to be included in written agreements with such Subcontractors or other persons or entities substantially the terms of this Section and the provisions of SCHEDULE E. 27.12 One aspect of the determination of Supplier compliance with Bank Security Requirements is a review of Supplier Security Controls. As a condition precedent to performance under this Agreement, Supplier agrees to satisfy the following validation requirements: A. Participation in Bank of America's Supplier testing and assessment process including the completion of online and/or on-siteassessment(s), as appropriate, and remediation of any findings; Proprietary to Bank of America Page 22 vTIP2010 Source: CARDLYTICS, INC., S-1, 1/12/2018 B. Periodic discussions between Bank of America personnel and Supplier Information Technology security personnel to reviewSupplier Security Controls; and C. Delivery to Bank of America of network diagrams depicting Supplier perimeter controls and security policies and processes relevant to the protection of Confidential Information. Examples of these policies include, but are not limited to, access control, physical security, patch management. password standards, encryption standards, and change control. 27.13 During the course of performance under this Agreement, Supplier shall ensure the following: A. Adequate governance and risk assessment processes are in place to maintain controls over Confidential Information. A security awareness program must be in place or implemented that communicates security policies to all Supplier (and Supplier Subcontractor(s)) personnel having access to Confidential Information. B. Notification to Bank of America of changes that may impact the security of Confidential Information. Such changes requiring notification include, by way of example and not limitation, outsourcing of computer networking, data storage, management and processing or other information technology functions or facilities and the implementation of external web-enabled (internet) access to Confidential Information. C. Use of strong, industry-standard encryption of Confidential Information transmitted over public networks (e.g. internet,non-dedicated leased lines) and backup tapes residing