source: CARDLYTICS, INC., S-1, 1/12/2018 Bank of America acknowledges and agrees that the information Supplier so provides is Supplier's Confidential Information, as defined In this Agreement, and is valuable proprietary information of Supplier. Supplier shall provide detailed information including, but not limited to, the following topics, which also shall be addressed in Supplier's Program. 1. Diagrams. The diagrams shall show the detail of the system architecture including, without limitation, the logical topology of routers, switches, internet firewalls, management or monitoring firewalls, servers (web, application and database), intrusion detection systems, network and platform redundancy. The diagrams shall include all hosting environments including those provided by Supplier's Subcontractors. 2. Firewalls. Slate the specifications of the firewalls in use and who manages them. Specify the services, tools and connectivity requiredto manage the firewalls. 3. Intrusion Detection Systems. Describe the intrusion detection system ("lDS") environment and the Security Breach and event escalation process. Indicate who manages the IDS environment. Specify the services, tools and connectivity required to manage the IDS environment, and if the IDS network is host based. 4. Change Management. Describe the change management process for automated systems used to provide services. Describe theprocess for information handling policies and practices. 5. Business Continuity. Describe the business and technical disaster recovery management process. 6. System Administration Access Control. Describe the positions that perform administration functions on servers, firewalls or other devices within the application and network infrastructure. Detail level of access needed to perform functions. Explain the access control mechanisms. Describe the