Gigamon Security Measures Addendum
To Customer Data Processing Agreement(Gigamon as Supplier)As from the Effective Date of a DPA between Gigamon and Customer, Gigamon will implement andmaintain the Security Measures set out in this Addendum. “DPA” means the Gigamon Customer Data
Processing Agreement (Gigamon as Supplier), which may be found at www.gigamon.com/data-processingagreement.html, or any superseding signed data processing or protection agreement in effect between
Gigamon and Customer. Gigamon reserves the right to make changes to this Addendum by publishing anupdate at www.gigamon.com/security-measures-addendum.pdf or at the Gigamon Trust Center, at
www.gigamon.com/legal.html. The Gigamon Data Processing Agreement (Gigamon as Supplier) may befound at www.gigamon.com/data-processing-agreement.pdf.
Security Control
Category

Description

1. Governancea. Assign to an individual or a group of individuals appropriate roles fordeveloping, coordinating, implementing, and managing Gigamon’sadministrative, physical, and technical safeguards designed to protect
the security, confidentiality, and integrity of Personal Datab. Use of data security personnel that are sufficiently trained, qualified,and experienced to be able to fulfill their information security-related
functionsa. Conduct periodic risk assessments designed to analyze existing
information security risks, identify potential new risks, and evaluate
the effectiveness of existing security controlsb. Maintain risk assessment processes designed to evaluate likelihood ofrisk occurrence and material potential impacts if risks occurc. Document formal risk assessments
d. Review formal risk assessments by appropriate managerial personnel
a. Create information security policies, approved by management,
published and communicated to all employees and relevant external
partiesb. Review policies at planned intervals or if significant changes occur toensure its continuing suitability, adequacy, and effectivenessa. Maintain policies requiring reasonable background checks of any new
employees
b. Regularly and periodically train personnel on information security
controls and policies that are relevant to their business responsibilities
and based on their roles within the organization
a. Maintain policies establishing data retention and secure destruction
requirements
a. Maintain controls designed to limit access to Personal Datab. Review personnel access rights on a periodic basis
c. Maintain policies requiring termination of physical and electronic
access to Personal Data after termination of an employee
d. Implement access controls designed to authenticate users and limit
access to Personal Data

2. Risk Assessment

3. Information
Security Policies

4. HumanResources
Security

5. AssetManagement
6. Access Controls

Gigamon Security Measures Addendum
v.2024.03.21

Page 1 of 2

7.

Cryptography

8.

Physical Security

9.

Operations
Security

10. CommunicationsSecurity

11. System
Acquisition,Development,and Maintenance
12. Supplier
Relationship
13. Information
Security IncidentManagement

14. BusinessContinuity
Management

e. Maintain dual layer access authentication processes for Gigamon
employee access to Gigamon systems
a. Implement encryption key management procedures
b. Encrypt sensitive data using a minimum of AES-256 bit ciphers intransit
a. Maintain high assurance physical security controls including manned
security stations, mantraps, and biometric or badge-based access
controla. Perform periodic network and application vulnerability testing using
qualified internal or 3rd party resources
b. Contract with qualified independent 3rd parties to perform periodic
penetration testingc. Implement procedures to document and remediate vulnerabilities
discovered during vulnerability and penetration tests
a. Maintain a secure boundary using firewalls and network traffic filteringb. Require segmentation to isolate production systems fromdevelopment systems
c. Require periodic reviews and testing of network controlsa. Assign responsibility for system security, system changes andmaintenanceb. Test, evaluate and authorize major system components prior toimplementation
a. Periodically review available security assessment reports of Subprocessors to assess their security controls and analyze any exceptions
set forth in such reports
a. Monitor the access, availability, capacity and performance of systemlogs and network traffic
b. Maintain incident response procedures for identifying, reporting, andacting on Information Security Incidents
c. Establish a cross-disciplinary Security Incident response teama. Implement a tiered data architecture with operational diversity toallow rapid recovery in the event a service impacting incident
b. Establish procedures designed to ensure all applicable statutory,
regulatory and contractual requirements are adhered toGigamon Security Measures Addendum
v.2024.03.21

Page 2 of 2