removed because not required by Supplier's services to Bank of America. Identify and provide current operating system fixes that have not been applied, if any. Proprietary to Bank of America E-3 vTIP2010 Source: CARDLYTICS, INC., S-1, 1/12/2018 10. Encryption. Describe in detail the technology and usage of encryption for protecting Confidential Information, including passwordsand authentication information, during transit and in all forms and locations where it may be stored. 11. Application and Network Management. Specify the services, tools and connectivity required to manage the application and networkenvironments: who carries out the management functions; and what level of physical security applies to managed devices. 12. Physical Security. For each location where Confidential Information will be processed or stored or services for Bank of Americaproduced by Supplier, describe in detail the arrangements in place for physical security. 13. Privacy: Describe Supplier's privacy and security policies; indicate if they are in writing; and whether they are compatible with Bankof America's policies. 14. Location of Servers. Are web servers on a separate segment of the network from the application and database servers? If not, explainthe reason this has not been done. At Bank of America's request, Supplier shall make reasonable efforts to create this separation. 15. Portable Media and Devices. Bank of America's Confidential Information shall not be stored on any portable media or devices to include notebook/laptop computers, USB storage devices, approved by Bank of America and security precautions such as encryption of data and remote network connectivity will be addressed in the Supplier's Information Security Program. Proprietary to Bank of America E-4 vTIP2010 Source: CARDLYTICS, INC., S-1, 1/12/2018 INFORMATION DESTRUCTION REQUIREMENTS Overall Requirements At Bank of America's direction, Supplier shall destroy all Confidential Information at all locations where it is stored after it is no longer needed for performance under this Agreement